高性能API网关Kong介绍

这篇具有很好参考价值的文章主要介绍了高性能API网关Kong介绍。希望对大家有所帮助。如果存在错误或未考虑完全的地方,请大家不吝赐教,您也可以点击"举报违法"按钮提交疑问。

本文关键词:高性能、API网关、Kong、微服务​​​​​​​

1.Introduction

        API网关是随着微服务(Microservice)概念兴起的一种架构模式。原本一个庞大的单体应用(All in one)业务系统被拆分成许多微服务(Microservice)系统进行独立的维护和部署,服务拆分带来的变化是API的规模成倍增长,API的管理难度也在日益增加,使用API网关发布和管理API逐渐成为一种趋势。一般来说,API网关是运行于外部请求与内部服务之间的一个流量入口,实现对外部请求的协议转换、鉴权、流控、参数校验、监控等通用功能。

        本文即将介绍的Kong是一个开源的API gateway和微服务管理的工具,基于Nginx和lua-nginx-module(特殊的OpenResty),Kong具有可插拔的架构,使其功能强大且灵活。

2.Key Concepts

  • Service: Kong的一个实体对象,表示了外部的上游API或者微服务
  • Route: Kong的一个实体对象,表示了一种将下游请求映射到上游服务的路由
  • Consumer: Kong的一个实体对象,表示使用API的开发者或者机器,在使用Kong时,一个Consumer仅与Kong交互。
  • Plugin:插件用于是Kong内部将请求转发给上游API前后执行的一系列动作,Kong在其插件库中提供了非常强大的插件
  • Credential: A certificate object represents a public certificate/private key pair for an SSL certificate.
  • SNI: An SNI object represents a many-to-one mapping of hostnames to a certificate. That is, a certificate object can have many hostnames associated with it
  • Upstream: 上游服务,指代Kong背后的API或者服务,也是客户端请求转发的目的端,The upstream object represents a virtual hostname and can be used to loadbalance incoming requests over multiple services (targets).
  • Target: A target is an ip address/hostname with a port that identifies an instance of a backend service. Every upstream can have many targets, and the targets can be dynamically added. Changes are effectuated on the fly.
  • Admin API -用于管理Kong配置,端点,使用者,插件等的RESTful API端点

下图展示了Kong和其他传统架构的区别,可以帮助我们理解为什么有Kong:

kong x-api-key,云计算,技术类,云计算,网络

大概有鉴权、监控、日志、安全审计、ACL、缓存、限流、serverless等等。

3.Setup

官方文档提供了多种环境下详细的安装说明。我们这里使用docker进行安装(docker安装过程略):

#1.create docker network

$ docker network create kong-net

#2.run PostgreSQL database

$ docker run -d --name kong-database \

            --network=kong-net \

            -p 5432:5432 \

            -e "POSTGRES_USER=kong" \

            -e "POSTGRES_DB=kong" \

            postgres:9.6

#3.prepare database

$ docker run --rm \

    --network=kong-net \

    -e "KONG_DATABASE=postgres" \

    -e "KONG_PG_HOST=kong-database" \

    -e "KONG_CASSANDRA_CONTACT_POINTS=kong-database" \

    kong:latest kong migrations bootstrap

Unable to find image 'kong:latest' locally

latest: Pulling from library/kong

59265c40e257: Pull complete

6389eff8e6ff: Pull complete

f58488256be6: Pull complete

Digest: sha256:f7ed033bb9955da0fcefa034d07fee324cad6d01c12ebf54268dfe825ba2e92c

Status: Downloaded newer image for kong:latest

bootstrapping database...

migrating core on database 'kong'...

core migrated up to: 000_base (executed)

core migrated up to: 001_14_to_15 (executed)

core migrated up to: 002_15_to_1 (executed)

migrating oauth2 on database 'kong'...

oauth2 migrated up to: 000_base_oauth2 (executed)

oauth2 migrated up to: 001_14_to_15 (executed)

oauth2 migrated up to: 002_15_to_10 (executed)

migrating acl on database 'kong'...

acl migrated up to: 000_base_acl (executed)

acl migrated up to: 001_14_to_15 (executed)

migrating jwt on database 'kong'...

jwt migrated up to: 000_base_jwt (executed)

jwt migrated up to: 001_14_to_15 (executed)

migrating basic-auth on database 'kong'...

