Mixing
Can I replace a microservice inside of AKS k8s with smarter nginx config?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}
Question
Can I get nginx to call another microservice inside of AKS k8s prior to it routing to the requested api? - the goal being to speed up requests (fewer hops) and simplify build and deployment (fewer services).
Explanation
In our currently deployed Azure AKS (Kubernetes) cluster, we have an additional service I was hoping to replace with nginx. It's a routing microservice that calls out to a identity API prior to doing the routing.
The reason is a common one I'd imagine, we recieve some kind of authentication token via some pre-defined header(s) (the standard Authorization header, or sometimes some bespoke ones used for debug tokens, and impersonation), we call from the routing API into the identity API with those pre-defined headers and get a user identity object in return.
We then pass on this basic user identity object into the microservices so they have quick and easy access to the user and roles.
A brief explanation would be:
- Nginx receives a request, off-loads SSL and route to the requested service.
- Routing API takes the authorization headers and makes a call to the Identity API.
- Identity API validations the authorization information and returns either an authorization error (when auth fails), or a serialized user identity object.
- Router API either returns there and then, for failure, or routes to the requested microservice (by cracking the request path), and attaches the user identity object as a header.
- Requested microservice can then turn that user identity object into a Claims Principal in the case of .NET Core for example.
There are obviously options for merging the Router.API and the UserIdentity.API, but keeping the separation of concerns seems like a better move. I'd just to remove the Route.API, in-order to maintain that separation, but get nginx to do that work for me.
kubernetes microservices kubernetes-ingress azure-kubernetes nginx-ingress asked Jan 3 at 13:13
KieronKieron
15.6k1268110
add a comment |
Question
Can I get nginx to call another microservice inside of AKS k8s prior to it routing to the requested api? - the goal being to speed up requests (fewer hops) and simplify build and deployment (fewer services).
Explanation
In our currently deployed Azure AKS (Kubernetes) cluster, we have an additional service I was hoping to replace with nginx. It's a routing microservice that calls out to a identity API prior to doing the routing.
The reason is a common one I'd imagine, we recieve some kind of authentication token via some pre-defined header(s) (the standard Authorization header, or sometimes some bespoke ones used for debug tokens, and impersonation), we call from the routing API into the identity API with those pre-defined headers and get a user identity object in return.
We then pass on this basic user identity object into the microservices so they have quick and easy access to the user and roles.
A brief explanation would be:
- Nginx receives a request, off-loads SSL and route to the requested service.
- Routing API takes the authorization headers and makes a call to the Identity API.
- Identity API validations the authorization information and returns either an authorization error (when auth fails), or a serialized user identity object.
- Router API either returns there and then, for failure, or routes to the requested microservice (by cracking the request path), and attaches the user identity object as a header.
- Requested microservice can then turn that user identity object into a Claims Principal in the case of .NET Core for example.
There are obviously options for merging the Router.API and the UserIdentity.API, but keeping the separation of concerns seems like a better move. I'd just to remove the Route.API, in-order to maintain that separation, but get nginx to do that work for me.
kubernetes microservices kubernetes-ingress azure-kubernetes nginx-ingress asked Jan 3 at 13:13
KieronKieron
15.6k1268110
As I saw according to your post, I may say that’s the way how nginx works. What’s your specific issue? You’ve met some unexpected error?
– Light.G
Jan 3 at 13:22
@Light.G No error, but reducing the number of services being hit before getting to it's destination is the goal.
– Kieron
Jan 3 at 13:23
add a comment |
Question
Can I get nginx to call another microservice inside of AKS k8s prior to it routing to the requested api? - the goal being to speed up requests (fewer hops) and simplify build and deployment (fewer services).
Explanation
In our currently deployed Azure AKS (Kubernetes) cluster, we have an additional service I was hoping to replace with nginx. It's a routing microservice that calls out to a identity API prior to doing the routing.
The reason is a common one I'd imagine, we recieve some kind of authentication token via some pre-defined header(s) (the standard Authorization header, or sometimes some bespoke ones used for debug tokens, and impersonation), we call from the routing API into the identity API with those pre-defined headers and get a user identity object in return.
We then pass on this basic user identity object into the microservices so they have quick and easy access to the user and roles.
A brief explanation would be:
- Nginx receives a request, off-loads SSL and route to the requested service.
- Routing API takes the authorization headers and makes a call to the Identity API.
- Identity API validations the authorization information and returns either an authorization error (when auth fails), or a serialized user identity object.
- Router API either returns there and then, for failure, or routes to the requested microservice (by cracking the request path), and attaches the user identity object as a header.
- Requested microservice can then turn that user identity object into a Claims Principal in the case of .NET Core for example.
