k8s本身獲取用戶真實(shí)IP就有寫問題呜象，可以參考這個(gè)
https://kubernetes.io/docs/tutorials/services/source-ip/
另一種辦法：
在istio-gateway-ingress前面代理用上traefik-ingrss膳凝，traefik需要hostPort的方式啟動(dòng)，具體部署方式可以參照http://www.reibang.com/p/2b50f150ecde
Gateway 參照：
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: lps-web
namespace: th #這個(gè)是應(yīng)用所在的namespace
spec:
selector:
istio: ingressgateway
servers:
- hosts:
- lps-web.th.xxx.cn
port:
name: http
number: 80
protocol: HTTP
ingress參照：
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
ingress.kubernetes.io/custom-request-headers: 'Host: lps-web.th.xxx.cn' #配置成istiogateway 上面配置的hosts
name: lps-web.th.xxx.cn
namespace: istio-system #需要在istio-system 空間才能訪問到istiogateway services
spec:
rules:
- host: lps-web.th.xxx.cn #配置成istiogateway 上面配置的hosts
http:
paths:
- backend:
serviceName: istio-ingressgateway 這里是istio 的gateway services恭陡，
servicePort: 80
path: /
注意： 幾個(gè)Host的一定要和istio geteway-ingess上面的一致
創(chuàng)建EnvoyFilter
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: ingressgateway-user-ip
namespace: istio-system
spec:
workloadLabels:
app: istio-ingressgateway
filters:
- listenerMatch:
portNumber: 80
listenerType: ANY
filterName: envoy.lua
filterType: HTTP
filterConfig:
inlineCode: |
function envoy_on_request(request_handle)
local xff_header = request_handle:headers():get("X-Forwarded-For");
local client_ip
for ip in string.gmatch (xff_header, "(%d+.%d+.%d+.%d+)") do
client_ip = ip
break #這里只獲取第一個(gè)IP
end
request_handle:headers():add("x-real-ip", client_ip);
end