basic-auth migrated up to: 000_base_basic_auth (executed)

basic-auth migrated up to: 001_14_to_15 (executed)

migrating key-auth on database 'kong'...

key-auth migrated up to: 000_base_key_auth (executed)

key-auth migrated up to: 001_14_to_15 (executed)

migrating rate-limiting on database 'kong'...

rate-limiting migrated up to: 000_base_rate_limiting (executed)

rate-limiting migrated up to: 001_14_to_15 (executed)

rate-limiting migrated up to: 002_15_to_10 (executed)

migrating hmac-auth on database 'kong'...

hmac-auth migrated up to: 000_base_hmac_auth (executed)

hmac-auth migrated up to: 001_14_to_15 (executed)

migrating response-ratelimiting on database 'kong'...

response-ratelimiting migrated up to: 000_base_response_rate_limiting (executed)

response-ratelimiting migrated up to: 001_14_to_15 (executed)

response-ratelimiting migrated up to: 002_15_to_10 (executed)

22 migrations processed

22 executed

database is up-to-date

#4.start Kong

$ docker run -d --name kong \

    --network=kong-net \

    -e "KONG_DATABASE=postgres" \

    -e "KONG_PG_HOST=kong-database" \

    -e "KONG_CASSANDRA_CONTACT_POINTS=kong-database" \

    -e "KONG_PROXY_ACCESS_LOG=/dev/stdout" \

    -e "KONG_ADMIN_ACCESS_LOG=/dev/stdout" \

    -e "KONG_PROXY_ERROR_LOG=/dev/stderr" \

    -e "KONG_ADMIN_ERROR_LOG=/dev/stderr" \

    -e "KONG_ADMIN_LISTEN=0.0.0.0:8001, 0.0.0.0:8444 ssl" \

    -p 8000:8000 \

    -p 8443:8443 \

    -p 8001:8001 \

    -p 8444:8444 \

    kong:latest

999a5cf1db1a8c23ca870933b73407d7ae5f0fd2d9a895a78627a9c27e08045c

$ docker container ls

CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                                                                NAMES

999a5cf1db1a        kong:latest         "/docker-entrypoint."   8 seconds ago       Up 7 seconds        0.0.0.0:8000-8001->8000-8001/tcp, 0.0.0.0:8443-8444->8443-8444/tcp   kong

ecb50c2f7307        postgres:9.6        "docker-entrypoint.s"   About an hour ago   Up About an hour    0.0.0.0:5432->5432/tcp

容器启动完毕后,尝试curl -i http://localhost:8001/,得到如下:

{

    "plugins": {

        "enabled_in_cluster": [ ],

        "available_on_server": {

            "response-transformer": true,

            "oauth2": true,

            "acl": true,

            "correlation-id": true,

            "pre-function": true,

            "jwt": true,

            "cors": true,

            "ip-restriction": true,

            "basic-auth": true,

            "key-auth": true,

            "rate-limiting": true,

            "request-transformer": true,

            "http-log": true,

            "file-log": true,

            "hmac-auth": true,

            "ldap-auth": true,

            "datadog": true,

            "tcp-log": true,

            "zipkin": true,

            "post-function": true,

            "request-size-limiting": true,

            "bot-detection": true,

            "syslog": true,

            "loggly": true,

            "azure-functions": true,

            "udp-log": true,

            "response-ratelimiting": true,

            "aws-lambda": true,

            "statsd": true,

            "prometheus": true,

            "request-termination": true

        }

    },

    "tagline": "Welcome to kong",

    "configuration": {

        "plugins": [

            "bundled"

