forked from docs/doc-exports
qiujiandong1
ab1e53a279
Reviewed-by: Gergo-Bence Lorincz <a200452876@noreply.gitea.eco.tsi-dev.otc-service.com> Co-authored-by: qiujiandong1 <qiujiandong1@huawei.com> Co-committed-by: qiujiandong1 <qiujiandong1@huawei.com>
142 lines
19 KiB
HTML
142 lines
19 KiB
HTML
<a name="cce_10_0832"></a><a name="cce_10_0832"></a>
|
|
|
|
<h1 class="topictitle1">Configuring a Blocklist/Trustlist Access Policy for a LoadBalancer Ingress</h1>
|
|
<div id="body0000001830734381"><p id="cce_10_0832__p192038832319">You can add IP addresses to a trustlist or blocklist to control access to a listener of a LoadBalancer ingress.</p>
|
|
<ul id="cce_10_0832__ul15304525162313"><li id="cce_10_0832__li1730415259236">Trustlist: Only the IP addresses in the list can access the listener.</li><li id="cce_10_0832__li130412252233">Blocklist: The IP addresses in the list are not allowed to access the listener.</li></ul>
|
|
<div class="section" id="cce_10_0832__section569611318180"><h4 class="sectiontitle">Prerequisites</h4><ul id="cce_10_0832__ul148691914205117"><li id="cce_10_0832__li148691314135118">A CCE standard or Turbo cluster is available, and the cluster version meets the following requirements:<ul id="cce_10_0832__ul11869814115110"><li id="cce_10_0832__li1886951435115">v1.23: v1.23.12-r0 or later</li><li id="cce_10_0832__li3869414185117">v1.25: v1.25.7-r0 or later</li><li id="cce_10_0832__li573712112417">v1.27: v1.27.4-r0 or later</li><li id="cce_10_0832__li147371021132418">v1.28: v1.28.2-r0 or later</li><li id="cce_10_0832__li194601627112417">Other clusters of later versions</li></ul>
|
|
</li><li id="cce_10_0832__li10736110193518">An IP address group has been created on the ELB console. </li></ul>
|
|
</div>
|
|
<div class="section" id="cce_10_0832__section1940142810119"><h4 class="sectiontitle">Notes and Constraints</h4><ul id="cce_10_0832__ul6301133710119"><li id="cce_10_0832__li13301123710117">After a blocklist or trustlist access policy is configured, if you delete the blocklist or trustlist access policy configuration on the CCE console or delete the target annotation from the YAML file, the configuration on the ELB will be retained.</li><li id="cce_10_0832__li1662484416227">If multiple ingresses share the same external port on a load balancer, you are advised to use the same blocklist/trustlist configuration for these ingresses. Otherwise, the configuration of the first created ingress will take precedence. For details, see <a href="cce_10_0954.html">Configuring Multiple Ingresses in a Cluster to Use the Same Load Balancer</a>.</li></ul>
|
|
</div>
|
|
<div class="section" id="cce_10_0832__section16306926104716"><h4 class="sectiontitle">Using the CCE Console to Configure a Blocklist/Trustlist Access Policy</h4><ol id="cce_10_0832__ol02861038132116"><li id="cce_10_0832__li330462393220"><span>Log in to the <span id="cce_10_0832__cce_10_0004_ph18314322182">CCE console</span> and click the cluster name to access the cluster console.</span></li><li id="cce_10_0832__li012894520229"><span>Choose <strong id="cce_10_0832__b17431088718">Services & Ingresses</strong> in the navigation pane, click the <span class="uicontrol" id="cce_10_0832__uicontrol14441681878"><b>Ingresses</b></span> tab, and click <strong id="cce_10_0832__b2044481678">Create Ingress</strong> in the upper right corner.</span></li><li id="cce_10_0832__li123254304536"><span>Configure ingress parameters.</span><p><div class="note" id="cce_10_0832__note20244416142510"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="cce_10_0832__p1624416162256">This example explains only key parameters for configuring blocklist/trustlist access policies. You can configure other parameters as required. For details, see <a href="cce_10_0251.html">Creating a LoadBalancer Ingress on the Console</a>.</p>
|
|
</div></div>
|
|
|
|
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="cce_10_0832__table126841312121118" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Key parameters</caption><thead align="left"><tr id="cce_10_0832__row1568431217118"><th align="left" class="cellrowborder" valign="top" width="15.47%" id="mcps1.3.5.2.3.2.2.2.4.1.1"><p id="cce_10_0832__p1568418122112">Parameter</p>
|
|
</th>
|
|
