Question

我需要从EnvoyFilter中排除如下所示的特定主机：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: authn-filter
spec:
  workloadLabels:
    istio: ingressgateway
  filters:
  - filterConfig:
      httpService:
        serverUri:
          uri: http://authservice.$(namespace).svc.cluster.local
          cluster: outbound|8080||authservice.$(namespace).svc.cluster.local
          failureModeAllow: false
          timeout: 10s
        authorizationRequest:
          allowedHeaders:
            patterns:
            - exact: "cookie"
            - exact: "X-Auth-Token"
        authorizationResponse:
          allowedUpstreamHeaders:
            patterns:
            - exact: "kubeflow-userid"
      statusOnError:
        code: GatewayTimeout
    filterName: envoy.ext_authz
    filterType: HTTP
    insertPosition:
      index: FIRST
    listenerMatch:
      listenerType: GATEWAY

问题在于该过滤器适用于默认istio入口网关，该网关会影响通过该网关的所有流量，我希望某些主机可以从过滤器中排除/列入白名单。

Answer 1

我找到了答案here。这个问题要求排除一些路径，但我在主机上也成功了。这是我用的：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: bypass-authn
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_ROUTE
    match:
      routeConfiguration:
        vhost:
          name: subdomain.example.org:80 # <== your host goes here
    patch:
      operation: MERGE
      value:
        name: envoy.ext_authz_disabled
        typed_per_filter_config:
          envoy.ext_authz:
            "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
            disabled: true

Istio documentation 中有更多信息。具体来说，文档指定您还应该将端口放入 name: 字段中，但我认为没有它也可以正常工作。

EnvoyFilter排除特定主机

1 个答案: