API 网关实战：Kong、Envoy 与 Traefik 选型与部署

_format_version: "3.0"
services:
  - name: user-service
    url: http://user-api:8080
    routes:
      - name: user-routes
        paths: [/api/v1/users]
    plugins:
      - name: rate-limiting
        config:
          minute: 100
          policy: redis
          redis_host: redis
      - name: jwt
consumers:
  - username: mobile-app
    jwt_secrets:
      - key: mobile-issuer
        secret: "your-256-bit-secret"

export KONG_DATABASE=off
export KONG_DECLARATIVE_CONFIG=/path/to/kong.yml
kong start

# 创建服务
curl -X POST http://localhost:8001/services \
  --data name=order-service \
  --data url=http://order-api:8080

# 添加路由
curl -X POST http://localhost:8001/services/order-service/routes \
  --data 'paths[]=/api/v1/orders'

# 启用 Redis 限流（全局）
curl -X POST http://localhost:8001/plugins \
  --data name=rate-limiting \
  --data config.minute=200 \
  --data config.policy=redis \
  --data config.redis_host=redis

# 启用 JWT
curl -X POST http://localhost:8001/plugins --data name=jwt

# 为消费者创建 JWT Credentials
curl -X POST http://localhost:8001/consumers/web-app/jwt \
  --data key=web-issuer \
  --data secret="super-secret-key"

plugins:
  - name: rate-limiting
    config:
      minute: 120
      hour: 3000
      policy: redis
      redis_host: redis
      redis_timeout: 2000
      fault_tolerant: true  # Redis 故障时不过度拒绝

curl -X POST http://localhost:8001/plugins \
  --data name=key-auth \
  --data config.key_names=apikey \
  --data config.hide_credentials=true

curl -X POST http://localhost:8001/consumers/mobile-app/key-auth \
  --data key=ak_prod_2026_xyz789

plugins:
  - name: request-transformer
    config:
      add:
        headers: ["X-Request-ID:$(request_id)"]
      remove:
        headers: [X-Internal-Token]

curl -X POST http://localhost:8001/plugins \
  --data name=oauth2 \
  --data config.scopes=read,write \
  --data config.mandatory_scope=true \
  --data config.enable_authorization_code=true

curl -X POST http://localhost:8001/consumers/partner-app/oauth2 \
  --data name="Partner Portal" \
  --data client_id=partner_client_001 \
  --data redirect_uris[]="https://partner.example.com/callback"

package main

import (
    "github.com/Kong/go-pdk"
    "github.com/Kong/go-pdk/server"
)

type CustomAuthConfig struct {
    HeaderName string `json:"header_name"`
    Secret     string `json:"secret"`
}

type CustomAuth struct{ Config CustomAuthConfig }

func New() interface{} { return &CustomAuth{} }

func (conf *CustomAuth) Access(kong *pdk.PDK) error {
    header, err := kong.Request.GetHeader(conf.Config.HeaderName)
    if err != nil || header != conf.Config.Secret {
        kong.Response.Exit(401, `{"error":"unauthorized"}`, nil)
        return nil
    }
    kong.ServiceRequest.SetHeader("X-Auth-Verified", "true")
    return nil
}

func main() {
    server.StartServer(New, "0.1.0", 1)
}

static_resources:
  listeners:
    - name: http_listener
      address:
        socket_address: { address: 0.0.0.0, port_value: 8080 }
      filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: ingress_http
                route_config:
                  name: local_route
                  virtual_hosts:
                    - name: backend
                      domains: ["*"]
                      routes:
                        - match: { prefix: "/api/v1/users" }
                          route:
                            cluster: user_service
                            retry_policy:
                              retry_on: "gateway-error,connect-failure"
                              num_retries: 3
                              per_try_timeout: 5s
                http_filters:
                  - name: envoy.filters.http.lua
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
                      inline_code: |
                        function envoy_on_request(request_handle)
                          request_handle:headers():add("X-Envoy-Lua", "injected")
                        end
                  - name: envoy.filters.http.router

  clusters:
    - name: user_service
      connect_timeout: 5s
      type: STRICT_DNS
      lb_policy: ROUND_ROBIN
      health_checks:
        - timeout: 5s
          interval: 10s
          unhealthy_threshold: 3
          healthy_threshold: 2
          http_health_check: { path: "/healthz" }
      load_assignment:
        cluster_name: user_service
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address: { address: user-api, port_value: 8080 }

