MB-40533 I discovered that whilst the CBAUTH_REVRPC_URL is set to http://.../cbq-engine* (which means the cbauth service registration looks for a service "cbq-engine-service_api") , ns_server is listening to/for ".../n1ql-service_api".
The original approach we took to contain things was to augment the cbauth API with a function that wasn't reliant on the environment variable (thus permitting us to make the change) but cbauth don't want this, so we need the provided URL or the service listener address to change.
I've tested changing tls_config (src/menelaus_cbauth.erl) and goport_defs (src/ns_ports_setup.erl; setting 'rpc' to 'n1ql') and it seems to work but I suspect there would be upgrade implications.
Another approach tried was to add a special case in conn_label (src/service_agent.erl) to generate "cbq-engine-service_api" for the n1ql service. As it is only the new feature that is using this service, the thought is that this best contains any side-effects. (However doing this seems to break everything.)
Nevertheless the requirement remains - provide a consistent CBAUTH_REVRPC_URL value & service_api listener address - so that we can call cbauth.RegisterManager() and have it connect with the set CBAUTH_REVRPC_URL value.