This document discusses using NGINX as an API gateway for microservices architectures. It describes how NGINX can provide essential API gateway functions like API routing, authentication, overload protection, and request tracing in a lightweight and efficient manner. The document advocates for separating the roles of a secure proxy and API gateway to handle north-south and east-west traffic respectively. Key API gateway capabilities of NGINX like API routing, authentication using API keys or JWT, and request tracing are demonstrated with code examples.

1. 1

2. API gateway for microservices
environments - the NGINX way
microservices
paris
30-Nov-2017 Liam Crilly
liam@nginx.com
@liamcrilly

3. We empower creators
of the new digital
world

4. Source: Source information goes here.Source: Source information goes here.
#1for the busiest sites
The busiest sites choose NGINX
4
Source: W3Techs Web server ranking 20-Nov-2017

5. Innovators powered by NGINX
5

6. • NGINX v0.1 published in 2004
• NGINX, Inc. founded in 2011
• NGINX Plus released in 2013
• Offices in San Francisco, Cambridge, Cork, Moscow and Singapore
• 300M+ websites
• 1,200+ commercial customers
• 180+ employees across engineering, support, sales and marketing

7. Our Products
NGINX Plus
The only all-in-one load balancer, web server, application firewall and content cache.
Simplify your architecture while reducing costs.
NGINX Controller
Centralized monitoring and management for
NGINX Plus. Deploy and automate virtual
load balancers with a beautiful interface and
API.
NGINX Unit
The new, open source application server
from NGINX, Inc. Lightweight, with multi-
language support and an API-driven
configuration.
NGINX
Industry-defining, open source webserver, reverse proxy and web accelerator
NGINX Amplify
NGINX Monitoring Made Easy: out-of-the-box graphs for NGINX and OS metrics, static analyzer and
automated alerts

8. Microservices

10. If beer
was a
web
app…

11. Monoliths are complex
11
• Tightly coupled to the
underlying infrastructure
• Nobody knows how it all
works
• Hard to maintain
• Impossible to debug

12. Microservices are minimal
12
• Easily separated from
underlying infrastructure
• Independently managed
• Easily
replaced/replenished
• Consistent interface
Photos
http://www.thedieline.com/blog/2017/1/26/a-fresh-look-at-craft-beer-cans
https://www.threadless.com/product/3314/ring_pull

13. Microservices do one thing
13
• One function
• Easy to test
• Easy to scale
Photo http://www.thedieline.com/blog/2017/1/26/a-fresh-look-at-craft-beer-cans

14. Microservices do one thing
14
• Avoid duplicating
functionality
◦ Crypto
◦ Authentication
◦ Access Control
◦ Analytics

15. Microservices do one thing
15
• Microservice?
• Miniservice?
• Mini-monolith?

16. But singular services can go bad
16

17. So deploy with redundancy
17
• Plan for failure
• At least 2 per service
• Scale independently
• Scale on demand
Photo:
https://twitter.com/clinkbeer/status/812324082809180161

19. Choose complexity carefully
19
Proxy Model Fabric Model (Service
Mesh)

20. The Goldilocks principle
20
Suitability
Low
High
“Just right”Too simple Too complex

21. Router Mesh Architecture
21
Secure Proxy API Gateway

22. Separation of duties
22
Secure proxy
• North-South traffic
• TLS termination
• Client authentication
• Centralized logging for all
client-initiated requests
• Request tracing injection
API gateway
• East-West and N-S traffic
• API routing
• Fine-grained access
control
• Rate limiting
• Propagate request ID

23. Everyone needs an
API gateway!

24. API Management products look a lot like
monoliths

25. Docker
#1 stars
#1 pulls

26. API gateway functions
26
Things you need
• Fast proxying
• API routing
• Overload protection
• Authentication of clients
• TLS support (termination or
end-to-end encryption)
Things you don’t need
• Digital strategy alignment
• API design tools
• Monetization metrics
• Business value measures
• Developer portals

27. API routing
(URI mapping)
27
# conf.d/routing_map.conf
map $request_uri $upstream_api {
{
# Pricing API
"^/api/prices/.*$" pricing_api;
"^/v1/pricing/.*$" pricing_api;
"^/item/.*/price/.*$" pricing_api;
# Partcodes API
"^/api/partcodes/.*$" partcodes_api;
"^/v1/partno/.*$" partcodes_api;
"^/item/.*/sku/.*$" partcodes_api;
# More APIs
# ...
}

28. API routing
Overload protection
28
# conf.d/api_gateway.conf
upstream pricing_api {
server 172.16.0.1:80 max_conns=500;
server 172.16.0.2:80 max_conns=500;
}
upstream partcodes_api {
server partcodes.app.example.com resolve;
}
server {
listen 80;
location / {
proxy_pass http://$upstream_api;
limit_conn clientip 20;
limit_req zone=10persec;
}
}

29. Authentication
(API keys)
29
# conf.d/apikeys_map.conf
map $http_apikey $client_name {
{
rL0Y20zC-Fzt72VPzMSk2A client_foo;
N7UdGUp1E-RbVvZSTy1R8g client_bar;
c_7_pLf2u2jkTPmEyF9uiA client_baz;
OiHNcxfhRFvomZn11_YqUw client_pub;
# ...
}

30. Authentication
(API keys)
30
# conf.d/api_gateway.conf
#[upstreams here]
server {
listen 80;
location / {
if ($client_name = "") {
return 401;
}
proxy_pass http://$upstream_api;
proxy_set_header API-Client $client_name;
limit_conn clientip 20;
limit_req zone=10persec;
}
}

31. Authentication
(JSON Web Token)
31
# conf.d/api_gateway.conf
#[upstreams here]
server {
listen 80;
auth_jwt "private API";
auth_jwt_key_file jwk.json;
location / {
proxy_pass http://$upstream_api;
proxy_set_header APIclient $jwt_claim_sub;
limit_conn clientip 20;
limit_req zone=10persec;
}
}

32. Request tracing
32
# conf.d/api_gateway.conf
#[upstreams here]
server {
listen 80;
location / {
proxy_pass http://$upstream_api;
proxy_set_header RequestID $http_requestid;
}
}
# Secure Proxy
server {
listen 443 ssl;
#ssl_* # TLS configuration
proxy_set_header RequestID $request_id;
proxy_pass http://api_gateway;
}

33. If beer
was a
web
app…

34. If beer was a web app…

35. nginx.com | @nginxnginx.com | @nginx
liam@nginx.com
@liamcrilly
Thank you
Merci