        ],

        "admin_ssl_enabled": true,

        "lua_ssl_verify_depth": 1,

        "trusted_ips": { },

        "prefix": "/usr/local/kong",

        "loaded_plugins": {

            "response-transformer": true,

            "request-termination": true,

            "prometheus": true,

            "ip-restriction": true,

            "pre-function": true,

            "jwt": true,

            "cors": true,

            "statsd": true,

            "basic-auth": true,

            "key-auth": true,

            "ldap-auth": true,

            "aws-lambda": true,

            "http-log": true,

            "response-ratelimiting": true,

            "hmac-auth": true,

            "request-size-limiting": true,

            "datadog": true,

            "tcp-log": true,

            "zipkin": true,

            "post-function": true,

            "bot-detection": true,

            "acl": true,

            "loggly": true,

            "syslog": true,

            "azure-functions": true,

            "udp-log": true,

            "file-log": true,

            "request-transformer": true,

            "correlation-id": true,

            "rate-limiting": true,

            "oauth2": true

        },

        "cassandra_username": "kong",

        "ssl_cert_key": "/usr/local/kong/ssl/kong-default.key",

        "admin_ssl_cert_key": "/usr/local/kong/ssl/admin-kong-default.key",

        "dns_resolver": { },

        "pg_user": "kong",

        "mem_cache_size": "128m",

        "ssl_ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256",

        "nginx_admin_directives": { },

        "nginx_http_directives": [

            {

                "value": "prometheus_metrics 5m",

                "name": "lua_shared_dict"

            }

        ],

        "pg_host": "kong-database",

        "nginx_acc_logs": "/usr/local/kong/logs/access.log",

        "proxy_listen": [

            "0.0.0.0:8000",

            "0.0.0.0:8443 ssl"

        ],

        "client_ssl_cert_default": "/usr/local/kong/ssl/kong-default.crt",

        "ssl_cert_key_default": "/usr/local/kong/ssl/kong-default.key",

        "db_update_frequency": 5,

        "db_update_propagation": 0,

        "stream_listen": [

            "off"

        ],

        "nginx_err_logs": "/usr/local/kong/logs/error.log",

        "cassandra_port": 9042,

        "dns_order": [

            "LAST",

            "SRV",

            "A",

            "CNAME"

        ],

        "dns_error_ttl": 1,

        "headers": [

            "server_tokens",

            "latency_tokens"

        ],

        "cassandra_lb_policy": "RequestRoundRobin",

        "nginx_optimizations": true,

        "pg_timeout": 5000,

        "database": "postgres",

        "pg_database": "kong",

        "nginx_worker_processes": "auto",

        "lua_package_cpath": "",

        "admin_acc_logs": "/usr/local/kong/logs/admin_access.log",

        "lua_package_path": "./?.lua;./?/init.lua;",

        "nginx_pid": "/usr/local/kong/pids/nginx.pid",

        "upstream_keepalive": 60,

        "client_ssl": false,

        "admin_access_log": "/dev/stdout",

        "cassandra_data_centers": [

            "dc1:2",

            "dc2:3"

        ],

        "cassandra_ssl": false,

        "proxy_listeners": [

            {

                "transparent": false,

                "ssl": false,

                "ip": "0.0.0.0",

                "proxy_protocol": false,

                "port": 8000,

                "http2": false,

                "listener": "0.0.0.0:8000"

            },

            {

                "transparent": false,

                "ssl": true,

                "ip": "0.0.0.0",

                "proxy_protocol": false,

                "port": 8443,

                "http2": false,

                "listener": "0.0.0.0:8443 ssl"

            }

        ],

        "proxy_ssl_enabled": true,

        "client_max_body_size": "0",

        "proxy_error_log": "/dev/stderr",

        "enabled_headers": {

            "latency_tokens": true,

            "X-Kong-Proxy-Latency": true,

            "Via": true,

            "server_tokens": true,

            "Server": true,

            "X-Kong-Upstream-Latency": true,

            "X-Kong-Upstream-Status": false

        },

        "dns_stale_ttl": 4,

        "lua_socket_pool_size": 30,

        "db_resurrect_ttl": 30,

        "origins": { },

        "cassandra_consistency": "ONE",

        "db_cache_ttl": 0,

        "admin_error_log": "/dev/stderr",

        "pg_ssl_verify": false,

        "dns_not_found_ttl": 30,

        "pg_ssl": false,

        "nginx_daemon": "off",

        "nginx_kong_stream_conf": "/usr/local/kong/nginx-kong-stream.conf",

        "cassandra_repl_strategy": "SimpleStrategy",

        "error_default_type": "text/plain",

        "dns_no_sync": false,

        "nginx_proxy_directives": { },

        "proxy_access_log": "/dev/stdout",

        "nginx_kong_conf": "/usr/local/kong/nginx-kong.conf",

        "cassandra_schema_consensus_timeout": 10000,

        "dns_hostsfile": "/etc/hosts",

        "admin_listeners": [

            {

                "transparent": false,

                "ssl": false,

                "ip": "0.0.0.0",

                "proxy_protocol": false,

                "port": 8001,

                "http2": false,

                "listener": "0.0.0.0:8001"