There are obviously options for merging the Router.API and the UserIdentity.API, but keeping the separation of concerns seems like a better move. I'd just to remove the Route.API, in-order to maintain that separation, but get nginx to do that work for me.
kubernetes microservices kubernetes-ingress azure-kubernetes nginx-ingress asked Jan 3 at 13:13
KieronKieron
15.6k1268110
Question
Can I get nginx to call another microservice inside of AKS k8s prior to it routing to the requested api? - the goal being to speed up requests (fewer hops) and simplify build and deployment (fewer services).
Explanation
In our currently deployed Azure AKS (Kubernetes) cluster, we have an additional service I was hoping to replace with nginx. It's a routing microservice that calls out to a identity API prior to doing the routing.
The reason is a common one I'd imagine, we recieve some kind of authentication token via some pre-defined header(s) (the standard Authorization header, or sometimes some bespoke ones used for debug tokens, and impersonation), we call from the routing API into the identity API with those pre-defined headers and get a user identity object in return.
We then pass on this basic user identity object into the microservices so they have quick and easy access to the user and roles.
A brief explanation would be:
- Nginx receives a request, off-loads SSL and route to the requested service.
- Routing API takes the authorization headers and makes a call to the Identity API.
- Identity API validations the authorization information and returns either an authorization error (when auth fails), or a serialized user identity object.
- Router API either returns there and then, for failure, or routes to the requested microservice (by cracking the request path), and attaches the user identity object as a header.
- Requested microservice can then turn that user identity object into a Claims Principal in the case of .NET Core for example.
There are obviously options for merging the Router.API and the UserIdentity.API, but keeping the separation of concerns seems like a better move. I'd just to remove the Route.API, in-order to maintain that separation, but get nginx to do that work for me.
kubernetes microservices kubernetes-ingress azure-kubernetes nginx-ingress kubernetes microservices kubernetes-ingress azure-kubernetes nginx-ingress asked Jan 3 at 13:13
KieronKieron
15.6k1268110
asked Jan 3 at 13:13
KieronKieron
15.6k1268110
edited Jan 16 at 14:11
Kieron
asked Jan 3 at 13:13
KieronKieron
15.6k1268110
asked Jan 3 at 13:13
KieronKieron
15.6k1268110
asked Jan 3 at 13:13
KieronKieron
15.6k1268110
15.6k1268110
As I saw according to your post, I may say that’s the way how nginx works. What’s your specific issue? You’ve met some unexpected error?
– Light.G
Jan 3 at 13:22
@Light.G No error, but reducing the number of services being hit before getting to it's destination is the goal.
– Kieron
Jan 3 at 13:23
add a comment |
As I saw according to your post, I may say that’s the way how nginx works. What’s your specific issue? You’ve met some unexpected error?
– Light.G
Jan 3 at 13:22
@Light.G No error, but reducing the number of services being hit before getting to it's destination is the goal.
– Kieron
Jan 3 at 13:23
As I saw according to your post, I may say that’s the way how nginx works. What’s your specific issue? You’ve met some unexpected error?
– Light.G
Jan 3 at 13:22
As I saw according to your post, I may say that’s the way how nginx works. What’s your specific issue? You’ve met some unexpected error?
– Light.G
Jan 3 at 13:22
@Light.G No error, but reducing the number of services being hit before getting to it's destination is the goal.
– Kieron
Jan 3 at 13:23
@Light.G No error, but reducing the number of services being hit before getting to it's destination is the goal.
– Kieron
Jan 3 at 13:23
add a comment |
1 Answer
1
active
oldest
votes
ProxyKit (https://github.com/damianh/ProxyKit) could be a good alternative to nginx - it allows you to easily add custom logic to certain requests (for example I lookup API keys based on a tenant in URL) and you can cache the responses using CacheCow (see a recipe in ProxyKit source)
answered Jan 28 at 10:55
Jakub KoneckiJakub Konecki
37.9k672116
I think after everything I've read, I'm happy with NGINX as it is (looks like the Pro version does what I need), so leaving it to do top-level routing and SSL offload is a better option. I'm liking the look of ProxyKit to replacing my Router.API with something built for the job - ours was thrown together. So get PK to call out to the identity api then route after.
– Kieron
Jan 28 at 11:20
Following up on this, I replaced 90% of the Router.API with ProxyKit. It was a much better solution for the internal routing. Thanks for the tip!
– Kieron
yesterday
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54023020%2fcan-i-replace-a-microservice-inside-of-aks-k8s-with-smarter-nginx-config%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
ProxyKit (https://github.com/damianh/ProxyKit) could be a good alternative to nginx - it allows you to easily add custom logic to certain requests (for example I lookup API keys based on a tenant in URL) and you can cache the responses using CacheCow (see a recipe in ProxyKit source)
answered Jan 28 at 10:55
Jakub KoneckiJakub Konecki
37.9k672116
I think after everything I've read, I'm happy with NGINX as it is (looks like the Pro version does what I need), so leaving it to do top-level routing and SSL offload is a better option. I'm liking the look of ProxyKit to replacing my Router.API with something built for the job - ours was thrown together. So get PK to call out to the identity api then route after.
