<h2>Question</h2>

<p>Can I get nginx to call another microservice inside of AKS k8s prior to it routing to the requested api? - the goal being to speed up requests (fewer hops) and simplify build and deployment (fewer services).</p>

<h2>Explanation</h2>

<p>In our currently deployed Azure AKS (Kubernetes) cluster, we have an additional service I was hoping to replace with nginx. It's a routing microservice that calls out to a identity API prior to doing the routing.</p>

<p>The reason is a common one I'd imagine, we recieve some kind of authentication token via some pre-defined header(s) (the standard <code>Authorization</code> header, or sometimes some bespoke ones used for debug tokens, and impersonation), we call from the routing API into the identity API with those pre-defined headers and get a user identity object in return.</p>

<p>We then pass on this basic user identity object into the microservices so they have quick and easy access to the user and roles.</p>

<p>A brief explanation would be:</p>

<ul>
<li>Nginx receives a request, off-loads SSL and route to the requested service.</li>
<li>Routing API takes the authorization headers and makes a call to the Identity API.</li>
<li>Identity API validations the authorization information and returns either an authorization error (when auth fails), or a serialized user identity object.</li>
<li>Router API either returns there and then, for failure, or routes to the requested microservice (by cracking the request path), and attaches the user identity object as a header.</li>
<li>Requested microservice can then turn that user identity object into a Claims Principal in the case of .NET Core for example.</li>
</ul>

<p><a href="https://i.stack.imgur.com/C7vwo.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/C7vwo.png" alt="k8s with our own Router API"></a></p>

<p>There are obviously options for merging the Router.API and the UserIdentity.API, but keeping the separation of concerns seems like a better move. I'd just to remove the Route.API, in-order to maintain that separation, but get nginx to do that work for me.</p>

<p>ProxyKit (<a href="https://github.com/damianh/ProxyKit" rel="nofollow noreferrer">https://github.com/damianh/ProxyKit</a>) could be a good alternative to nginx - it allows you to easily add custom logic to certain requests (for example I lookup API keys based on a tenant in URL) and you can cache the responses using CacheCow (see a recipe in ProxyKit source)</p>
