Hi Team,
I am facing 2 issues while testing tyk-oss and not able to test tyk features.
Environment details:
tried in 2 deployments
Deployement1) Kubernates: private 3 node kubernates cluster as given below:
[root@master-node TykPoc]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
master-node Ready control-plane 9d v1.28.2
worker-node1 Ready 9d v1.28.2
worker-node2 Ready 9d v1.28.2
tyk-deployement: installed tyk and redis(using simple-redis)from tyk-helm/tyk-oss chart given in *****ce-helm-chart-new
[root@master-node TykPoc]# kubectl get pods -n=tyk
NAME READY STATUS RESTARTS AGE
gateway-tyk-oss-tyk-gateway-7cf57f9dd4-wbrp4 1/1 Running 0 15m
redis-dcbf66675-8pxkd 1/1 Running 0 3h33m
[root@master-node TykPoc]# kubectl get services -n=tyk
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
gateway-svc-tyk-oss-tyk-gateway NodePort 10.110.11.45 8080:30315/TCP 128m
redis ClusterIP 10.104.86.8 6379/TCP 3h33m
Deployment2) docker install as given below from tyk-gateway-docker git repo
[root@master-node ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
c56c6909c855 ************:v5.1.0 “/opt/tyk-gateway/ty…” 20 minutes ago Up 20 minutes 0.0.0.0:8080->8080/tcp, :::8080->8080/tcp tyk-gateway-docker_tyk-gateway_1
a6bb8da0006b redis:6.2.7-alpine “docker-entrypoint.s…” 20 minutes ago Up 20 minutes 0.0.0.0:6379->6379/tcp, :::6379->6379/tcp tyk-gateway-docker_tyk-redis_1
Health of gateway:
[root@master-node Tyk]# curl localhost:8080/hello
{“status”:“pass”,“version”:“5.1.0”,“description”:“Tyk GW”,“details”:{“redis”:{“status”:“pass”,“componentType”:“datastore”,“time”:“2023-10-06T09:49:39Z”}}}
ISSUE-1: Test on internal organizational api(/operation/rests) with username:passsword
**Working Case:**it is working fine when I create api def with keyless in tyk as given below:
API Def:
curl -v -H “x-tyk-authorization: foo”
-s
-H “Content-Type: application/json”
-X POST
-d ‘{
“name”: “internal-api”,
“api_id”: “internal-api”,
“org_id”: “1”,
“use_keyless”: true,
“auth”: {
“auth_header_name”: “Authorization”
},
“definition”: {
“location”: “header”,
“key”: “x-api-version”
},
“version_data”: {
“not_versioned”: true,
“versions”: {
“Default”: {
“name”: “Default”,
“use_extended_paths”: true
}
}
},
“proxy”: {
“listen_path”: “/internal-api/”,
“target_url”: “http://:8181/rests/operations”,
“strip_listen_path”: true
},
“active”: true
}’ *****:8080/tyk/apis | python -mjson.tool
Result:{
“action”: “added”,
“key”: “internal-api”,
“status”: “ok”
}
access of API is fine:
Hot reload:
[root@master-node TykPoc]# curl -H “x-tyk-authorization: foo” -s ****8080/tyk/reload/group | python -mjson.tool
{
“message”: “”,
“status”: “ok”
}
API-Access
[root@master-node TykPoc]# curl localhost:8080/internal-api/ -u admin:admin
{“ietf-restconf:operations”:{“ss-olt:write”:[null],“ss-device-system-info:read”:[null],“h-pon-dataservice:delete”:[null],
“1-run-cli:execute”:[null],“q-inventory:device-delete”:[null],"ietf-netconf:close…
Non Working case:
when I try to create api def with key as given below:
API Def:
curl -v -H “x-tyk-authorization: foo”
-s
-H “Content-Type: application/json”
-X POST
-d ‘{
“name”: “internal-api-secure”,
“api_id”: “internal-api-secure”,
“org_id”: “1”,
“auth”: {
“auth_header_name”: “Authorization”
},
“definition”: {
“location”: “header”,
“key”: “x-api-version”
},
“version_data”: {
“not_versioned”: true,
“versions”: {
“Default”: {
“name”: “Default”,
“use_extended_paths”: true
}
}
},
“proxy”: {
“listen_path”: “/internal-api-secure/”,
“target_url”: “http://:8181/rests/operations”,
“strip_listen_path”: true
},
“active”: true
}’ ***:8080/tyk/apis | python -mjson.tool
Result:
{
“action”: “added”,
“key”: “internal-api-secure”,
“status”: “ok”
}
Hot Reload:
[root@master-node TykPoc]# curl -H “x-tyk-authorization: foo” -s ***8080/tyk/reload/group | python -mjson.tool
{
“message”: “”,
“status”: “ok”
}
API-Key Creation:
curl -X POST -H “x-tyk-authorization: foo”
-s
-H “Content-Type: application/json”
-X POST
-d ‘{
“allowance”: 1000,
“rate”: 1000,
“per”: 1,
“expires”: -1,
“quota_max”: -1,
