Configure Custom Plugins in Tyk Cloud

Introduction

This section explains that you can use plugins with Tyk Cloud and links to details of Python, JSVM and Golang based plugins. Tyk Cloud allows you to take advantage of Tyk’s plugin architecture that allows you to write powerful middleware. For this version of Tyk Cloud, we support the use of Python, JavaScript Middleware and Golang based plugins. For more details, see:

Next you’ll set up an Tyk Cloud Control Plane to use a Python Authentication Plugin.

Setup Control Plane

This page explains how to set up a control plane with plugins to customize it on Tyk Cloud, so that you can ensure your API management solution is as effective as possible. What do I need to do to use Plugins?

You need to enable Plugins on a Control Plane and on a Cloud Data Plane.
You need to enter Provider details to enable you to store and access your plugins. For this version of Tyk Cloud, we are supporting Amazon AWS S3. If you haven’t got an AWS S3 account, go to https://aws.amazon.com/s3/ and set one up. You will need the following details to configure SW3 within your Control Plane:
- Your AWS Key ID
- Your AWS Secret
- Your AWS Region
For this release of Tyk Cloud, you need to enter your AWS Region manually. You also need to consider that uploading a custom plugin bundle to Tyk Cloud results in a new bucket being created for each bundle uploaded. It also requires that Tyk Cloud has permissions in the form of an AWS IAM policy to have create rights on AWS.

AWS IAM Policy What is an IAM Policy?

A policy is an entity that, when attached to an identity or resource, defines their permissions. IAM policies define permissions for an action regardless of the method that you use to perform the operation.
We have included a sample IAM policy that you need to create in AWS to allow the plugin bundle to work. For more information on creating IAM policies, see the AWS Documentation.
We recommend you restrict your IAM user as much as possible before sharing the credentials with any 3rd party, including Tyk Cloud. See IAM User Permissions for more details.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:CreateBucket",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:DeleteBucket"
            ],
            "Resource": "arn:aws:s3:::mserv-plugin-*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::mserv-plugin-*/*"
        }
    ]
}

Next you’ll set up the Python authentication code bundle.

Uploading your Bundle

This section walks you through uploading your bundle as part of the process of Python custom authentication on Tyk Cloud, so that you can ensure your API management solution is as effective as possible. How do I upload my bundle file to my Amazon S3 bucket? We are going to use a Tyk CLI tool called mservctl. This acts as a file server for our plugins. You use it to push your plugin bundle to your S3 bucket. Your Tyk Cloud Tyk Gateway will use MServ to retrieve your bundle, instead of connecting directly into S3. Prerequisites

You need to install the mserv binary according to your local environment from the following repo - https://github.com/TykTechnologies/mserv/releases. Linux and MacOS are supported.
From your Control Plane you need the following settings.

Your Tyk Cloud Control Plane Ingress File Server Endpoint (1)
Your File Server API Key (2)

How does mservctl work? You create a config file (in YAML) that contains your Control Plane settings that connects to your S3 bucket. You then use a push command to upload your bundle.zip file to your bucket. mservctl settings - Mac To run mservctl from your local machine, from the binary directory, run:

./mservctl.macos.amd64

mservctl settings - Linux To run mservctl from your local machine, from the binary directory, run:

./mservctl.linux.amd64

The help for mservctl will be displayed. We will be using the config file options for this tutorial.

$ mservctl help
mservctl is a CLI application that enables listing and operating middleware in an Mserv instance.
Use a config file (by default at $HOME/.mservctl.yaml) in order to configure the Mserv to use with the CLI.
Alternatively pass the values with command line arguments, e.g.:
$ mservctl list -e https://remote.mserv:8989
Set TYK_MSERV_LOGLEVEL="debug" environment variable to see raw API requests and responses.
Usage:
  mservctl [command]
Available Commands:
  delete      Deletes a middleware from mserv
  fetch       Fetches a middleware record from mserv
  help        Help about any command
  list        List middleware in mserv
  push        Pushes a middleware to mserv
Flags:
      --config string     config file (default is $HOME/.mservctl.yaml)
  -e, --endpoint string   mserv endpoint
  -h, --help              help for mservctl
  -t, --token string      mserv security token
Use "mservctl [command] --help" for more information about a command.

You may have to change the CHMOD settings on the binary to make it executable. (chmod +x <filename>). On MacOS you may also need to change your security settings to allow the binary to run.

Creating the mserv config file

Create a file (we’ll call it python-demo.mservctl.yaml)
Copy your Control Plane File Server endpoint URL and use it for your endpoint flag. Remember to prepend it with https://.
Copy your File Server API Key and use it for your token flag

Your python-demo.mservctl.yaml config file should now look like this:

endpoint: https://agreeable-native-mgw.usw2.ara-staging.tyk.technology/mserv
token: eyJvcmciOiI1ZWIyOGUwY2M3ZDc4YzAwMDFlZGQ4ZmYiLCJpZCI6ImVmMTZiNGM3Y2QwMDQ3Y2JhMTAxNWIyOTUzZGRkOWRmIiwiaCI6Im11cm11cjEyOCJ9

Uploading To Your S3 Bucket

We are going to use the MacOS binary here, just substitute the binary name for the Linx version if using that OS. Note we have our YAML config file in the same directory as our bundle.zip file. Run the following mserv push command:

./mservctl.macos.amd64 --config ~/my-tyk-plugin/python-demo.mservctl.yaml push ~/my-tyk-plugin/bundle.zip

You should get confirmation that your middleware has been uploaded to your S3 bucket.

INFO[0000] Using config file:/Users/marksouthee/my-tyk-plugin/python-demo.mservctl.yaml  app=mservctl
Middleware uploaded successfully, ID: 9c9ecec1-8f98-4c3f-88cd-ca3c27599e6b

You will notice that the middleware uploaded has been given an ID. We are going to use that ID with an API that allows you to specify specific middlware. You can also check the contents of the middleware you have just uploaded using the mservctl list command. Run:

./mservctl.macos.amd64 --config ~/my-tyk-plugin/python-demo.mservctl.yaml list

You will see the list of middleware you have pushed to your S3 Bucket

INFO[0000] Using config file:/Users/marksouthee/my-tyk-plugin/python-demo.mservctl.yaml  app=mservctl
  ID                                    ACTIVE  SERVE ONLY  LAST UPDATE

  9c9ecec1-8f98-4c3f-88cd-ca3c27599e6b  true    false       2020-05-20T15:06:55.901Z

If you use the -f flag with the list command, you will see the functions within your middleware listed:

./mservctl.macos.amd64 --config ~/my-tyk-plugin/python-demo.mservctl.yaml list -f

As you can see, the 2 middleware hooks specified within your manifest.json are returned:

INFO[0000] Using config file:/Users/marksouthee/my-tyk-plugin/python-demo.mservctl.yaml  app=mservctl
  ID                                    ACTIVE  SERVE ONLY  LAST UPDATE               FUNCTION          TYPE

  9c9ecec1-8f98-4c3f-88cd-ca3c27599e6b  true    false       2020-05-20T15:06:55.901Z
  MyPostMiddleware  Post
  MyAuthMiddleware  CustomKeyCheck

Next you will create an API from our Control Plane and see our middleware in action.

Test Middleware

This section explains how to test out your Python custom authentication on Tyk Cloud, to ensure that it’s working properly. Testing our middleware with an API You now have your middleware uploaded to your S3 bucket. We are now going to create an API from our Control Plane Dashboard and test it via Postman Prerequisites

A Postman API Client from https://www.postman.com/product/api-client/
Your mserv middleware ID
The auth value token from your middleware.py code

Create your API

From your Control Plane in Tyk Cloud, click the Ingress > Dashboard link

Overview

Getting Started

Management

Configuration

Developer Support

Configure Custom Plugins in Tyk Cloud

Introduction

Setup Control Plane

Uploading your Bundle

Test Middleware

​Introduction

​Setup Control Plane

​Uploading your Bundle

​Test Middleware

Introduction

Setup Control Plane

Uploading your Bundle

Test Middleware