Downloaded 58 times
![Authentication
(API keys)
30
# conf.d/api_gateway.conf
#[upstreams here]
server {
listen 80;
location / {
if ($client_name = "") {
return 401;
}
proxy_pass http://$upstream_api;
proxy_set_header API-Client $client_name;
limit_conn clientip 20;
limit_req zone=10persec;
}
}](https://image.slidesharecdn.com/apigateway-nginxway-171201102108/75/API-Gateway-Nginx-way-30-2048.jpg)
![Authentication
(JSON Web Token)
31
# conf.d/api_gateway.conf
#[upstreams here]
server {
listen 80;
auth_jwt "private API";
auth_jwt_key_file jwk.json;
location / {
proxy_pass http://$upstream_api;
proxy_set_header APIclient $jwt_claim_sub;
limit_conn clientip 20;
limit_req zone=10persec;
}
}](https://image.slidesharecdn.com/apigateway-nginxway-171201102108/75/API-Gateway-Nginx-way-31-2048.jpg)
![Request tracing
32
# conf.d/api_gateway.conf
#[upstreams here]
server {
listen 80;
location / {
proxy_pass http://$upstream_api;
proxy_set_header RequestID $http_requestid;
}
}
# Secure Proxy
server {
listen 443 ssl;
#ssl_* # TLS configuration
proxy_set_header RequestID $request_id;
proxy_pass http://api_gateway;
}](https://image.slidesharecdn.com/apigateway-nginxway-171201102108/75/API-Gateway-Nginx-way-32-2048.jpg)
![Authentication
(API keys)
30
# conf.d/api_gateway.conf
#[upstreams here]
server {
listen 80;
location / {
if ($client_name = "") {
return 401;
}
proxy_pass http://$upstream_api;
proxy_set_header API-Client $client_name;
limit_conn clientip 20;
limit_req zone=10persec;
}
}](https://crownmelresort.com/image.slidesharecdn.com/apigateway-nginxway-171201102108/75/API-Gateway-Nginx-way-30-2048.jpg)
![Authentication
(JSON Web Token)
31
# conf.d/api_gateway.conf
#[upstreams here]
server {
listen 80;
auth_jwt "private API";
auth_jwt_key_file jwk.json;
location / {
proxy_pass http://$upstream_api;
proxy_set_header APIclient $jwt_claim_sub;
limit_conn clientip 20;
limit_req zone=10persec;
}
}](https://crownmelresort.com/image.slidesharecdn.com/apigateway-nginxway-171201102108/75/API-Gateway-Nginx-way-31-2048.jpg)
![Request tracing
32
# conf.d/api_gateway.conf
#[upstreams here]
server {
listen 80;
location / {
proxy_pass http://$upstream_api;
proxy_set_header RequestID $http_requestid;
}
}
# Secure Proxy
server {
listen 443 ssl;
#ssl_* # TLS configuration
proxy_set_header RequestID $request_id;
proxy_pass http://api_gateway;
}](https://crownmelresort.com/image.slidesharecdn.com/apigateway-nginxway-171201102108/75/API-Gateway-Nginx-way-32-2048.jpg)
Uploaded byinovia
API Gateway: Nginx way
This document discusses using NGINX as an API gateway for microservices architectures. It describes how NGINX can provide essential API gateway functions like API routing, authentication, overload protection, and request tracing in a lightweight and efficient manner. The document advocates for separating the roles of a secure proxy and API gateway to handle north-south and east-west traffic respectively. Key API gateway capabilities of NGINX like API routing, authentication using API keys or JWT, and request tracing are demonstrated with code examples.
More Related Content
Similar to API Gateway: Nginx way
API Gateway: Nginx way
- 1.
- 2. API gateway formicroservices environments - the NGINX way microservices paris 30-Nov-2017 Liam Crilly liam@nginx.com @liamcrilly
- 3. We empower creators ofthe new digital world
- 4. Source: Source informationgoes here.Source: Source information goes here. #1for the busiest sites The busiest sites choose NGINX 4 Source: W3Techs Web server ranking 20-Nov-2017
- 5. Innovators powered byNGINX 5
- 6. • NGINX v0.1published in 2004 • NGINX, Inc. founded in 2011 • NGINX Plus released in 2013 • Offices in San Francisco, Cambridge, Cork, Moscow and Singapore • 300M+ websites • 1,200+ commercial customers • 180+ employees across engineering, support, sales and marketing
- 7. Our Products NGINX Plus Theonly all-in-one load balancer, web server, application firewall and content cache. Simplify your architecture while reducing costs. NGINX Controller Centralized monitoring and management for NGINX Plus. Deploy and automate virtual load balancers with a beautiful interface and API. NGINX Unit The new, open source application server from NGINX, Inc. Lightweight, with multi- language support and an API-driven configuration. NGINX Industry-defining, open source webserver, reverse proxy and web accelerator NGINX Amplify NGINX Monitoring Made Easy: out-of-the-box graphs for NGINX and OS metrics, static analyzer and automated alerts
- 8.