– Kieron
Jan 28 at 11:20
Following up on this, I replaced 90% of the Router.API with ProxyKit. It was a much better solution for the internal routing. Thanks for the tip!
– Kieron
yesterday
add a comment |
ProxyKit (https://github.com/damianh/ProxyKit) could be a good alternative to nginx - it allows you to easily add custom logic to certain requests (for example I lookup API keys based on a tenant in URL) and you can cache the responses using CacheCow (see a recipe in ProxyKit source)
answered Jan 28 at 10:55
Jakub KoneckiJakub Konecki
37.9k672116
I think after everything I've read, I'm happy with NGINX as it is (looks like the Pro version does what I need), so leaving it to do top-level routing and SSL offload is a better option. I'm liking the look of ProxyKit to replacing my Router.API with something built for the job - ours was thrown together. So get PK to call out to the identity api then route after.
– Kieron
Jan 28 at 11:20
Following up on this, I replaced 90% of the Router.API with ProxyKit. It was a much better solution for the internal routing. Thanks for the tip!
– Kieron
yesterday
add a comment |
ProxyKit (https://github.com/damianh/ProxyKit) could be a good alternative to nginx - it allows you to easily add custom logic to certain requests (for example I lookup API keys based on a tenant in URL) and you can cache the responses using CacheCow (see a recipe in ProxyKit source)
answered Jan 28 at 10:55
Jakub KoneckiJakub Konecki
37.9k672116
ProxyKit (https://github.com/damianh/ProxyKit) could be a good alternative to nginx - it allows you to easily add custom logic to certain requests (for example I lookup API keys based on a tenant in URL) and you can cache the responses using CacheCow (see a recipe in ProxyKit source)
answered Jan 28 at 10:55
Jakub KoneckiJakub Konecki
37.9k672116
answered Jan 28 at 10:55
Jakub KoneckiJakub Konecki
37.9k672116
answered Jan 28 at 10:55
Jakub KoneckiJakub Konecki
37.9k672116
answered Jan 28 at 10:55
Jakub KoneckiJakub Konecki
37.9k672116
37.9k672116
I think after everything I've read, I'm happy with NGINX as it is (looks like the Pro version does what I need), so leaving it to do top-level routing and SSL offload is a better option. I'm liking the look of ProxyKit to replacing my Router.API with something built for the job - ours was thrown together. So get PK to call out to the identity api then route after.
– Kieron
Jan 28 at 11:20
Following up on this, I replaced 90% of the Router.API with ProxyKit. It was a much better solution for the internal routing. Thanks for the tip!
– Kieron
yesterday
add a comment |
I think after everything I've read, I'm happy with NGINX as it is (looks like the Pro version does what I need), so leaving it to do top-level routing and SSL offload is a better option. I'm liking the look of ProxyKit to replacing my Router.API with something built for the job - ours was thrown together. So get PK to call out to the identity api then route after.
– Kieron
Jan 28 at 11:20
Following up on this, I replaced 90% of the Router.API with ProxyKit. It was a much better solution for the internal routing. Thanks for the tip!
– Kieron
yesterday
I think after everything I've read, I'm happy with NGINX as it is (looks like the Pro version does what I need), so leaving it to do top-level routing and SSL offload is a better option. I'm liking the look of ProxyKit to replacing my Router.API with something built for the job - ours was thrown together. So get PK to call out to the identity api then route after.
– Kieron
Jan 28 at 11:20
I think after everything I've read, I'm happy with NGINX as it is (looks like the Pro version does what I need), so leaving it to do top-level routing and SSL offload is a better option. I'm liking the look of ProxyKit to replacing my Router.API with something built for the job - ours was thrown together. So get PK to call out to the identity api then route after.
– Kieron
Jan 28 at 11:20
Following up on this, I replaced 90% of the Router.API with ProxyKit. It was a much better solution for the internal routing. Thanks for the tip!
– Kieron
yesterday
Following up on this, I replaced 90% of the Router.API with ProxyKit. It was a much better solution for the internal routing. Thanks for the tip!
– Kieron
yesterday
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54023020%2fcan-i-replace-a-microservice-inside-of-aks-k8s-with-smarter-nginx-config%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
As I saw according to your post, I may say that’s the way how nginx works. What’s your specific issue? You’ve met some unexpected error?
– Light.G
Jan 3 at 13:22
@Light.G No error, but reducing the number of services being hit before getting to it's destination is the goal.
– Kieron
Jan 3 at 13:23