如何搭建一个高效安全的API开放平台：完整步骤指南

┌─────────────────────────────────────────────────┐
│                  客户端应用                     │
└──────────────────────┬─────────────────────────┘
                       │
┌──────────────────────▼─────────────────────────┐
│                  API网关集群                   │
└───────┬───────────────────────┬────────────────┘
        │                       │
┌───────▼───────┐     ┌─────────▼─────────┐
│  认证授权服务  │     │    API管理平台    │
└───────┬───────┘     └─────────┬─────────┘
        │                       │
┌───────▼───────────────────────▼─────────┐
│              业务微服务集群              │
└───────┬───────────────────────┬─────────┘
        │                       │
┌───────▼───────┐     ┌─────────▼─────────┐
│   缓存系统    │     │     数据库       │
└───────────────┘     └──────────────────┘

# docker-compose.yml 示例
version: '3'

services:
  kong:
    image: kong:latest
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: postgres
      KONG_PROXY_ACCESS_LOG: /dev/stdout
      KONG_ADMIN_ACCESS_LOG: /dev/stdout
      KONG_PROXY_ERROR_LOG: /dev/stderr
      KONG_ADMIN_ERROR_LOG: /dev/stderr
    ports:
      - "8000:8000"   # 代理端口
      - "8443:8443"   # SSL代理端口
      - "8001:8001"   # 管理API
      - "8444:8444"   # 管理API SSL
    depends_on:
      - postgres

  postgres:
    image: postgres:9.6
    environment:
      POSTGRES_USER: kong
      POSTGRES_PASSWORD: kong
      POSTGRES_DB: kong
    volumes:
      - postgres-data:/var/lib/postgresql/data

volumes:
  postgres-data:

# Flask示例代码
from authlib.integrations.flask_oauth2 import AuthorizationServer
from models import db, User, OAuth2Client

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'
app.config['OAUTH2_JWT_ENABLED'] = True
app.config['OAUTH2_JWT_ISS'] = 'https://auth.your-api.com'
app.config['OAUTH2_JWT_KEY'] = 'your-jwt-secret'
app.config['OAUTH2_JWT_ALG'] = 'HS256'

authorization = AuthorizationServer()

def config_oauth(app):
    authorization.init_app(app)

    @app.route('/oauth/token', methods=['POST'])
    def issue_token():
        return authorization.create_token_response()

# swagger.yaml 示例
openapi: 3.0.0
info:
  title: 示例API平台
  version: 1.0.0
  description: |-
    这是我们的开放API平台文档
    
servers:
  - url: https://api.example.com/v1
    description: 生产环境

paths:
  /users:
    get:
      summary: 获取用户列表
      description: 返回分页用户数据
      parameters:
        - name: page
          in: query
          schema:
            type: integer
          description: 页码
      responses:
        '200':
          description: 成功返回用户列表
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/User'

# prometheus.yml
global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'api-gateway'
    metrics_path: '/metrics'
    static_configs:
      - targets: ['kong:8001']
  
  - job_name: 'business-service'
    static_configs:
      - targets: ['service1:8080', 'service2:8080']