When using MSE Nacos for service discovery and configuration management, enable RAM authentication to enhance instance security. However, abruptly switching to RAM authentication can block unauthenticated clients and disrupt business continuity. Grayscale authentication lets you identify and update non-compliant clients before enforcing authentication, ensuring a seamless transition.
Overview
Grayscale authentication provides a safe, zero-downtime migration path between no authentication and full RAM authentication.
Key benefits
-
No request blocking: During the grayscale period, no client requests are blocked, ensuring your business operations continue without interruption.
-
Identify non-compliant clients: The system automatically logs access attempts from clients with incorrect authentication settings, helping you pinpoint which clients need to be updated.
-
Seamless migration: After you update all clients, you can safely switch to the mandatory authentication mode, guaranteeing a zero-downtime migration.
Prerequisites
-
You have created an MSE Nacos instance.
-
You have enabled RAM authentication-related parameters, such as
ConfigAuthEnabledorNamingAuthEnabled.
Procedure
-
Log on to the MSE Console.
-
In the left-side navigation pane, choose Microservices Registry > Instances.
-
Click the name of the target instance to open its details page.
-
In the left-side navigation pane, click Parameter Settings.
-
In the parameter list, find the
grayAuthparameter and click Edit. -
In the parameter verification dialog box that appears, confirm that you want to enable grayscale authentication (grayAuth).
NoteBefore you enable grayscale authentication, ensure that the
ConfigAuthEnabledandNamingAuthEnabledparameters are already enabled. If neither is enabled, the system enables them for you. -
Click Activate and restart an instance. The cluster performs a rolling restart to apply the new configuration.
Authentication observability
You must upgrade your instance to the Enterprise Edition to view Authentication Observability data.
After you enable grayscale authentication, you can view authentication observability data in the console, including interception statistics and interception details.
-
In the left-side navigation pane, choose Security Protection > Authentication.
-
Click the Observe authentication tab.
-
View the following information:
-
Current authentication status: Shows whether grayscale authentication is enabled. You can disable it with one click or refresh the status.
-
Interception statistics: Shows interception counts at the service registry level and the configuration center level.
-
Interception trend: Shows a time-series chart of interception counts, which can be broken down by interceptions for the service registry and configuration center.
-
Interception details: Lists the identified problematic clients, including request time, group, service or configuration, source IP, interception type, and interception details.
-
-
Based on the information in the interception details, update the authentication configuration of the affected clients.
Results
After you enable grayscale authentication, the system automatically logs all client access attempts that would be blocked due to incorrect authentication settings. You can use these logs to correct each client's configuration. After all clients are updated and no more interceptions are logged, you can disable grayscale authentication and switch to the mandatory RAM authentication mode.
Regularly check the Authentication Observability page to ensure all clients are correctly configured before you disable grayscale authentication.