istio实现IP白名单
一种结合IP_TAGGING，另一种方式直接判断header中的X-FORWARDED-FOR
配置SVC
ingress-gateway service的Type=Loadbalancer时，需要增加加以下配置，X-FORWARDED-FOR才会是真实的远程IP
1
| externalTrafficPolicy: Local
|
1. 结合IP_TAGGING
配置 AuthorizationPolicy
namespace为 root（istio-system），需要通过selector限制策略应用在istio-ingressgateway
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: ip-white-list
namespace: istio-system # “metadata/namespace” tells which namespace the policy applies. If set to root namespace, the policy applies to all namespaces in a mesh.
spec:
selector:
matchLabels:
app: istio-ingressgateway
istio: ingressgateway
action: DENY
rules:
- to:
- operation:
hosts:
- "*-host.cn"
when:
- key: request.headers[x-envoy-ip-tags]
notValues: # 与ip_tagging配合使用
- "white-list-ip"
|
ip_tagging
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
| apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: ip-white-list
namespace: istio-system
spec:
workloadSelector:
labels:
app: istio-ingressgateway
istio: ingressgateway
configPatches:
- applyTo: HTTP_FILTER
match:
context: GATEWAY
listener:
portNumber: 443
filterChain:
filter:
name: "envoy.http_connection_manager"
subFilter:
name: "envoy.filters.http.rbac"
patch:
operation: INSERT_BEFORE
value:
name: envoy.ip_tagging # https://github.com/envoyproxy/envoy/issues/5267#issuecomment-596909572
typed_config:
"@type": "type.googleapis.com/envoy.config.filter.http.ip_tagging.v2.IPTagging"
request_type: BOTH
ip_tags:
- ip_tag_name: white-list-ip
ip_list:
- address_prefix: 202.220.211.211
|
2. 使用x-forwarded-for
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
| apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: allow-from-manqian
namespace: istio-system # “metadata/namespace” tells which namespace the policy applies. If set to root namespace, the policy applies to all namespaces in a mesh.
spec:
selector:
matchLabels:
app: istio-ingressgateway
istio: ingressgateway
action: DENY
rules:
# - from: # see: https://github.com/envoyproxy/envoy/issues/5267
# - source:
# notIpBlocks:
# - 58.250.159.235 # 深圳办公室联通线
# - 113.90.38.174
- to:
- operation:
hosts:
- "*-grpc.manqian.cn"
when:
- key: request.headers[X-FORWARDED-FOR]
notValues:
- 58.250.159.235
- 113.90.38.174
|
目前 source.ip 不会根据 x-forwarded-for 获取真实ip，不能直接使用 soure.ipBlocks 实现外网IP白名单
参考
