Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: support Nacos ak/sk authentication #10445

Merged
merged 8 commits into from
Nov 13, 2023
Merged

feat: support Nacos ak/sk authentication #10445

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
1743b93
feat: support nacos ak/sk auth mode
yuweizzz Nov 4, 2023
ecc9d11
add ci test
yuweizzz Nov 5, 2023
6a0c5fd
remove debug code
yuweizzz Nov 5, 2023
925ad2d
fix code lint failed
yuweizzz Nov 6, 2023
baf3f5c
fix code lint
yuweizzz Nov 6, 2023
b70f53b
perf comment
yuweizzz Nov 7, 2023
f43b0d1
Update nacos3.t
yuweizzz Nov 8, 2023
eee29d1
Update nacos3.t
yuweizzz Nov 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions apisix/discovery/nacos/init.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,8 @@ local auth_path = 'auth/login'
local instance_list_path = 'ns/instance/list?healthyOnly=true&serviceName='
local default_namespace_id = "public"
local default_group_name = "DEFAULT_GROUP"
local access_key
local secret_key
Copy link
Contributor

@monkeyDluffy6017 monkeyDluffy6017 Nov 6, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, I'm not very familiar with nacos, how does these configurations work? Don't we need to configure the Nacos?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In nacos open source version, these configurations was no needed, but it can work in Alibaba Cloud MSE Nacos when MSE Nacos enabled authentication, and it also need to create a RAM user and grant permissions. More details in https://www.alibabacloud.com/help/en/mse/user-guide/access-authentication-by-the-nacos-client .

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So it's for MSE only? Could you describe this in the comment? like

#    access_key: ""        # Nacos AccessKey ID in Alibaba Cloud, notice that it's for Nacos instances on Microservices Engine (MSE)
#    secret_key: ""         # Nacos AccessKey Secret in Alibaba Cloud, notice that it's for Nacos instances on Microservices Engine (MSE)


local events
local events_list
Expand Down Expand Up @@ -145,6 +147,20 @@ local function get_group_name_param(group_name)
return param
end

local function get_signed_param(group_name, service_name)
local param = ''
if access_key ~= '' and secret_key ~= '' then
local str_to_sign = ngx.now() * 1000 .. '@@' .. group_name .. '@@' .. service_name
local args = {
ak = access_key,
data = str_to_sign,
signature = ngx.encode_base64(ngx.hmac_sha1(secret_key, str_to_sign))
}
param = '&' .. ngx.encode_args(args)
end
return param
end

local function get_base_uri()
local host = local_conf.discovery.nacos.host
-- TODO Add health check to get healthy nodes.
Expand Down Expand Up @@ -286,8 +302,10 @@ local function fetch_full_registry(premature)
local scheme = service_info.scheme or ''
local namespace_param = get_namespace_param(service_info.namespace_id)
local group_name_param = get_group_name_param(service_info.group_name)
local signature_param = get_signed_param(service_info.group_name, service_info.service_name)
local query_path = instance_list_path .. service_info.service_name
.. token_param .. namespace_param .. group_name_param
.. signature_param
data, err = get_url(base_uri, query_path)
if err then
log.error('get_url:', query_path, ' err:', err)
Expand Down Expand Up @@ -385,6 +403,8 @@ function _M.init_worker()
log.info('default_weight:', default_weight)
local fetch_interval = local_conf.discovery.nacos.fetch_interval
log.info('fetch_interval:', fetch_interval)
access_key = local_conf.discovery.nacos.access_key
secret_key = local_conf.discovery.nacos.secret_key
ngx_timer_at(0, fetch_full_registry)
ngx_timer_every(fetch_interval, fetch_full_registry)
end
Expand Down
2 changes: 2 additions & 0 deletions apisix/discovery/nacos/schema.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,8 @@ return {
read = 5000,
}
},
access_key = {type = 'string', default = ''},
secret_key = {type = 'string', default = ''},
},
required = {'host'}
}
2 changes: 2 additions & 0 deletions conf/config-default.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -308,6 +308,8 @@ nginx_config: # Config for render the template to generate n
# connect: 2000 # Default 2000ms
# send: 2000 # Default 2000ms
# read: 5000 # Default 5000ms
# access_key: ""
# secret_key: ""
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add some comments for the two configurations?

# consul_kv: # Consul KV
# servers: # Consul KV address(es)
# - "http://127.0.0.1:8500"
Expand Down
Loading