如何使用Istio替代Nginx的proxy_pass功能实现通用代理转发

问题原因 #

你当前的配置是TCP透传网关，仅支持预定义域名的TLS流量透传，无法实现类似Nginx的动态HTTP代理能力，需要调整为Istio正向代理模式的配置，具体调整方案如下：

调整步骤 #

1. 重建Gateway配置，启用HTTP代理端口

把原来的TCP协议网关替换为HTTP协议网关，支持HTTP代理请求解析：

---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: forward-proxy-gw
  namespace: kube-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 36003
      name: http-proxy
      protocol: HTTP
    hosts:
    - "*"

2. 配置域名白名单ServiceEntry

对应Nginx的域名访问限制规则，仅允许白名单内的域名走代理，避免未授权的代理请求：

---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: allowed-external-domains
  namespace: kube-system
spec:
  hosts:
  - "*.domain1.com"
  - "domain1.com"
  - "*.domain2.com"
  - "domain2.com"
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: tls
    protocol: TLS
  resolution: DNS
  location: MESH_EXTERNAL

3. 配置VirtualService实现域名校验和路由

匹配白名单域名的请求走代理，其余请求直接返回403：

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: forward-proxy-vs
  namespace: kube-system
spec:
  hosts:
  - "*"
  gateways:
  - forward-proxy-gw
  http:
  - match:
    - authority:
        regex: "^(.*\\.)?(domain1|domain2)\\.com$"
    route:
    - destination:
        host: "%REQ(HOST)%"
        port:
          number: 80
  - directResponse:
      status: 403
      body:
        string: "Forbidden: Domain not allowed"

4. 新增EnvoyFilter实现动态转发能力

Istio原生VirtualService不支持变量作为目标集群，通过EnvoyFilter挂载Envoy的动态转发代理插件实现类似Nginx proxy_pass http://$http_host 的动态转发效果：

---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: dynamic-forward-proxy
  namespace: kube-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        portNumber: 36003
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.router"
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.dynamic_forward_proxy
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.dynamic_forward_proxy.v3.FilterConfig
          dns_cache_config:
            name: dynamic_proxy_dns_cache
            dns_lookup_family: V4_ONLY
            max_hosts: 1000
            ttl: 300s
  - applyTo: HTTP_ROUTE
    match:
      context: GATEWAY
      routeConfiguration:
        portNumber: 36003
        vhost:
          name: "*"
    patch:
      operation: MERGE
      value:
        route:
          cluster: dynamic_forward_proxy_cluster
  - applyTo: CLUSTER
    patch:
      operation: ADD
      value:
        name: dynamic_forward_proxy_cluster
        connect_timeout: 10s
        lb_policy: CLUSTER_PROVIDED
        cluster_type:
          name: envoy.clusters.dynamic_forward_proxy
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.clusters.dynamic_forward_proxy.v3.ClusterConfig
            dns_cache_config:
              name: dynamic_proxy_dns_cache
              dns_lookup_family: V4_ONLY
              max_hosts: 1000
              ttl: 300s

验证说明 #

上述配置适配你使用的Istio 1.11.2版本，配置生效后：

• 客户端直接配置HTTP代理地址为Istio ingressgateway的公网IP+36003端口即可，不需要修改DNS配置
• 所有符合白名单的HTTP请求都会走Istio代理转发，不会出现静态资源直接访问公网的问题
• 如果需要支持HTTPS CONNECT请求，只需在Gateway新增对应HTTPS端口配置，同时在EnvoyFilter中开启CONNECT方法支持即可。

内容的提问来源于stack exchange，提问作者4c74356b41