Via CRs
There are three levels you can attach Interceptor APIPolicy:
- Configuring Operation level Interceptors
- Configuring API level Interceptors
- Configuring Gateway level Interceptors
Configuring Operation level Interceptors¶
You need to create the APIPolicy with targetRef.kind property set to Resource for that and give the targetRef.name as the name of the HTTPRouteresource. Then you need to define a filter in that HTTPRoute with ExtensiomRef type which refers the APIPolicy you created. Refer the following example which describes the full example.
Create your API¶
API resource¶
apiVersion: dp.wso2.com/v1alpha1
kind: API
metadata:
name: interceptor-api
spec:
apiName: Interceptor API
apiType: REST
apiVersion: 1.0.0
basePath: /interceptor-api/1.0.0
production:
- httpRouteRefs:
- interceptor-http-route
organization: default
HTTPRoute resource¶
Note that the first rule in this HTTPRoute has a filter defined using filter type ExtensionRef which refers to the Interceptor APIPolicy we have defined below. This makes the Interceptor serivce applicable in the operation level.
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
name: interceptor-http-route
spec:
hostnames:
- default.gw.wso2.com
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: default
sectionName: httpslistener
rules:
- backendRefs:
- group: dp.wso2.com
kind: Backend
name: legacy-xml-backend
matches:
- path:
type: RegularExpression
value: /books/with-interceptors
method: POST
filters:
- type: URLRewrite
urlRewrite:
path:
type: ReplaceFullPath
replaceFullPath: /books
- type: ExtensionRef
extensionRef:
group: dp.wso2.com
kind: APIPolicy
name: interceptor-api-policy-operation-level
- backendRefs:
- group: dp.wso2.com
kind: Backend
name: legacy-xml-backend
matches:
- path:
type: RegularExpression
value: /books/without-interceptors
method: POST
filters:
- type: URLRewrite
urlRewrite:
path:
type: ReplaceFullPath
replaceFullPath: /books
Backend resource for API backend¶
apiVersion: dp.wso2.com/v1alpha1
kind: Backend
metadata:
name: legacy-xml-backend
spec:
services:
- host: legacy-xml-backend
port: 9082
Create Interceptor APIPolicy¶
APIPolicy resource with operation level interceptors¶
apiVersion: dp.wso2.com/v1alpha1
kind: APIPolicy
metadata:
name: interceptor-api-policy-operation-level
spec:
override:
requestInterceptors:
- name: request-interceptor-service-operation-level
responseInterceptors:
- name: response-interceptor-service-operation-level
targetRef:
group: dp.wso2.com
kind: Resource
name: interceptor-api
InterceptorService resource for Interceptor API policy¶
``` apiVersion: dp.wso2.com/v1alpha1 kind: InterceptorService metadata: name: request-interceptor-service-operation-level spec: backendRef: name: interceptor-backend includes: - request_headers - request_body - invocation_context
apiVersion: dp.wso2.com/v1alpha1 kind: InterceptorService metadata: name: response-interceptor-service-operation-level spec: backendRef: name: interceptor-backend includes: - response_headers - response_body - invocation_context ```
Backend resource for Interceptor service backend¶
apiVersion: dp.wso2.com/v1alpha1
kind: Backend
metadata:
name: interceptor-backend
spec:
protocol: https
services:
- host: interceptor-backend
port: 9081
tls:
secretRef:
name: interceptor-cert-secret
key: ca.crt
Here interceptor-cert-secret refers to a Kubernetes Secret resource which contains the tls certificate information for the interceptor service.
Tip
You can define CA certificate of interceptor service using three different ways. If you have the certificate on your hand use certificateInline to define it inline. Or you can use secretRef or configMapRef fields to read them from a Secret resource or a ConfigMap resource respectively. Check the Manage Certificate section for more information.
Configuring API level Interceptors¶
When you want to apply the Interceptor APIPolicy for the API, you can create a APIPolicy with targetRef.kind property set to API and give the targetRef.name as the name of the APIresource. Refer the following example which describes a complete example.
