RAM authentication enhances MSE Nacos instance security, but abruptly enabling it can block unauthenticated clients and disrupt business continuity. Grayscale authentication lets you identify and update non-compliant clients before enforcing full authentication, ensuring a seamless transition.
Overview
Grayscale authentication provides a safe, zero-downtime migration path between no authentication and full RAM authentication.
Key benefits
-
No request blocking: During the grayscale period, no client requests are blocked, so business operations continue uninterrupted.
-
Identify non-compliant clients: The system logs access attempts from clients with incorrect authentication settings, helping you pinpoint which clients need updates.
-
Seamless migration: Once all clients are updated, you can safely switch to mandatory authentication with zero downtime.
Prerequisites
-
You have created an MSE Nacos instance.
-
You have enabled RAM authentication-related parameters, such as
ConfigAuthEnabledorNamingAuthEnabled.
Procedure
-
Log on to the MSE Console.
-
In the left-side navigation pane, choose Microservices Registry > Instances.
-
Click the name of the target instance to open its details page.
-
In the left-side navigation pane, click Parameter Settings.
-
In the parameter list, find the
grayAuthparameter and click Edit. -
In the parameter verification dialog box that appears, confirm that you want to enable grayscale authentication (grayAuth).
NoteBefore you enable grayscale authentication, ensure that the
ConfigAuthEnabledandNamingAuthEnabledparameters are already enabled. If neither is enabled, the system enables them for you. -
Click Activate and restart an instance. The cluster performs a rolling restart to apply the new configuration.
Authentication observability
You must upgrade your instance to the Enterprise Edition to view Authentication Observability data.
After enabling grayscale authentication, view authentication observability data in the console, including interception statistics and details.
-
In the left-side navigation pane, choose Security Protection > Authentication.
-
Click the Observe authentication tab.
-
View the following information:
-
Current authentication status: Shows whether grayscale authentication is enabled. You can disable it with one click or refresh the status.
-
Interception statistics: Shows interception counts at the service registry level and the configuration center level.
-
Interception trend: Shows a time-series chart of interception counts, which can be broken down by interceptions for the service registry and configuration center.
-
Interception details: Lists the identified problematic clients, including request time, group, service or configuration, source IP, interception type, and interception details.
-
-
Based on the information in the interception details, update the authentication configuration of the affected clients.
Results
After grayscale authentication is enabled, the system logs all client access attempts that would be blocked due to incorrect authentication settings. Use these logs to correct each client's configuration. Once all clients are updated and no more interceptions are logged, disable grayscale authentication and switch to mandatory RAM authentication.
Regularly check the Authentication Observability page to ensure all clients are correctly configured before you disable grayscale authentication.