            },

            {

                "transparent": false,

                "ssl": true,

                "ip": "0.0.0.0",

                "proxy_protocol": false,

                "port": 8444,

                "http2": false,

                "listener": "0.0.0.0:8444 ssl"

            }

        ],

        "ssl_cipher_suite": "modern",

        "ssl_cert": "/usr/local/kong/ssl/kong-default.crt",

        "cassandra_timeout": 5000,

        "admin_ssl_cert_key_default": "/usr/local/kong/ssl/admin-kong-default.key",

        "cassandra_ssl_verify": false,

        "cassandra_contact_points": [

            "kong-database"

        ],

        "real_ip_header": "X-Real-IP",

        "real_ip_recursive": "off",

        "cassandra_repl_factor": 1,

        "client_ssl_cert_key_default": "/usr/local/kong/ssl/kong-default.key",

        "admin_ssl_cert": "/usr/local/kong/ssl/admin-kong-default.crt",

        "anonymous_reports": true,

        "log_level": "notice",

        "kong_env": "/usr/local/kong/.kong_env",

        "pg_port": 5432,

        "admin_ssl_cert_default": "/usr/local/kong/ssl/admin-kong-default.crt",

        "client_body_buffer_size": "8k",

        "ssl_preread_enabled": true,

        "ssl_cert_csr_default": "/usr/local/kong/ssl/kong-default.csr",

        "stream_listeners": { },

        "cassandra_keyspace": "kong",

        "ssl_cert_default": "/usr/local/kong/ssl/kong-default.crt",

        "nginx_conf": "/usr/local/kong/nginx.conf",

        "admin_listen": [

            "0.0.0.0:8001",

            "0.0.0.0:8444 ssl"

        ]

    },

    "version": "1.0.3",

    "node_id": "3ccef799-3037-4a8f-8ccd-2e60326b4444",

    "lua_version": "LuaJIT 2.1.0-beta3",

    "prng_seeds": {

        "pid: 36": 229762112224,

        "pid: 37": 131951181922,

        "pid: 1": 136391662351

    },

    "timers": {

        "pending": 5,

        "running": 0

    },

    "hostname": "999a5cf1db1a"

}

上面几个端口,分别是:

  • :8000 on which Kong listens for incoming HTTP traffic from your clients, and forwards it to your upstream services.
  • :8443 on which Kong listens for incoming HTTPS traffic. This port has a similar behavior as the :8000 port, except that it expects HTTPS traffic only. This port can be disabled via the configuration file.
  • :8001 on which the Admin API used to configure Kong listens.
  • :8444 on which the Admin API listens for HTTPS traffic.

4.API Management

在本地配置Kong完毕后,我们来感受一下Kong强大的特性。首先我们有一个简单的API服务,之前已经写好的一个flavors的增删改查,以flavors的查询为例,我们将GET /flavors/detail添加到Kong中。

我们的API server地址是http://127.0.0.1:8080/flavors/detail,于是我们有:

  • route path: /flavors/detail
  • service host: http://127.0.0.1:8080

4.1 Add a service

curl -i -X POST \

  --url http://localhost:8001/services/ \   --data 'name=example-flavors'\   --data 'url=http://127.0.0.1:8080/flavors/detail'

得到的响应:

HTTP/1.1 201 Created

Date: Wed, 27 Feb 2019 06:08:25 GMT

Content-Type: application/json; charset=utf-8

Connection: keep-alive

Access-Control-Allow-Origin: *

Server: kong/1.0.3

Content-Length: 273

{ "host": "127.0.0.1", "created_at": 1551247705, "connect_timeout": 60000, "id": "abba6d52-b239-4b8f-ad11-1e7389d4cf71", "protocol": "http", "name": "example-flavors", "read_timeout": 60000, "port": 8080, "path": "/flavors/detail", "updated_at": 1551247705, "retries": 5, "write_timeout": 60000 }

4.2 List current services

curl -i -X GET \

  --url http://localhost:8001/services/

得到的响应:

