下一代云原生网关Higress：基于Wasm开发JWT认证插件

# 环境为Kubernetes v1.27.3
$ kubectl get nodes
NAME                 STATUS   ROLES           AGE   VERSION
kind-control-plane   Ready    control-plane   9h    v1.27.3

# 通过Helm安装
$ helm repo add higress.io https://higress.io/helm-charts

"higress.io" already exists with the same configuration, skipping
$ helm install higress -n higress-system higress.io/higress --create-namespace --render-subchart-notes --set global.local=true --set higress-console.o11y.enabled=false  --set higress-console.domain=console.higress.io --set higress-console.admin.password.value=admin

NAME: higress
LAST DEPLOYED: Thu Aug 10 20:37:40 2023
NAMESPACE: higress-system
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Higress successfully installed!

To learn more about the release, try:
  $ helm status higress -n higress-system
  $ helm get all higress -n higress-system

1. Use the following URL to access the console:
  http://console.higress.io/
  Since Higress Console is running in local mode, you may need to add the following line into your hosts file before accessing the console:
  127.0.0.1 console.higress.io
2. Use following commands to get the credential and login:
  export ADMIN_USERNAME=$(kubectl get secret --namespace higress-system higress-console -o jsonpath="{.data.adminUsername}" | base64 -d)
  export ADMIN_PASSWORD=$(kubectl get secret --namespace higress-system higress-console -o jsonpath="{.data.adminPassword}" | base64 -d)
  echo -e "Username: ${ADMIN_USERNAME}\nPassword: ${ADMIN_PASSWORD}"
  NOTE: If this is an upgrade release, your current password won't be changed.
3. If you'd like to change the credential, you can edit this secret with new values: higress-system/higress-console

# 查看密码
$ export ADMIN_USERNAME=$(kubectl get secret --namespace higress-system higress-console -o jsonpath="{.data.adminUsername}" | base64 -d)
$ export ADMIN_PASSWORD=$(kubectl get secret --namespace higress-system higress-console -o jsonpath="{.data.adminPassword}" | base64 -d)
$ echo -e "Username: ${ADMIN_USERNAME}\nPassword: ${ADMIN_PASSWORD}"
Username: admin
Password: admin

# 配置Hosts
 $ cat /etc/hosts
 127.0.0.1 demo.kubesre.com console.higress.io

# 转发一下端口本地可以访问
$ kubectl  port-forward service/higress-gateway -n higress-system 80:80

# 安装golang
$ brew install go
$ go version
go version go1.19.9 darwin/arm64

# TinyGo
$ wget https://github.com/tinygo-org/tinygo/releases/download/v0.25.0/tinygo0.25.0.darwin-amd64.tar.gz
$ tar -zxf tinygo0.25.0.darwin-amd64.tar.gz
$ export PATH=/tmp/tinygo/bin:$PATH
$ tinygo version
tinygo version 0.28.0-dev-5c2753e darwin/amd64 (using go version go1.19.9 and LLVM version 15.0.0)

# Wasm-opt
$ wget https://github.com/WebAssembly/binaryen/releases/download/version_114/binaryen-version_114-arm64-macos.tar.gz
$ tar binaryen-version_114-arm64-macos.tar.gz
$ export PATH=/tmp/binaryen/bin:$PATH
$ wasm-opt --version
wasm-opt version 114 (version_114)

# 初始化工程
$  mkdir jwt-plugin
$  cd jwt-plugin
$  go mod init jwt-plugin
go: creating new go.mod: module jwt-plugin
# 设置代理
$ go env -w GOPROXY=https://proxy.golang.com.cn,direct
# 下载依赖性
$ go get github.com/tetratelabs/proxy-wasm-go-sdk
$ go get github.com/alibaba/higress/plugins/wasm-go@main
$ go get github.com/tidwall/gjson

package main

import (
 "encoding/json"
 "github.com/alibaba/higress/plugins/wasm-go/pkg/wrapper"
 jwt "github.com/dgrijalva/jwt-go"
 "github.com/tetratelabs/proxy-wasm-go-sdk/proxywasm"
 "github.com/tetratelabs/proxy-wasm-go-sdk/proxywasm/types"
 "github.com/tidwall/gjson"
)