Create your API¶
API resource¶
apiVersion: dp.wso2.com/v1alpha1
kind: API
metadata:
name: interceptor-api
spec:
apiName: Interceptor API
apiType: REST
apiVersion: 1.0.0
basePath: /interceptor-api/1.0.0
production:
- httpRouteRefs:
- interceptor-http-route
organization: default
HTTPRoute resource¶
Note that we do not define filter with ExtensionRef type as we did for operation level interceptors.
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
name: interceptor-http-route
spec:
hostnames:
- default.gw.wso2.com
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: default
sectionName: httpslistener
rules:
- backendRefs:
- group: dp.wso2.com
kind: Backend
name: legacy-xml-backend
matches:
- path:
type: RegularExpression
value: /books
method: POST
filters:
- type: URLRewrite
urlRewrite:
path:
type: ReplaceFullPath
replaceFullPath: /books
- backendRefs:
- group: dp.wso2.com
kind: Backend
name: legacy-xml-backend
matches:
- path:
type: RegularExpression
value: /offers
method: POST
filters:
- type: URLRewrite
urlRewrite:
path:
type: ReplaceFullPath
replaceFullPath: /offers
Backend resource for API backend¶
apiVersion: dp.wso2.com/v1alpha1
kind: Backend
metadata:
name: legacy-xml-backend
spec:
services:
- host: legacy-xml-backend
port: 9082
Create Interceptor APIPolicy¶
APIPolicy resource with API level interceptors¶
Since the targetRef.kind is for the API, interceptor is applicable for all the HTTPRoutes reffered from that API.
apiVersion: dp.wso2.com/v1alpha1
kind: APIPolicy
metadata:
name: interceptor-api-policy-api-level
spec:
override:
requestInterceptors:
- name: request-interceptor-service-api-level
responseInterceptors:
- name: response-interceptor-service-api-level
targetRef:
group: dp.wso2.com
kind: API
name: interceptor-api
InterceptorService resource for Interceptor API policy¶
``` apiVersion: dp.wso2.com/v1alpha1 kind: InterceptorService metadata: name: request-interceptor-service-api-level spec: backendRef: name: interceptor-backend includes: - request_headers - request_body - invocation_context
apiVersion: dp.wso2.com/v1alpha1 kind: InterceptorService metadata: name: response-interceptor-service-api-level spec: backendRef: name: interceptor-backend includes: - response_headers - response_body - invocation_context ```
Backend resource for Interceptor service backend¶
apiVersion: dp.wso2.com/v1alpha1
kind: Backend
metadata:
name: interceptor-backend
spec:
protocol: https
services:
- host: interceptor-backend
port: 9081
tls:
secretRef:
name: interceptor-cert-secret
key: ca.crt
Configuring Gateway level Interceptors¶
If you want all of your requests coming to the Gateway (from all the APIs deployed in the Gateway) to be intercepted, then you can target the Interceptor APIPolicy to your Gateway resource like below:
apiVersion: dp.wso2.com/v1alpha1
kind: APIPolicy
metadata:
name: gateway-interceptor-policy
spec:
default:
requestInterceptors:
- name: request-interceptor-service-gateway-level
responseInterceptors:
- name: response-interceptor-service-gateway-level
targetRef:
group: gateway.networking.k8s.io
kind: Gateway
name: default
InterceptorService resource for Interceptor API policy¶
apiVersion: dp.wso2.com/v1alpha1
kind: InterceptorService
metadata:
name: request-interceptor-service-gateway-level
spec:
backendRef:
name: interceptor-backend
includes:
- request_headers
- request_body
- invocation_context
Backend resource for Interceptor service backend¶
apiVersion: dp.wso2.com/v1alpha1
kind: Backend
metadata:
name: interceptor-backend
spec:
protocol: https
services:
- host: interceptor-backend
port: 9081
tls:
secretRef:
name: interceptor-cert-secret
key: ca.crt
Info
This global interceptor is a separate execution from API/Operation level interceptors as we discussed above and they works independently.