Question

我在Kubernetes容器中运行了HAproxy。这是示例日志的样子

<134>Jul 20 13:11:37 haproxy[6]: <SOURCE_ADDRESS> [20/Jul/2020:13:11:37.713] front gameApi/game-api-test 0/0/0/9/9 200 384 - - ---- 37/37/0/0/0 0/0 {<FORWARD_FOR_ADDRESS>} "GET /api/games/lists?dtype=brandlist HTTP/1.1"

这里的是haproxy kubernetes节点的ip地址，我需要将其用作clinet / forwardfor ip地址，以便filebeat能够正确解析地理位置。

编辑：

我找到了使用haproxy的解决方案，只需设置http-request set-src hdr(x-forwarded-for)

但是，尝试使用解决方案externalTrafficPolicy: Local似乎破坏了我服务网站的能力。当我尝试访问某个网站时，它会显示“无法访问此网站”或“安全连接失败”

代理服务

apiVersion: v1

kind: Service
metadata: 
  name: haproxy-test
  labels:
    app: haproxy-test
  namespace: test
  annotations:
    # Note that the backend talks over HTTP.
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
    service.beta.kubernetes.io/aws-sload-balancer-ssl-cert: arn:aws:acm:us-east-2:redacted:certificate/redacted
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
spec: 
  type: LoadBalancer
  externalTrafficPolicy: Local
  ports: 
  - port: 80
    name: http
    targetPort: 80
    protocol: "TCP"
  - port: 443
    name: https
    targetPort: 80
    protocol: "TCP"
  selector: 
    app: haproxy-test
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: haproxy-test
  namespace: test
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: haproxy-test
    spec:
      containers:
      - name: haproxy-test
        image: <redacted>.dkr.ecr.us-east-2.amazonaws.com/haproxy:$TAG
        imagePullPolicy: Always
        ports:
        - containerPort: 80
        resources:
          limits:
            cpu: "50m"
          requests:
            cpu: "25m"

Answer 1

您可以通过将externalTrafficPolicy设置为local来保留源IP。请查看此问题以获取更多详细信息How do Kubernetes NodePort services with Service.spec.externalTrafficPolicy=Local route traffic?

或者使用http-request set-src hdr(x-forwarded-for)配置HAProxy使用X-Forward-For标头的内容来建立其内部请求源地址的概念，而不是使用实际IP地址来启动入站连接。 / p>

haproxy源ip地址显示Kubernetes节点ip地址

1 个答案: