API网关设计与实现完全指南

API网关设计与实现完全指南前言API网关是微服务架构中的统一入口负责请求路由、负载均衡、安全认证、限流熔断等功能。一个设计良好的API网关可以极大地简化微服务架构的复杂度提升系统的可维护性和安全性。本文将详细介绍API网关的设计理念、核心功能和最佳实践。一、API网关概述1.1 为什么需要API网关在微服务架构中如果没有统一的入口层会面临以下问题客户端需要知道所有服务的地址和协议跨域、认证等逻辑需要在每个服务中重复实现难以统一监控和限制流量服务升级时客户端需要同步更新1.2 API网关核心功能┌─────────────────────────────────────────────────────┐ │ API Gateway │ │ │ │ ┌──────────────────────────────────────────────┐ │ │ │ 路由转发 │ │ │ │ /api/users/* → User Service │ │ │ │ /api/products/* → Product Service │ │ │ │ /api/orders/* → Order Service │ │ │ └──────────────────────────────────────────────┘ │ │ │ │ ┌────────────┐ ┌────────────┐ ┌────────────┐ │ │ │ 认证鉴权 │ │ 限流熔断 │ │ 监控日志 │ │ │ └────────────┘ └────────────┘ └────────────┘ │ │ │ │ ┌────────────┐ ┌────────────┐ ┌────────────┐ │ │ │ 请求转换 │ │ 协议转换 │ │ 缓存 │ │ │ └────────────┘ └────────────┘ └────────────┘ │ └─────────────────────────────────────────────────────┘二、Spring Cloud Gateway2.1 基础配置server: port: 8080 spring: application: name: api-gateway cloud: gateway: enabled: true discovery: locator: enabled: true lower-case-service-id: true filters: - name: CircuitBreaker args: name: myCircuitBreaker fallbackUri: forward:/fallback routes: - id: user-service uri: lb://user-service predicates: - Path/api/users/** filters: - StripPrefix1 - name: RequestRateLimiter args: redis-rate-limiter.replenishRate: 100 redis-rate-limiter.burstCapacity: 200 - id: product-service uri: lb://product-service predicates: - Path/api/products/** filters: - StripPrefix1 - id: order-service uri: lb://order-service predicates: - Path/api/orders/** filters: - StripPrefix12.2 动态路由配置Configuration public class DynamicRouteConfig { Autowired private RouteDefinitionWriter routeDefinitionWriter; Autowired private ApplicationEventPublisher publisher; public void addRoute(RouteDefinition definition) { routeDefinitionWriter.save(Mono.just(definition)) .subscribe(); publisher.publishEvent(new RefreshRoutesEvent(this)); } public void updateRoute(RouteDefinition definition) { deleteRoute(definition.getId()); addRoute(definition); } public MonoResponseEntityObject deleteRoute(String id) { return routeDefinitionWriter.delete(Mono.just(id)) .then(Mono.defer(() - Mono.just(ResponseEntity.ok().build()))) .onErrorResume(e - Mono.just(ResponseEntity.notFound().build())); } public FluxRouteDefinition getRoutes() { return routeDefinitionWriter.getRouteDefinitions(); } }2.3 全局过滤器Component Slf4j public class LoggingFilter implements GlobalFilter, Ordered { Override public MonoVoid filter(ServerWebExchange exchange, GatewayFilterChain chain) { ServerHttpRequest request exchange.getRequest(); String path request.getPath().value(); String method request.getMethod().name(); String traceId request.getHeaders() .getFirst(X-Trace-Id); log.info(Request: {} {} - TraceId: {}, method, path, traceId); long startTime System.currentTimeMillis(); return chain.filter(exchange) .then(Mono.fromRunnable(() - { long duration System.currentTimeMillis() - startTime; log.info(Response: {} {} - Status: {} - Duration: {}ms, method, path, exchange.getResponse().getStatusCode(), duration); })); } Override public int getOrder() { return Ordered.HIGHEST_PRECEDENCE; } } // 认证过滤器 Component public class AuthenticationFilter implements GlobalFilter { Autowired private JwtTokenProvider tokenProvider; Autowired private RedisTemplateString, Object redisTemplate; Override public MonoVoid filter(ServerWebExchange exchange, GatewayFilterChain chain) { String path exchange.getRequest().getPath().value(); // 跳过不需要认证的路径 if (isPublicPath(path)) { return