Istio 常見(jiàn)問(wèn)題 - 獲取客戶端真實(shí) IP

原文：https://makeoptim.com/istio-faq/get-client-ip

問(wèn)題現(xiàn)象
解決方法
- 升級(jí) Istio
- 設(shè)置 externalTrafficPolicy
參考鏈接
延伸閱讀

問(wèn)題現(xiàn)象

在帶有 istio-injection: enabled 標(biāo)簽的命名空間中部署服務(wù)急鳄，服務(wù)無(wú)法通過(guò) X-Forwarded-For 獲取客戶端真實(shí) IP静盅。

解決方法

升級(jí) Istio

檢查并升級(jí) Istio 版本到 1.7 以上。

設(shè)置 externalTrafficPolicy

設(shè)置 externalTrafficPolicy 為 Local耿战。

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: istiocontrolplane
spec:
  profile: default
  components:
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
        k8s:
          service:
            externalTrafficPolicy: Local

等待 ingressgateway 重新部署完成禽作。

下面骏庸，部署 httpbin 服務(wù)作為驗(yàn)證直焙。

# httpbin.yaml
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
    - "httpbin.makeoptim.com"
  gateways:
    - gateway/makeoptim-gateway
  http:
    - route:
        - destination:
            port:
              number: 8000
            host: httpbin
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
  labels:
    app: httpbin
spec:
  ports:
    - name: http
      port: 8000
  selector:
    app: httpbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
      version: v1
  template:
    metadata:
      labels:
        app: httpbin
        version: v1
    spec:
      containers:
        - image: docker.io/citizenstig/httpbin
          imagePullPolicy: IfNotPresent
          name: httpbin
          ports:
            - containerPort: 8000

部署完 httpbin 后祠斧，直接訪問(wèn)并查看 Headers盹兢，可以看到多了一項(xiàng) X-Envoy-External-Address Header邻梆，并且指向客戶端真實(shí) IP。

? curl httpbin.makeoptim.com/get
{
  "args": {},
  "headers": {
    "Accept": "*/*",
    "Content-Length": "0",
    "Host": "httpbin.makeoptim.com",
    "User-Agent": "curl/7.64.1",
    "X-B3-Parentspanid": "50419cd0b3ae983a",
    "X-B3-Sampled": "0",
    "X-B3-Spanid": "5a0bbd2e611fa59e",
    "X-B3-Traceid": "33c8c481a13746c050419cd0b3ae983a",
    "X-Envoy-Attempt-Count": "1",
    "X-Envoy-External-Address": "38.75.137.213",
    "X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/default;Hash=abb1a2a76a04fe7476cd38738e98a228b39dbf6a88936fd249ee23839ec98234;Subject=\"\";URI=spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",
    "X-Request-Id": "2fe85688-cf60-4f61-b9bb-25e354625124"
  },
  "origin": "38.75.137.213",
  "url": "http://httpbin.makeoptim.com/get"
}

在自己的服務(wù)中绎秒，即可通過(guò) X-Envoy-External-Address 來(lái)獲取客戶端真實(shí) IP浦妄，下面以 Golang 代碼為例：

package http

import "net/http"

var clientIPHeaders = []string{"X-Envoy-External-Address", "X-Forwarded-For", "X-Real-Ip", "X-Appengine-Remote-Addr"}

// ClientIP get client IP with possible headers.
func ClientIP(request *http.Request) string {
    for _, v := range clientIPHeaders {
        ip := request.Header.Get(v)
        if ip != "" {
            return ip
        }
    }
    return ""
}

參考鏈接

https://github.com/istio/istio/issues/7607
https://github.com/istio/istio/issues/7679