ingress記錄真實IP地址 · Kubernetes

[TOC] 有時候我們需要在容器中獲取客戶端真實的IP等信息，而經過 IngressNginxController 轉發后，這些信息不一定拿得到，所以我們需要對 IngressNginxController 進行配置。 ## 負載均衡使用四層代理 ## haproxy ```shell $ kubectl -n ingress-nginx edit configmap ingress-nginx-controller # 在 data 字段添加下面幾行 data: # 源地址附加到 X-Forwarded-For 標頭，而不是替換它 compute-full-forwarded-for: "true" # 標頭允許下劃線，默認是關閉 enable-underscores-in-headers: "true" # 設置用于標識客戶端的原始 IP 地址的標頭字段。默認值：X-Forwarded-For forwarded-for-header: X-Forwarded-For # 當期望將 X-Forwarded-* 的標頭信息傳遞給后端服務時，需要設置為true use-forwarded-headers: "true" # 啟用或禁用 PROXY 協議以接收通過代理服務器和負載均衡器傳遞的客戶端連接（真實 IP 地址）信息 use-proxy-protocol: "true" # 重啟 ingress-nginx-controller 容器 $ kubectl -n ingress-nginx delete pod -l app.kubernetes.io/component=controller pod "ingress-nginx-controller-6c979c5b47-hrb4k" deleted ``` > 請注意：如果在 `ingress-nginx-controller` 高可用上的負載均衡器沒有啟動 `proxy protocol` 的話，訪問服務都會異常 harbor的配置如下： ```shell listen ingress_nginx_http bind 192.168.31.188:80 mode tcp balance roundrobin server master01 192.168.31.103:80 weight 1 check inter 1000 rise 3 fall 5 send-proxy server master02 192.168.31.79:80 weight 1 check inter 1000 rise 3 fall 5 send-proxy listen ingress_nginx_https bind 192.168.31.188:443 mode tcp balance roundrobin server master01 192.168.31.103:443 weight 1 check inter 1000 rise 3 fall 5 send-proxy server master02 192.168.31.79:443 weight 1 check inter 1000 rise 3 fall 5 send-proxy ``` > server參數必須包含有 `send-proxy` 選項下面的日志是通過 `ingress` 設置的域名訪問，客戶端收集的日志 ```shell {"time": "2022-09-15T16:56:15+08:00", "namespace": "default", "service_name": "hearder", "service_port": 80, "domain": " www.ecloud.com", "path": "/hearder", "request_id": "8ee4be46fb1799f75553fa9c3dee716a", "remote_user": "admin", "request_query": "-", "bytes_sent": 919, "status": 200, "request_time": 0.003, "request_proto": "HTTP/1.1", "request_length": 501, "duration": 0.003, "method": "GET", "http_referrer": "-", "remote_addr":"192.168.31.245", "remote_port": "54328", "proxy_protocol_addr": "192.168.31.245", "proxy_add_x_forwarded_for": "192.168.31.245", "x_forwarded_for": "-", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36" } ``` > - `remote_addr` 是真實客戶端IP地址 > - haproxy 的 x_forwarded_for 參數使用 remote_addr 直接覆蓋，則只有真實客戶端IP地址，沒有具體的調用IP鏈 > - 該日志是自定義日志格式。如果需要的話，請參考 [自定義ingress日志](./ingress_log.md)