chain.filter(exchange); } String token extractToken(exchange.getRequest()); if (token null) { return unauthorized(exchange, Missing authentication token); } try { if (!tokenProvider.validateToken(token)) { return unauthorized(exchange, Invalid token); } // 检查Token是否在黑名单 if (isTokenBlacklisted(token)) { return unauthorized(exchange, Token has been revoked); } // 提取用户信息并添加到请求头 UserPrincipal principal tokenProvider.getUserPrincipal(token); ServerHttpRequest mutatedRequest exchange.getRequest() .mutate() .header(X-User-Id, principal.getUserId().toString()) .header(X-Username, principal.getUsername()) .header(X-Authorities, String.join(,, principal.getAuthorities())) .build(); return chain.filter( exchange.mutate().request(mutatedRequest).build()); } catch (Exception e) { log.error(Authentication failed, e); return unauthorized(exchange, Authentication failed); } } private boolean isPublicPath(String path) { return path.startsWith(/api/auth/) || path.startsWith(/api/public/) || path.startsWith(/actuator/); } private String extractToken(ServerHttpRequest request) { String bearerToken request.getHeaders() .getFirst(HttpHeaders.AUTHORIZATION); if (StringUtils.hasText(bearerToken) bearerToken.startsWith(Bearer )) { return bearerToken.substring(7); } return null; } private boolean isTokenBlacklisted(String token) { String key token:blacklist: token; return Boolean.TRUE.equals(redisTemplate.hasKey(key)); } private MonoVoid unauthorized(ServerWebExchange exchange, String message) { ServerHttpResponse response exchange.getResponse(); response.setStatusCode(HttpStatus.UNAUTHORIZED); response.getHeaders().add(HttpHeaders.CONTENT_TYPE, application/json); String body String.format( {\error\: \Unauthorized\, \message\: \%s\}, message); DataBuffer buffer response.bufferFactory().wrap(body.getBytes()); return response.writeWith(Mono.just(buffer)); } }三、限流与熔断3.1 限流配置// 限流key解析器 Component public class CustomKeyResolver implements KeyResolver { Autowired private ServerHttpRequestFactory requestFactory; Override public MonoString resolve(ServerWebExchange exchange) { ServerHttpRequest request exchange.getRequest(); String path request.getPath().value(); String ip request.getRemoteAddress() ! null ? request.getRemoteAddress().getAddress().getHostAddress() : unknown; // 基于IP限流 return Mono.just(ip); // 基于用户限流需要认证 // String userId request.getHeaders() // .getFirst(X-User-Id); // return Mono.just(userId ! null ? userId : ip); // 基于路径IP限流 // return Mono.just(path : ip); } } // 限流配置 Configuration public class RateLimiterConfig { Bean public RedisRateLimiter redisRateLimiter( RedisTemplateString, String redisTemplate) { return new RedisRateLimiter(100, 200, 100); } Bean public CustomKeyResolver customKeyResolver() { return new CustomKeyResolver(); } } // 限流过滤器 Component public class RateLimitFilter implements GlobalFilter { Autowired private RedisRateLimiter rateLimiter; Autowired private KeyResolver keyResolver; Override public MonoVoid filter(ServerWebExchange exchange, GatewayFilterChain chain) { String key keyResolver.resolve(exchange).block(); return rateLimiter.isAllowed(key, 1) .flatMap(allowed - { if (allowed) { return chain.filter(exchange); } exchange.getResponse().setStatusCode( HttpStatus.TOO_MANY_REQUESTS); exchange.getResponse().getHeaders() .add(X-RateLimit-Limit, 100); String body {\error\: \Too many requests\}; DataBuffer buffer exchange.getResponse() .bufferFactory() .wrap(body.getBytes()); return exchange.getResponse() .writeWith(Mono.just(buffer)); }); } }3.2 