add:
This commit is contained in:
wwweww
@@ -0,0 +1,385 @@
|
||||
static_resources:
|
||||
listeners:
|
||||
# HTTP 监听器（重定向到 HTTPS）
|
||||
- name: listener_http
|
||||
address:
|
||||
socket_address:
|
||||
address: 0.0.0.0
|
||||
port_number: 8080
|
||||
filter_chains:
|
||||
- filters:
|
||||
- name: envoy.filters.network.http_connection_manager
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
|
||||
stat_prefix: ingress_http
|
||||
http_filters:
|
||||
# CSRF 防护过滤器
|
||||
- name: envoy.filters.http.local_ratelimit
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
|
||||
stat_prefix: http_local_rate_limiter
|
||||
token_bucket:
|
||||
max_tokens: 1000
|
||||
tokens_per_fill: 1000
|
||||
fill_interval: 1s
|
||||
filter_enabled:
|
||||
runtime_key: local_rate_limit_enabled
|
||||
default_value:
|
||||
numerator: 100
|
||||
denominator: HUNDRED
|
||||
filter_enforced:
|
||||
runtime_key: local_rate_limit_enforced
|
||||
default_value:
|
||||
numerator: 100
|
||||
denominator: HUNDRED
|
||||
|
||||
# 路由过滤器
|
||||
- name: envoy.filters.http.router
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
|
||||
|
||||
route_config:
|
||||
name: local_route
|
||||
virtual_hosts:
|
||||
- name: backend
|
||||
domains: ["*"]
|
||||
routes:
|
||||
# 登录端点 - 不需要 JWT
|
||||
- match:
|
||||
path: /api/v1/users/login
|
||||
headers:
|
||||
- name: ":method"
|
||||
string_match:
|
||||
exact: "POST"
|
||||
route:
|
||||
cluster: user_api_cluster
|
||||
timeout: 30s
|
||||
|
||||
# 注册端点 - 不需要 JWT
|
||||
- match:
|
||||
path: /api/v1/users/register
|
||||
headers:
|
||||
- name: ":method"
|
||||
string_match:
|
||||
exact: "POST"
|
||||
route:
|
||||
cluster: user_api_cluster
|
||||
timeout: 30s
|
||||
|
||||
# 其他所有用户 API 端点 - 需要 JWT
|
||||
- match:
|
||||
prefix: /api/v1/users
|
||||
headers:
|
||||
- name: ":method"
|
||||
string_match:
|
||||
exact: "GET"
|
||||
route:
|
||||
cluster: user_api_cluster
|
||||
timeout: 30s
|
||||
request_headers_to_add:
|
||||
- header:
|
||||
key: "x-verified-user"
|
||||
value: "%REQ(X-USER-ID)%"
|
||||
|
||||
# 订单 API - 需要 JWT
|
||||
- match:
|
||||
prefix: /api/v1/orders
|
||||
route:
|
||||
cluster: order_api_cluster
|
||||
timeout: 30s
|
||||
request_headers_to_add:
|
||||
- header:
|
||||
key: "x-verified-user"
|
||||
value: "%REQ(X-USER-ID)%"
|
||||
|
||||
# 健康检查端点
|
||||
- match:
|
||||
path: /health
|
||||
route:
|
||||
cluster: user_api_cluster
|
||||
timeout: 10s
|
||||
|
||||
# 默认路由
|
||||
- match:
|
||||
prefix: /
|
||||
route:
|
||||
cluster: user_api_cluster
|
||||
timeout: 30s
|
||||
direct_response:
|
||||
status: 404
|
||||
body:
|
||||
inline_string: "Not Found"
|
||||
|
||||
# HTTPS 监听器（需要配置 TLS 证书）
|
||||
- name: listener_https
|
||||
address:
|
||||
socket_address:
|
||||
address: 0.0.0.0
|
||||
port_number: 8443
|
||||
filter_chains:
|
||||
- transport_socket:
|
||||
name: envoy.transport_sockets.tls
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
|
||||
common_tls_context:
|
||||
tls_certificates:
|
||||
- certificate_chain:
|
||||
filename: /etc/envoy/certs/tls.crt
|
||||
private_key:
|
||||
filename: /etc/envoy/certs/tls.key
|
||||
filters:
|
||||
- name: envoy.filters.network.http_connection_manager
