使用docker和docker-compose部署和简单配置kong网关

参考资料

• https://cloud.tencent.com/developer/article/1776213

基础概念

api gateway 的必要性

What is API gateway really all about? Java Brains - Brain Bytes

Kong 是由 Mashape 开源的一款具有高性能、高可用特点的云原生架构下的分布式 API 网关。Kong 是一个在 Nginx 中运行的 Lua 应用程序

Kong 通过插件形式，提供了微服务网关的各项功能，包括负载均衡、日志、授权、限流、转发等等

• Kong，基于 Nginx 来实现 Api Gateway 基本的负载均衡、反向代理等功能
• OpenResty，一个基于 Nginx 的库，它将 Nginx 进行封装，并提供了整个生命周期的 Hook（ 钩子 ），使得开发者可以通过 Lua 脚本对 Nginx 进行插件化管理
• Kong 使用PostgreSQL 或 Cassandra 来对其配置文件进行持久化存储。
• Kong 的插件模型，使用 Lua 脚本来对 Nginx 整个生命周期进行扩展。

使用docker启动kong

在docker-compose中启动kong

docker network create kong-net

docker run -d --name kong-db \
  --network=kong-net \
  -p 5432:5432 \
  -e "POSTGRES_USER=kong" \
  -e "POSTGRES_DB=kong" \
  -e "POSTGRES_PASSWORD=passwd" \
  postgres:9.6
  
docker run --rm --network=kong-net \
  -e "KONG_DATABASE=postgres" \
  -e "KONG_PG_HOST=kong-db" \
  -e "KONG_PG_PASSWORD=passwd" \
  -e "KONG_PASSWORD=kong" \
  kong kong migrations bootstrap
  
docker run -d --name kong --network=kong-net \
  -e "KONG_DATABASE=postgres" \
  -e "KONG_PG_HOST=kong-db" \
  -e "KONG_PG_PASSWORD=passwd" \
  -e "KONG_PROXY_ACCESS_LOG=/dev/stdout" \
  -e "KONG_ADMIN_ACCESS_LOG=/dev/stdout" \
  -e "KONG_PROXY_ERROR_LOG=/dev/stderr" \
  -e "KONG_ADMIN_ERROR_LOG=/dev/stderr" \
  -e "KONG_ADMIN_LISTEN=0.0.0.0:8001, 0.0.0.0:8444 ssl" \
  -p 80:8000 \
  -p 443:8443 \
  -p 8001:8001 \
  -p 8444:8444 \
  kong

可以使用图形化管理工具konga，便于网关管理

使用docker-compose启动kong

使用docker-compose启动更为方便

version: "3.8"

networks:
  kong-net:
    external: true
    
services: 
  postgres:
    image: postgres:9.6
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_USER=kong
      - POSTGRES_DB=kong
      - POSTGRES_PASSWORD=kongpasswd
    networks:
      - kong-net

  kong-migration:
    image: kong
    command: "kong migrations bootstrap"
    restart: on-failure
    links:
      - "postgres:postgres"
    environment:
      - "KONG_DATABASE=postgres"
      - "KONG_PG_USER=kong"
      - "KONG_PG_DATABASE=kong"
      - "KONG_PG_HOST=postgres"
      - "KONG_PG_PASSWORD=kongpasswd"
      - "KONG_CASSANDRA_CONTACT_POINTS=postgres"
    depends_on:
      - postgres
    networks:
      - kong-net

  kong:
    image: kong
    restart: always
    links:
      - "postgres:postgres"
    environment:
      - "KONG_DATABASE=postgres"
      - "KONG_PG_USER=kong"
      - "KONG_PG_DATABASE=kong"
      - "KONG_PG_HOST=postgres"
      - "KONG_PG_PASSWORD=kongpasswd"
      - "KONG_CASSANDRA_CONTACT_POINTS=postgres"
      - "KONG_PROXY_LISTEN=0.0.0.0:8000"
      - "KONG_PROXY_LISTEN_SSL=0.0.0.0:8443"
      - "KONG_ADMIN_LISTEN=0.0.0.0:8001"
    depends_on:
      - postgres
      - kong-migration
    ports:
      - 8000:8000
      - 8001:8001
      - 8443:8443
      - 8444:8444
    networks:
      - kong-net

  konga-prepare:
    image: pantsel/konga
    command: "-c prepare -a postgres -u postgresql://kong:kongpasswd@postgres:5432/kong"
    restart: on-failure
    environment:
      - "DB_ADAPTER=postgres"
      - "DB_HOST=postgres"
      - "DB_PORT=5432"
      - "DB_USER=kong"
      - "DB_PASSWORD=kongpasswd"
      - "DB_DATABASE=kong"
      - "NODE_ENV=development"
    links:
      - "postgres:postgres"
    depends_on:
      - kong
      - postgres
      - kong-migration
    ports:
      - "1337:1337"
    networks:
     - kong-net

  konga:
    image: pantsel/konga
    restart: always
    environment:
      - "DB_ADAPTER=postgres"
      - "DB_HOST=postgres"
      - "DB_PORT=5432"
      - "DB_USER=kong"
      - "DB_PASSWORD=kongpasswd"
      - "DB_DATABASE=kong"
      - "NODE_ENV=development"
    links:
      - "postgres:postgres"
    depends_on:
      - kong
      - postgres
      - kong-migration
      - konga-prepare
    ports:
      - "1337:1337"
    networks:
     - kong-net

查看相关配置

查看数据库，可见已经迁移成功

# psql -U kong -d kong -h 127.0.0.1 -p 5432
kong=# \c kong
You are now connected to database "kong" as user "kong".
kong=# \d
                        List of relations
 Schema |                 Name                 |   Type   | Owner 
--------+--------------------------------------+----------+-------
 public | acls                                 | table    | kong
 public | acme_storage                         | table    | kong
 public | basicauth_credentials                | table    | kong
 public | ca_certificates                      | table    | kong
 public | certificates                         | table    | kong
 public | cluster_events                       | table    | kong
 public | clustering_data_planes               | table    | kong
 public | consumers                            | table    | kong
 public | hmacauth_credentials                 | table    | kong
 public | jwt_secrets                          | table    | kong
 public | key_sets                             | table    | kong
 public | keyauth_credentials                  | table    | kong
 public | keys                                 | table    | kong
 public | konga_api_health_checks              | table    | kong
 public | konga_api_health_checks_id_seq       | sequence | kong

查看kong镜像的入口文件如下

• /usr/local/share/lua/5.1/kong/templates/kong_defaults.lua路径为所有kong选项

• /usr/local/kong为kong的根目录

• 最终使用/usr/local/openresty/nginx/sbin/nginx命令启动nginx服务器

#!/usr/bin/env bash
...
if [[ "$1" == "kong" ]]; then

  all_kong_options="/usr/local/share/lua/5.1/kong/templates/kong_defaults.lua"
  ...
  file_env KONG_PASSWORD
  PREFIX=${KONG_PREFIX:=/usr/local/kong}
  if [[ "$2" == "docker-start" ]]; then
    kong prepare -p "$PREFIX" "$@"
	..。二设置日志路径
    exec /usr/local/openresty/nginx/sbin/nginx \
      -p "$PREFIX" \
      -c nginx.conf
  fi
fi
exec "$@"

配置端口的作用

• 8000：监听来自客户端的HTTP请求的，并将此请求转发到上游服务
• 8443：监听HTTPS的请求，并不会产生转发行为
• 8001：管理员的配置端口
• 8444：管理员监听HTTPS请求的端口

创建服务

启动kong之后直接访问，目前还没有服务

$ curl -i -X GET --url http://172.31.18.4:8001/services
HTTP/1.1 200 OK
Date: Thu, 23 Feb 2023 06:34:45 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Length: 23
X-Kong-Admin-Latency: 32
Server: kong/3.1.1

{"data":[],"next":null}

使用api接口创建一个服务

curl -i -X POST \
    --url http://172.31.18.4:8001/services/ \
    --data 'name=example-service' \
    --data 'url=https://www.example.com/'
resp:
{
    "path": "/",
    "created_at": 1680412179,
    "updated_at": 1680412179,
    "enabled": true,
    "port": 443,
    "name": "example-service",
    "client_certificate": null,
    "write_timeout": 60000,
    "id": "3590d0c6-fe30-4367-b7e0-d4fd2e202445",
    "tls_verify": null,
    "tags": null,
    "connect_timeout": 60000,
    "tls_verify_depth": null,
    "read_timeout": 60000,
    "ca_certificates": null,
    "protocol": "https",
    "retries": 5,
    "host": "www.example.com"
}

curl -ik -X POST \
    --url http://172.31.18.4:8001/services/example-service/routes \
    --data 'hosts[]=example.com' \
    --data 'paths[]=/api/example'

resp:
{
    "response_buffering": true,
    "paths": [
        "/api/example"
    ],
    "methods": null,
    "https_redirect_status_code": 426,
    "destinations": null,
    "hosts": [
        "example.com"
    ],
    "created_at": 1680412226,
    "updated_at": 1680412226,
    "regex_priority": 0,
    "name": null,
    "headers": null,
    "id": "b6d7fddd-8e84-4f75-9443-8fd7b5bf9995",
    "snis": null,
    "service": {
        "id": "3590d0c6-fe30-4367-b7e0-d4fd2e202445"
    },
    "protocols": [
        "http",
        "https"
    ],
    "strip_path": true,
    "path_handling": "v0",
    "tags": null,
    "sources": null,
    "preserve_host": false,
    "request_buffering": true
}

访问服务

$ curl -k http://172.31.18.4:8000/api/example --header 'Host: example.com'
<!doctype html>
<html>
<head>
    <title>Example Domain</title>
</head>

<body>
<div>
    <h1>Example Domain</h1>
    <p>This domain is for use in illustrative examples in documents. You may use this
    domain in literature without prior coordination or asking for permission.</p>
    <p><a href="https://www.iana.org/domains/example">More information...</a></p>
</div>
</body>
</html>

图形化工具

kong提供了ui工具管理网关，连接konga查看

https://cloud.tencent.com/developer/article/1777423?from=article.detail.1776213&areaSource=106000.2&traceId=NcRPy8q4uvJPQQ3HHXiC5

添加kong连接

刚才创建的service

查看路由

之后的具体使用还有很多，用到再说

• 身份验证
• 安全管理
• 流量控制

尤其是流控，可以进行请求数量，请求大小，请求速率，终止请求等流控插件的配置

https://cloud.tencent.com/developer/article/1781923?from=article.detail.1776213&areaSource=106000.6&traceId=K8QRo3Q1D4UZRT4Zktq1B