🔗 技術調査 - EclipseEDC

データスペース = 多組織間合意 + 技術インフラ（フェデレーテッドネットワーク）

# リポジトリ取得
git clone https://github.com/eclipse-edc/Connector.git
cd Connector

# ビルド（全モジュール）
./gradlew clean build

git clone https://github.com/eclipse-edc/Samples.git
cd Samples

# 特定モジュールのビルド
./gradlew transfer:transfer-00-prerequisites:connector:build

# JAR の実行
java -jar basic/basic-01-basic-connector/build/libs/basic-connector.jar --log-level=DEBUG

// settings.gradle.kts
dependencyResolutionManagement {
    versionCatalogs {
        create("libs") {
            from("org.eclipse.edc:edc-versions:0.14.0")
        }
    }
}

// build.gradle.kts
dependencies {
    implementation(libs.edc.boot)
    implementation(libs.edc.connector.core)
    implementation(libs.edc.http)
    implementation(libs.edc.configuration.filesystem)
}

<dependency>
  <groupId>org.eclipse.edc</groupId>
  <artifactId>connector-core</artifactId>
  <version>0.14.0</version>
</dependency>

// build.gradle.kts
dependencies {
    implementation(libs.edc.boot)
    implementation(libs.edc.connector.core)
}

public class HealthEndpointExtension implements ServiceExtension {

    @Inject
    WebService webService;

    @Override
    public void initialize(ServiceExtensionContext context) {
        webService.registerResource(new HealthApiController(context.getMonitor()));
    }
}

com.example.HealthEndpointExtension

// launcher/build.gradle.kts
plugins {
    `java-library`
    id("application")
    id("com.github.johnrengelman.shadow") version "8.1.1"
}

application {
    mainClass.set("org.eclipse.edc.boot.system.runtime.BaseRuntime")
}

dependencies {
    implementation(libs.edc.boot)
    implementation(libs.edc.connector.core)
    implementation(libs.edc.http)
    implementation(libs.edc.management.api)
    implementation(libs.edc.configuration.filesystem)
    // 追加する機能に応じてモジュールを追加
}

# Fat JAR のビルド
./gradlew launcher:shadowJar
java -jar launcher/build/libs/connector.jar

FROM eclipse-temurin:17-jre-alpine
ARG JAR_FILE
COPY ${JAR_FILE} /app/connector.jar
EXPOSE 8181 8182
ENTRYPOINT ["java", "-jar", "/app/connector.jar"]

services:
  provider:
    build:
      context: .
      target: provider
    ports:
      - "19193:19193"
    volumes:
      - /tmp/provider:/tmp/provider

  consumer:
    build:
      context: .
      target: consumer
    ports:
      - "29193:29193"
    volumes:
      - /tmp/consumer:/tmp/consumer

# コンテナ起動
docker compose up -d

# ヘッダーに X-Api-Key を付与
curl -H "X-Api-Key: password" ...

# connector.properties
edc.api.auth.key=password
web.http.management.port=19193
web.http.management.path=/management

curl -X POST http://localhost:19193/management/v3/assets \
  -H 'Content-Type: application/json' \
  -d '{
    "@context": {
      "@vocab": "https://w3id.org/edc/v0.0.1/ns/"
    },
    "@type": "Asset",
    "@id": "assetId",
    "properties": {
      "name": "product description",
      "contenttype": "application/json"
    },
    "dataAddress": {
      "type": "HttpData",
      "name": "Test asset",
      "baseUrl": "https://jsonplaceholder.typicode.com/users"
    }
  }' -s | jq

curl -X POST http://localhost:19193/management/v3/policydefinitions \
  -H 'Content-Type: application/json' \
  -d '{
    "@context": {
      "@vocab": "https://w3id.org/edc/v0.0.1/ns/"
    },
    "@type": "PolicyDefinition",
    "@id": "aPolicy",
    "policy": {
      "@context": "http://www.w3.org/ns/odrl.jsonld",
      "@type": "Set"
    }
  }' -s | jq

curl -X POST http://localhost:19193/management/v3/contractdefinitions \
  -H 'Content-Type: application/json' \
  -d '{
    "@context": {
      "@vocab": "https://w3id.org/edc/v0.0.1/ns/"
    },
    "@type": "ContractDefinition",
    "@id": "1",
    "accessPolicyId": "aPolicy",
    "contractPolicyId": "aPolicy",
    "assetsSelector": []
  }' -s | jq

