如何在每个 nginx-ingress 主机上添加阻止 IP 规则

Question

我找了很多都没有找到解决办法。我想 block/allow ip 进入 nginx-ingress 中的每个主机定义，而不是每个位置。

这是ingress.yaml:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-nginx
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - host: test1.test.com
    #Blocking rules here, only affecting test1.test.com domain
    http:
      paths:
      - path: /
        backend:
          serviceName: wordpressA
          servicePort: 80
  - host: test2.test.com
    #Blocking rules here, only affecting test2.test.com domain
    http:
      paths:
      - path: /
        backend:
          serviceName: wordpressB
          servicePort: 80

非常感谢您的宝贵时间

Answer 1

您需要将这些 host 定义拆分为单独的 ingress 规则。

然后您可以使用以下 annotation 对 whitelist source range 进行注释： nginx.ingress.kubernetes.io/whitelist-source-range

像这样：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: app1-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/24"
spec:
  rules:
  - host: app1.com
    http:
      paths:
      - path: /
        backend:
          serviceName: app1-service
          servicePort: http
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: app2-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/24"
spec:
  rules:
  - host: app2.com
    http:
      paths:
      - path: /
        backend:
          serviceName: app2-service
          servicePort: http

您还可以使用 server snipper 并将 nginx 配置添加到 yaml。

像这样：

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/server-snippet: |
location / {
  # block one workstation
  deny    192.168.1.1;
  # allow anyone in 192.168.1.0/24
  allow   192.168.1.0/24;
  # drop rest of the world 
  deny    all;
}

如何在每个 nginx-ingress 主机上添加阻止 IP 规则

How to add blocking IP rules on each nginx-ingress host

nginx

kubernetes-ingress

nginx-ingress