Roll Your Own API Management Platform with nginx and Lua
•
18 j'aime•47,423 vues
We recently replaced a proprietary API management solution with an in-house implementation built with nginx and Lua that let us get to a continuous delivery practice in a handful of months. Learn about our development process and the overall architecture that allowed us to write minimal amounts of code, enjoying native code performance while permitting interactive codeing, and how we leveraged other open source tools like Vagrant, Ansible, and OpenStack to build an automation-rich delivery pipeline. We will also take an in-depth look at our capacity management approach that differs from the rate limiting concept prevalent in the API community.
Recommandé
Contenu connexe
Tendances
Tendances (20)
En vedette
En vedette (20)
Similaire à Roll Your Own API Management Platform with nginx and Lua
Similaire à Roll Your Own API Management Platform with nginx and Lua (20)
Dernier
Dernier (20)
Roll Your Own API Management Platform with nginx and Lua
- 1. Roll Your Own API Management Platform with nginx and Lua Jon Moore Senior Fellow, Comcast Cable @jon_moore
- 6. Lua
- 9. --- Validates the OAuth signature! -- @return Const.HTTP_UNAUTHORIZED if either the key or signature is invalid! -- this method is internal and should not be called directly! function _M.validate_signature(self)! local headers = self.req.get_oauth_params()! local key = headers[Const.OAUTH_CONSUMER_KEY]! local keyconf = self.conf.keys[key]! if keyconf == nil then! return {! code = Const.HTTP_UNAUTHORIZED! error = Const.ERROR_INVALID_CONSUMER_KEY! }! end! ! local sig = get_hmac_signature(self.req, keyconf.secret)! if sig ~= headers[Const.OAUTH_SIGNATURE] then! return {! code = Const.HTTP_UNAUTHORIZED,! error = Const.ERROR_INVALID_SIGNATURE! }! end! end!
- 10. Lua < 3k LOC
- 11. testing
- 12. function TestOAuth1:test_reject_request_when_signature_invalid()! local header = Header:new()! header[Const.OAUTH_SIGNATURE] = “invalid”! local req = Req:new({oauth_params = header })! local conf = Conf:new()! local oauth = OAuth1:new(conf, req)! ! local res = oauth:authorize()! assertEquals(res.code, Const.HTTP_UNAUTHORIZED)! assertEquals(res.error, Const.ERROR_INVALID_SIGNATURE)! end! ! lu = LuaUnit.new()! Lu:setOutputType(“tap”)! os.exit(lu:runSuite())!
- 16. function get_oauth_params_from_auth_header(env)! env = env or ngx! local auth_hdrs = env.req.get_headers()[“Authorization”]! ...!
- 17. function get_oauth_params_from_auth_header(env)! env = env or ngx! local auth_hdrs = env.req.get_headers()[“Authorization”]! ...!
- 18. function get_oauth_params_from_auth_header(env)! env = env or ngx! local auth_hdrs = env.req.get_headers()[“Authorization”]! ...!
- 19. function TestRequest:test_retrieve_oauth_params_from_header()! local header = [[Oauth realm=“example.com”, ]]! .. [[oauth_consumer_key=“mykey”,]]! .. [[oauth_version=“1.0”]]! local ngx = StubNgx:new({ Authorization = header })! local res = get_oauth_params_from_auth_header(ngx)! assertEquals(“1.0”, res.oauth_version)! ...!
- 20. function TestRequest:test_retrieve_oauth_params_from_header()! local header = [[Oauth realm=“example.com”, ]]! .. [[oauth_consumer_key=“mykey”,]]! .. [[oauth_version=“1.0”]]! local ngx = StubNgx:new({ Authorization = header })! local res = get_oauth_params_from_auth_header(ngx)! assertEquals(“1.0”, res.oauth_version)! ...!
- 21. function TestRequest:test_retrieve_oauth_params_from_header()! local header = [[Oauth realm=“example.com”, ]]! .. [[oauth_consumer_key=“mykey”,]]! .. [[oauth_version=“1.0”]]! local ngx = StubNgx:new({ Authorization = header })! local res = get_oauth_params_from_auth_header(ngx)! assertEquals(“1.0”, res.oauth_version)! ...!
- 22. function TestRequest:test_retrieve_oauth_params_from_header()! local header = [[Oauth realm=“example.com”, ]]! .. [[oauth_consumer_key=“mykey”,]]! .. [[oauth_version=“1.0”]]! local ngx = StubNgx:new({ Authorization = header })! local res = get_oauth_params_from_auth_header(ngx)! assertEquals(“1.0”, res.oauth_version)! ...!
- 23. function TestRequest:test_retrieve_oauth_params_from_header()! local header = [[Oauth realm=“example.com”, ]]! .. [[oauth_consumer_key=“mykey”,]]! .. [[oauth_version=“1.0”]]! local ngx = StubNgx:new({ Authorization = header })! local res = get_oauth_params_from_auth_header(ngx)! assertEquals(“1.0”, res.oauth_version)! ...!
