Kong网关部署研究

A叶子叶2025-04-01 8:18

目录

概述

部署kong

docker服务

kong初始化与启动

验证

部署konga

网关功能

JWT认证

若依的鉴权认证

kong的JWT支持

概述

Kong网关基于OpenResty，而OpenResty基于Nginx，Nginx本身是性能强大的方向代理与web容器，OpenResty增加Lua支持以响应式地织入业务逻辑，让其可以直接可以写业务代码了，跟上面我们提的PostgREST直接把PostgreSQL的关系表转成Rest接口，使用SQL函数与存储过程写业务代码异曲同工，常规软件架构的每一层能力都很强，都可以有深挖掘的骚操作，如果想简化架构，方法可多的是。（这样想最开始的JavaScript拿到后端的json解析后渲染也很合理了，前端/web容器/后端/数据库都可以写业务逻辑，拿CPU资源计算）

Kong网关基于OpenResty增加了插件系统、RDB持久化支持、企业级的安全监控、API管理方式、图形化管理界面、网关基础功能等特性，让它成为一款性能强悍又功能齐全的云原生网关，这里的云原生概念我觉得可以理解只是技术栈使用上比较符合云原生，网关本身就是无状态的，它的很多安全监控组件都是云原生比较适合的组件（如Prometheus，grafana等），还有API服务方式比较符合云原生管理。

部署kong

Kong需要PostgreSQL作为后端服务的，我们上篇文章已经完成了部署高可用PostgreSQL14集群，直接复用这个集群使用，但kong和konga因为是无状态的，都使用docker来部署；

docker服务

本机yum源是非正规el系统，所以使用二进制下载docker并使用service服务管理，用于部署kong和konga，两者数据状态保存在PostgreSQL中；

bash 复制代码 
[root@pgcluster-1 ~]# wget https://download.docker.com/linux/static/stable/x86_64/docker-20.10.18.tgz
[root@pgcluster-1 ~]# tar -zxvf docker-20.10.18.tgz 
[root@pgcluster-1 ~]# sudo mv docker/* /usr/bin/

# 创建docker 数据目录
mkdir -p /var/lib/docker
# 增加docker服务
[root@pgcluster-1 ~]# vim /etc/systemd/system/docker.service  

[Unit]
Description=Docker Application Container Engine
After=network.target
Wants=network-online.target
[Service]
Type=notify
# 指定 Docker 的二进制路径（确保路径正确）
ExecStart=/usr/bin/dockerd
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s SIGINT $MAINPID
PIDFile=/var/run/docker.pid
User=root
Group=root
# 设置工作目录（可选）
WorkingDirectory=/var/lib/docker
[Install]
WantedBy=multi-user.target	

# 好像只有第一个生效可以使用docker pull docker.m.daocloud.io/redis:5 测试
# insecure-registries是我的阿里docker私人镜像仓库
[root@pgcluster-1 ~]# vi /etc/docker/daemon.json
{
  "registry-mirrors": [
    "https://docker.m.daocloud.io",
    "https://docker.mirrors.ustc.edu.cn",
    "https://hub-mirror.c.163.com",
    "https://docker.imgdb.de"
  ],
  "insecure-registries": ["101.200.90.13:5000"]
}  

# 确保国际域名服务器开启
[root@node1 docker]# vi /etc/resolv.conf
nameserver 8.8.8.8
nameserver 114.114.114.114
search localdomain

# docker使用
[root@pgcluster-1 ~]# systemctl daemon-reload
[root@pgcluster-1 ~]# systemctl start docker.service 
[root@pgcluster-1 ~]# systemctl status docker.service   

[root@node1 docker]# ps -ef |grep docker
root     34541     1  1 10:51 ?        00:00:00 /usr/bin/dockerd
root     34554 34541  1 10:51 ?        00:00:00 containerd --config /var/run/docker/containerd/containerd.toml --log-level info
root     34697 33738  0 10:51 pts/0    00:00:00 grep --color=auto docker

[root@node1 docker]# docker images
REPOSITORY   TAG       IMAGE ID   CREATED   SIZE

