feat: add embedded apisix dashboard ui#12276
Conversation
bzp2010
changed the title
| location = /ui { | ||
| return 301 /ui/; | ||
| } | ||
| location ^~ /ui/ { |
There was a problem hiding this comment.
There are no IP or permission restrictions, which may cause security issues
There was a problem hiding this comment.
There are no security concerns about unauthorized access as you understand it.
Even if that ui endpoint is exposed on the Internet, the user still needs to be able to access the Admin API (/apisix/admin/xx) and have the proper credentials. And this part will undoubtedly be IP-restricted depending on the configuration.
Separate access to the UI makes no sense; that thing will be built in CI and will not contain any data about the user's environment. Without credentials and permissions, that UI will always just report errors and not display any data.
However, I recognize that this does carry some risk, mainly from the fact that if the endpoint is unintentionally exposed, it may cause bandwidth consumption on the server, but not face any potential data leakage or illegal operations.
For that reason, I'll be introducing the IP restrictions that are currently in place on the Admin API to the new endpoint at the same time to alleviate that concern.
There was a problem hiding this comment.
Moved allow/deny on /apisix/admin to the server block level, which will resolve this issue.
There was a problem hiding this comment.
Added test cases for this.
| # role: viewer | ||
|
|
||
| enable_admin_cors: true # Enable Admin API CORS response header `Access-Control-Allow-Origin`. | ||
| enable_admin_ui: true # Enable embedded APISIX Dashboard UI. |
There was a problem hiding this comment.
if the role of APISIX is data plane, will enable_admin_ui be false automatically? Or we can set enable_admin_ui to false by default.
There was a problem hiding this comment.
On the data plane, the Admin API won't actually start at all.
Since the ui enforces the use of the Admin API port (to minimize problems with CORS), it is implicit that if the Admin API is not enabled, the ui will not be enabled.
So the answer to that question is that if the Admin API is not enabled (e.g. by turning it off on traditional, or by using data plane mode), the config item will have no effect. That is, whatever it is set to, the ui will not be exposed.
This is accomplished by a template in ngx_tpl, where location blocks about /ui/ are not rendered if the server block used by the Admin API does not exist.
There was a problem hiding this comment.
So I don't think anything needs to be done about it.
About the documentationThis integration process is not yet complete. We need to modify the APISIX build process to complete the front-end compilation in advance. |
dosubot
Bot
added
size:L
Perhaps you could try reusing the Dockerfile used to build the image in |
I would try to compile the frontend in the workflow and copy dist directly when building the container. Probably not modifying the Dockerfile significantly. For example, change to a multi-stage build. |
moonming
left a comment
moonming
left a comment
There was a problem hiding this comment.
How should the Dashboard be integrated with APISIX? Should we embed the Dashboard's commit ID as part of the integration?
submodule (I prefer this way) or follow https://github.com/apache/apisix/blob/master/.requirements. |
We need to adjust the APISIX build and release process to shift the functionality of the apisix-docker repository to the APISIX repository itself. No doubt these will be done before the next release. First, let me merge this PR. After that, I will try to contact the ASF Infra team to configure Docker Hub credentials for the apisix repository. https://issues.apache.org/jira/browse/INFRA-26888 |
5 participants
Description
Add a new embedded UI to APISIX as part of the apache/apisix-dashboard#2981 plan.
This is the infrastructure for enabling the embedded dashboard.
Subsequent work needs to be completed in the build process to include the built frontend files in the APISIX container build. This is expected to slightly increase the container image size.
Which issue(s) this PR fixes:
Fixes #12160
Checklist