“org_id”: “1”,
“quota_renews”: 1449051461,
“quota_remaining”: -1,
“quota_renewal_rate”: 60,
“access_rights”: {
“internal-api-secure”: {
“api_id”: “internal-api-secure”,
“api_name”: “internal-api-secure”,
“versions”: [“Default”]
}
},
“meta_data”: {}
}’ ***8080/tyk/keys/create | python -mjson.tool
Key Details:
{
“action”: “added”,
“key”: “1bdc9c05bafd14c8d84966b9d1cc94f03”,
“key_hash”: “9293fc56”,
“status”: “ok”
}
Policy Details:
[root@master-node ~]# curl -H “x-tyk-authorization:foo” localhost:8080/tyk/policies | python -mjson.tool
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 897 100 897 0 0 157k 0 --:–:-- --:–:-- --:–:-- 175k
[
{
“_id”: “”,
“access_rights”: {
“internal-api-secure”: {
“allowance_scope”: “”,
“allowed_types”: null,
“allowed_urls”: null,
“api_id”: “internal-api-secure”,
“api_name”: “internal-api-secure”,
“disable_introspection”: false,
“field_access_rights”: null,
“limit”: {
“max_query_depth”: 0,
“per”: 0,
“quota_max”: 0,
“quota_remaining”: 0,
“quota_renewal_rate”: 0,
“quota_renews”: 0,
“rate”: 0,
“throttle_interval”: 0,
“throttle_retry_limit”: 0
},
“restricted_types”: null,
“versions”: [
“Default”
]
}
},
“active”: true,
“enable_http_signature_validation”: false,
“graphql_access_rights”: null,
“hmac_enabled”: false,
“id”: “”,
“is_inactive”: false,
“key_expires_in”: 0,
“last_updated”: “”,
“max_query_depth”: 0,
“meta_data”: null,
“name”: “”,
“org_id”: “1”,
“partitions”: {
“acl”: false,
“complexity”: false,
“per_api”: false,
“quota”: false,
“rate_limit”: false
},
“per”: 1,
“quota_max”: 100,
“quota_renewal_rate”: 60,
“rate”: 1000,
“tags”: null,
“throttle_interval”: 0,
“throttle_retry_limit”: 0
}
]
Hot-Reload:
[root@master-node ~]# curl -H “x-tyk-authorization: foo” -s ***8080/tyk/reload/group | python -mjson.tool
{
“message”: “”,
“status”: “ok”
}
Error in API access:
[root@master-node ~]# curl localhost:8080/internal-api-secure/ --digest -u admin:admin -H ‘Authorization:1bdc9c05bafd14c8d84966b9d1cc94f03’ -v
- About to connect() to localhost port 8080 (#0)
- Trying ::1…
- Connected to localhost (::1) port 8080 (#0)
- Server auth using Digest with user ‘admin’
GET /internal-api-secure/ HTTP/1.1
User-Agent: curl/7.29.0
Host: localhost:8080
Accept: /
Authorization:1bdc9c05bafd14c8d84966b9d1cc94f03
< HTTP/1.1 401 Unauthorized
< Content-Length: 0
< Www-Authenticate: BASIC realm=“application”
< X-Ratelimit-Limit: -1
< X-Ratelimit-Remaining: -1
< X-Ratelimit-Reset: 1696589243
< Date: Fri, 06 Oct 2023 10:49:13 GMT
<
- Connection #0 to host localhost left intact
[root@master-node ~]#
tyk configuration:
{
“log_level”: “info” ,
“listen_port”: 8080,
“secret”: “352d20ee67be67f6340b4c0605b044b7”,
“template_path”: “/opt/tyk-gateway/templates”,
“tyk_js_path”: “/opt/tyk-gateway/js/tyk.js”,
“middleware_path”: “/opt/tyk-gateway/middleware”,
“use_db_app_configs”: false,
“app_path”: “/opt/tyk-gateway/apps/”,
“storage”: {
“type”: “redis”,
“host”: “tyk-redis”,
“port”: 6379,
“username”: “”,
“password”: “”,
“database”: 0,
“optimisation_max_idle”: 2000,
“optimisation_max_active”: 4000
},
“enable_analytics”: false,
“analytics_config”: {
“type”: “”,
“ignored_ips”:
},
“health_check”: {
“enable_health_checks”: false,
“health_check_value_timeouts”: 60
},
“optimisations_use_async_session_write”: false,
“enable_non_transactional_rate_limiter”: true,
“enable_sentinel_rate_limiter”: false,
“enable_redis_rolling_limiter”: false,
“allow_master_keys”: false,
“policies”: {
“policy_source”: “file”,
“policy_record_name”: “/opt/tyk-gateway/policies/policies.json”
},
“hash_keys”: true,
“close_connections”: false,
“http_server_options”: {
“enable_websockets”: true
},
“allow_insecure_configs”: true,
“coprocess_options”: {
“enable_coprocess”: true,
“coprocess_grpc_server”: “”
},
“enable_bundle_downloader”: true,
“bundle_base_url”: “”,
“global_session_lifetime”: 100,
“force_global_session_lifetime”: false,
“max_idle_connections_per_host”: 500,
“enable_jsvm”: true,
“enable_hashed_keys_listing”: true,
“log_level”: “debug”
}
tyk-debug-logs:
NOTE: We are not able to access API by key.
