作者洛水石 标签微服务网关、Spring Cloud Gateway、鉴权、限流、日志__________________________________________________一、为什么需要微服务网关1.1 单体应用 vs 微服务架构在单体应用中所有功能模块共享一个入口__INLINE_客户端 → Nginx → 单体应用(用户/订单/支付模块)____INLINE_微服务架构下服务数量爆炸式增长____INLINE_客户端 → 用户服务:8081→ 订单服务:8082→ 支付服务:8083→ 库存服务:8084→ 物流服务:8085→ ...____INLINE_没有网关的问题- 客户端需要维护多个服务地址- 每个服务都要实现鉴权、限流、日志- 跨域问题需要在每个服务处理- 服务升级时客户端需要同步修改1.2 网关的核心价值____INLINE_┌─────────────────────────────────────────────┐│ 微服务网关 ││ ┌─────────┬─────────┬─────────┬─────────┐ ││ │ 路由 │ 鉴权 │ 限流 │ 日志 │ ││ │ Routing │ Auth │ Rate │ Log │ ││ │ │ │ Limit │ │ ││ └─────────┴─────────┴─────────┴─────────┘ │└─────────────────────────────────────────────┘│ │ │用户服务 订单服务 支付服务 库存服务____INLINE_网关统一处理-路由转发/api/users → 用户服务-统一鉴权JWT Token 校验-限流熔断保护后端服务-日志追踪请求全链路记录__________________________________________________二、Spring Cloud Gateway 快速入门2.1 核心概念概念说明示例Route路由规则/api/users/** → lb://user-servicePredicate断言条件Path、Method、HeaderFilter过滤器鉴权、限流、日志2.2 基础配置pom.xml 依赖____INLINE_xmldependenciesdependencygroupIdorg.springframework.cloud/groupIdartifactIdspring-cloud-starter-gateway/artifactId/dependencydependencygroupIdorg.springframework.cloud/groupIdartifactIdspring-cloud-starter-loadbalancer/artifactId/dependency/dependencies____INLINE_application.yml 基础路由____INLINE_yamlserver:port: 8080spring:application:name: gateway-servicecloud:gateway:routes:用户服务路由- id: user-serviceuri: lb://user-servicepredicates:- Path/api/users/**filters:- StripPrefix1订单服务路由- id: order-serviceuri: lb://order-servicepredicates:- Path/api/orders/**filters:- StripPrefix1支付服务路由- id: pay-serviceuri: lb://pay-servicepredicates:- Path/api/pay/**filters:- StripPrefix1____INLINE_路由说明- __lb://__INLINE_使用 LoadBalancer 负载均衡- __StripPrefix1__INLINE_去掉第一个前缀 /api- 例如__/api/users/info→/users/info__INLINE___________________________________________________三、统一鉴权实战3.1 JWT 鉴权方案____INLINE_┌─────────┐ ┌─────────┐ ┌─────────┐│ 客户端 │ ──────→ │ 网关 │ ──────→ │ 业务服务 │└─────────┘ └─────────┘ └─────────┘│ ││ 1.登录获取Token ││←─────────────────││ ││ 2.请求携带Token ││─────────────────→│ 3.校验Token│ ││ 4.返回数据 │ 5.转发请求│←─────────────────│←───────────────│____INLINE_3.2 全局鉴权过滤器____INLINE_javaComponentSlf4jpublic class AuthGlobalFilter implements GlobalFilter, Ordered {Autowiredprivate JwtTokenProvider tokenProvider;// 白名单路径不需要鉴权private static final ListString__QUOTE_1__3.3 Token 刷新机制____INLINE_javaComponentpublic class TokenRefreshFilter implements GlobalFilter, Ordered {Autowiredprivate JwtTokenProvider tokenProvider;Overridepublic MonoVoid__QUOTE_2__3.4 权限控制RBAC____INLINE_javaComponentpublic class RbacAuthFilter implements GlobalFilter, Ordered {// URL-角色映射配置private static final MapString, ListString__QUOTE_3____________________________________________________四、网关限流实战4.1 限流算法选择算法特点适用场景固定窗口简单但存在突刺简单限流滑动窗口平滑精度高精确限流令牌桶允许突发平滑API网关漏桶强制平滑输出流量整形网关推荐令牌桶算法4.2 Redis Lua 分布式限流____INLINE_javaComponentpublic class RateLimitFilter implements GlobalFilter, Ordered {Autowiredprivate StringRedisTemplate redisTemplate;// 限流配置路径 -__QUOTE_4__4.3 热点参数限流Sentinel 集成____INLINE_javaConfigurationpublic class SentinelGatewayConfig {PostConstructpublic void init() {// 注册网关规则GatewayRuleManager.loadRules(Arrays.asList(// 