// 自定义插件配置

func main() {
 wrapper.SetCtx(
  "jwt-plugin",  // 配置插件名称
  wrapper.ParseConfigBy(parseConfig),
  wrapper.ProcessRequestHeadersBy(onHttpRequestHeaders),
 )
}

type Config struct {
 TokenSecretKey string // 解析Token SecretKey
 TokenHeaders   string // 定义获取Token请求头名称
}

type Res struct {
 Code int    `json:"code"`  // 返回状态码
 Msg  string `json:"msg"`  // 返回信息
}

func parseConfig(json gjson.Result, config *Config, log wrapper.Log) error {
 // 解析出配置，更新到config中
 config.TokenSecretKey = json.Get("token_secret_key").String()
 config.TokenHeaders = json.Get("token_headers").String()
 return nil
}

func onHttpRequestHeaders(ctx wrapper.HttpContext, config Config, log wrapper.Log) types.Action {
 var res Res
 if config.TokenHeaders == "" || config.TokenSecretKey == "" {
  res.Code = 401
  res.Msg = "参数不足"
  data, _ := json.Marshal(res)
  _ = proxywasm.SendHttpResponse(401, nil, data, -1)
  return types.ActionContinue
 }

 token, err := proxywasm.GetHttpRequestHeader(config.TokenHeaders)  // 获取Token
 if err != nil {
  res.Code = 401
  res.Msg = "认证失败"
  data, _ := json.Marshal(res)
  _ = proxywasm.SendHttpResponse(401, nil, data, -1)
  return types.ActionContinue
 }
 valid := ParseTokenValid(token, config.TokenSecretKey)
 if valid {
  _ = proxywasm.ResumeHttpRequest()
  return types.ActionPause
 } else {
  res.Code = 401
  res.Msg = "认证失败"
  data, _ := json.Marshal(res)
  _ = proxywasm.SendHttpResponse(401, nil, data, -1)
  return types.ActionContinue
 }
}
// 认证解析Token
func ParseTokenValid(tokenString, TokenSecretKey string) bool {
 token, _ := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
  // 在这里提供用于验证签名的密钥
  return []byte(TokenSecretKey), nil
 })
 return token.Valid
}

# 编译WASM
$  tinygo build -o main.wasm -scheduler=none -target=wasi -gc=custom -tags='custommalloc nottinygc_finalizer' main.go

# 查看Dockerfile
cat Dockerfile
FROM scratch
COPY main.wasm plugin.wasm

# 编译Docker Image
$ docker build -t  registry.cn-shanghai.aliyuncs.com/kubesre01/jwt-plugin:v1 .

[+] Building 0.1s (5/5) FINISHED                                                                                                                                                                               docker:desktop-linux
 => [internal] load build definition from Dockerfile                                                                                                                                                                           0.0s
 => => transferring dockerfile: 113B                                                                                                                                                                                           0.0s
 => [internal] load .dockerignore                                                                                                                                                                                              0.0s
 => => transferring context: 2B                                                                                                                                                                                                0.0s
 => [internal] load build context                                                                                                                                                                                              0.0s
 => => transferring context: 1.99MB                                                                                                                                                                                            0.0s
 => [1/1] COPY main.wasm plugin.wasm                                                                                                                                                                                           0.0s
 => exporting to image                                                                                                                                                                                                         0.0s
 => => exporting layers                                                                                                                                                                                                        0.0s
 => => writing image sha256:6097b8347fc71e52eadd05753b2bd6877f4f9283a9cd4d844e62259ef714e373                                                                                                                                   0.0s
 => => naming to registry.cn-shanghai.aliyuncs.com/kubesre01/jwt-plugin:v1

 # 上传镜像到仓库
 $ docker push  registry.cn-shanghai.aliyuncs.com/kubesre01/jwt-plugin:v1
The push refers to repository [registry.cn-shanghai.aliyuncs.com/kubesre01/jwt-plugin]
31f0fa5f1adf: Pushed
v1: digest: sha256:c3c629576c71d3dbd4d2bd8118c5523346c63cff7853ce995eb5879affd2c752 size: 526

# 部署Auth服务
$ cat auth.yml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: auth
  labels:
    app: auth
spec:
  replicas: 1
  selector:
    matchLabels:
      app: auth
  template:
    metadata:
      labels:
        app: auth
    spec:
      containers:
      - name: auth
        imagePullPolicy: Always
        image: registry.cn-shanghai.aliyuncs.com/kubesre01/auth:v1
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: auth-svc
spec:
  type: ClusterIP
  selector:
    app: auth
  ports:
    - port: 8080
      targetPort: 8080
$ kubectl apply -f auth.yml
deployment.apps/auth unchanged
service/auth-svc unchanged


# 部署demo服务
$  cat demo.yml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo
  labels:
    app: demo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo
  template:
    metadata:
      labels:
        app: demo
    spec:
      containers:
      - name: demo
        imagePullPolicy: Always
        image: registry.cn-shanghai.aliyuncs.com/kubesre01/demo:v1
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: demo-svc
spec:
  type: ClusterIP
  selector:
    app: demo
  ports:
    - port: 8080
      targetPort: 8080

$ kubectl apply -f demo.yml
deployment.apps/demo unchanged
service/demo-svc unchanged