ISSUE2: I tried API testing with local http server , for that even keyless is not working.
local http server details:
[root@master-node ~]# kubectl get pods
NAME READY STATUS RESTARTS AGE
nginx-7c5ddbdf54-gf2z4 1/1 Running 0 24h
[root@master-node ~]# cat nginx-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx
labels:
app: nginx
spec:
replicas: 1
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx
ports:
- containerPort: 80
[root@master-node ~]# cat nginx-service.yaml
apiVersion: v1
kind: Service
metadata:
name: ngnix-service
spec:
selector:
app: nginx
type: NodePort
ports:
- protocol: TCP
port: 80
targetPort: 80
[root@master-node ~]# kubectl get services
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.96.0.1 443/TCP 9d
ngnix-service NodePort 10.97.252.227 80:32305/TCP 24h
[root@master-node ~]# kubectl get deployments.apps
NAME READY UP-TO-DATE AVAILABLE AGE
nginx 1/1 1 1 24h
Able to access locally:
[root@master-node ~]# curl ngnix-service:32305
Welcome to nginx!
If you see this page, the nginx web server is successfully installed and working. Further configuration is required.
For online documentation and support please refer to
nginx.org.
Commercial support is available at
nginxcom.
Thank you for using nginx.
[root@master-node ~]#NOTE: when we try to access with tyk gate way it is giving error:
API Creation Details:
[root@master-node ~]# curl -v -H “x-tyk-authorization: foo” \
-s
-H “Content-Type: application/json”
-X POST
-d ‘{
“name”: “http-server3”,
“slug”: “http-server3”,
“api_id”: “http-server3”,
“org_id”: “1”,
“use_keyless”: true,
“auth”: {
“auth_header_name”: “Authorization”
},
“definition”: {
“location”: “header”,
“key”: “x-api-version”
},
“version_data”: {
“not_versioned”: true,
“versions”: {
“Default”: {
“name”: “Default”,
“use_extended_paths”: true
}
}
},
“proxy”: {
“listen_path”: “/http-server3/”,
“target_url”: “***:32305”,
“strip_listen_path”: true
},
“active”: true
}’ localhost:8080/tyk/apis | python -mjson.tool
- About to connect() to localhost port 8080 (#0)
- Trying ::1…
- Connected to localhost (::1) port 8080 (#0)
POST /tyk/apis HTTP/1.1
User-Agent: curl/7.29.0
Host: localhost:8080
Accept: /
x-tyk-authorization: foo
Content-Type: application/json
Content-Length: 621
} [data not shown]
- upload completely sent off: 621 out of 621 bytes
< HTTP/1.1 200 OK
< Content-Type: application/json
< Date: Fri, 06 Oct 2023 11:03:35 GMT
< Content-Length: 54
<
{ [data not shown] - Connection #0 to host localhost left intact
{
“action”: “added”,
“key”: “http-server3”,
“status”: “ok”
}
[root@master-node ~]# curl -H “x-tyk-authorization: foo” -s localhost:8080/tyk/reload/group | python -mjson.tool {
“message”: “”,
“status”: “ok”
}
ERROR:
root@master-node ~]# curl localhost:8080/http-server3/ -v
- About to connect() to localhost port 8080 (#0)
- Trying ::1…
- Connected to localhost (::1) port 8080 (#0)
GET /http-server3/ HTTP/1.1
User-Agent: curl/7.29.0
Host: localhost:8080
Accept: /
< HTTP/1.1 500 Internal Server Error
< Content-Type: application/json
< X-Generator: tykio
< Date: Fri, 06 Oct 2023 11:04:46 GMT
< Content-Length: 59
<
{
“error”: “There was a problem proxying the request”
- Connection #0 to host localhost left intact
tyk-debug-log: will attach in reply
Kindly looks into the issue as we are evaluating the product for internal usage but are stuck for basic testing.
Thanks in advance!
NOTE: I HAVE REPLACED SOME IP AND URL WITH *** BECAUSE OF LINK LIMITs FOR POSTING THE ISSUE.
