API Management within a Microservice Architecture
6 likes2,975 views
The document outlines WSO2's approach to API management within a microservices architecture, highlighting the company's growth, capabilities, and the importance of managing APIs for digital transformation. It emphasizes the need for secure, accessible API management solutions that enhance discoverability, monitoring, and lifecycle management in a microservices context. Additionally, it contrasts traditional gateway architectures with microgateway implementations that optimize performance and reduce latency in modern application environments.
API Management within a Microservice Architecture
- 1. API Management within a Microservices Architecture Nadeesha Gamage Senior Lead Solutions Engineer
- 2. WSO2 At-A-Glance 2 $25m Sales in 2017 53% YoY growth 450+ Customers, 175 New Customers in 2017 Open Source Founded 2005, Backed by Cisco and Toba Capital Colombo London Mountain View, CA New York, NY São Paulo Sydney 500+ Employees (300 Engineers)
- 3. 3 #1 6th Open Source Integration Vendor Largest Apache Committer Largest Open Source Vendor 5th WSO2: Helping Digitally Driven Organizations Become Integration Agile
- 4. OPEN TECHNOLOGY FOR AGILE DIGITAL BUSINESS 4 Build internal and external developer ecosystems with an API marketplace. Manage identity, security, and privacy across your digital business. Create real-time, intelligent, actionable business insights and data products. Platform enable your digital business with “micro-services” and “micro-integrations”.
- 5. All WSO2 PRODUCTS ARE 5 WSO2 PRODUCTS Seamlessly Integrated Comprehensive platform Go to market faster Flexible Deploy on-premises, public or private cloud, or hybrid environment Easily migrate between on-premises and in the cloud 100% Open source Quickly build POC Affordably scale out to production systems Backed by world class team More than a decade of experience helping companies realize digital transformation goals
- 6. The WSO2 Subscription Get the most from your WSO2 product with enterprise-grade services: Open source technology WSO2 Subscription Options: - WSO2 managed cloud - Consulting services - Managed services 6
- 7. WSO2 Training and Certification Training material free online; learn at your own pace 7 WSO2 Provides Certification a verifiable way to present skills to team, employers, customers, partners. Standard training (onsite and online) Customized training (on-site) in-depth, personalized training for your specific need
- 8. ANALYSTS SAY 8 “Strong Performer for Hybrid Integration” - The Forrester Wave™: Hybrid Integration for Enterprises, Q4 2016 report, published November 18, 2016 “Leader in API Management Solutions” - The Forrester Wave™: API Management Solutions, Q4 2018 report, published November 1, 2018. “Visionary” - Gartner Cool Vendors in Internet of Things Analytics, 2016 report, published May 11, 2016. “Strong Performer for Big Data Streaming Analytics” - The Forrester Wave™: Big Data Streaming Analytics, Q1 2016 report1, published March 30, 2016. - Gartner Magic Quadrant for Full Life Cycle API Management, published October 27, 2016 “Cool Vendor”
- 10. Flagship Customers Across every industry and geography Financial Healthcare Governments Education Telecom Retail TechnologyTransport 10
- 11. Agenda ● APIs, the digital connector ● Microservices Architecture ● WSO2 API Manager ● Introduction to WSO2 API Microgateway ● Demo on WSO2 API Manager and Microgateway ● API Microgateway deployment patterns 11
- 12. It Is The Age Of The Consumer 12 Source: Forrester Research
- 13. API - “The Digital Connector”
- 14. API - “The Digital Connector” ● APIs are the interfaces that allows various services to expose their functionality for consumption. ● Enables platform independent, language neutral way of integration. ● Enables Digital Transformation.
- 15. Digital Transformation is all about creating a “Digital Experience” for your customers
- 16. Why is it needed to manage APIs? ○ Open API access to consumers ○ Easy API discoverability ○ Protecting APIs ■ Securing for unauthorized access ■ Fine grained access control ■ Throttling ○ Metering and Monitoring ○ Monetization ○ Manage lifecycle and versioning
- 20. Monolithic Application (continued) ● Despite modularity, application is packaged as a single monolith ● Packaging depends on the language ○ .war, .jar or directory structure ● Simple to test and deploy ● If simple, what is the issue? ○ Simple and easy only at the beginning
- 21. Problems with Monolithic applications ● Increasingly difficult to make code changes Disrupts agile development ● Overtime, no single developer will understand the entire code. Changes will be error prone ● CI/CD would become painful ● Scaling would be difficult ● An issue in one component could potentially bring down the entire application ● Stuck with a single language
- 23. Microservices Architecture pattern ● An application written as small interconnected services, each implementing distinct functionality ● Self contained, maintains its own datastores ● Each service may expose a REST API, a transactions require interaction with multiple service. ● Services may also use other Inter-process- communication methods to interact, such as queue etc.