- 26. test harness
- 31. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 32. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 33. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 34. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 35. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 36. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 37. def spec_using_valid_oauth_credentials(self, harness)! auth = OAuth1(“mykey”, “mysecret”)! body_data = “{‘function’: ‘tick’}”! harness.reset_data()! response = requests.post(root_url, data=body_data, auth=auth,! headers={‘Content-Type’:! ‘application/json’})! assert response.status_code == 200! assert “Authorization” in harness.forwarded_headers! assert “Oauth” in harness.forwarded_headers[“Authorization”]! assert harness.forwarded_body == body_data!
- 39. N = XR # concurrent requests transaction rate response time
- 41. API Mgmt client origin 1s2 req/s N = XR = 2 req/s × 1s = 2 req
- 42. API Mgmt client origin 1s2 req/s N = XR = 2 req/s × 1s = 2 req
- 43. API Mgmt client origin 1s2 req/s N = XR = 2 req/s × 1s = 2 req
- 44. API Mgmt client origin 1s2 req/s N = XR = 2 req/s × 1s = 2 req
- 45. API Mgmt client origin 1s2 req/s N = XR = 2 req/s × 1s = 2 req
- 47. API Mgmt client origin 10s2 req/s N = XR = 2 req/s × 10s = 20 req
- 48. API Mgmt client origin 10s2 req/s N = XR = 2 req/s × 10s = 20 req
- 49. API Mgmt client origin 10s2 req/s N = XR = 2 req/s × 10s = 20 req
- 50. API Mgmt client origin 10s2 req/s N = XR = 2 req/s × 10s = 20 req
- 51. API Mgmt client origin 10s2 req/s N = XR = 2 req/s × 10s = 20 req
- 52. API Mgmt client origin 10s2 req/s N = XR = 2 req/s × 10s = 20 req
- 53. API Mgmt client origin 10s2 req/s ✗ N = XR = 2 req/s × 10s = 20 req
- 54. API Mgmt client origin 10s2 req/s ✗ ✗ N = XR = 2 req/s × 10s = 20 req
- 56. deployment
- 59. architecture
- 60. HAProxy HAProxy VIP . . . <API>
- 61. DC1 DC2 DC3 VIP VIP VIP entry-vip-dc1. A 10.1.0.1! <foo> <foo> <bar> <bar> foo-dc1. CNAME entry-vip-dc1.! foo. CNAME foo-dc1.! (GSLB) entry-vip-dc2. A 10.2.0.1! entry-vip-dc3. A 10.3.0.1!
- 62. DC1 DC2 DC3 VIP VIP VIP entry-vip-dc1. A 10.1.0.1! <foo> <foo> <bar> <bar> foo-dc1. CNAME entry-vip-dc1.! foo. CNAME foo-dc1.! (GSLB) entry-vip-dc2. A 10.2.0.1! entry-vip-dc3. A 10.3.0.1!
- 63. DC1 DC2 DC3 VIP VIP VIP entry-vip-dc1. A 10.1.0.1! <foo> <foo> <bar> <bar> foo-dc1. CNAME entry-vip-dc1.! foo. CNAME foo-dc1.! (GSLB) entry-vip-dc2. A 10.2.0.1! entry-vip-dc3. A 10.3.0.1!
- 64. DC1 DC2 DC3 VIP VIP VIP entry-vip-dc1. A 10.1.0.1! <foo> <foo> <bar> <bar> foo-dc1. CNAME entry-vip-dc1.! foo. CNAME foo-dc1.! (GSLB) entry-vip-dc2. A 10.2.0.1! entry-vip-dc3. A 10.3.0.1!
- 65. DC1 DC2 DC3 VIP VIP VIP entry-vip-dc1. A 10.1.0.1! <foo> <foo> <bar> <bar> foo-dc1. CNAME entry-vip-dc1.! foo. CNAME foo-dc1.! (GSLB) entry-vip-dc2. A 10.2.0.1! entry-vip-dc3. A 10.3.0.1!
- 66. DC1 DC2 DC3 VIP VIP VIP entry-vip-dc1. A 10.1.0.1! <foo> <foo> <bar> <bar> foo-dc1. CNAME entry-vip-dc1.! foo. CNAME foo-dc1.! (GSLB) entry-vip-dc2. A 10.2.0.1! entry-vip-dc3. A 10.3.0.1!
- 67. Roll Your Own API Management with nginx and Lua • nginx + Lua => great for HTTP middleware with a small amount of custom logic • Automated test and deployment pipeline with Vagrant, Python, and Ansible • Concurrent request limiting, not rate limiting • Network architecture with operational flexibility Presentation title (optional)67