为Kong添加服务、路由和认证

服务准备

准备一台kong服务器（192.168.250.246）来提供API网关服务，本文所有的操作都将在该服务器上进行。

再准备一个API服务器(192.168.250.245)，用来提供无需验证的WebApi。该服务使用Visual Studio 2022来创建，项目模板为ASP.NET Core Web Api。

打开“WeatherForecastController.cs”,修改

 [Route("[controller]")]
  public class WeatherForecastController : ControllerBase
    {

修改成如下内容

 [Route("api/[controller]")]
  public class WeatherForecastController : ControllerBase
    {

整个项目无需添加任何代码（仅一处修改），项目默认会提供swagger来展示和测试Web Api，直接运行示例项目，会得到一个“/WeatherForecast”的 Web Api。

这篇文章示例中，我们使用默认的示例进行演示。这里我将服务端口修改成了80端口（最简单的方式，将项目发布到IIS，即可）。

在Windows的浏览器中打开下面网页

http://localhost:5214/WeatherForecast

或者在命令行执行

curl http://localhost:5214/WeatherForecast

都会得到一串json字符串（数据为随机生成，内容不同，但格式相同）：

[
{
“date”: “2021-11-01T08:27:23.8059871+08:00”,
“temperatureC”: 8,
“temperatureF”: 46,
“summary”: “Cool”
},
{
“date”: “2021-11-02T08:27:23.8066421+08:00”,
“temperatureC”: 30,
“temperatureF”: 85,
“summary”: “Scorching”
},
{
“date”: “2021-11-03T08:27:23.8066469+08:00”,
“temperatureC”: 6,
“temperatureF”: 42,
“summary”: “Chilly”
},
{
“date”: “2021-11-04T08:27:23.8066472+08:00”,
“temperatureC”: 53,
“temperatureF”: 127,
“summary”: “Balmy”
},
{
“date”: “2021-11-05T08:27:23.8066473+08:00”,
“temperatureC”: 21,
“temperatureF”: 69,
“summary”: “Sweltering”
}
]

将localhost修改为192.168.250.245，可以在其它计算机上访问，比如在192.168.250.246（kong服务器）这台计算机上，需要将localhost修改为192.168.250.245才能正常访问。

接下来所有操作均在192.168.250.246这台服务器上操作，也就是直接在运行了kong服务的API网关上操作。

添加一个服务

curl -i -X POST http://172.17.0.1:8001/services \
  --data name=gdlisnet \
  --data url='http://192.168.250.245/api/'

输出结果

{
“connect_timeout”: 60000,
“protocol”: “http”,
“id”: “6122903e-b6eb-4b75-adab-5e189fddb66f”,
“created_at”: 1635643735,
“updated_at”: 1635643735,
“host”: “192.168.250.245”,
“retries”: 5,
“write_timeout”: 60000,
“ca_certificates”: null,
“port”: 80,
“read_timeout”: 60000,
“client_certificate”: null,
“path”: “/api/”,
“name”: “gdlisnet”,
“tags”: null,
“tls_verify”: null,
“tls_verify_depth”: null
}

由于本系统对kong的管理服务（8001端口）仅向172.17.0.1所在网段开放，其它网络无法访问管理服务，包括127.0.0.1也无法访问，当然192.168.250.246也是不可访问的。如果你没做安全设置，那么无论是127还是172,192，都应该是可以访问。

在这里创建了一个“Services”，名称为“gdlisnet”，提供了一个“http://192.168.250.245/api/”的服务。

这里只写了两个配置，当然还有其它可选配置，这里不再赘述，如果你有兴趣了解，请看kong官网(http://www.konghq.com)文档。

验证服务

curl -i http://172.17.0.1:8001/services/gdlisnet

kong管理服务：http://172.17.0.1:8001/services/
服务名：gdlisnet

执行后，将会得到如下结果，与添加后返回结果相同。

{
“connect_timeout”: 60000,
“protocol”: “http”,
“id”: “6122903e-b6eb-4b75-adab-5e189fddb66f”,
“created_at”: 1635643735,
“updated_at”: 1635643735,
“host”: “192.168.250.245”,
“retries”: 5,
“write_timeout”: 60000,
“ca_certificates”: null,
“port”: 80,
“read_timeout”: 60000,
“client_certificate”: null,
“path”: “/api/”,
“name”: “gdlisnet”,
“tags”: null,
“tls_verify”: null,
“tls_verify_depth”: null
}

添加路由

curl -i -X POST http://172.17.0.1:8001/services/gdlisnet/routes \
  --data 'paths[]=/gdlisnet' \
  --data name=gdlisnet

kong管理服务：http://172.17.0.1:8001/services/
服务名：gdlisnet
路由：routes
路径数组：/gdlisnet
路由名称：gdlisnet

这里添加了一个路由，也就是一个path，路径“/gdlisnet”，将来可以通过“http://172.17.0.1/gdlisnet”来访问的路径。

执行后，得到如下结果

{
“hosts”: null,
“id”: “201ecab4-45b0-4a57-962a-af634aec2d0f”,
“created_at”: 1635644135,
“sources”: null,
“regex_priority”: 0,
“strip_path”: true,
“request_buffering”: true,
“response_buffering”: true,
“headers”: null,
“https_redirect_status_code”: 426,
“preserve_host”: false,
“tags”: null,
“updated_at”: 1635644135,
“methods”: null,
“path_handling”: “v0”,
“snis”: null,
“paths”: ["/gdlisnet"],
“name”: “gdlisnet”,
“protocols”: [“http”, “https”],
“destinations”: null,
“service”: {
“id”: “6122903e-b6eb-4b75-adab-5e189fddb66f”
}
}

