Question

我有两个虚拟服务配置文件，它们由istio合并为一个。

我希望仅通过客户端ip地址列表访问特定的API（帐户/ v1 /邀请）。

此API仅由外部后端服务器调用，我想限制仅由我列出的IP地址调用该API的功能。

我的假设是，在host参数中列出ip地址会强制执行此限制，但我根本无法访问api。

我是正确配置它还是我做出了严重错误的假设？

---虚拟服务Yaml ---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: mp-server-virtualservice
spec:
  hosts:
  - "*"
  gateways:
  - mp-server-gateway              
  http:
  - match:
    - uri:
        exact: /private/api
    - uri:
        exact: /private/graphiql
    - uri:
        exact: /public/api
    route:
    - destination:
        host: mp-server
        port:
          number: 4000
    corsPolicy:
      allowOrigin:
        - 'https://xxxxxxx.com'
      allowMethods:
        - POST
        - GET
        - OPTIONS
      allowHeaders:
        - content-type
        - namespace
        - authorization
      maxAge: 500s
      allowCredentials: true

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: mp-server-virtualservice-machine2machine
spec:
  hosts:
  - "138.91.154.99"
  - "54.183.64.135"
  - "54.67.77.38"
  - "54.67.15.170"
  - "54.183.204.205"
  - "54.173.21.107"
  - "54.85.173.28"
  - "35.167.74.121"
  - "35.160.3.103"
  - "35.166.202.113"
  - "52.14.40.253"
  - "52.14.38.78"
  - "52.14.17.114"
  - "52.71.209.77"
  - "34.195.142.251"
  - "52.200.94.42"
  gateways:
  - mp-server-gateway              
  http:
  - match:
    - uri:
        exact: /accounts/v1/invites
    route:
    - destination:
        host: mp-server
        port:
          number: 4000

---网关Yaml ---

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: mp-server-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    tls:
      httpsRedirect: true
    hosts:
    - "*"
  - port:
      number: 443
      name: https-443
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "*"

Answer 1

恐怕Istio基于IP的白/黑列表访问网格内部服务的方式是通过使用IP_ADDRESSES类型的listchecker。请检查示例here。

根据文档（Traffic Management），虚拟服务主机下的hosts应该具有DNS名称（而非IP地址），该名称需要由群集DNS服务器解析为FQDN。

Istio虚拟服务：仅允许通过ip地址列表访问某些api

1 个答案: