API 网关演进：从 Kong 到 APISIX 的云原生网关选型实践

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

location /api/resume/ {
    access_by_lua_block {
        -- 鉴权
        local token = ngx.var.http_authorization
        if not validate_token(token) then
            ngx.exit(401)
        end
        -- 限流
        if not rate_limit(ngx.var.remote_addr) then
            ngx.exit(429)
        end
    }
    proxy_pass http://resume_service;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

import requests

# 从 Kong Admin API 导出配置
kong_routes = requests.get("http://kong-admin:8001/routes").json()
kong_services = requests.get("http://kong-admin:8001/services").json()
kong_plugins = requests.get("http://kong-admin:8001/plugins").json()

# 转换成 APISIX 格式并导入
for route in kong_routes["data"]:
    apisix_route = {
        "uri": route["paths"][0],
        "methods": route.get("methods", ["GET", "POST"]),
        "upstream": {
            "type": "roundrobin",
            "nodes": {
                f"{service['host']}:{service['port']}": 1
                for service in kong_services["data"]
                if service["id"] == route["service"]["id"]
            }
        },
        "plugins": convert_plugins(route.get("plugins", []))
    }
    requests.put("http://apisix-admin:9180/apisix/admin/routes", 
                 json=apisix_route,
                 headers={"X-API-KEY": "admin-key"})

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

// 自定义插件：招聘平台统一鉴权
package main

import (
    "github.com/apache/apisix-go-plugin-runner/go/internal"
    "github.com/apache/apisix-go-plugin-runner/go/plugin"
)

// 注册插件
func init() {
    plugin.RegisterPlugin(&RecruitAuth{})
}

type RecruitAuth struct {
    Name string
}

func (p *RecruitAuth) GetName() string {
    return "recruit-auth"
}

// ParseConf 解析插件配置
func (p *RecruitAuth) ParseConf(data []byte) (interface{}, error) {
    var conf struct {
        TokenHeader string `json:"token_header"`
        WhiteList   []string `json:"white_list"`
    }
    if err := json.Unmarshal(data, &conf); err != nil {
        return nil, err
    }
    return conf, nil
}

// RequestFilter 请求过滤（鉴权）
func (p *RecruitAuth) RequestFilter(conf interface{}, w http.ResponseWriter, r pkgHTTP.Request) {
    config := conf.(struct {
        TokenHeader string
        WhiteList   []string
    })

    // 白名单路径跳过鉴权
    for _, path := range config.WhiteList {
        if strings.HasPrefix(r.Path().String(), path) {
            return
        }
    }

    // 校验 Token
    token := r.Header().Get(config.TokenHeader)
    if token == "" || !validateToken(token) {
        w.WriteHeader(401)
        w.Write([]byte(`{"code":401,"message":"未授权"}`))
        return
    }

    // 把用户信息注入 header，传给后端
    userInfo := parseToken(token)
    r.Header().Set("X-User-ID", strconv.FormatInt(userInfo.ID, 10))
    r.Header().Set("X-User-Role", userInfo.Role)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

{
  "uri": "/api/resume/*",
  "plugins": {
    "recruit-auth": {
      "token_header": "Authorization",
      "white_list": ["/api/resume/public"]
    },
    "limit-req": {
      "rate": 100,
      "burst": 50,
      "key": "remote_addr"
    },
    "prometheus": {}
  },
  "upstream": {
    "type": "roundrobin",
    "nodes": {
      "resume-service:8080": 1
    }
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

{
  "uri": "/api/resume/*",
  "plugins": {
    "traffic-split": {
      "rules": [
        {
          "match": [
            {
              "vars": [["http_x_user_type", "==", "internal"]]
            }
          ],
          "weighted_upstreams": [
            {
              "upstream": {
                "name": "resume-service-v2",
                "nodes": {
                  "resume-service-v2:8080": 1
                }
              },
              "weight": 1
            }
          ]
        }
      ]
    }
  },
  "upstream": {
    "type": "roundrobin",
    "nodes": {
      "resume-service-v1:8080": 1
    }
  }
}

1
2
3
4
5

{
  "plugins": {
    "prometheus": {}
  }
}