Kong系列文章
1 ACL鉴权
1.1 启用插件
在服务上启用插件
$ curl -X POST http://kong:8001/services/{service}/plugins \
--data "name=acl" \
--data "config.whitelist=group1, group2" \
--data "config.hide_groups_header=true"
在路由上启用插件
$ curl -X POST http://kong:8001/routes/{route_id}/plugins \
--data "name=acl" \
--data "config.whitelist=group1, group2" \
--data "config.hide_groups_header=true"
curl -X POST http://localhost:8001/routes/b0db420a-d3c3-45ee-8b25-11f3fd8ca283/plugins \ --data "name=acl" \ --data "config.whitelist=devops" \ --data "config.hide_groups_header=true" { "created_at": 1609210608, "id": "c0256ae6-271c-44d8-bee3-f11d36e05abb", "tags": null, "enabled": true, "protocols": ["grpc", "grpcs", "http", "https"], "name": "acl", "consumer": null, "service": null, "route": { "id": "b0db420a-d3c3-45ee-8b25-11f3fd8ca283" }, "config": { "allow": ["devops"], "hide_groups_header": true, "deny": null } }
1.2 访问测试
由于开启ACL鉴权,用户无法再访问该服务
1.3 将用户加入授权的devops组
curl -X POST http://127.0.0.1:8001/consumers/basic/acls --data "group=devops" { "created_at": 1609210724, "id": "6e066cff-b8ea-4d6e-b412-e3d39509c342", "group": "devops", "tags": null, "consumer": { "id": "7e9ac7ce-5a8e-4bce-8baa-cf09a7aa5c47" } }
2 IP限制
2.1 启用IP限制插件
1、在服务上启用插件
$ curl -X POST http://kong:8001/services/{service}/plugins \
--data "name=ip-restriction" \
--data "config.whitelist=54.13.21.1, 143.1.0.0/24"
2、在路由上启用插件
$ curl -X POST http://kong:8001/routes/{route_id}/plugins \
--data "name=ip-restriction" \
--data "config.whitelist=54.13.21.1, 143.1.0.0/24"
config.whitelist :白名单,逗号分隔的IPs或CIDR范围。 config.blacklist :白名单,逗号分隔的IPs或CIDR范围。
curl -X POST http://127.0.0.1:8001/routes/b0db420a-d3c3-45ee-8b25-11f3fd8ca283/plugins \ --data "name=ip-restriction" \ --data "config.whitelist=172.16.60.9" { "created_at": 1609211384, "id": "e6ad04af-6484-482c-aea7-2c70243ef835", "tags": null, "enabled": true, "protocols": ["grpc", "grpcs", "http", "https"], "name": "ip-restriction", "consumer": null, "service": null, "route": { "id": "b0db420a-d3c3-45ee-8b25-11f3fd8ca283" }, "config": { "allow": ["172.16.60.9"], "deny": null } }
2.2 测试访问
当前本机器IP地址为: 172.24.107.55
2.3 将IP加入白名单
2.4 再次测试访问
3 爬虫控制
1、在服务上启用插件
$ curl -X POST http://kong:8001>/services/{service}>/plugins \
--data "name=bot-detection"
2、在路由上启用插件
$ curl -X POST http://kong:8001/routes/{route_id}>/plugins \
--data "name=bot-detection"
config.whitelist :白名单,逗号分隔的正则表达式数组。正则表达式是根据头部匹配的。
config.blacklist :黑名单,逗号分隔的正则表达式数组。正则表达式是根据头部匹配的。