Version: 2.11

Running APISIX in AWS with AWS CDK

APISIX is a cloud-native microservices API gateway, delivering the ultimate performance, security, open source and scalable platform for all your APIs and microservices.

Architecture

This reference architecture walks you through building APISIX as a serverless container API Gateway on top of AWS Fargate with AWS CDK.

Apache APISIX Serverless Architecture

Generate an AWS CDK project with projen

  1. $ mkdir apisix-aws
  2. $ cd $_
  3. $ npx projen new awscdk-app-ts

update the .projenrc.js with the following content:

  1. const { AwsCdkTypeScriptApp } = require('projen');
  4. const project = new AwsCdkTypeScriptApp({
  5.   cdkVersion: "1.70.0",
  6.   name: "apisix-aws",
  7.   cdkDependencies: [
  8.     '@aws-cdk/aws-ec2',
  9.     '@aws-cdk/aws-ecs',
  10.     '@aws-cdk/aws-ecs-patterns',
  11.   ]
  12. });
  15. project.synth();

update the project:

  1. $ npx projen

update src/main.ts

  1. import * as cdk from '@aws-cdk/core';
  2. import { Vpc, Port } from '@aws-cdk/aws-ec2';
  3. import { Cluster, ContainerImage, TaskDefinition, Compatibility } from '@aws-cdk/aws-ecs';
  4. import { ApplicationLoadBalancedFargateService, NetworkLoadBalancedFargateService } from '@aws-cdk/aws-ecs-patterns';
  7. export class ApiSixStack extends cdk.Stack {
  8.   constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
  9.     super(scope, id, props);
  12.     const vpc = Vpc.fromLookup(this, 'VPC', {
  13.       isDefault: true
  14.     })
  17.     const cluster = new Cluster(this, 'Cluster', {
  18.       vpc
  19.     })
  22.     /**
  23.      * ApiSix service
  24.      */
  25.     const taskDefinition = new TaskDefinition(this, 'TaskApiSix', {
  26.       compatibility: Compatibility.FARGATE,
  27.       memoryMiB: '512',
  28.       cpu: '256'
  29.     })
  32.     taskDefinition
  33.       .addContainer('apisix', {
  34.         image: ContainerImage.fromRegistry('iresty/apisix'),
  35.       })
  36.       .addPortMappings({
  37.         containerPort: 9080
  38.       })
  41.     taskDefinition
  42.       .addContainer('etcd', {
  43.         image: ContainerImage.fromRegistry('gcr.azk8s.cn/etcd-development/etcd:v3.3.12'),
  44.         // image: ContainerImage.fromRegistry('gcr.io/etcd-development/etcd:v3.3.12'),
  45.       })
  46.       .addPortMappings({
  47.         containerPort: 2379
  48.       })
  51.     const svc = new ApplicationLoadBalancedFargateService(this, 'ApiSixService', {
  52.       cluster,
  53.       taskDefinition,
  54.     })
  57.     svc.targetGroup.setAttribute('deregistration_delay.timeout_seconds', '30')
  58.     svc.targetGroup.configureHealthCheck({
  59.       interval: cdk.Duration.seconds(5),
  60.       healthyHttpCodes: '404',
  61.       healthyThresholdCount: 2,
  62.       unhealthyThresholdCount: 3,
  63.       timeout: cdk.Duration.seconds(4)
  64.     })
  67.     /**
  68.      * PHP service
  69.      */
  70.     const taskDefinitionPHP = new TaskDefinition(this, 'TaskPHP', {
  71.       compatibility: Compatibility.FARGATE,
  72.       memoryMiB: '512',
  73.       cpu: '256'
  74.     })
  77.     taskDefinitionPHP
  78.       .addContainer('php', {
  79.         image: ContainerImage.fromRegistry('abiosoft/caddy:php'),
  80.       })
  81.       .addPortMappings({
  82.         containerPort: 2015
  83.       })
  86.     const svcPHP = new NetworkLoadBalancedFargateService(this, 'PhpService', {
  87.       cluster,
  88.       taskDefinition: taskDefinitionPHP,
  89.       assignPublicIp: true,
  90.     })
  93.     // allow Fargate task behind NLB to accept all traffic
  94.     svcPHP.service.connections.allowFromAnyIpv4(Port.tcp(2015))
  95.     svcPHP.targetGroup.setAttribute('deregistration_delay.timeout_seconds', '30')
  96.     svcPHP.loadBalancer.setAttribute('load_balancing.cross_zone.enabled', 'true')
  99.     new cdk.CfnOutput(this, 'ApiSixDashboardURL', {
  100.       value: `http://${svc.loadBalancer.loadBalancerDnsName}/apisix/dashboard/`
  101.     })
  102.   }
  103. }
  106. const devEnv = {
  107.   account: process.env.CDK_DEFAULT_ACCOUNT,
  108.   region: process.env.CDK_DEFAULT_REGION,
  109. };
  112. const app = new cdk.App();
  115. new ApiSixStack(app, 'apisix-stack-dev', { env: devEnv });
  118. app.synth();

