Envoy代理监听器，用于捕获所有流量。

huangapple
go评论91阅读模式
英文:

Envoy proxy listener for catching all traffic

问题

在一个K8s集群中，我需要设置Keycloak，并将第二个Keycloak作为身份提供者。问题是，我需要使流量经过第二个Envoy，它充当服务网格入口点和负载均衡器，然后流向第二个Keycloak。

我找到了一个可行的解决方案，但它过于复杂。我需要摆脱监听对127.0.0.1和9090的请求的Envoy监听器。

将它替换为一个捕获所有流量并将其转发到envoylb集群的监听器。

我尝试了几种方法，但似乎都不起作用。

英文:

In a k8s cluster i need to setup keycloak with a second keycloak as an identity provider.
The problem is that i need to make traffic towards the second keycloak to go through a second envoy which acts as
service mesh entry point and load balancer.

I have found a working solution but it is too complex.
I need to get rid of this envoy listener which listens on requests towards 127.0.0.1 and 9090

  1.   - name: idp
  2.     address:
  3.       socket_address:
  4.         address: 127.0.0.1
  5.         ipv4_compat: true
  6.         port_value: 9090
  7.         protocol: TCP
  8.     filter_chains:
  9.       filters:
  10.       - name: envoy.filters.network.tcp_proxy
  11.         typed_config:
  12.           "@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
  13.           stat_prefix: idp
  14.           cluster: envoylb
  15.           access_log:
  16.           - name: envoy.access_loggers.file
  17.             typed_config:
  18.               "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
  19.               path: "/var/log/envoysidecar.log"

and replace it with one that catches all traffic and forwards it to the envoylb cluster

  1.   - name: envoylb
  2.     type: STRICT_DNS
  3.     connect_timeout:
  4.       seconds: 15552000
  5.     lb_policy: ROUND_ROBIN
  6.     load_assignment:
  7.       cluster_name:  envoylb
  8.       endpoints:
  9.       - lb_endpoints:
  10.         - endpoint:
  11.             address:
  12.               socket_address:
  13.                 address: envoylbservice
  14.                 port_value: 8298

I tried several things but nothing seems to work.

答案1

得分: 1

Envoy config.core.v3.SocketAddress 必须具有特定的端口以进行侦听。
对于地址，您可以使用 0.0.0.0 来绑定任何地址。

然后，通过使用筛选器 envoy.filters.network.tcp_proxy，Envoy 可以将所有从此特定端口发出的请求传递到所需的群集。

示例：

  1. static_resources:
  2.   listeners:
  3.     - name: idp
  4.       address:
  5.         socket_address:
  6.           address: 0.0.0.0
  7.           port_value: 9090
  8.       filter_chains:
  9.         - filters:
  10.             - name: envoy.filters.network.tcp_proxy
  11.               typed_config:
  12.                 "@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
  13.                 stat_prefix: destination
  14.                 cluster: envoylb
  15.   clusters:
  16.     - name: envoylb
  17.       type: STRICT_DNS
  18.       connect_timeout:
  19.          seconds: 15552000
  20.       lb_policy: ROUND_ROBIN
  21.       load_assignment:
  22.         cluster_name: envoylb
  23.         endpoints:
  24.           - lb_endpoints:
  25.               - endpoint:
  26.                   address:
  27.                     socket_address:
  28.                       address: envoylbservice
  29.                       port_value: 8298
英文:

Not sure from the question what you try to obtain.
Envoy config.core.v3.SocketAddress must have once specific port to listen.
For the address, you can use 0.0.0.0 to bind any address.

Then by using the filter envoy.filters.network.tcp_proxy envoy can passthrough all the requests from this specific port the desired cluster.

Example:

  1. static_resources:
  2.   listeners:
  3.     - name: idp
  4.       address:
  5.         socket_address:
  6.           address: 0.0.0.0
  7.           port_value: 9090
  8.       filter_chains:
  9.         - filters:
  10.             - name: envoy.filters.network.tcp_proxy
  11.               typed_config:
  12.                 "@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
  13.                 stat_prefix: destination
  14.                 cluster: envoylb
  15.   clusters:
  16.     - name: envoylb
  17.       type: STRICT_DNS
  18.       connect_timeout:
  19.          seconds: 15552000
  20.       lb_policy: ROUND_ROBIN
  21.       load_assignment:
  22.         cluster_name: envoylb
  23.         endpoints:
  24.           - lb_endpoints:
  25.               - endpoint:
  26.                   address:
  27.                     socket_address:
  28.                       address: envoylbservice
  29.                       port_value: 8298

huangapple
  • 本文由 发表于 2023年6月12日 22:51:48
  • 转载请务必保留本文链接：https://go.coder-hub.com/76457848.html
  • envoyproxy
  • kubernetes
  • proxy
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定