以上完成docker服务配置，拉取kong:2.8.1版本与konga:0.14.9版本镜像：

bash 复制代码 
[root@node1 ~]# docker pull kong:3.4.2
[root@node1 ~]# docker pull konga:0.14.9

[root@node1 docker]# docker images
REPOSITORY      TAG       IMAGE ID       CREATED        SIZE
kong            latest    edd909108d5f   3 months ago   389MB
pantsel/konga   0.14.9    a3d6a03845c7   4 years ago    409MB

kong元数据准备

复用上文的高可用集群就是docker+本机host网络的部署模式，先在PostgreSQL中增加kong和konga的数据库和用户配置：

sql 复制代码 
-- 创建Kong用户及数据库
CREATE USER kong WITH PASSWORD 'kong';
CREATE DATABASE kong OWNER kong;
GRANT ALL PRIVILEGES ON DATABASE kong TO kong;

-- 创建Konga用户及数据库
CREATE USER konga WITH PASSWORD 'konga';
CREATE DATABASE konga OWNER konga;
GRANT ALL PRIVILEGES ON DATABASE konga TO konga;

kong初始化与启动

使用host网络初始化元数据表并启动kong服务，这里比较坑的地方是：kong的官方是使用一个脚本来拉取postgresql的docker镜像并启动的所以基本上所有的AI问答包括deepseek，豆包和通义都是让先启动kong再初始化数据库 ，你怀疑这一步它还给你圆起来，很离谱，就导致启动一直报错没有初始化表，AI问答分析问题能力也是有限的，实际上一定是先初始化后启动；

bash 复制代码 
初始化数据库
[root@node1 docker]# docker run -it --rm --network host \
> -e "KONG_DATABASE=postgres" \
> -e "KONG_PG_HOST=100.3.254.212" \
> -e "KONG_PG_PORT=5432" \
> -e "KONG_PG_USER=kong" \
> -e "KONG_PG_PASSWORD=kong" \
> -e "KONG_PG_DATABASE=kong" \
> kong:3.4.2 kong migrations bootstrap