- 24. Advantages with MSA ● Faster and focused development ● Easy deployment and thus easy CI/CD ● Demand based scalability and flexibility ● Reduced downtime due to modularity ● Reduce time to market for new features and capabilities.
- 26. Drawback of MSA ● Inherent complexity of distribution of systems ○ Handling transactions (partial failures) ● Multiple databases ● Need for advanced technology (service mesh, service discovery, circuit breaker, container orchestration etc)
- 27. Does MSA need API Management? ● Common misconception that Microservices Architecture eliminates the need of API Management. ● Rather it augments and works collaboratively ● Don’t we need control on what we expose as a REST API in microservices? ● Its not a good practice to allow apps to directly consume microservice
- 28. What API Management brings to MSA ● Control API access and security ● API portal and discoverability ● Monitoring usage ● API documentation and testing before adoption ● Versioning and lifecycle management
- 29. Traditional Gateway vs Gateway for MSA
- 30. Microservices with an API Gateway ● API Microgateway for service - Deploying Gateway closer to the microservice API Gateways MicroservicesProducts Orders
- 31. ● API Microgateway for each client - The same API interface exposed to 3 types of Gateways. Each optimized for the client type it serves. Products Orders MobileWebPublic Microservices with an API Gateway
- 32. WSO2 API Manager Design, create, publish and manage APIs to unlock the true value of your digital assets
- 34. 35 Componentized
- 35. 36 WSO2 API Manager ● Available as a single downloadable package ● Available as a cloud / SaaS solution ● Flexible deployment choices ● High performance gateway ● API governance, marketplace solution
- 36. 37 Cloud First or Start On-Prem ● Multi-tenanted, shared everything ● WSO2 Hosted and managed ● Pay as you go ● Multi-region availability ● VPN tunnel to private DC ● Guaranteed uptime ● Limited options in customizing ● Hybrid Cloud ● Privately hosted ● WSO2 managed ● Upgrades, patches installation ● Guaranteed uptime ● Full flexibility in customization ● Better control ● Self hosted ● Self managed ● Full flexibility ● Dev-ops learning curve ● Self managed upgrades http://wso2.com/api-management/cloud/ https://docs.wso2.com/display/ManagedCl oud/WSO2+Managed+Cloud+Documenta tion
- 37. Creating an API Designing or Publicizing an API 38
- 38. 39 ● Start with an existing endpoint/contract or design and prototype a new API ● Exposing SOAP services (convert to REST or as a passthrough) ● Exposing streaming APIs (Websocket endpoints) Creating APIs
- 39. 40 ● API Design - Over the wizard & with swagger Creating APIs
- 40. 41 ● Point to a production backend or prototype at the gateway Managed or prototyped
- 41. Publishing an API Enforcing Security and SLAs 42
- 42. 43 ● Protecting for applications and users ● Controlling access and entitlement with scope ● Multi-Tier subscription model Protecting APIs
- 45. 46 ● Encapsulate the client application ● Associates OAuth2 keys ● Support different integration patterns for application security through OAuth grant types ● Pre-generated access tokens for testing Client Application
- 46. 47 ● Tier based simple model ○ Application developer selects the tier at app registration ○ Each tier is tied to a policy that describe the quota ○ Tiers can be applied at the application, API or at the API resource level ● Advance rule based models ○ Policies containing IP conditions, message attribute based conditions, transport header based conditions ○ Complex real time pattern based conditions Traffic Management
- 49. 50 ● Manage stages of an API ● Manage associated states ● Create a new version from an existing ● Audit changes to lifecycle states ● Support for custom lifecycles API Lifecycle Management
- 50. Consuming an API The developer portal / marketplace 51
- 51. 52 ● Searchable (with context) - by name, tag, description, author etc. ● Social features: tagging, commenting, rating ● Minimalistic forum ● Themeable: change color, logo, view ● Configure alerts for application developers ● Application based API analytics ● OAuth2 application management ● API Monetization The Developer Portal
- 52. Monitoring an API Analytics and Insight 53
- 53. 54 ● Analytics dashboard on API stats ○ API Usage / Response times / Backend latency / Geo-location etc ● Stats on Applications for application owners (subscribers) ● Stats on subscriptions API Analytics: Batch