HTTP/1.1 200 OK

Date: Wed, 27 Feb 2019 06:11:07 GMT

Content-Type: application/json; charset=utf-8

Connection: keep-alive

Access-Control-Allow-Origin: *

Server: kong/1.0.3

Content-Length: 296

{ "next": null, "data": [ { "host": "127.0.0.1", "created_at": 1551247705, "connect_timeout": 60000, "id": "abba6d52-b239-4b8f-ad11-1e7389d4cf71", "protocol": "http", "name": "example-flavors", "read_timeout": 60000, "port": 8080, "path": "/flavors/detail", "updated_at": 1551247705, "retries": 5, "write_timeout": 60000 } ] }

可以看到目前就我们前面添加的一个。

4.3 Add a route to service

有了服务之后,我们为服务填一个转发路由:

curl -i -X POST \

  --url http://localhost:8001/services/example-flavors/routes \   --data 'hosts[]=hb.ctyun.com' \   --data 'paths[]=/flavors/detail' \   --data 'name=flavor-detail' 

得到的响应是:

HTTP/1.1 201 Created

Date: Wed, 27 Feb 2019 06:24:00 GMT

Content-Type: application/json; charset=utf-8

Connection: keep-alive

Access-Control-Allow-Origin: *

Server: kong/1.0.3

Content-Length: 377

{ "created_at": 1551248640, "methods": null, "id": "11dbb4a1-7452-4d40-a45a-de3f3cad5275", "service": { "id": "abba6d52-b239-4b8f-ad11-1e7389d4cf71" }, "name": "flavor-detail", "hosts": [ "hb.ctyun.com" ], "updated_at": 1551248640, "preserve_host": false, "regex_priority": 0, "paths": [ "/flavors/detail" ], "sources": null, "destinations": null, "snis": null, "protocols": [ "http", "https" ], "strip_path": true }

原先获取flavors列表,我们是通过:

curl -X GET http://localhost:8080/flavors/detail

而我们现在可以直接通过Kong进行访问,注意,我们必须修改Header,添加指定的Host信息:

curl -X GET http://localhost:8000/flavors/detail -H 'Host:hb.ctyun.com'

结果遇到了报错,提示:

172.18.0.1 - - [27/Feb/2019:06:43:17 +0000] "GET /flavors/detail HTTP/1.1" 502 69 "-" "curl/7.54.0"

2019/02/27 06:43:17 [error] 36#0: *35879 connect() failed (111: Connection refused) while connecting to upstream, client: 172.18.0.1, server: kong, request: "GET /flavors/detail HTTP/1.1", upstream: "http://127.0.0.1:8080/flavors/detail", host: "hb.ctyun.com"

可以看到能够按照路由规则进行转发,但是由于网络问题(kong部署在了docker容器中),所以没有办法进行访问。

我们重新创建service、route,并使用kennethreitz/httpbin来验证:

# 运行一个容器,将本地的8080的请求转发到容器的80端口

docker run -d --name simple-web-server \

    --network kong-net \

    -p 8080:80 kennethreitz/httpbin

# 创建名为demoservice

curl -i -X POST \

  --url http://localhost:8001/services/ \

  --data 'name=demo'\

  --data 'url=http://simple-web-server/get'

HTTP/1.1 201 Created

Date: Wed, 27 Feb 2019 07:51:45 GMT

Content-Type: application/json; charset=utf-8

Connection: keep-alive

Access-Control-Allow-Origin: *

Server: kong/1.0.3

Content-Length: 256

{

    "host": "simple-web-server",

    "created_at": 1551253905,

    "connect_timeout": 60000,

    "id": "978de8a6-6767-4741-baca-a25c9a131f9d",

    "protocol": "http",

    "name": "demo",

    "read_timeout": 60000,

    "port": 80,

    "path": "/get",

    "updated_at": 1551253905,

    "retries": 5,

    "write_timeout": 60000

}

# service demo配置route规则

curl -i -X POST \

  --url http://localhost:8001/services/demo/routes \

  --data 'hosts[]=api.ctyun.com' \

  --data 'paths[]=/get' \

  --data 'name=demo-get'

HTTP/1.1 201 Created

Date: Wed, 27 Feb 2019 07:52:40 GMT

Content-Type: application/json; charset=utf-8

Connection: keep-alive

Access-Control-Allow-Origin: *

Server: kong/1.0.3

Content-Length: 361

{

    "created_at": 1551253960,

    "methods": null,

    "id": "06d6754e-a4ae-4be6-9b87-b64ccfe6c920",

    "service": {

        "id": "978de8a6-6767-4741-baca-a25c9a131f9d"