curl -X POST http://localhost:29193/management/v3/catalog/request \
  -H 'Content-Type: application/json' \
  -d '{
    "@context": {
      "@vocab": "https://w3id.org/edc/v0.0.1/ns/"
    },
    "counterPartyAddress": "http://localhost:19194/protocol",
    "protocol": "dataspace-protocol-http"
  }' -s | jq

curl -X POST http://localhost:29193/management/v3/contractnegotiations \
  -H 'Content-Type: application/json' \
  -H 'X-Api-Key: password' \
  -d '{
    "@context": {
      "@vocab": "https://w3id.org/edc/v0.0.1/ns/"
    },
    "@type": "ContractRequest",
    "counterPartyAddress": "http://localhost:19194/protocol",
    "protocol": "dataspace-protocol-http",
    "policy": {
      "@context": "http://www.w3.org/ns/odrl.jsonld",
      "@type": "Offer",
      "@id": "<catalog から取得した offer ID>",
      "assigner": "<provider ID>",
      "target": "assetId"
    }
  }' -s | jq

# {negotiation_id} は交渉開始レスポンスの @id
curl http://localhost:29193/management/v3/contractnegotiations/{negotiation_id} \
  -H 'X-Api-Key: password' -s | jq

curl -X POST http://localhost:29193/management/v3/transferprocesses \
  -H 'Content-Type: application/json' \
  -H 'X-Api-Key: password' \
  -d '{
    "@context": {
      "@vocab": "https://w3id.org/edc/v0.0.1/ns/"
    },
    "@type": "TransferRequest",
    "counterPartyAddress": "http://localhost:19194/protocol",
    "contractId": "<contractAgreementId>",
    "assetId": "assetId",
    "protocol": "dataspace-protocol-http",
    "transferType": "HttpData-PULL"
  }' -s | jq

# 1. EDR 取得（アクセストークン含む）
curl http://localhost:29193/management/v3/edrs/{transfer_id}/dataaddress \
  -H 'X-Api-Key: password' -s | jq

# 2. EDR のエンドポイントとトークンでデータ取得
curl -H "Authorization: <EDR の authorization 値>" \
  "<EDR の endpoint 値>" -s | jq

curl -X POST http://localhost:29193/management/v3/transferprocesses \
  -H 'Content-Type: application/json' \
  -H 'X-Api-Key: password' \
  -d '{
    "@context": {
      "@vocab": "https://w3id.org/edc/v0.0.1/ns/"
    },
    "@type": "TransferRequest",
    "counterPartyAddress": "http://localhost:19194/protocol",
    "contractId": "<contractAgreementId>",
    "assetId": "assetId",
    "protocol": "dataspace-protocol-http",
    "transferType": "HttpData-PUSH",
    "dataDestination": {
      "type": "HttpData",
      "baseUrl": "http://consumer-backend:4000/receiver"
    }
  }' -s | jq

{
  "@type": "DataAddress",
  "type": "https://w3id.org/idsa/v4.1/HTTP",
  "endpoint": "http://provider-data-plane:19291/public",
  "authType": "bearer",
  "authorization": "<JWT トークン>"
}

services:
  controlplane:
    image: <your-image>/controlplane:latest
    ports:
      - "8181:8181"  # API / Health Check
      - "8080:8080"  # Management API
      - "8084:8084"  # DSP Protocol
    environment:
      - EDC_VAULT_HASHICORP_URL=http://vault:8200
      - EDC_VAULT_HASHICORP_TOKEN=<token>
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8181/api/check/health"]
      interval: 5s
      timeout: 5s
      retries: 10

  prometheus:
    image: prom/prometheus:v2.30.3
    volumes:
      - ./prometheus/:/etc/prometheus/
    ports:
      - "9090:9090"

# 名前空間作成（参加者分離）
kubectl create ns provider
kubectl create ns consumer

# Helm でコネクター展開
git clone https://github.com/eclipse-tractusx/tractusx-edc
cd tractusx-edc/charts/tractusx-connector
helm dependency build
helm upgrade --install provider ./ -f provider_edc.yaml -n provider
helm upgrade --install consumer ./ -f consumer_edc.yaml -n consumer

{
  "dataAddress": {
    "edc:type": "AmazonS3",
    "name": "Vehicle Carbon Footprint",
    "bucketName": "<BUCKET_NAME>",
    "keyName": "carbon_data.json",
    "region": "eu-west-1",
    "accessKeyId": "<ACCESS_KEY>",
    "secretAccessKey": "<SECRET_KEY>"
  }
}

edc.vault.azure.name=<vault-name>
edc.vault.azure.client.id=<client-id>
edc.vault.azure.tenant.id=<tenant-id>
edc.vault.azure.client.secret=<secret>