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
|
||||
stat_prefix: ingress_https
|
||||
access_log:
|
||||
- name: envoy.access_loggers.file
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
|
||||
path: /var/log/envoy/access.log
|
||||
format: |
|
||||
[%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%"
|
||||
%RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT%
|
||||
"%DURATION%" "%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%"
|
||||
"%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
|
||||
|
||||
http_filters:
|
||||
# JWT 验证过滤器
|
||||
- name: envoy.filters.http.jwt_authn
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
|
||||
providers:
|
||||
jwt_provider:
|
||||
issuer: "juwan-user-rpc"
|
||||
audiences: "api.juwan.local"
|
||||
# 本地验证（离线模式）- 需要在 ConfigMap 中配置公钥
|
||||
local_jwks:
|
||||
inline_string: |
|
||||
{
|
||||
"keys": [
|
||||
{
|
||||
"kty": "oct",
|
||||
"k": "YOUR-BASE64-ENCODED-SECRET-KEY"
|
||||
}
|
||||
]
|
||||
}
|
||||
# 也可以使用远程 JWKS（更推荐）
|
||||
# remote_jwks:
|
||||
# http_uri:
|
||||
# uri: "http://user-rpc-svc:9001/.well-known/jwks.json"
|
||||
# cluster: user_rpc_cluster
|
||||
# timeout: 5s
|
||||
# cache_ttl:
|
||||
# seconds: 300
|
||||
# payload_in_metadata: "JWT_PAYLOAD"
|
||||
rules:
|
||||
# 不需要验证的路由
|
||||
- match:
|
||||
prefix: /api/v1/users/login
|
||||
allow_missing_or_failed: true
|
||||
|
||||
- match:
|
||||
prefix: /api/v1/users/register
|
||||
allow_missing_or_failed: true
|
||||
|
||||
- match:
|
||||
path: /health
|
||||
allow_missing_or_failed: true
|
||||
|
||||
# 所有其他路由都需要有效的 JWT
|
||||
- match:
|
||||
prefix: /
|
||||
requires:
|
||||
provider_name: jwt_provider
|
||||
|
||||
# CSRF 防护过滤器
|
||||
- name: envoy.filters.http.csrf
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.http.csrf.v3.CsrfPolicy
|
||||
filter_enabled:
|
||||
default_value:
|
||||
numerator: 100
|
||||
denominator: HUNDRED
|
||||
runtime_key: csrf_filter_enabled
|
||||
shadow_enabled:
|
||||
default_value:
|
||||
numerator: 0
|
||||
denominator: HUNDRED
|
||||
runtime_key: csrf_filter_shadow_enabled
|
||||
additional_origins:
|
||||
- exact: "https://admin.juwan.local"
|
||||
ignore_method_matches:
|
||||
- google_re2:
|
||||
regex: "^(GET|HEAD|OPTIONS|TRACE)$"
|
||||
|
||||
# 代理验证过滤器（可选 - 调用 RPC 验证 token 黑名单）
|
||||
# - name: envoy.filters.http.ext_authz
|
||||
# typed_config:
|
||||
# "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
|
||||
# grpc_service:
|
||||
# envoy_grpc:
|
||||
# cluster_name: user_rpc_cluster
|
||||
# failure_mode_allow: false
|
||||
# with_request_body:
|
||||
# max_request_bytes: 8192
|
||||
# allow_partial_message: false
|
||||
|
||||
# 本地速率限制（DDOS 防护）
|
||||
- name: envoy.filters.http.local_ratelimit
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
|
||||
stat_prefix: https_local_rate_limiter
|
||||
token_bucket:
|
||||
max_tokens: 10000
|
||||
tokens_per_fill: 10000
|
||||
fill_interval: 1s
|
||||
filter_enabled:
|
||||
runtime_key: local_rate_limit_enabled
|
||||
default_value:
|
||||
numerator: 100
|
||||
denominator: HUNDRED
|
||||
|
||||
# 路由过滤器
|
||||
- name: envoy.filters.http.router
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