    },

    "name": "demo-get",

    "hosts": [

        "api.ctyun.com"

    ],

    "updated_at": 1551253960,

    "preserve_host": false,

    "regex_priority": 0,

    "paths": [

        "/get"

    ],

    "sources": null,

    "destinations": null,

    "snis": null,

    "protocols": [

        "http",

        "https"

    ],

    "strip_path": true

}

然后我们尝试通过访问kong,转发到httpbin:

curl -i -X GET http://localhost:8000/get -H 'Host:api.ctyun.com'

HTTP/1.1 200 OK

Content-Type: application/json

Content-Length: 266

Connection: keep-alive

Server: gunicorn/19.9.0

Date: Wed, 27 Feb 2019 07:56:50 GMT

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

X-Kong-Upstream-Latency: 9

X-Kong-Proxy-Latency: 84

Via: kong/1.0.3

{

  "args": {},

  "headers": {

    "Accept": "*/*",

    "Connection": "keep-alive",

    "Host": "simple-web-server",

    "User-Agent": "curl/7.54.0",

    "X-Forwarded-Host": "api.ctyun.com"

  },

  "origin": "172.18.0.1",

  "url": "http://api.ctyun.com/get"

}

至此,我们已经可以通过来源host、route将请求换发到指定的目标host,并且得到了返回值,这就算完成了基本API转发流程。

4.4 Plugins

Kong提供了非常丰富的插件,都可以在Kong Hub找得到。这里我们简单为我们的服务配置一个Key Authentication的plugin。

在服务demo上启用key-auth的插件:

curl -X POST http://localhost:8001/services/demo/plugins \

    --data "name=key-auth" 

{

    "created_at": 1551256029,

    "config": {

        "key_names": [

            "apikey"

        ],

        "run_on_preflight": true,

        "anonymous": null,

        "hide_credentials": false,

        "key_in_body": false

    },

    "id": "4eaa000f-0fa2-4b3e-8c13-2db4c6b7ce49",

    "service": {

        "id": "978de8a6-6767-4741-baca-a25c9a131f9d"

    },

    "enabled": true,

    "run_on": "first",

    "consumer": null,

    "route": null,

    "name": "key-auth"

}

也可以在具体的route上启用插件,比如:

curl -X POST http://<host>:8001/routes/{route_id}/plugins \

   --data "name=key-auth" 

我们这里就不再赘述了。

开启插件后,再次访问前面的simple-web-server,则有:

curl -i -X GET http://localhost:8000/get -H 'Host:api.ctyun.com'

HTTP/1.1 401 Unauthorized

Date: Wed, 27 Feb 2019 08:27:13 GMT

Content-Type: application/json; charset=utf-8

Connection: keep-alive

WWW-Authenticate: Key realm="kong"

Content-Length: 41

Server: kong/1.0.3

{"message":"No API key found in request"}

此时插件key-auth已经开启了,开启之后怎么用呢?要想使用鉴权插件,离不开Consumer。如何创建Consumer并使用指定的插件,我们放到4.5 Add Consumers中尽心更详细的介绍。

4.5 Add Consumers

添加一个consumer,username和custom_id指定任一即可:

curl -i -X POST \

  --url http://localhost:8001/consumers/ \   --data "username=<USERNAME>" \   --data "custom_id=<CUSTOM_ID>"

如:

curl -i -X POST \

  --url http://localhost:8001/consumers/ \

  --data "username=elbarco"

HTTP/1.1 201 Created

Date: Wed, 27 Feb 2019 08:47:50 GMT

Content-Type: application/json; charset=utf-8

Connection: keep-alive

Access-Control-Allow-Origin: *

Server: kong/1.0.3

Content-Length: 107

{

    "custom_id": null,

    "created_at": 1551257270,

    "username": "elbarco",

    "id": "738627ae-57e9-4b20-9d1d-fb12998d5296"

}

为用户提供一个key:

curl -i -X POST \

  --url http://localhost:8001/consumers/elbarco/key-auth/ \

  --data 'key=hola-elbarco'

HTTP/1.1 201 Created

Date: Wed, 27 Feb 2019 09:12:12 GMT

Content-Type: application/json; charset=utf-8

Connection: keep-alive

Access-Control-Allow-Origin: *

Server: kong/1.0.3

Content-Length: 147

{

    "key": "hola-elbarco",

    "created_at": 1551258732,

    "consumer": {

        "id": "738627ae-57e9-4b20-9d1d-fb12998d5296"