- 54. 55 ● Leverages real-time analytics streaming engine ● Used for various alerting use-cases ○ Fraudulent access token usage ○ Keeping API developers alerted on backend performance issues ○ Alerting on SLA violations ○ Alerting on tier crossing for subscriptions ● Detect trends ● Detect API call sequences that needs to be blocked ● Detect non-usage scenarios API Analytics: Realtime
- 56. The API Manager Runtime Processing Flow and Extensibility 57
- 57. 58 API Gateway
- 58. 59 ● Message manipulation, transformation and enrichment ● WSO2 developer studio based tooling ● Wizard based mediation policy application Message mediation
- 59. 60 API Gateway Performance WSO2 API Manager all in one simple deployment performance H/W config: 4 core cpu with 8GB memory / c4.xlarge ec2 equivalent
- 61. 62 ● API gateway handlers ○ Security handlers ○ Analytics handlers ● OAuth custom grant types ○ SAML extension grant type ○ NTLM / Kerberos ○ JWT extension grant Extensibility & Enhancements
- 62. 63 ● OAuth scope handlers ○ Role based scope validation ○ XACML based scope validation ● Mediation extensions ○ Message transformation ○ Routing to backends ○ Payload validation ● Lifecycle extension ○ Executor plugin for lifecycle stages / transitions Extensibility & Enhancements
- 64. Introducing the WSO2 API Microgateway ● Designed to scale. ○ Immutable ○ Self validating tokens ○ Localized rate limiting ○ Offline analytics ● Native support for Docker/K8S. ● Dedicated gateway for microservices. ● First class support for lifecycle management across environments. ● Low resource requirement (2 core, 256 MB RAM).
- 65. Characteristic of WSO2 API Microgateway ● Ability to execute in isolation without connection to other components; key manager, traffic manager etc. ● Ability to manage a subset of APIs, instead of all. ● Offers a proxy that is capable of performing security validation, in-memory (local) throttling and operational analytics. ● Immutability.
- 66. Microgateway Overview Microgateway Toolkit Microgateway Runtime Request API Definitions Download API Definitions (JSON) Generate Microgateway Runtime
- 67. Microgateway Security - JWT/JWS Microgateway Products Orders Request Access Token (with scopes) Provide Signed JWT 1 2 3 3 Microgateway 4 4 Client Application sends Signed JWT to Microgateways
- 68. Microgateway Security - Standard OAuth2.0 Request Access Token (with scopes) Provide Opaque Token 1 2 3 Microgateway 4 Client Application sends Token to Microgateway Validate Token
- 69. Microgateway - Localized Rate Limiting Rate limiting policies are burnt into the microgateway runtime Microgateway Products Orders Apply 1000 req/min on Products microservic e Apply 500 req/min on Orders microservic e
- 70. Microgateway - Offline Analytics Microgateway Microgateway Accumulate data in files and upload offline
- 71. Microgateway - Native Support for Docker/K8S Microgateway Toolkit Request API Definitions Download API Definitions (JSON) Microgateway VM Microgateway Docker Microgateway K8S Provide relevant arguments in build phase for desired output
- 72. Microgateway - Cross Environment Lifecycle Mgt Microgateway VM Microgateway Microgateway Staging Prod Products Products gateway -e ProductsAPI.v1.prod.endpoint.0="http://staging.apis.wso2.com/products" gateway -e ProductsAPI.v1.prod.endpoint.0="http://apis.wso2.com/products"
- 73. API Gateway vs Microgateway Feature API Gateway Microgateway Self contained token based authentication No Yes OAuth 2.0 token based authentication Yes Yes Mediation extension support(in/out sequences) Yes No Response Caching(GET and HEAD methods) Yes Yes Javascript based mediation logic Yes No Analytics support Yes Yes Logging and monitoring support Yes Yes
- 74. When to use API Microgateway ● Run in lockdown or offline mode ● Cater to unusual traffic patterns of APIs (run in private jet mode) ● Scaling a subset of APIs. ● When consumers and services reside in the same network and a gateway is required in close proximity to reduce latency. ● Running the gateway in sidecar mode.
- 75. When to use the traditional API gateway ● When there is requirement to throttle API calls based on counters across all gateway nodes. ● Run API gateway as centralized gateway. Handle requests for many different APIs and different backend servers. ● Traditional SOAP architecture which requires Gateway to perform mediations, orchestrations.
- 76. Demo
- 77. API Microgateway deployment patterns in MSA
- 78. 79 Centralized API Gateway Shared Cluster of API Gateways to Handle the Internal and External Load
- 79. 80 Private Jet API Gateway Dedicated API Gateways to Each Microservice or a Group of Microservices
- 80. 81 Sidecar API Gateway API Gateway alongside Microservices - Service Mesh Architecture