- 10.
- 11. Monoliths are complex 11 •Tightly coupled to the underlying infrastructure • Nobody knows how it all works • Hard to maintain • Impossible to debug
- 12. Microservices are minimal 12 •Easily separated from underlying infrastructure • Independently managed • Easily replaced/replenished • Consistent interface Photos http://www.thedieline.com/blog/2017/1/26/a-fresh-look-at-craft-beer-cans https://www.threadless.com/product/3314/ring_pull
- 13. Microservices do onething 13 • One function • Easy to test • Easy to scale Photo http://www.thedieline.com/blog/2017/1/26/a-fresh-look-at-craft-beer-cans
- 14. Microservices do onething 14 • Avoid duplicating functionality ◦ Crypto ◦ Authentication ◦ Access Control ◦ Analytics
- 15. Microservices do onething 15 • Microservice? • Miniservice? • Mini-monolith?
- 16. But singular servicescan go bad 16
- 17. So deploy withredundancy 17 • Plan for failure • At least 2 per service • Scale independently • Scale on demand Photo: https://twitter.com/clinkbeer/status/812324082809180161
- 19. Choose complexity carefully 19 ProxyModel Fabric Model (Service Mesh)
- 20. The Goldilocks principle 20 Suitability Low High “Justright”Too simple Too complex
- 21. Router Mesh Architecture 21 SecureProxy API Gateway
- 22. Separation of duties 22 Secureproxy • North-South traffic • TLS termination • Client authentication • Centralized logging for all client-initiated requests • Request tracing injection API gateway • East-West and N-S traffic • API routing • Fine-grained access control • Rate limiting • Propagate request ID
- 23. Everyone needs an APIgateway!
- 24. API Management productslook a lot like monoliths
- 25.
- 26. API gateway functions 26 Thingsyou need • Fast proxying • API routing • Overload protection • Authentication of clients • TLS support (termination or end-to-end encryption) Things you don’t need • Digital strategy alignment • API design tools • Monetization metrics • Business value measures • Developer portals
- 27. API routing (URI mapping) 27 #conf.d/routing_map.conf map $request_uri $upstream_api { { # Pricing API "^/api/prices/.*$" pricing_api; "^/v1/pricing/.*$" pricing_api; "^/item/.*/price/.*$" pricing_api; # Partcodes API "^/api/partcodes/.*$" partcodes_api; "^/v1/partno/.*$" partcodes_api; "^/item/.*/sku/.*$" partcodes_api; # More APIs # ... }
- 28. API routing Overload protection 28 #conf.d/api_gateway.conf upstream pricing_api { server 172.16.0.1:80 max_conns=500; server 172.16.0.2:80 max_conns=500; } upstream partcodes_api { server partcodes.app.example.com resolve; } server { listen 80; location / { proxy_pass http://$upstream_api; limit_conn clientip 20; limit_req zone=10persec; } }
- 29. Authentication (API keys) 29 # conf.d/apikeys_map.conf map$http_apikey $client_name { { rL0Y20zC-Fzt72VPzMSk2A client_foo; N7UdGUp1E-RbVvZSTy1R8g client_bar; c_7_pLf2u2jkTPmEyF9uiA client_baz; OiHNcxfhRFvomZn11_YqUw client_pub; # ... }
- 30. Authentication (API keys) 30 # conf.d/api_gateway.conf #[upstreamshere] server { listen 80; location / { if ($client_name = "") { return 401; } proxy_pass http://$upstream_api; proxy_set_header API-Client $client_name; limit_conn clientip 20; limit_req zone=10persec; } }
- 31. Authentication (JSON Web Token) 31 #conf.d/api_gateway.conf #[upstreams here] server { listen 80; auth_jwt "private API"; auth_jwt_key_file jwk.json; location / { proxy_pass http://$upstream_api; proxy_set_header APIclient $jwt_claim_sub; limit_conn clientip 20; limit_req zone=10persec; } }
- 32. Request tracing 32 # conf.d/api_gateway.conf #[upstreamshere] server { listen 80; location / { proxy_pass http://$upstream_api; proxy_set_header RequestID $http_requestid; } } # Secure Proxy server { listen 443 ssl; #ssl_* # TLS configuration proxy_set_header RequestID $request_id; proxy_pass http://api_gateway; }
- 33.
- 34. If beer wasa web app…
- 35. nginx.com | @nginxnginx.com| @nginx liam@nginx.com @liamcrilly Thank you Merci