gpt4 book ai didi

kubernetes - EnvoyFilter 排除特定主机

转载 作者:行者123 更新时间:2023-12-05 06:16:49 25 4
gpt4 key购买 nike

我需要从如下所示的 EnvoyFilter 中排除特定主机:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: authn-filter
spec:
workloadLabels:
istio: ingressgateway
filters:
- filterConfig:
httpService:
serverUri:
uri: http://authservice.$(namespace).svc.cluster.local
cluster: outbound|8080||authservice.$(namespace).svc.cluster.local
failureModeAllow: false
timeout: 10s
authorizationRequest:
allowedHeaders:
patterns:
- exact: "cookie"
- exact: "X-Auth-Token"
authorizationResponse:
allowedUpstreamHeaders:
patterns:
- exact: "kubeflow-userid"
statusOnError:
code: GatewayTimeout
filterName: envoy.ext_authz
filterType: HTTP
insertPosition:
index: FIRST
listenerMatch:
listenerType: GATEWAY

问题是过滤器适用于影响所有通过该网关的流量的默认 istio 入口网关,我希望有一些主机可以从过滤器中排除/列入白名单。

最佳答案

我找到了答案 here .这个问题要求排除一些路径,但我对主机也很成功。这是我使用的:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: bypass-authn
namespace: istio-system
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:
- applyTo: HTTP_ROUTE
match:
routeConfiguration:
vhost:
name: subdomain.example.org:80 # <== your host goes here
patch:
operation: MERGE
value:
name: envoy.ext_authz_disabled
typed_per_filter_config:
envoy.ext_authz:
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
disabled: true

更多信息请参见 Istio documentation .具体来说,文档指定您还应该将端口放入 name: 字段,但我认为没有它也应该可以工作。

关于kubernetes - EnvoyFilter 排除特定主机,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/61941663/

25 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com