    },

    "id": "b9cb021d-cb37-4841-b172-40ff2dcacb5e"

}

此时,我们就可以带着鉴权访问前面的simple-web-server了,有两种方式:

curl http://kong:8000/{proxy path}?apikey=<some_key>

curl http://kong:8000/{proxy path} \

    -H 'apikey: <some_key>'

我们这里任选一种即可:

curl -i -X GET http://localhost:8000/get -H 'Host:api.ctyun.com' -H 'apikey:hola-elbarco'

HTTP/1.1 200 OK

Content-Type: application/json

Content-Length: 398

Connection: keep-alive

Server: gunicorn/19.9.0

Date: Wed, 27 Feb 2019 09:19:31 GMT

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

X-Kong-Upstream-Latency: 68

X-Kong-Proxy-Latency: 26

Via: kong/1.0.3

{

  "args": {},

  "headers": {

    "Accept": "*/*",

    "Apikey": "hola-elbarco",

    "Connection": "keep-alive",

    "Host": "simple-web-server",

    "User-Agent": "curl/7.54.0",

    "X-Consumer-Id": "738627ae-57e9-4b20-9d1d-fb12998d5296",

    "X-Consumer-Username": "elbarco",

    "X-Forwarded-Host": "api.ctyun.com"

  },

  "origin": "172.18.0.1",

  "url": "http://api.ctyun.com/get"

}

4.6 Rate limiting

额外的,我们再看一下限流插件:Rate Limiting。

5.Advanced Features

5.1 Load balancing

Loadbalancing reference

6.Kong Dashboard (From community)

Kong的商业版中,提供了一个可视化界面工具,叫做Kong Manager,功能很是强大

试用需要申请,我们转而在社区中寻求替代工具,于是在Github上搜到了Kong Dashboard,提供了使用npm和docker安装两种方式,这里采用docker的方式安装一下,看看效果:

# Start Kong Dashboard

docker run --rm -p 9090:8080 pgbi/kong-dashboard start --kong-url http://locahost:8001

# Start Kong Dashboard on a custom port

docker run --rm -p [port]:8080 pgbi/kong-dashboard start --kong-url http://kong:8001

# Start Kong Dashboard with basic auth

docker run --rm -p 8080:8080 pgbi/kong-dashboard start \ --kong-url http://kong:8001   --basic-auth user1=password1 user2=password2

# See full list of start options

docker run --rm -p 8080:8080 pgbi/kong-dashboard start --help 

docker run --rm --name kong-dashboard -p 9090:808i0 pgbi/kong-dashboard start --kong-url http://locahost:8001

docker run --rm  --network kong-net --name kong-dashboard -p 9090:8080 pgbi/kong-dashboard start --kong-url http://kong:8001

Connecting to Kong on http://kong:8001 ...

This version of Kong dashboard doesn't support Kong v0.15 and higher.

受限于Kong的版本:

docker container exec 999a5cf1db1a kong version

1.0.3

我们没办法接入kong-dashboard,后面再进行调研吧。

7.Summary

kong的模型比较清晰,从service、route、plugin到upstream、consumer,通用性比较强,因为插件的存在,功能扩展性也很高。从我们的实际业务触发,也可以参考借鉴这种模型方式,先从核心功能出发。文章来源地址https://www.toymoban.com/news/detail-776352.html

8.Reference

  • [1].An Introduction to Kong
  • [2].Kong Admin API

到了这里,关于高性能API网关Kong介绍的文章就介绍完了。如果您还想了解更多内容,请在右上角搜索TOY模板网以前的文章或继续浏览下面的相关文章,希望大家以后多多支持TOY模板网!

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处: 如若内容造成侵权/违法违规/事实不符,请点击违法举报进行投诉反馈,一经查实,立即删除!