2025/03/31 08:06:58 [warn] ulimit is currently set to "1024". For better performance set it to at least "4096" using "ulimit -n"
2025/03/31 08:06:58 [warn] ulimit is currently set to "1024". For better performance set it to at least "4096" using "ulimit -n"
Bootstrapping database...
migrating core on database 'kong'...
core migrated up to: 000_base (executed)
core migrated up to: 003_100_to_110 (executed)
core migrated up to: 004_110_to_120 (executed)
core migrated up to: 005_120_to_130 (executed)
core migrated up to: 006_130_to_140 (executed)
core migrated up to: 007_140_to_150 (executed)
core migrated up to: 008_150_to_200 (executed)
core migrated up to: 009_200_to_210 (executed)
core migrated up to: 010_210_to_211 (executed)
core migrated up to: 011_212_to_213 (executed)
core migrated up to: 012_213_to_220 (executed)
core migrated up to: 013_220_to_230 (executed)
core migrated up to: 014_230_to_270 (executed)
core migrated up to: 015_270_to_280 (executed)
core migrated up to: 016_280_to_300 (executed)
core migrated up to: 017_300_to_310 (executed)
core migrated up to: 018_310_to_320 (executed)
core migrated up to: 019_320_to_330 (executed)
core migrated up to: 020_330_to_340 (executed)
migrating acl on database 'kong'...
acl migrated up to: 000_base_acl (executed)
acl migrated up to: 002_130_to_140 (executed)
acl migrated up to: 003_200_to_210 (executed)
acl migrated up to: 004_212_to_213 (executed)
migrating acme on database 'kong'...
acme migrated up to: 000_base_acme (executed)
acme migrated up to: 001_280_to_300 (executed)
acme migrated up to: 002_320_to_330 (executed)
migrating basic-auth on database 'kong'...
basic-auth migrated up to: 000_base_basic_auth (executed)
basic-auth migrated up to: 002_130_to_140 (executed)
basic-auth migrated up to: 003_200_to_210 (executed)
migrating bot-detection on database 'kong'...
bot-detection migrated up to: 001_200_to_210 (executed)
migrating hmac-auth on database 'kong'...
hmac-auth migrated up to: 000_base_hmac_auth (executed)
hmac-auth migrated up to: 002_130_to_140 (executed)
hmac-auth migrated up to: 003_200_to_210 (executed)
migrating http-log on database 'kong'...
http-log migrated up to: 001_280_to_300 (executed)
migrating ip-restriction on database 'kong'...
ip-restriction migrated up to: 001_200_to_210 (executed)
migrating jwt on database 'kong'...
jwt migrated up to: 000_base_jwt (executed)
jwt migrated up to: 002_130_to_140 (executed)
jwt migrated up to: 003_200_to_210 (executed)
migrating key-auth on database 'kong'...
key-auth migrated up to: 000_base_key_auth (executed)
key-auth migrated up to: 002_130_to_140 (executed)
key-auth migrated up to: 003_200_to_210 (executed)
key-auth migrated up to: 004_320_to_330 (executed)
migrating oauth2 on database 'kong'...
oauth2 migrated up to: 000_base_oauth2 (executed)
oauth2 migrated up to: 003_130_to_140 (executed)
oauth2 migrated up to: 004_200_to_210 (executed)
oauth2 migrated up to: 005_210_to_211 (executed)
oauth2 migrated up to: 006_320_to_330 (executed)
oauth2 migrated up to: 007_320_to_330 (executed)
migrating post-function on database 'kong'...
post-function migrated up to: 001_280_to_300 (executed)
migrating pre-function on database 'kong'...
pre-function migrated up to: 001_280_to_300 (executed)
migrating rate-limiting on database 'kong'...
rate-limiting migrated up to: 000_base_rate_limiting (executed)
rate-limiting migrated up to: 003_10_to_112 (executed)
rate-limiting migrated up to: 004_200_to_210 (executed)
rate-limiting migrated up to: 005_320_to_330 (executed)
migrating response-ratelimiting on database 'kong'...
response-ratelimiting migrated up to: 000_base_response_rate_limiting (executed)
migrating session on database 'kong'...
session migrated up to: 000_base_session (executed)
session migrated up to: 001_add_ttl_index (executed)
session migrated up to: 002_320_to_330 (executed)
58 migrations processed
58 executed
Database is up-to-date
# 启动kong
[root@node1 docker]# docker run -d --name kong \
>   --network host \
>   -e "KONG_DATABASE=postgres" \
>   -e "KONG_PG_HOST=100.3.254.212" \
>   -e "KONG_PG_PORT=5432" \
>   -e "KONG_PG_USER=kong" \
>   -e "KONG_PG_PASSWORD=kong" \
>   -e "KONG_PG_DATABASE=kong" \
>   -e "KONG_PROXY_ACCESS_LOG=/dev/stdout" \
>   -e "KONG_ADMIN_ACCESS_LOG=/dev/stdout" \
>   -e "KONG_PROXY_ERROR_LOG=/dev/stderr" \
>   -e "KONG_ADMIN_ERROR_LOG=/dev/stderr" \
>   -e "KONG_ADMIN_LISTEN=0.0.0.0:8001, 0.0.0.0:8444 ssl" \
>   kong:3.4.2 
7b9f6f62b3c0160aa298af4e3d97147631365f9c03f44a7d036a3292deab7023
[root@node1 docker]# docker ps -a
CONTAINER ID   IMAGE        COMMAND                  CREATED         STATUS                            PORTS     NAMES
7b9f6f62b3c0   kong:3.4.2   "/docker-entrypoint...."   4 seconds ago   Up 3 seconds (health: starting)             kong

kong的元数据初始化后的表 ：

验证

docker的logs正常且能够提供API服务表明网关服务是ok的，因为开放了8001端口和8004的https端口这里可以直接拿到版本相关信息；

bash 复制代码 
[root@node1 docker]# curl -i http://localhost:8001/
HTTP/1.1 200 OK
Date: Mon, 31 Mar 2025 08:20:11 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Content-Length: 14644
X-Kong-Admin-Latency: 6
Server: kong/3.4.2

