kubernetes - EnvoyFilter 排除特定主机

Question

我需要从如下所示的 EnvoyFilter 中排除特定主机:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: authn-filter
spec:
  workloadLabels:
    istio: ingressgateway
  filters:
  - filterConfig:
      httpService:
        serverUri:
          uri: http://authservice.$(namespace).svc.cluster.local
          cluster: outbound|8080||authservice.$(namespace).svc.cluster.local
          failureModeAllow: false
          timeout: 10s
        authorizationRequest:
          allowedHeaders:
            patterns:
            - exact: "cookie"
            - exact: "X-Auth-Token"
        authorizationResponse:
          allowedUpstreamHeaders:
            patterns:
            - exact: "kubeflow-userid"
      statusOnError:
        code: GatewayTimeout
    filterName: envoy.ext_authz
    filterType: HTTP
    insertPosition:
      index: FIRST
    listenerMatch:
      listenerType: GATEWAY

问题是过滤器适用于影响所有通过该网关的流量的默认 istio 入口网关，我希望有一些主机可以从过滤器中排除/列入白名单。

Answer 1

我找到了答案 here .这个问题要求排除一些路径，但我对主机也很成功。这是我使用的:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: bypass-authn
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_ROUTE
    match:
      routeConfiguration:
        vhost:
          name: subdomain.example.org:80 # <== your host goes here
    patch:
      operation: MERGE
      value:
        name: envoy.ext_authz_disabled
        typed_per_filter_config:
          envoy.ext_authz:
            "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
            disabled: true

更多信息请参见 Istio documentation .具体来说，文档指定您还应该将端口放入 name: 字段，但我认为没有它也应该可以工作。