day25 : kong api gateway(下)

kong的安装我同样会透过operator的方式进行，相信经过了这几天应该很多人都感受到operator的优势

安装方式

git clone https://github.com/Kong/kong-operator.git
kubectl apply -f kong-operator/deploy/
kubectl apply -f kong-operator/deploy/operator/
kubectl apply -f kong-operator/deploy/crds/

并且会有一个loadbalance的入口

在配置完成kong的基本设定後，就可以开始尝试配置服务给kong罗，另外因为要与istio整合要记得在kong 的namespaces中加入istio-injection=enabled，然後开始玩看看罗

配置一个kong的入口

kubectl create -f - <<EOF
apiVersion: charts.helm.k8s.io/v1alpha1
kind: Kong
metadata:
  name: example-kong
spec:
  proxy:
    type: NodePort
  env:
    prefix: /kong_prefix/
  resources:
    limits:
      cpu: 500m
      memory: 2G
    requests:
      cpu: 100m
      memory: 512Mi
  ingressController:
    enabled: true
    ingressClass: example-ingress-class
    installCRDs: false
EOF

做一个验证用的服务

kubectl apply -f https://bit.ly/echo-service

kubectl create -f - <<EOF
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: demo-foo
  annotations:
    # Note that the annotation below is deprecated as of Kubernetes 1.18
    # in favor of the new spec.ingressClassName field. At the moment of writing
    # (Kong Ingress Controller v0.9.0), Kong Ingress Controller does not support
    # the new format yet.
    kubernetes.io/ingress.class: example-ingress-class
spec:
  rules:
  - http:
      paths:
      - path: /foo
        backend:
          serviceName: echo
          servicePort: 8080
-- -
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: demo-bar
  annotations:
    kubernetes.io/ingress.class: example-ingress-class
    konghq.com/plugins: request-id
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /bar
        backend:
          serviceName: echo
          servicePort: 80
EOF

这样就可以透过kong ingress进来罗

PROXY_IP=$(kubectl get service example-kong-kong-proxy -o jsonpath={.spec.clusterIP})
curl http://$PROXY_IP/foo/
curl -i -H "Host: example.com" $PROXY_IP/bar/sample

接着可以对echo service加一些限制功能看看
加入rate limit

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: limit-by-ip
config:
  minute: 5
  limit_by: ip
  policy: local
plugin: rate-limiting

kubectl patch svc echo  -p '{"metadata":{"annotations":{"konghq.com/plugins": “limit-by-ip\n"}}}'

再重新curl一次就会发现有多了limit的讯息罗。

如果没有想要透过operator的方式配置kong，官方也有两种配置方法可以参考，其一是在外部主机用docker-compose的方式简易的启动kong服务，另一个同样是在k8s上配置kong yaml如下

kubectl apply -f "https://raw.githubusercontent.com/Kong/kubernetes-ingress-controller/main/deploy/single-v2/all-in-one-dbless.yaml"

这个方法相对於使用operator简单好理解一点。

kong在https://github.com/Kong/kong-operator/tree/main/helm-charts/kong/example-values 的页面中也有属於enterprise的布署，我认为enterprise有介面可以让使用者更好上手，如果不想用enterprise但是又想要有介面的话其实也可以玩看看konga这个专案。