领支付宝红包 赞助服务器费用

相关文章

  • 【云原生网关】Kong 使用详解

    目录 一、前言 二、Kong介绍 三、Kong核心组件 3.1 kong组件介绍 3.1.1 Kong Server

    2024年02月02日
    浏览(43)
  • Nginx、Kong、Apisix、Gateway网关比较

    Nginx是一款高性能的http 服务器/反向代理服务器及电子邮件(IMAP/POP3)代理服务器。能够支撑 5 万并发链接,并且 cpu、内存等资源消耗却非常低,运行非常稳定,由C语言编写。支持负载均衡、限流熔断、热部署、安全认证等。 应用场景 http 服务器:独立提供 http 服务,用于

    2024年02月14日
    浏览(39)
  • FluxMQ—引领物联网新时代的高性能MQTT网关

    随着物联网技术的快速发展,人们越来越意识到实时、可靠、安全的数据传输对于智能化的生产与生活的重要性。因此,市场对于高性能的物联网数据传输解决方案有着强烈的需求。FluxMQ正是为满足这一需求而诞生的一款高性能、可靠且易于使用的MQTT网关产品。 产品介绍

    2023年04月18日
    浏览(43)
  • ClickHouse进阶|如何自研一款企业级高性能网关组件?

    使用原生ClickHouse集群进行节点数据查询和写入时,离不开第三方开源网关组件chproxy支持。但由于chproxy缺少TCP协议支持,导致性能、查询能力等受限。这也成为困扰众多ClickHouse开发者的一大难题。那么,究竟应该如何突破?本文将揭秘火山引擎ByteHouse企业版自研网关组件如何

    2024年02月07日
    浏览(48)
  • 为kong网关添加key-auth插件实现安全认证

    官方指导文档:https://docs.konghq.com/gateway/latest/get-started/key-authentication/ 这里我们新建一个username=luka的用户 这一步我们看到kong给我们分配一个key:mZiuw2s2mJvFTbwhVx1zpYzFGaUbS2t1 1、启用key-auth插件 2、不带key进行请求 3、携带错误的key进行请求 4、使用正确的key进行请求 1、查看当前已

    2024年02月06日
    浏览(42)
  • FastAPI 构建 API 高性能的 web 框架(一)

    如果要部署一些大模型一般langchain+fastapi,或者fastchat, 先大概了解一下fastapi,本篇主要就是贴几个实际例子。 官方文档地址: https://fastapi.tiangolo.com/zh/ 来源:大语言模型工程化服务系列之五-------复旦MOSS大模型fastapi接口服务 服务端代码: api启动后,调用代码: 来源: 大语

    2024年02月13日
    浏览(48)
  • FastAPI 构建 API 高性能的 web 框架(二)

    上一篇 FastAPI 构建 API 高性能的 web 框架(一)是把LLM模型使用Fastapi的一些例子,本篇简单来看一下FastAPI的一些细节。 有中文官方文档:fastapi中文文档 假如你想将应用程序部署到生产环境,你可能要执行以下操作: 并且安装uvicorn来作为服务器: 然后对你想使用的每个可选

    2024年02月12日
    浏览(51)
  • 高性能软件负载OpenResty介绍和安装

    OpenResty是一个基于 Nginx 与 Lua 的高性能 Web 平台,其内部集成了大量精良的 Lua 库、第三方模块以及大多数的依赖项 当请求进入Nginx后先READ REQUEST HEADERS 读取头部 然后再分配由哪个指令操作 Identity 寻找匹配哪个Location* Apply Rate Limits 是否要对该请求限制 Preform Authertication 权限验

    2024年02月08日
    浏览(59)
  • 高性能的全文检索库Apache Lucene 介绍

            Apache Lucene 是一个高性能的全文检索库,由 Apache Software Foundation 维护。Lucene 提供了丰富的 API,用于实现快速、准确的全文搜索。本文将详细介绍 Apache Lucene 的技术特点、应用场景和优势。         Apache Lucene 的历史和发展         Apache Lucene 起源于 1999 年

    2024年03月27日
    浏览(53)
  • Linux高性能服务器编程 学习笔记 第五章 Linux网络编程基础API

    我们将从以下3方面讨论Linux网络API: 1.socket地址API。socket最开始的含义是一个IP地址和端口对(ip,port),它唯一表示了使用TCP通信的一端,本书称其为socket地址。 2.socket基础API。socket的主要API都定义在sys/socket.h头文件中,包括创建socket、命名socket、监听socket、接受连接、发

    2024年02月07日
    浏览(56)

觉得文章有用就打赏一下文章作者

支付宝扫一扫打赏

博客赞助

微信扫一扫打赏

请作者喝杯咖啡吧~博客赞助

支付宝扫一扫领取红包,优惠每天领

二维码1

领取红包

二维码2

领红包