熔断配置Configuration public class Resilience4JConfig { Bean public CircuitBreakerRegistry circuitBreakerRegistry() { CircuitBreakerConfig defaultConfig CircuitBreakerConfig.custom() .failureRateThreshold(50) .slowCallRateThreshold(80) .slowCallDurationThreshold(Duration.ofSeconds(2)) .waitDurationInOpenState(Duration.ofSeconds(30)) .permittedNumberOfCallsInHalfOpenState(3) .minimumNumberOfCalls(10) .slidingWindowType(SlidingWindowType.COUNT_BASED) .slidingWindowSize(10) .build(); return CircuitBreakerRegistry.of(defaultConfig); } Bean public CircuitBreaker userServiceCircuitBreaker( CircuitBreakerRegistry registry) { return registry.circuitBreaker(userService); } } // 熔断过滤器 Component Slf4j public class CircuitBreakerFilter implements GlobalFilter { Autowired private CircuitBreakerRegistry circuitBreakerRegistry; Override public MonoVoid filter(ServerWebExchange exchange, GatewayFilterChain chain) { String path exchange.getRequest().getPath().value(); String circuitBreakerName getCircuitBreakerName(path); CircuitBreaker circuitBreaker circuitBreakerRegistry.circuitBreaker(circuitBreakerName); // 注册事件监听 circuitBreaker.getEventPublisher() .onStateTransition(event - log.info(Circuit breaker state changed: {}, event)) .onFailureRateExceeded(event - log.warn(Circuit breaker failure rate exceeded)) .onSlowCallRateExceeded(event - log.warn(Circuit breaker slow call rate exceeded)); MonoVoid responseMono chain.filter(exchange); return responseMono.transformDeferred( operator - Mono.fromSupplier(() - operator) .transformDeferred(decoratedMono - decoratedMono.transformDeferred( it - it.transform( parallel().onErrorResume(ex - { if (circuitBreaker ! null circuitBreaker.isCallPermitted()) { return Mono.error(ex); } log.error(Circuit breaker opened, ex); return fallback(exchange, ex); }) ) ) ) ); } private String getCircuitBreakerName(String path) { if (path.startsWith(/api/users)) { return userService; } else if (path.startsWith(/api/products)) { return productService; } else if (path.startsWith(/api/orders)) { return orderService; } return defaultService; } private MonoVoid fallback(ServerWebExchange exchange, Throwable ex) { log.warn(Fallback triggered for path: {}, exchange.getRequest().getPath()); exchange.getResponse().setStatusCode( HttpStatus.SERVICE_UNAVAILABLE); exchange.getResponse().getHeaders() .add(X-CircuitBreaker, OPEN); String body String.format( {\error\: \Service unavailable\, \message\: \%s\}, 服务暂时不可用请稍后重试); DataBuffer buffer exchange.getResponse() .bufferFactory() .wrap(body.getBytes()); return exchange.getResponse().writeWith(Mono.just(buffer)); } }四、协议转换4.1 HTTP到gRPC转换Configuration public class GrpcProxyConfig { Bean public RouteLocator grpcProxyRouteLocator( RouteLocatorBuilder builder) { return builder.routes() .route(grpc_product_service, r - r .path(/grpc.product.v1.**) .filters(f - f.stripPrefix(1)) .uri(grpc://localhost:9090)) .build(); } } // gRPC代理请求处理 Component public class GrpcProxyHandler { Autowired private GrpcChannelFactory channelFactory; public Monobyte[] forwardToGrpcService( String serviceName, String methodName, byte[] requestBody) { ManagedChannel channel channelFactory.createChannel(serviceName); return Mono.fromFuture( sendGrpcRequest(channel, methodName, requestBody) ); } }4.2 SOAP到REST转换Component public class SoapToRestConverter { public String convertRestToSoap(String restRequest, String soapAction) { // REST JSON到SOAP XML转换 DocumentBuilder builder; try { builder DocumentBuilderFactory.newInstance() .newDocumentBuilder(); Document document