|
||||
|
||||
route_config:
|
||||
name: https_route
|
||||
virtual_hosts:
|
||||
- name: backend
|
||||
domains: ["*"]
|
||||
routes:
|
||||
# 登录和注册不需要 JWT
|
||||
- match:
|
||||
path: /api/v1/users/login
|
||||
headers:
|
||||
- name: ":method"
|
||||
string_match:
|
||||
exact: "POST"
|
||||
route:
|
||||
cluster: user_api_cluster
|
||||
timeout: 30s
|
||||
|
||||
- match:
|
||||
path: /api/v1/users/register
|
||||
headers:
|
||||
- name: ":method"
|
||||
string_match:
|
||||
exact: "POST"
|
||||
route:
|
||||
cluster: user_api_cluster
|
||||
timeout: 30s
|
||||
|
||||
# 用户 API（带 JWT 验证）
|
||||
- match:
|
||||
prefix: /api/v1/users
|
||||
route:
|
||||
cluster: user_api_cluster
|
||||
timeout: 30s
|
||||
request_headers_to_add:
|
||||
- header:
|
||||
key: "x-verified-user"
|
||||
value: "%REQ(X-USER-ID)%"
|
||||
|
||||
# 订单 API（带 JWT 验证）
|
||||
- match:
|
||||
prefix: /api/v1/orders
|
||||
route:
|
||||
cluster: order_api_cluster
|
||||
timeout: 30s
|
||||
request_headers_to_add:
|
||||
- header:
|
||||
key: "x-verified-user"
|
||||
value: "%REQ(X-USER-ID)%"
|
||||
|
||||
# 健康检查
|
||||
- match:
|
||||
path: /health
|
||||
route:
|
||||
cluster: user_api_cluster
|
||||
timeout: 10s
|
||||
|
||||
# 默认路由
|
||||
- match:
|
||||
prefix: /
|
||||
direct_response:
|
||||
status: 404
|
||||
body:
|
||||
inline_string: "Not Found"
|
||||
|
||||
clusters:
|
||||
# User API 集群
|
||||
- name: user_api_cluster
|
||||
connect_timeout: 10s
|
||||
type: STRICT_DNS
|
||||
dns_lookup_family: V4_ONLY
|
||||
lb_policy: ROUND_ROBIN
|
||||
load_assignment:
|
||||
cluster_name: user_api_cluster
|
||||
endpoints:
|
||||
- lb_endpoints:
|
||||
- endpoint:
|
||||
address:
|
||||
socket_address:
|
||||
address: user-api-svc
|
||||
port_number: 8888
|
||||
health_checks:
|
||||
- timeout: 5s
|
||||
interval: 10s
|
||||
unhealthy_threshold: 2
|
||||
healthy_threshold: 2
|
||||
http_health_check:
|
||||
path: /health
|
||||
expected_statuses:
|
||||
- start: 200
|
||||
end: 299
|
||||
|
||||
# Order API 集群
|
||||
- name: order_api_cluster
|
||||
connect_timeout: 10s
|
||||
type: STRICT_DNS
|
||||
dns_lookup_family: V4_ONLY
|
||||
lb_policy: ROUND_ROBIN
|
||||
load_assignment:
|
||||
cluster_name: order_api_cluster
|
||||
endpoints:
|
||||
- lb_endpoints:
|
||||
- endpoint:
|
||||
address:
|
||||
socket_address:
|
||||
address: order-api-svc
|
||||
port_number: 8889
|
||||
health_checks:
|
||||
- timeout: 5s
|
||||
interval: 10s
|
||||
unhealthy_threshold: 2
|
||||
healthy_threshold: 2
|
||||
http_health_check:
|
||||
path: /health
|
||||
expected_statuses:
|
||||
- start: 200
|
||||
end: 299
|
||||
|
||||
# User RPC 集群（用于 ext_authz 调用）
|
||||
- name: user_rpc_cluster
|
||||
connect_timeout: 10s
|
||||
type: STRICT_DNS
|
||||
dns_lookup_family: V4_ONLY
|
||||
lb_policy: ROUND_ROBIN
|
||||
load_assignment:
|
||||
cluster_name: user_rpc_cluster
|
||||
endpoints:
|
||||
- lb_endpoints:
|
||||
- endpoint:
|
||||
address:
|
||||
socket_address:
|
||||
address: user-rpc-svc
|
||||
port_number: 9001
|
||||
http2_protocol_options: {}
|
||||
|
||||
admin:
|
||||
address:
|
||||
socket_address:
|
||||
address: 0.0.0.0
|
||||
port_number: 9901
|
||||
Reference in New Issue
Block a user