用户API限流100 QPSnew GatewayFlowRule(user-service).setCount(100).setIntervalSec(1),// 订单API限流50 QPS热点参数限流new GatewayFlowRule(order-service).setCount(50).setIntervalSec(1).setParamItem(new GatewayParamFlowItem().setParseStrategy(SentinelGatewayConstants.PARAM_PARSE_STRATEGY_URL_PARAM).setFieldName(userId)),// 支付API严格限流10 QPSnew GatewayFlowRule(pay-service).setCount(10).setIntervalSec(1).setGrade(RuleConstant.FLOW_GRADE_QPS)));}}____INLINE___________________________________________________五、全链路日志追踪5.1 TraceID 传递____INLINE_javaComponentSlf4jpublic class TraceFilter implements GlobalFilter, Ordered {public static final String TRACE_ID_HEADER X-Trace-Id;public static final String SPAN_ID_HEADER X-Span-Id;Overridepublic MonoVoid__QUOTE_5__5.2 异步日志收集____INLINE_javaComponentSlf4jpublic class AccessLogFilter implements GlobalFilter, Ordered {Autowiredprivate AccessLogProducer logProducer;Overridepublic MonoVoid__QUOTE_6__5.3 ELK 日志查询____INLINE_json// Kibana 查询DSL{query: {bool: {must: [{ match: { traceId: abc123def456 } },{ range: { timestamp: { gte: now-1h } } }]}},sort: [{ timestamp: asc }],aggs: {latency_percentiles: {percentiles: { field: duration, percents: [50, 95, 99] }}}}____INLINE___________________________________________________六、完整配置示例6.1 application.yml____INLINE_yamlspring:cloud:gateway:默认过滤器所有路由生效default-filters:- name: Retryargs:retries: 3statuses: BAD_GATEWAY,SERVICE_UNAVAILABLE- name: CircuitBreakerargs:name: defaultfallbackUri: forward:/fallback全局跨域配置globalcors:cors-configurations:[/**]:allowedOrigins: *allowedMethods: GET,POST,PUT,DELETE,OPTIONSallowedHeaders: *allowCredentials: falsemaxAge: 3600路由配置routes:- id: user-serviceuri: lb://user-servicepredicates:- Path/api/users/**- MethodGET,POST,PUT,DELETEfilters:- StripPrefix1- name: RequestRateLimiterargs:redis-rate-limiter.replenishRate: 100redis-rate-limiter.burstCapacity: 150key-resolver: #{ipKeyResolver}- name: Hystrixargs:name: user-servicefallbackUri: forward:/fallback/user- id: order-serviceuri: lb://order-servicepredicates:- Path/api/orders/**filters:- StripPrefix1- name: RequestRateLimiterargs:redis-rate-limiter.replenishRate: 50redis-rate-limiter.burstCapacity: 80熔断器配置hystrix:command:default:execution:isolation:thread:timeoutInMilliseconds: 5000circuitBreaker:requestVolumeThreshold: 10sleepWindowInMilliseconds: 10000errorThresholdPercentage: 50____INLINE_6.2 网关启动类____INLINE_javaSpringBootApplicationEnableDiscoveryClientpublic class GatewayApplication {public static void main(String[] args) {SpringApplication.run(GatewayApplication.class, args);}Beanpublic KeyResolver ipKeyResolver() {return exchange -__QUOTE_7____________________________________________________七、性能优化建议7.1 网关性能指标指标目标值优化方案吞吐量7.2 生产环境配置____INLINE_yamlJVM 参数-Xms2g -Xmx2g-XX:UseG1GC-XX:MaxGCPauseMillis100-Dreactor.netty.ioWorkerCount16Netty 配置spring:cloud:gateway:httpclient:connect-timeout: 2000response-timeout: 5spool:type: elasticmax-connections: 1000max-idle-time: 10s____________________________________________________总结微服务网关三大核心能力能力关键实现注意事项**统一鉴权**JWT 全局过滤器Token刷新、RBAC权限控制**限流保护**令牌桶 Redis分布式限流、热点参数限流**日志追踪**TraceID ELK异步收集、全链路追踪作者洛水石 | 架构进阶 | 微服务网关实战作者洛水石 | 架构进阶 | Java高并发实战