Istio - 阻止某些 IP 访问服务答案

【问题标题】：Istio - Block certain IPs to access servicesIstio - 阻止某些 IP 访问服务
【发布时间】：2020-01-15 16:37:46
【问题描述】：

我想阻止某些 IP 列表访问服务。为此，我使用下面的代码，但它给了我upstream connect error or disconnect/reset before headers. reset reason: connection termination。难道我做错了什么？ Istio 策略设置正确。我检查了给定的示例代码，它工作正常，但我想阻止外部 IP。

yaml

apiVersion: config.istio.io/v1alpha2
kind: handler
metadata:
  name: blacklistip
spec:
  compiledAdapter: listchecker
  params:
    # providerUrl: ordinarily black and white lists are maintained
    # externally and fetched asynchronously using the providerUrl.
    overrides: ["xx.xx.xx.xx"]  # overrides provide a static list
    blacklist: true
    entryType: IP_ADDRESSES
---
apiVersion: config.istio.io/v1alpha2
kind: instance
metadata:
  name: clientip
spec:
  compiledTemplate: listentry
  params:
    value: request.headers["x-forwarded-for"] | "unknown"
---
apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: checkip
spec:
  match: source.labels["istio"] == "ingressgateway"
  actions:
  - handler: blacklistip
    instances: [ clientip ]

我检查了 istioingressgateway 日志：

{"bytes_sent":"95","upstream_cluster":"outbound|3000||api.default.svc.cluster.local","downstream_remote_address":"xx.xx.xx.xx:59762","authority":"api.example.com","path":"/core/csrf","protocol":"HTTP/2","upstream_service_time":"-","upstream_local_address":"-","duration":"1","downstream_local_address":"10.2.0.14:443","upstream_transport_failure_reason":"-","route_name":"-","response_code":"503","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36","response_flags":"UC","start_time":"2020-01-15T16:32:21.634Z","method":"GET","request_id":"353149b6-0749-4a1a-9348-4016d20215de","upstream_host":"10.2.0.33:3000","x_forwarded_for":"xx.xx.xx.xx","requested_server_name":"api.example.com","bytes_received":"0","istio_policy_status":"-"}

pod 内的 Istio 代理日志：

{"authority":"-","path":"-","protocol":"-","upstream_service_time":"-","upstream_local_address":"127.0.0.1:53894","duration":"0","downstream_local_address":"10.2.0.33:3000","upstream_transport_failure_reason":"-","route_name":"-","response_code":"0","user_agent":"-","response_flags":"-","start_time":"2020-01-15T17:21:25.220Z","method":"-","request_id":"-","upstream_host":"127.0.0.1:3000","x_forwarded_for":"-","requested_server_name":"outbound_.3000_._.api.default.svc.cluster.local","bytes_received":"0","istio_policy_status":"-","bytes_sent":"0","upstream_cluster":"inbound|3000|https|api.default.svc.cluster.local","downstream_remote_address":"10.2.0.14:37126"}

Istio 版本：1.4.2

混音器日志

2020-01-15T22:48:47.633162Z error   evaluation failed at [sourceip.instance.default]'Value': 'lookup failed: 'request.headers''
2020-01-15T22:48:47.633192Z error   error creating instance: destination='listentry:whitelistip.default(listchecker)', error='evaluation failed at [sourceip.instance.default]'Value': 'lookup failed: 'request.headers'''
2020-01-15T22:48:47.633204Z error   api Check failed: performing check operation failed: 1 error occurred:
* evaluation failed at [sourceip.instance.default]'Value': 'lookup failed: 'request.headers''

【问题讨论】：

在您的应用程序 pod 上运行的 istio 代理 sidecar 的日志
连同该错误消息，您是否收到任何错误代码，例如 503？
你在使用 nginx 入口吗？
@ArghyaSadhu：使用代理日志更新问题。我正在使用istio ingressgateway。在浏览器中我只看到upstream connect error or disconnect/reset before headers. reset reason: connection termination。
另外，当我将 value: request.headers["x-forwarded-for"] | "unknown" 替换为 value: source.ip | ip("0.0.0.0") 时，它可以工作。但是，我想在我的用例中使用客户端 IP。

标签： kubernetes istio nginx-ingress

【解决方案1】：

为了使x-forwarded-for 工作，网关需要将该标头转发到与您的应用程序 pod 一起运行的 istio-proxy sidecar。

您需要在网关中进行一些配置才能转发。检查this issue，它指的是其他问题以及如何操作的详细信息。

如果您可以选择使用 nginx ingress 而不是 istio ingress，那么您可以使用 request.headers["x-real-ip"]，它由 nginx 基于 configuration 设置

【讨论】：

我在 x-forwarded-for 中获取客户端 IP，但不知何故，混音器无法识别它。请参阅更新的问题。我添加了混音器日志。
"x_forwarded_for":"-" 没有 ip
正如您在日志中看到的那样，它存在于 ingressgateway 中，但不在 pod 的代理容器中。这意味着两者之间有问题。