验证刚才添加的路由

直接访问245上的Web Api如下

curl -i -X GET http://192.168.250.245/api/WeatherForecast

通过kong服务器访问

curl -i -X GET http://172.17.0.1/gdlisnet/WeatherForecast

执行结果：

[{
“date”: “2021-11-01T09:26:45.2960934+08:00”,
“temperatureC”: 47,
“temperatureF”: 116,
“summary”: “Bracing”
}, {
“date”: “2021-11-02T09:26:45.2960977+08:00”,
“temperatureC”: 24,
“temperatureF”: 75,
“summary”: “Freezing”
}, {
“date”: “2021-11-03T09:26:45.296098+08:00”,
“temperatureC”: -15,
“temperatureF”: 6,
“summary”: “Mild”
}, {
“date”: “2021-11-04T09:26:45.2960982+08:00”,
“temperatureC”: 45,
“temperatureF”: 112,
“summary”: “Warm”
}, {
“date”: “2021-11-05T09:26:45.2960984+08:00”,
“temperatureC”: 1,
“temperatureF”: 33,
“summary”: “Balmy”
}]

确保直接访问，与通过kong服务器访问，可以得到一致的结果。

安装Key Authentication认证插件

curl -X POST http://172.17.0.1:8001/routes/gdlisnet/plugins \
  --data name=key-auth

执行结果：

{
“enabled”: true,
“id”: “f72a73d6-4b4f-4b88-b068-ec9043485a83”,
“consumer”: null,
“config”: {
“key_names”: [“apikey”],
“run_on_preflight”: true,
“key_in_header”: true,
“anonymous”: null,
“key_in_body”: false,
“key_in_query”: true,
“hide_credentials”: false
},
“tags”: null,
“route”: {
“id”: “201ecab4-45b0-4a57-962a-af634aec2d0f”
},
“name”: “key-auth”,
“protocols”: [“grpc”, “grpcs”, “http”, “https”],
“created_at”: 1635644400,
“service”: null
}

验证认证

重新通过kong来访问web api

curl -i http://172.17.0.1/gdlisnet

curl -i http://172.17.0.1/gdlisnet/WeatherForecast

都会得到如下信息，表明认证插件已生效

HTTP/1.1 401 Unauthorized
Date: Sun, 31 Oct 2021 01:41:06 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
WWW-Authenticate: Key realm=“kong”
Content-Length: 45
X-Kong-Response-Latency: 15
Server: kong/2.6.0

{
“message”:“No API key found in request”
}

设置用户和认证凭据

curl -i -X POST http://172.17.0.1:8001/consumers/ \
  --data username=yuntu \
  --data custom_id=id_yuntu

运行后，得到如下结果：

{
“custom_id”: “id_yuntu”,
“username”: “yuntu”,
“id”: “356c894c-9ee5-4c4e-9850-e1f402a8b6ad”,
“tags”: null,
“created_at”: 1635644718
}

为apikey设置密码

curl -i -X POST http://172.17.0.1:8001/consumers/yuntu/key-auth \
  --data key=myApikey

得到如下结果

{
“id”: “254b4234-b8fa-4d15-9954-99140504c049”,
“created_at”: 1635644846,
“key”: “myApikey”,
“ttl”: null,
“consumer”: {
“id”: “356c894c-9ee5-4c4e-9850-e1f402a8b6ad”
},
“tags”: null
}

验证

curl -X GET http://172.17.0.1:8001/routes/gdlisnet/plugins/

得到如下结果：

{
“next”: null,
“data”: [{
“enabled”: true,
“id”: “f72a73d6-4b4f-4b88-b068-ec9043485a83”,
“consumer”: null,
“config”: {
“key_names”: [“apikey”],
“run_on_preflight”: true,
“key_in_header”: true,
“anonymous”: null,
“key_in_body”: false,
“key_in_query”: true,
“hide_credentials”: false
},
“tags”: null,
“route”: {
“id”: “201ecab4-45b0-4a57-962a-af634aec2d0f”
},
“name”: “key-auth”,
“protocols”: [“grpc”, “grpcs”, “http”, “https”],
“created_at”: 1635644400,
“service”: null
}]
}

验证Key Authentication认证

未提供认证，执行

curl -i http://172.17.0.1/gdlisnet/WeatherForecast

执行结果：

{
“message”:“No API key found in request”
}

提供认证，执行：

curl -i http://172.17.0.1/gdlisnet/WeatherForecast \
  -H 'apikey:myApikey'

执行结果：

[{
“date”: “2021-11-01T09:41:23.5599289+08:00”,
“temperatureC”: 4,
“temperatureF”: 39,
“summary”: “Freezing”
}, {
“date”: “2021-11-02T09:41:23.559936+08:00”,
“temperatureC”: 27,
“temperatureF”: 80,
“summary”: “Scorching”
}, {
“date”: “2021-11-03T09:41:23.5599363+08:00”,
“temperatureC”: 50,
“temperatureF”: 121,
“summary”: “Scorching”
}, {
“date”: “2021-11-04T09:41:23.5599365+08:00”,
“temperatureC”: 31,
“temperatureF”: 87,
“summary”: “Sweltering”
}, {
“date”: “2021-11-05T09:41:23.5599367+08:00”,
“temperatureC”: 18,
“temperatureF”: 64,
“summary”: “Hot”
}]

到此，配置完毕！