builder.newDocument(); Element envelope document.createElementNS( http://schemas.xmlsoap.org/soap/envelope/, soap:Envelope); Element body document.createElement(soap:Body); Element request document.createElement(Request); // 填充请求数据 // ... body.appendChild(request); envelope.appendChild(body); document.appendChild(envelope); return documentToString(document); } catch (Exception e) { throw new ConversionException(Failed to convert REST to SOAP, e); } } }五、监控与日志5.1 指标收集spring: cloud: gateway: metrics: enabled: true tags: path: enabled: true management: endpoints: web: exposure: include: gateway,health,info,metrics metrics: export: prometheus: enabled: true tags: application: ${spring.application.name}Component public class MetricsFilter implements GlobalFilter, Ordered { Autowired private MeterRegistry meterRegistry; Override public MonoVoid filter(ServerWebExchange exchange, GatewayFilterChain chain) { String routeId exchange.getAttribute( GatewayFilterDictionary.ROUTE_ID); Timer.Sample sample Timer.start(meterRegistry); return chain.filter(exchange) .doOnSuccess(v - { String status exchange.getResponse() .getStatusCode().toString(); sample.stop(meterRegistry.timer( gateway.requests, Tags.of( route, routeId ! null ? routeId : unknown, status, status ) )); meterRegistry.counter( gateway.requests.total, Tags.of( route, routeId, status, status ) ).increment(); }) .doOnError(ex - { meterRegistry.counter( gateway.requests.errors, Tags.of( route, routeId, error, ex.getClass().getSimpleName() ) ).increment(); }); } }5.2 分布式追踪spring: cloud: gateway: discovery: locator: enabled: true sleuth: enabled: true sampler: probability: 1.0 tracing: enabled: true propagation: type: B3,W3六、最佳实践6.1 缓存策略Component public class CachingFilter implements GlobalFilter { Autowired private RedisTemplateString, Object redisTemplate; private static final Duration CACHE_TTL Duration.ofMinutes(5); Override public MonoVoid filter(ServerWebExchange exchange, GatewayFilterChain chain) { ServerHttpRequest request exchange.getRequest(); // 只缓存GET请求 if (!HttpMethod.GET.equals(request.getMethod())) { return chain.filter(exchange); } String cacheKey generateCacheKey(exchange); return Mono.justOrEmpty( redisTemplate.opsForValue().get(cacheKey)) .flatMap(cachedResponse - { log.debug(Cache hit for key: {}, cacheKey); ServerHttpResponse response exchange.getResponse(); response.getHeaders().add(X-Cache, HIT); response.getHeaders().add( HttpHeaders.CONTENT_TYPE, application/json ); DataBuffer buffer response.bufferFactory() .wrap((byte[]) cachedResponse); return response.writeWith(Mono.just(buffer)); }) .switchIfEmpty( chain.filter(exchange) .doOnSuccess(v - { // 缓存响应 cacheResponse(exchange, cacheKey); }) .doOnError(ex - { // 不缓存错误响应 }) ); } private String generateCacheKey(ServerWebExchange exchange) { String path exchange.getRequest().getPath().value(); String query exchange.getRequest().getQueryParams() .isEmpty() ? : : exchange.getRequest().getQueryParams().toString(); return gateway:cache: path query; } }6.2 请求重试spring: cloud: gateway: routes: - id: retry-route uri: lb://order-service predicates: - Path/api/orders/** filters: - name: Retry args: retries: 3 series: SERVER_ERROR statuses: INTERNAL_SERVER_ERROR,SERVICE_UNAVAILABLE methods: GET,POST exceptions: java.io.IOException,java.util.concurrent.TimeoutException backoff: firstBackoff: 100ms maxBackoff: 500ms factor: 2 basedOnPreviousValue: false七、总结API网关是微服务架构中不可或缺的组件通过统一的入口处理认证、限流、监控等横切关注点极大地简化了微服务的复杂度。Spring Cloud Gateway提供了强大的路由和过滤功能结合限流、熔断等机制可以构建安全、可靠、高性能的API网关服务。