如何配置Istio/Envoy作为正向代理？适配Nginx现有规则

一、Envoy静态配置方案 #

针对你的需求，以下是适配正向代理模式、域名白名单校验、流式响应的完整可运行配置：

{
    "admin": {
        "access_log_path": "/tmp/admin_access.log",
        "address": {
            "socket_address": {
                "address": "0.0.0.0",
                "port_value": 9901
            }
        }
    },
    "static_resources": {
        "listeners": [
            {
                "name": "forward_proxy_listener",
                "address": {
                    "socket_address": {
                        "address": "0.0.0.0",
                        "port_value": 8888
                    }
                },
                "filter_chains": [
                    {
                        "filters": [
                            {
                                "name": "envoy.http_connection_manager",
                                "typed_config": {
                                    "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
                                    "stat_prefix": "ingress_http",
                                    "codec_type": "AUTO",
                                    "route_config": {
                                        "name": "forward_proxy_route",
                                        "virtual_hosts": [
                                            {
                                                "name": "allowed_domains",
                                                "domains": ["*"],
                                                "routes": [
                                                    {
                                                        "match": {
                                                            "prefix": "/"
                                                        },
                                                        "route": {
                                                            "cluster": "dynamic_forward_proxy_cluster",
                                                            "upgrade_configs": [
                                                                {
                                                                    "upgrade_type": "CONNECT"
                                                                }
                                                            ]
                                                        },
                                                        "per_filter_config": {
                                                            "envoy.filters.http.router": {
                                                                "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
                                                                "suppress_envoy_headers": true
                                                            }
                                                        }
                                                    }
                                                ]
                                            }
                                        ]
                                    },
                                    "http_filters": [
                                        // 域名白名单校验Lua过滤器，放在最前面
                                        {
                                            "name": "envoy.filters.http.lua",
                                            "typed_config": {
                                                "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
                                                "inline_code": "\nfunction envoy_on_request(request_handle)\n    local host = request_handle:headers():get(\"Host\")\n    local allowed_domains = {\"domain1.com\", \"domain2.net\", \"etc\"}\n    local allowed = false\n    for _, domain in ipairs(allowed_domains) do\n        if string.find(host, domain) then\n            allowed = true\n            break\n        end\n    end\n    if not allowed then\n        request_handle:respond({[\":status\"] = \"403\"}, \"Forbidden\")\n    end\nend\n"
                                            }
                                        },
                                        {
                                            "name": "envoy.filters.http.router",
                                            "typed_config": {
                                                "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
                                            }
                                        }
                                    ],
                                    "forward_proxy_config": {
                                        "auto_config": {
                                            "http_protocol_options": {}
                                        }
                                    },
                                    "use_remote_address": true,
                                    "xff_num_trusted_hops": 0
                                }
                            }
                        ]
                    }
                ]
            }
        ],
        "clusters": [
            {
                "name": "dynamic_forward_proxy_cluster",
                "type": "LOGICAL_DNS",
                "connect_timeout": "0.25s",
                "lb_policy": "ROUND_ROBIN",
                "dns_lookup_family": "V4_ONLY",
                "dns_resolvers": [
                    {
                        "socket_address": {
                            "address": "8.8.8.8",
                            "port_value": 53
                        }
                    }
                ],
                "circuit_breakers": {
                    "thresholds": [
                        {
                            "max_connections": 1000,
                            "max_pending_requests": 1000
                        }
                    ]
                }
            }
        ]
    },
    "layered_runtime": {
        "layers": [
            {
                "name": "static_layer",
                "static_layer": {
                    "envoy": {
                        "dynamic_forward_proxy": {
                            "dns_cache_config": {
                                "name": "dynamic_forward_proxy_cache_config",
                                "dns_lookup_family": "V4_ONLY"
                            }
                        }
                    }
                }
            }
        ]
    }
}

关键配置对应Nginx功能： #

• 正向代理支持：通过forward_proxy_config.auto_config开启自动代理模式，兼容HTTP请求和HTTPS的CONNECT请求，对应Nginx的proxy_connect
• 域名白名单：用Lua过滤器校验Host头，不符合直接返回403，对应Nginx的if判断逻辑
• 动态域名转发：LOGICAL_DNS类型集群自动解析请求的Host域名，对应Nginx的proxy_pass http://$http_host
• 流式响应：Envoy默认流式处理请求，无需额外配置，对应Nginx的proxy_max_temp_file_size 0
• 指定DNS解析：集群中配置dns_resolvers为8.8.8.8，对应Nginx的resolver

二、Istio配置方案（迁移目标） #

Istio实现正向代理需调整Gateway、VirtualService和ServiceEntry，同时覆盖HTTP/HTTPS场景：

1. Gateway配置（开启代理端口） #

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: forward-proxy-gateway
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 8888
      name: http-proxy
      protocol: HTTP
    hosts:
    - "*"
  - port:
      number: 8443
      name: https-proxy
      protocol: HTTPS
    tls:
      mode: PASSTHROUGH
    hosts:
    - "*"

2. VirtualService配置（白名单校验+路由） #

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: forward-proxy-vs
  namespace: default
spec:
  hosts:
  - "*"
  gateways:
  - forward-proxy-gateway
  # HTTP代理规则
  http:
  - match:
    - gateways:
      - forward-proxy-gateway
      port: 8888
      headers:
        Host:
          regex: "(domain1.com)|(domain2.net)|(etc)"
    route:
    - destination:
        host: "$request_host"
        port:
          number: 80
  - match:
    - gateways:
      - forward-proxy-gateway
      port: 8888
    # 非白名单请求返回403
    route:
    - destination:
        host: blackhole.istio-system.svc.cluster.local
        port:
          number: 80
      headers:
        response:
          set:
            ":status": "403"
  # HTTPS代理规则（CONNECT请求）
  tls:
  - match:
    - gateways:
      - forward-proxy-gateway
      port: 8443
      sniHosts:
      - "*.domain1.com"
      - "*.domain2.net"
      - "*.etc"
    route:
    - destination:
        host: "$sni_host"
        port:
          number: 443

3. ServiceEntry配置（允许访问外部白名单域名） #

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: allowed-external-domains
  namespace: default
spec:
  hosts:
  - "*.domain1.com"
  - "*.domain2.net"
  - "*.etc"
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: https
    protocol: HTTPS
  location: MESH_EXTERNAL
  resolution: DNS

关键配置说明： #

• Gateway：8888端口处理HTTP代理请求，8443端口用PASSTHROUGH模式处理HTTPS的CONNECT请求
• VirtualService：通过headers.Host.regex匹配白名单域名，用$request_host动态转发到目标域名；非白名单请求转发到Istio内置的黑洞服务返回403
• ServiceEntry：将白名单域名注册为外部服务，允许Istio流量转发到这些域名

三、常见问题排查 #

• 代理超时：检查Envoy/Istio的connect_timeout配置，确认集群能访问外部域名，同时验证DNS解析是否正常
• 静态内容无法转发：确保路由配置未修改请求路径，Istio VirtualService不要添加不必要的URI重写规则
• 白名单不生效：核对Lua脚本的字符串匹配逻辑（Envoy）或VirtualService的regex表达式（Istio），注意域名大小写和通配符格式

内容的提问来源于stack exchange，提问作者4c74356b41