部署konga

konga的docker最新latest版本实际上是0.14.9，不支持PostgreSQL，这里不再配置了，会报错：

bash 复制代码 
[root@node1 ~]#   docker run --rm --network host pantsel/konga:latest  -c prepare -a postgres -u postgresql://konga:[email protected]:5432/konga
debug: Preparing database...
Using postgres DB Adapter.
Database exists. Continue...
error: A hook (`orm`) failed to load!
error: Failed to prepare database: error: column r.consrc does not exist
    at Connection.parseE (/app/node_modules/sails-postgresql/node_modules/pg/lib/connection.js:539:11)
    at Connection.parseMessage (/app/node_modules/sails-postgresql/node_modules/pg/lib/connection.js:366:17)
    at Socket.<anonymous> (/app/node_modules/sails-postgresql/node_modules/pg/lib/connection.js:105:22)
    at Socket.emit (events.js:310:20)
    at Socket.EventEmitter.emit (domain.js:482:12)
    at addChunk (_stream_readable.js:286:12)
    at readableAddChunk (_stream_readable.js:268:9)
    at Socket.Readable.push (_stream_readable.js:209:10)
    at TCP.onStreamRead (internal/stream_base_commons.js:186:23)

网关功能

以上kong部署完成，下面进行kong的网关功能测试，包括基本的JWT使用测试与限流、转发配置等，这里主要关注JWT规范使用，并考虑如何迁移到kong上；

JWT认证

JWT（JSON Web Token） 本身是标准的规范化流程，用于在网络中安全传输信息，核心由 三部分 组成，通过 . 分隔，格式为：Header.Payload.Signature，比如：

bash 复制代码 
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
若依的鉴权认证

首先回忆下若依框架（Ruoyi）的认证流程，其结合了 JWT 和 Redis 缓存 ，同时基于 Spring Security 的安全框架实现的，若依的登录和认证流程如下：

java 复制代码 
用户登录页面
   ↓ 提交登录请求
验证验证码（服务端）
   ↓ 成功？是 → 验证用户信息
查询用户信息（数据库）
   ↓ 验证密码 & 状态
生成JWT & UUID（TokenService）
   ↓ 存储用户信息到Redis（Key=UUID）
返回Token给前端
   ↓ 前端存储Token
用户请求（携带Token）
   ↓ 拦截器拦截请求（JwtAuthenticationTokenFilter）
解析Token → 获取UUID
   ↓ 查询Redis（Key=UUID）
Redis存在用户信息？
   ↓ 是 → 提取用户权限
存入SecurityContext → 权限校验 → 放行请求
   ↓ 否 → 返回Token无效

登录接口/login做了几件事：

①验证码、验证、账号密码及ip相关合法性；

②进行UUID生成并放入redis当做状态；

③spring-security标准逻辑；

④按照jwt规范生成token并返回；

java 复制代码 
// login过程
    @PostMapping("/login")
    public AjaxResult login(@RequestBody LoginBody loginBody)
    {
        AjaxResult ajax = AjaxResult.success();
        // 生成令牌
        String token = loginService.login(loginBody.getUsername(), loginBody.getPassword(), loginBody.getCode(),
                loginBody.getUuid());
        ajax.put(Constants.TOKEN, token);
        return ajax;
    }

// login方法
    public String login(String username, String password, String code, String uuid)
    {
        // ............ 各种校验
        AsyncManager.me().execute(AsyncFactory.recordLogininfor(username, Constants.LOGIN_SUCCESS, MessageUtils.message("user.login.success")));
        LoginUser loginUser = (LoginUser) authentication.getPrincipal();
        recordLoginInfo(loginUser.getUserId());
        // 生成token
        return tokenService.createToken(loginUser);
    }


// 创建token代码
    public String createToken(LoginUser loginUser)
    {
        String token = IdUtils.fastUUID();
        loginUser.setToken(token);
        setUserAgent(loginUser);
        //放入redis
        refreshToken(loginUser);

        Map<String, Object> claims = new HashMap<>();
        claims.put(Constants.LOGIN_USER_KEY, token);
        return createToken(claims);
    }

