Primeros pasos con Apisix en Kubernetes: JWT Auth

apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: user-service
  template:
    metadata:
      labels:
        app: user-service
    spec:
      containers:
      - name: user-service
        image: jagedn/monolito
        imagePullPolicy: Always
        ports:
          - containerPort: 8080
            protocol: TCP
            name: http
        env:
          - name: MICRONAUT_SECURITY_TOKEN_JWT_SIGNATURES_SECRET_GENERATOR_SECRET
            value: MY_APPLICATION_JWT_SECRET_KEY_DUMMY (1)

---
apiVersion: v1
kind: Service
metadata:
  name: user-service
spec:
  ports:
  - name: http
    targetPort: http
    port: 8080
  selector:
    app: user-service

apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  name: apisix-login-route
  namespace: default
spec:
  http:
    - name: route-login
      match:
        paths:
          - /login
      backends:
        - serviceName: user-service
          servicePort: http

http localhost:8881/login username=jorgepayaso password=password

{
    "access_token": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqb3JnZXBheWFzbyIsIm5iZiI6MTY4MDg4MjMwMCwicm9sZXMiOltdLCJpc3MiOiJtaWNyb25hdXRndWlkZSIsImV4cCI6MTY4MDg4NTkwMCwiaWF0IjoxNjgwODgyMzAwLCJrZXkiOiJtYWluIn0.ALYLxJFNPYE-jmalF0cBGjTBse7DZFwzfd5DMEN1JLs",
    "expires_in": 3600,
    "refresh_token": "eyJhbGciOiJIUzI1NiJ9.NjBlNTk3N2EtZjIyYi00MjFjLTk2MjktOGM5NzdjZTZkODE0.jysMcQJDEDHDTypmSOBnFA4YpkmyS-o3eqvmv_--c3U",
    "token_type": "Bearer",
    "username": "jorgepayaso"
}

{
  "sub": "jorgepayaso",
  "nbf": 1680882300,
  "roles": [],
  "iss": "micronautguide",
  "exp": 1680885900,
  "iat": 1680882300,
  "key": "main"
}

apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  name: apisix-whoami-route
  namespace: default
spec:
  http:
    - name: route-1
      match:
        paths:
          - /v2/*
      backends:
        - serviceName: whoami-service
          servicePort: http
      authentication:
        enable: true
        type: jwtAuth

apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
  name: jwt-consumer
spec:
  authParameter:
    jwtAuth:
      value:
        key: main  (1)
        secret: MY_APPLICATION_JWT_SECRET_KEY_DUMMY (2)

$ TOKEN=$(http localhost:8881/login username=jorgepayaso password=password | jq -r .access_token)

$ http localhost:8881/v2/soy/yo Authorization:"Bearer $TOKEN"
HTTP/1.1 200 OK
GET /v2/soy/yo HTTP/1.1
Host: localhost:8881

apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  name: apisix-whoami-route
  namespace: default
spec:
  http:
    - name: route-1
      match:
        paths:
          - /v2/*
      backends:
        - serviceName: whoami-service
          servicePort: http
      authentication:
        enable: true
        type: jwtAuth
      plugins:
        - name: "serverless-post-function"
          enable: true
          config:
            functions:
              - |
                -- probably this function can be placed in another file
                function parseJWTPayload(conf, ctx)
                    -- Import neccessary libraries
                    local core  = require("apisix.core")
                    local jwt      = require("resty.jwt")
                    -- Parse jwt
                    local sub_str  = string.sub
                    local jwt_token = core.request.header(ctx, "authorization")
                    local prefix = sub_str(jwt_token, 1, 7)
                    if prefix == 'Bearer ' or prefix == 'bearer ' then
                        jwt_token = sub_str(jwt_token, 8)
                    end
                    local jwt_obj = jwt:load_jwt(jwt_token)
                    -- Set x-user-id header
                    core.request.set_header(ctx, "X-USER-ID", jwt_obj.payload.sub)
                end
                -- this is the function to call
                return function(conf, ctx)
                  return parseJWTPayload(conf, ctx)
                end

$ TOKEN=$(http localhost:8881/login username=jorgepayaso password=password | jq -r .access_token)

$ http localhost:8881/v2/soy/yo Authorization:"Bearer $TOKEN"
HTTP/1.1 200 OK
Content-Length: 729
Content-Type: text/plain; charset=utf-8
Date: Fri, 07 Apr 2023 16:21:22 GMT
Server: APISIX/3.2.0

Hostname: whoami-deployment-5d4fc76b57-2h8pl
IP: 127.0.0.1
IP: ::1
IP: 10.42.0.195
IP: fe80::d4f6:4dff:fe1f:75af
RemoteAddr: 10.42.0.191:59322
GET /v2/soy/yo HTTP/1.1
Host: localhost:8881
User-Agent: HTTPie/2.6.0
Accept: */*
Accept-Encoding: gzip, deflate
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqb3JnZXBheWFzbyIsIm5iZiI6MTY4MDg4NDQ4MCwicm9sZXMiOltdLCJpc3MiOiJtaWNyb25hdXRndWlkZSIsImV4cCI6MTY4MDg4ODA4MCwiaWF0IjoxNjgwODg0NDgwLCJrZXkiOiJtYWluIn0.o-yU9BSYyw314oPN_KZFLxgmqXOT2IQ9smDlfmC28Ss
X-Forwarded-For: 10.42.0.1, 10.42.0.187
X-Forwarded-Host: localhost:8881
X-Forwarded-Port: 8881
X-Forwarded-Proto: http
X-Forwarded-Server: traefik-7cd4fcff68-9ksw7
X-Real-Ip: 10.42.0.187
X-User-Id: jorgepayaso

$ TOKEN=$(http localhost:8881/login username=pepitopalotes password=password | jq -r .access_token)

$ http localhost:8881/v2/soy/yo Authorization:"Bearer $TOKEN"

HTTP/1.1 200 OK
Content-Length: 734
Content-Type: text/plain; charset=utf-8
Date: Fri, 07 Apr 2023 16:22:06 GMT
Server: APISIX/3.2.0

Hostname: whoami-deployment-5d4fc76b57-2h8pl
IP: 127.0.0.1
IP: ::1
IP: 10.42.0.195
IP: fe80::d4f6:4dff:fe1f:75af
RemoteAddr: 10.42.0.191:59322
GET /v2/soy/yo HTTP/1.1
Host: localhost:8881
User-Agent: HTTPie/2.6.0
Accept: */*
Accept-Encoding: gzip, deflate
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJwZXBpdG9wYWxvdGVzIiwibmJmIjoxNjgwODg0NTI0LCJyb2xlcyI6W10sImlzcyI6Im1pY3JvbmF1dGd1aWRlIiwiZXhwIjoxNjgwODg4MTI0LCJpYXQiOjE2ODA4ODQ1MjQsImtleSI6Im1haW4ifQ.-uFlClK5kmjMYWK4F-jZFwRTwvM8vXQEuKl5OzkhRdY
X-Forwarded-For: 10.42.0.1, 10.42.0.187
X-Forwarded-Host: localhost:8881
X-Forwarded-Port: 8881
X-Forwarded-Proto: http
X-Forwarded-Server: traefik-7cd4fcff68-9ksw7
X-Real-Ip: 10.42.0.187
X-User-Id: pepitopalotes