# Java プロセスとして起動
java -Dweb.http.credentials.port=10001 \
     -Dweb.http.credentials.path="/api/credentials" \
     -Dweb.http.port=8181 \
     -Dweb.http.path="/api" \
     -Dweb.http.identity.port=8182 \
     -Dweb.http.identity.path="/api/identity" \
     -jar launcher/identityhub/build/libs/identity-hub.jar

# Docker コンテナとして起動
docker run -d --rm --name identityhub \
    -e "WEB_HTTP_IDENTITY_PORT=8182" \
    -e "WEB_HTTP_IDENTITY_PATH=/api/identity" \
    -e "WEB_HTTP_PRESENTATION_PORT=10001" \
    -e "WEB_HTTP_PRESENTATION_PATH=/api/presentation" \
    -e "EDC_IAM_STS_PRIVATEKEY_ALIAS=privatekey-alias" \
    -e "EDC_IAM_STS_PUBLICKEY_ID=publickey-id" \
    identity-hub:latest

# Docker Compose 環境変数
environment:
  - OTEL_SERVICE_NAME=edc-controlplane
  - OTEL_EXPORTER_OTLP_ENDPOINT=http://jaeger:4317
  - OTEL_METRICS_EXPORTER=prometheus
  - JAVA_TOOL_OPTIONS=-javaagent:/app/opentelemetry-javaagent.jar

edc.vault.hashicorp.url=https://vault.example.com
edc.vault.hashicorp.token=<token>
edc.vault.hashicorp.api.secret.path=/v1/edc/
edc.vault.hashicorp.health.check.standby.ok=true

public class MyExtension implements ServiceExtension {

    @Inject
    private AssetService assetService;

    @Provider
    public MyService myService() {
        return new MyServiceImpl(assetService);
    }

    @Override
    public void initialize(ServiceExtensionContext context) {
        var setting = context.getSetting("my.setting", "defaultValue");
    }
}

{
  "@type": "PolicyDefinition",
  "@id": "bpn-policy",
  "policy": {
    "@type": "Set",
    "permission": [
      {
        "action": "use",
        "constraint": {
          "leftOperand": "BusinessPartnerNumber",
          "operator": "eq",
          "rightOperand": "BPNL00000000XXXX"
        }
      }
    ]
  }
}

{
  "permission": [
    {
      "action": "use",
      "constraint": {
        "leftOperand": "inForceDate",
        "operator": "lteq",
        "rightOperand": "2026-12-31T23:59:59Z"
      }
    }
  ]
}

{
  "permission": [
    {
      "action": "use",
      "constraint": {
        "@type": "AndConstraint",
        "and": [
          {
            "leftOperand": "FrameworkAgreement",
            "operator": "eq",
            "rightOperand": "DataExchangeGovernance:1.0"
          },
          {
            "leftOperand": "Membership",
            "operator": "eq",
            "rightOperand": "active"
          }
        ]
      }
    }
  ]
}

public class LocationConstraintFunction implements
    AtomicConstraintRuleFunction<Permission, ContractNegotiationPolicyContext> {

    @Override
    public boolean evaluate(Operator operator, Object rightValue,
        Permission rule, ContractNegotiationPolicyContext context) {
        var region = context.participantAgent().getClaims().get("region");
        return switch (operator) {
            case EQ  -> Objects.equals(region, rightValue);
            case NEQ -> !Objects.equals(region, rightValue);
            case IN  -> ((Collection<?>) rightValue).contains(region);
            default  -> false;
        };
    }
}

public class MyPolicyExtension implements ServiceExtension {

    @Inject
    private RuleBindingRegistry ruleBindingRegistry;

    @Inject
    private PolicyEngine policyEngine;

    @Override
    public void initialize(ServiceExtensionContext context) {
        // ルールをスコープにバインド
        ruleBindingRegistry.bind("use", ALL_SCOPES);
        ruleBindingRegistry.bind("location", NEGOTIATION_SCOPE);

        // 関数を PolicyEngine に登録
        policyEngine.registerFunction(
            ContractNegotiationPolicyContext.class,
            Permission.class,
            "location",
            new LocationConstraintFunction()
        );
    }
}

curl -X GET http://localhost:8081/management/v2/contractnegotiations/<negotiation-id> \
  -H "x-api-key: <api-key>"

# Kubernetes でのログ確認
kubectl logs -n provider deployment/provider-tractusx-connector-controlplane -f
kubectl logs -n provider deployment/provider-tractusx-connector-dataplane -f

# ヘルスチェック
curl http://localhost:8181/api/check/health