// jwt方法
    private String createToken(Map<String, Object> claims)
    {
        String token = Jwts.builder()
                .setClaims(claims)
                .signWith(SignatureAlgorithm.HS512, secret).compact();
        return token;
    }

而通用的接口到达后端服务进程后，会进入JwtAuthenticationTokenFilter过滤器，做了几件事：

①拦截拿到token；

②从token中解析出来uuid，并从redis拿用户信息；

③拿到用户信息后塞入spring-security的上下文，后续还要用；

java 复制代码 
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception
    {
        // spring-security逻辑
        httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class);
        httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class);
    }

// JwtAuthenticationTokenFilter 过滤器逻辑
@Component
public class JwtAuthenticationTokenFilter extends OncePerRequestFilter
{
    @Autowired
    private TokenService tokenService;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException
    {
        LoginUser loginUser = tokenService.getLoginUser(request);
        if (StringUtils.isNotNull(loginUser) && StringUtils.isNull(SecurityUtils.getAuthentication()))
        {
            tokenService.verifyToken(loginUser);
            UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(loginUser, null, loginUser.getAuthorities());
            authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
            SecurityContextHolder.getContext().setAuthentication(authenticationToken);
        }
        chain.doFilter(request, response);
    }
}

// 这里获取uuid并从redis拿到token，拿不到说明超时
    public LoginUser getLoginUser(HttpServletRequest request)
    {
        // 获取请求携带的令牌
        String token = getToken(request);
        if (StringUtils.isNotEmpty(token))
        {
            try
            {
                Claims claims = parseToken(token);
                // 解析对应的权限以及用户信息
                String uuid = (String) claims.get(Constants.LOGIN_USER_KEY);
                String userKey = getTokenKey(uuid);
                LoginUser user = redisCache.getCacheObject(userKey);
                return user;
            }
            catch (Exception e)
            {
                log.error("获取用户信息异常'{}'", e.getMessage());
            }
        }
        return null;
    }

// 验证令牌有效期，相差不足20分钟，自动刷新缓存
    public void verifyToken(LoginUser loginUser)
    {
        long expireTime = loginUser.getExpireTime();
        long currentTime = System.currentTimeMillis();
        if (expireTime - currentTime <= MILLIS_MINUTE_TEN)
        {
            refreshToken(loginUser);
        }
    }

从上面流程看出来，微服务化后登录接口是统一的且是所有服务共享的，登录login后拿到token放入浏览器后，其他服务只管携带浏览器存放在的token后，在网关层进行鉴权即可；

kong的JWT支持

接下来模拟真实业务来实现kong的JWT支持流程，熟悉kong的使用流程，直接上AI，使用python写个测试demo；

以下是实现代码：

python 复制代码 
[root@node1 ~]# cat kong_jwt_demo.py 
# -*- coding: utf-8 -*-
import requests
import jwt
import time

# Kong Admin API 地址
KONG_ADMIN_URL = "http://localhost:8001"
# Kong 代理地址
KONG_PROXY_URL = "http://localhost:8000"

# 创建服务
def create_service():
    timestamp = int(time.time())
    service_name = f"example-service-{timestamp}"
    service_data = {
        "name": service_name,
        "url": "http://httpbin.org"
    }
    response = requests.post(f"{KONG_ADMIN_URL}/services", data=service_data)
    if response.status_code == 201:
        print("服务创建成功")
        return response.json()
    else:
        print(f"服务创建失败: {response.text}")
        return None

# 创建路由
def create_route(service_id):
    route_data = {
        "paths[]": "/example"
    }
    response = requests.post(f"{KONG_ADMIN_URL}/services/{service_id}/routes", data=route_data)
    if response.status_code == 201:
        print("路由创建成功")
        return response.json()
    else:
        print(f"路由创建失败: {response.text}")
        return None

# 创建消费者
def create_consumer():
    timestamp = int(time.time())
    consumer_name = f"test-consumer-{timestamp}"
    consumer_data = {
        "username": consumer_name
    }
    response = requests.post(f"{KONG_ADMIN_URL}/consumers", data=consumer_data)
    if response.status_code == 201:
        print("消费者创建成功")
        return response.json()
    else:
        print(f"消费者创建失败: {response.text}")
        return None

