Hands-on Setup with Apache APISIX API Gateway

Introduction

What Is an API Gateway?

An API gateway is a server that sits between clients and backend services, handling API requests, enforcing security policies, and managing traffic efficiently. It simplifies API management and improves performance, security, and observability.

Why Use an API Gateway?

With the rise of microservices and cloud-native applications, API gateways help developers:

Route and balance API traffic efficiently.
Secure APIs with authentication and authorization.
Enforce rate limiting and protect against abuse.
Monitor API usage and performance.
Transform API requests and responses.

Setting Up an API Gateway (Hands-on Guide)

In this guide, we'll set up an API gateway using Apache APISIX and configure it to route requests to a backend service.

Prerequisites

Ensure you have the following installed:

Docker (for quick deployment)
cURL (for API testing)
A backend service (a simple HTTP server like NGINX, or a sample API)

Step 1: Install Apache APISIX

We will deploy Apache APISIX using Docker.

Clone the Apache APISIX repository and navigate to the directory:
```
git clone https://github.com/apache/apisix-docker.git
cd apisix-docker/example
```
Start APISIX using Docker Compose:
```
docker-compose up -d
```

Verify the APISIX gateway is running:

curl http://127.0.0.1:9080/apisix/admin/routes -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1'

If successful, this should return an empty list of routes.

Step 2: Add a Backend API

For this example, we'll use a simple backend API with httpbin:

Run the httpbin container:

docker run -d --name httpbin -p 8080:80 kennethreitz/httpbin

Test the backend API:
```
curl http://127.0.0.1:8080/get
```

Step 3: Configure API Gateway Routing

Now, let's configure APISIX to route requests to our backend.

Add a route in APISIX to proxy requests to httpbin:

curl http://127.0.0.1:9080/apisix/admin/routes/1 \
     -X PUT \
     -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' \
     -d '{
         "uri": "/get",
         "upstream": {
             "type": "roundrobin",
             "nodes": {
                 "127.0.0.1:8080": 1
             }
         }
     }'

Test the API gateway routing:
```
curl http://127.0.0.1:9080/get
```
You should see the response from httpbin.

Step 4: Add Rate Limiting

To protect the backend service, let's enable rate limiting.

Apply the rate-limiting plugin to our route:

curl http://127.0.0.1:9080/apisix/admin/routes/1 \
     -X PUT \
     -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' \
     -d '{
         "uri": "/get",
         "plugins": {
             "limit-count": {
                 "count": 5,
                 "time_window": 60,
                 "rejected_code": 429,
                 "key": "remote_addr"
             }
         },
         "upstream": {
             "type": "roundrobin",
             "nodes": {
                 "127.0.0.1:8080": 1
             }
         }
     }'

Test rate limiting:

for i in {1..6}; do curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:9080/get ; done

The 6th request should return 429 (Too Many Requests).

Step 5: Enable API Authentication

To secure APIs, we'll add API Key authentication.

Create a consumer with an API key:

curl http://127.0.0.1:9080/apisix/admin/consumers \
     -X PUT \
     -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' \
     -d '{
         "username": "test-user",
         "plugins": {
             "key-auth": {
                 "key": "my-secure-key"
             }
         }
     }'

Update the route to require authentication:

curl http://127.0.0.1:9080/apisix/admin/routes/1 \
     -X PUT \
     -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' \
     -d '{
         "uri": "/get",
         "plugins": {
             "key-auth": {}
         },
         "upstream": {
             "type": "roundrobin",
             "nodes": {
                 "127.0.0.1:8080": 1
             }
         }
     }'

Test authentication:

curl -H "apikey: my-secure-key" http://127.0.0.1:9080/get

Without the key, the request will be rejected.

Conclusion

Congratulations! You have set up a working API gateway with:

Basic request routing.
Rate limiting to protect the backend.
API authentication for security.

Next Steps

Stay tuned for our upcoming column on the API gateway Guide, where you'll find the latest updates and insights!

Eager to deepen your knowledge about API gateways? Follow our Linkedin for valuable insights delivered straight to your inbox!

If you have any questions or need further assistance, feel free to contact API7 Experts.