如何配置Envoy作为公网服务代理 按不同路径路由到不同后端服务

以下配置可直接实现你需要的公网域名按不同路径转发到不同后端服务的需求，适配的路由规则：

http://foo.example.com/service1/* -> http://somewhere.com/*
http://foo.example.com/service2/* -> http://somewhereelse.com/*

1. 完整配置示例 #

将以下内容保存为envoy.yaml，基于Envoy 1.20+版本兼容：

static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 80
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: foo_service
              domains: ["foo.example.com"]
              routes:
              # 路由规则1：匹配/service1/前缀的请求
              - match:
                  prefix: "/service1/"
                route:
                  cluster: cluster_service1
                  prefix_rewrite: "/"
                  auto_host_rewrite: true
              # 路由规则2：匹配/service2/前缀的请求
              - match:
                  prefix: "/service2/"
                route:
                  cluster: cluster_service2
                  prefix_rewrite: "/"
                  auto_host_rewrite: true
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  clusters:
  # 后端集群1：对应somewhere.com
  - name: cluster_service1
    connect_timeout: 0.25s
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: cluster_service1
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: somewhere.com
                port_value: 80
  # 后端集群2：对应somewhereelse.com
  - name: cluster_service2
    connect_timeout: 0.25s
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: cluster_service2
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: somewhereelse.com
                port_value: 80

如果后端服务是HTTPS协议，需要在对应集群配置中补充TLS传输配置，示例如下：

# 在对应cluster的配置末尾添加
transport_socket:
  name: envoy.transport_sockets.tls
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
    sni: "somewhere.com" # 替换为对应后端的域名

2. 核心配置说明 #

• 监听器默认监听0.0.0.0:80，作为公网入口接收HTTP请求，如需支持HTTPS可在filter_chain中补充TLS证书配置
• 路由规则按配置顺序匹配，prefix_rewrite: "/"实现路径重写，会删除原请求的路径前缀（如/service1/），将剩余路径透传给后端服务，刚好匹配需求中的路径转换逻辑
• auto_host_rewrite: true会自动将请求头的Host字段替换为后端服务的域名，避免后端服务因Host不匹配返回404错误
• 每个后端对应独立的集群配置，使用STRICT_DNS模式自动解析公网域名的IP地址

3. 启动验证 #

• 本地启动Envoy可直接使用官方Docker镜像，执行命令：
  docker run -d --name envoy -p 80:80 -v $(pwd)/envoy.yaml:/etc/envoy/envoy.yaml envoyproxy/envoy:v1.28-latest
• 测试验证：
  • 请求http://foo.example.com/service1/foo会转发到http://somewhere.com/foo
  • 请求http://foo.example.com/service2/bar/baz会转发到http://somewhereelse.com/bar/baz

内容的提问来源于stack exchange，提问作者Mark Richman