# 为消费者创建 JWT 凭证
def create_jwt_credential(consumer_id):
    response = requests.post(f"{KONG_ADMIN_URL}/consumers/{consumer_id}/jwt")
    if response.status_code == 201:
        print("JWT 凭证创建成功")
        return response.json()
    else:
        print(f"JWT 凭证创建失败: {response.text}")
        return None

# 启用 JWT 插件
def enable_jwt_plugin(service_id):
    plugin_data = {
        "name": "jwt"
    }
    response = requests.post(f"{KONG_ADMIN_URL}/services/{service_id}/plugins", data=plugin_data)
    if response.status_code == 201:
        print("JWT 插件启用成功")
        return response.json()
    else:
        print(f"JWT 插件启用失败: {response.text}")
        return None

# 生成 JWT
def generate_jwt(key, secret):
    payload = {
        "iss": key,
        "iat": int(time.time()),
        "exp": int(time.time()) + 3600
    }
    token = jwt.encode(payload, secret, algorithm="HS256")
    return token

# 发送带 JWT 的请求
def send_request_with_jwt(token):
    headers = {
        "Authorization": f"Bearer {token}"
    }
    response = requests.get(f"{KONG_PROXY_URL}/example", headers=headers)
    if response.status_code == 200:
        print("请求成功，JWT 验证通过")
        print(response.text)
    else:
        print(f"请求失败，状态码: {response.status_code}，错误信息: {response.text}")

if __name__ == "__main__":
    # 创建服务
    service = create_service()
    if service:
        service_id = service["id"]
        # 创建路由
        route = create_route(service_id)
        if route:
            # 创建消费者
            consumer = create_consumer()
            if consumer:
                consumer_id = consumer["id"]
                # 为消费者创建 JWT 凭证
                jwt_credential = create_jwt_credential(consumer_id)
                if jwt_credential:
                    key = jwt_credential["key"]
                    secret = jwt_credential["secret"]
                    # 启用 JWT 插件
                    enable_jwt_plugin(service_id)
                    # 生成 JWT
                    token = generate_jwt(key, secret)
                    # 发送带 JWT 的请求
                    send_request_with_jwt(token)

kong网关的其他功能，后续待研究；

相关推荐
Tiger_shl13 分钟前
【Python语言基础】24、并发编程
java·数据库·python
<<19 分钟前
基于Django的权限管理平台
后端·python·django
QMT量化交易42 分钟前
如何解决PyQt从主窗口打开新窗口时出现闪退的问题
python·pyqt
databook1 小时前
『Plotly实战指南』--样式定制高级篇
python·数据分析·数据可视化
bing_1581 小时前
Redis 的单线程模型对微服务意味着什么？需要注意哪些潜在瓶颈？
数据库·redis·微服务
basketball6162 小时前
Python torchvision.transforms 下常用图像处理方法
开发语言·图像处理·python
兔子蟹子2 小时前
Java集合框架解析
java·windows·python
宁酱醇2 小时前
各种各样的bug合集
开发语言·笔记·python·gitlab·bug
谷晓光2 小时前
Python 中 `r` 前缀：字符串处理的“防转义利器”
开发语言·python
姚毛毛2 小时前
Windows上，10分钟构建一个本地知识库
python·ai·rag
热门推荐
01从零安装 LLaMA-Factory 微调 Qwen 大模型成功及所有的坑02KGG转MP3工具|非KGM文件|解密音频03我决定放弃搞 Java 了04✨分享我在飞书多维表格中使用DeepSeek的经历✨05YOLOv8入门 | 重要性能衡量指标、训练结果评价及分析及影响mAP的因素【发论文关注的指标】06苍穹外卖面试总结07Coze扣子平台完整体验和实践（附国内和国际版对比）08yolov8，yolo11，yolo12 服务器训练到部署全流程 笔记09DeepSeek各版本说明与优缺点分析10如何在WPS和Word/Excel中直接使用DeepSeek功能