Deploy the APISIX Stack with AWS CDK

  1. $ cdk diff
  2. $ cdk deploy

On deployment complete, some outputs will be returned:

  1. Outputs:
  2. apiSix.PhpServiceLoadBalancerDNS5E5BAB1B = apiSi-PhpSe-FOL2MM4TW7G8-09029e095ab36fcc.elb.us-west-2.amazonaws.com
  3. apiSix.ApiSixDashboardURL = http://apiSi-ApiSi-1TM103DN35GRY-1477666967.us-west-2.elb.amazonaws.com/apisix/dashboard/
  4. apiSix.ApiSixServiceLoadBalancerDNSD4E5B8CB = apiSi-ApiSi-1TM103DN35GRY-1477666967.us-west-2.elb.amazonaws.com
  5. apiSix.ApiSixServiceServiceURLF6EC7872 = http://apiSi-ApiSi-1TM103DN35GRY-1477666967.us-west-2.elb.amazonaws.com

Open the apiSix.ApiSixDashboardURL from your browser and you will see the login prompt.

Configure the upstream nodes

All upstream nodes are running as AWS Fargate tasks and registered to the NLB(Network Load Balancer) exposing multiple static IP addresses. We can query the IP addresses by nslookup the apiSix.PhpServiceLoadBalancerDNS5E5BAB1B like this:

  1. $ nslookup apiSi-PhpSe-FOL2MM4TW7G8-09029e095ab36fcc.elb.us-west-2.amazonaws.com
  2. Server:         192.168.31.1
  3. Address:        192.168.31.1#53
  6. Non-authoritative answer:
  7. Name:   apiSi-PhpSe-FOL2MM4TW7G8-09029e095ab36fcc.elb.us-west-2.amazonaws.com
  8. Address: 44.224.124.213
  9. Name:   apiSi-PhpSe-FOL2MM4TW7G8-09029e095ab36fcc.elb.us-west-2.amazonaws.com
  10. Address: 18.236.43.167
  11. Name:   apiSi-PhpSe-FOL2MM4TW7G8-09029e095ab36fcc.elb.us-west-2.amazonaws.com
  12. Address: 35.164.164.178
  13. Name:   apiSi-PhpSe-FOL2MM4TW7G8-09029e095ab36fcc.elb.us-west-2.amazonaws.com
  14. Address: 44.226.102.63

Configure the IP addresses returned as your upstream nodes in your APISIX dashboard followed by the Services and Routes configuration. Let’s say we have a /index.php as the URI for the first route for our first Service from the Upstream IP addresses.

upstream with AWS NLB IP addresses service with created upstream define route with service and uri

Validation

OK. Let’s test the /index.php on {apiSix.ApiSixServiceServiceURL}/index.php

Testing Apache APISIX on AWS Fargate

Now we have been successfully running APISIX in AWS Fargate as serverless container API Gateway service.

Clean up

  1. $ cdk destroy

Running APISIX in AWS China Regions

update src/main.ts

  1.   taskDefinition
  2.     .addContainer('etcd', {
  3.       image: ContainerImage.fromRegistry('gcr.azk8s.cn/etcd-development/etcd:v3.3.12'),
  4.       // image: ContainerImage.fromRegistry('gcr.io/etcd-development/etcd:v3.3.12'),
  5.     })
  6.     .addPortMappings({
  7.       containerPort: 2379
  8.     })

(read here for more reference)

Run cdk deploy and specify your preferred AWS region in China.

  1. # let's say we have another AWS_PROFILE for China regions called 'cn'
  2. # make sure you have aws configure --profile=cn properly.
  3. #
  4. # deploy to NingXia region
  5. $ cdk deploy --profile cn -c region=cn-northwest-1
  6. # deploy to Beijing region
  7. $ cdk deploy --profile cn -c region=cn-north-1

In the following case, we got the Outputs returned for AWS Ningxia region(cn-northwest-1):

  1. Outputs:
  2. apiSix.PhpServiceLoadBalancerDNS5E5BAB1B = apiSi-PhpSe-1760FFS3K7TXH-562fa1f7f642ec24.elb.cn-northwest-1.amazonaws.com.cn
  3. apiSix.ApiSixDashboardURL = http://apiSi-ApiSi-123HOROQKWZKA-1268325233.cn-northwest-1.elb.amazonaws.com.cn/apisix/dashboard/
  4. apiSix.ApiSixServiceLoadBalancerDNSD4E5B8CB = apiSi-ApiSi-123HOROQKWZKA-1268325233.cn-northwest-1.elb.amazonaws.com.cn
  5. apiSix.ApiSixServiceServiceURLF6EC7872 = http://apiSi-ApiSi-123HOROQKWZKA-1268325233.cn-northwest-1.elb.amazonaws.com.cn

Open the apiSix.ApiSixDashboardURL URL and log in to configure your APISIX in AWS China region.

TBD

Decouple APISIX and etcd3 on AWS

For high availability and state consistency consideration, you might be interested to decouple the etcd3 as a separate cluster from APISIX not only for performance but also high availability and fault tolerance yet with highly reliable state consistency.

TBD