基于Azure DevOps Pipeline实现APIM自定义策略幂等自动化创建

需求概述 #

寻求在Azure API Manager中实现API和操作范围的自定义策略幂等自动化创建方案。

Pipeline输入示例 #

stages:
  - template: api-ops-pipeline.yaml
    parameters:
      policyList:
      - name: rate_limit_ip
        scope: api
        apiname: test-policy, test2-policy

      - name: IPfilter
        scope: operation
        ipAddressesFrom: xxxxx
        ipAddressesTo: xxxxxxx
        operationname: getxxx, getyy, getzz

Policy.xml模板示例 #

<policies>
    <inbound>
        <base />
         $(rate-limit-by_ip)
         $(rate-limit-by_subkey)
         $(rate-limit-by_DevID)
         $(rate-limit-by_ip)+$(rate-limit-by_DevID)
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
         $(rate-limit-by-ip_error)
         $(rate-limit-by_DevID_error)
         
    </on-error>
</policies>

核心流程说明 #

1. 生成initial_policy.xml
   根据应用团队提供的policyList，按策略范围（API级、单个/多个操作级）生成自定义initial_policy.xml文件，支持以下策略组合：

   • rate-limit-by_ip
   • rate-limit-by_subkey
   • rate-limit-by_DevID
   • rate-limit-by_ip+ rate-limit-by_DevID
   • 含错误处理属性的任意自定义组合
   • 若策略范围为操作级，需先检查父级API或APIM实例是否已应用相同策略。

2. 生成并应用final_policy.xml
   生成initial_policy.xml后，替换用户输入的参数（如阈值、时间等）得到final_policy.xml，最终将其应用到指定范围（API/多个API、操作/多个操作）。

已草拟的Pipeline模板示例 #

jobs:
  - job: api
    displayName: 'api policy'
    variables:
    - group: api_policy
    workspace:
      clean: all
    pool:
      name: xxxxxxx
    steps:
    - ${{ each policy in parameters.policyList }}:
      - ${{ if and(eq(policy.name, 'rate_limit_ip'), eq(policy.scope, 'api') ) }}:
        - bash: |      
           apiName=${{ policy.Name }}
           echo "##vso[task.setvariable variable=apiName]$apiName" 
           xxxxxxxxxxxxxxxxx
           xxxxxxxxxxxxxxxxxxxxxxxx
            xxxxxxxxxxxxxxxxxxxxxx          
          name: Resolve_variable  

        - task: qetza.replacetokens.replacetokens-task.replacetokens@3
          displayName: 'create initial xml'
          inputs:
            rootDirectory: '$(System.DefaultWorkingDirectory)/policy'
            targetFiles: initial_policy.xml
            tokenPrefix: '${'
            tokenSuffix: '}$'
            enableTelemetry: false
          continueOnError: true

        - task: qetza.replacetokens.replacetokens-task.replacetokens@3
          displayName: 'create final xml'
          inputs:
            rootDirectory: '$(System.DefaultWorkingDirectory)/policy'
            targetFiles: final_policy.xml
            tokenPrefix: '${'
            tokenSuffix: '}$'
            enableTelemetry: false
          continueOnError: true

内容的提问来源于stack exchange，提问作者Vowneee