    - name: order_service
      connect_timeout: 5s
      type: STRICT_DNS
      lb_policy: LEAST_REQUEST
      circuit_breakers:
        thresholds:
          - priority: DEFAULT
            max_connections: 1000
            max_pending_requests: 1000
            max_requests: 1000
            max_retries: 3
      load_assignment:
        cluster_name: order_service
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address: { address: order-api, port_value: 8080 }

admin:
  address:
    socket_address: { address: 0.0.0.0, port_value: 9901 }

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: user-service-vs
spec:
  hosts:
    - user-service
  http:
    - match:
        - uri:
            prefix: /api/v1/users
      route:
        - destination:
            host: user-service
            subset: v1
          weight: 90
        - destination:
            host: user-service
            subset: v2
          weight: 10
      retries:
        attempts: 3
        perTryTimeout: 5s
        retryOn: gateway-error,connect-failure
      timeout: 15s
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: user-service-dr
spec:
  host: user-service
  trafficPolicy:
    outlierDetection:
      consecutiveErrors: 5
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
  subsets:
    - name: v1
      labels: { version: v1 }
    - name: v2
      labels: { version: v2 }

use proxy_wasm::traits::*;
use proxy_wasm::types::*;

#[no_mangle]
pub fn _start() {
    proxy_wasm::set_log_level(LogLevel::Debug);
    proxy_wasm::set_http_context(|_, _| -> Box<dyn HttpContext> {
        Box::new(CustomFilter)
    });
}

struct CustomFilter;
impl Context for CustomFilter {}
impl HttpContext for CustomFilter {
    fn on_http_request_headers(&mut self, _: usize, _: bool) -> Action {
        if let Some(token) = self.get_http_request_header("authorization") {
            if !token.starts_with("Bearer ") {
                self.send_http_response(401, vec![], Some(b"Unauthorized"));
                return Action::Pause;
            }
        }
        Action::Continue
    }
}

http_filters:
  - name: envoy.filters.http.graphql
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.graphql.v3.GraphQL
      schema:
        inline_string: |
          type Query { user(id: ID!): User }
          type User { id: ID! name: String! email: String! }
      execution:
        max_depth: 5
        max_cost: 1000
        enable_introspection: false

services:
  traefik:
    image: traefik:v3.1
    command:
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
      - --certificatesresolvers.letsencrypt.acme.email=admin@example.com
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt

  user-api:
    image: user-api:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.user-api.rule=Host(`api.example.com`) && PathPrefix(`/api/v1/users`)"
      - "traefik.http.routers.user-api.entrypoints=websecure"
      - "traefik.http.routers.user-api.tls.certresolver=letsencrypt"
      - "traefik.http.services.user-api.loadbalancer.server.port=8080"
      - "traefik.http.middlewares.user-ratelimit.ratelimit.average=100"
      - "traefik.http.middlewares.user-ratelimit.ratelimit.burst=200"
      - "traefik.http.routers.user-api.middlewares=user-ratelimit"

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: api-gateway
  namespace: production
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`api.example.com`) && PathPrefix(`/api/v1/users`)
      kind: Rule
      services:
        - name: user-service
          port: 8080
          healthCheck:
            path: /healthz
            interval: 10s
      middlewares:
        - name: jwt-auth
        - name: rate-limit-100
    - match: Host(`api.example.com`) && PathPrefix(`/api/v1/orders`)
      kind: Rule
      services:
        - name: order-service
          port: 8080
      middlewares:
        - name: circuit-breaker-default
  tls:
    certResolver: letsencrypt

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: rate-limit-100
spec:
  rateLimit:
    average: 100
    burst: 200
    period: 1m
    sourceCriterion:
      ipStrategy:
        depth: 1

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: circuit-breaker-default
spec:
  circuitBreaker:
    expression: |
      LatencyAtQuantileMS(50.0) > 100 ||
      ResponseCodeRatio(500, 600, 0, 600) > 0.25 ||
      NetworkErrorRatio() > 0.5

certificatesResolvers:
  letsencrypt:
    acme:
      email: admin@example.com
      storage: /letsencrypt/acme.json
      tlsChallenge: {}

api:
  dashboard: true
  insecure: false

metrics:
  prometheus:
    addEntryPointsLabels: true
    addServicesLabels: true
    addRoutersLabels: true
    buckets: [0.1, 0.3, 1.2, 5.0]

supergraph:
  listen: 0.0.0.0:4000
  introspection: false

telemetry:
  exporters:
    metrics:
      prometheus:
        enabled: true
        listen: 0.0.0.0:9090
    tracing:
      otlp:
        endpoint: http://jaeger:4317

plugins:
  experimental.limit:
    max_depth: 10
    max_height: 100
    max_aliases: 15
    max_root_fields: 5

cors:
  origins: ["https://app.example.com"]
  allow_credentials: true

http_filters:
  - name: envoy.filters.http.local_ratelimit
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
      stat_prefix: http_local_rate_limiter
      token_bucket:
        max_tokens: 1000
        tokens_per_fill: 100
        fill_interval: 1s