<th align="left" class="cellrowborder" valign="top" width="61.19%" id="mcps1.3.5.2.3.2.2.2.4.1.2"><p id="cce_10_0832__p9684201221112">Description</p>
|
|
</th>
|
|
<th align="left" class="cellrowborder" valign="top" width="23.34%" id="mcps1.3.5.2.3.2.2.2.4.1.3"><p id="cce_10_0832__p1967985011345">Example</p>
|
|
</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody><tr id="cce_10_0832__row2684171261110"><td class="cellrowborder" valign="top" width="15.47%" headers="mcps1.3.5.2.3.2.2.2.4.1.1 "><p id="cce_10_0832__p068441251118">Name</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="61.19%" headers="mcps1.3.5.2.3.2.2.2.4.1.2 "><p id="cce_10_0832__p76841412131116">Enter an ingress name.</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="23.34%" headers="mcps1.3.5.2.3.2.2.2.4.1.3 "><p id="cce_10_0832__p9679155013412">ingress-test</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="cce_10_0832__row6684201231120"><td class="cellrowborder" valign="top" width="15.47%" headers="mcps1.3.5.2.3.2.2.2.4.1.1 "><p id="cce_10_0832__p66841912101118">Load Balancer</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="61.19%" headers="mcps1.3.5.2.3.2.2.2.4.1.2 "><p id="cce_10_0832__p12684312141119">Select a load balancer to be associated with the ingress or automatically create a load balancer. A load balancer can be dedicated or shared.</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="23.34%" headers="mcps1.3.5.2.3.2.2.2.4.1.3 "><p id="cce_10_0832__p3679155018345">Dedicated</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="cce_10_0832__row4841539172310"><td class="cellrowborder" valign="top" width="15.47%" headers="mcps1.3.5.2.3.2.2.2.4.1.1 "><p id="cce_10_0832__p17704229181112">Listener</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="61.19%" headers="mcps1.3.5.2.3.2.2.2.4.1.2 "><ul id="cce_10_0832__ul455143821118"><li id="cce_10_0832__li1232513016533"><strong id="cce_10_0832__b7943632204617">Frontend Protocol</strong>: <strong id="cce_10_0832__b175391539134918">HTTP</strong> and <strong id="cce_10_0832__b5539203914496">HTTPS</strong> are available.</li><li id="cce_10_0832__li19863155011215"><strong id="cce_10_0832__b1520254394917">External Port</strong>: specifies the port of the load balancer listener.</li><li id="cce_10_0832__li1773717619535"><strong id="cce_10_0832__b105689328580">Access Control</strong><ul id="cce_10_0832__ul2054313211531"><li id="cce_10_0832__li84255145214"><strong id="cce_10_0832__b1730614615356">Inherit ELB Configurations</strong>: CCE does not modify the existing access control configurations on the ELB console.</li><li id="cce_10_0832__li14372143620346"><strong id="cce_10_0832__b20467201065134">Allow all IP addresses</strong>: No access control is configured.</li><li id="cce_10_0832__li1221975114114"><strong id="cce_10_0832__b48351867444">Trustlist</strong>: Only the selected IP address group can access the load balancer.</li><li id="cce_10_0832__li119236292343"><strong id="cce_10_0832__b19092324410">Blocklist</strong>: The selected IP address group cannot access the load balancer.</li></ul>
|
|
<div class="note" id="cce_10_0832__note43497538394"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="cce_10_0832__cce_10_0681_p1580312103120">For clusters of v1.25.16-r10, v1.27.16-r10, v1.28.15-r0, v1.29.10-r0, v1.30.6-r0, v1.31.1-r0, or later, when using a dedicated load balancer, you can select a maximum of five IP address groups at a time for access control.</p>
|
|
</div></div>
|
|
</li></ul>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="23.34%" headers="mcps1.3.5.2.3.2.2.2.4.1.3 "><ul id="cce_10_0832__ul19125137132412"><li id="cce_10_0832__li171253702415">Frontend Protocol: HTTP</li><li id="cce_10_0832__li7218648171014">External Port: 80</li><li id="cce_10_0832__li143566375385">Advanced Options<p id="cce_10_0832__p1265415013550"><a name="cce_10_0832__li143566375385"></a><a name="li143566375385"></a>Access Control: Blocklist</p>
|
|
</li></ul>
|
|
</td>
|
|
</tr>
|
|
<tr id="cce_10_0832__row11838112317128"><td class="cellrowborder" valign="top" width="15.47%" headers="mcps1.3.5.2.3.2.2.2.4.1.1 "><p id="cce_10_0832__p138383238121">Forwarding Policy</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="61.19%" headers="mcps1.3.5.2.3.2.2.2.4.1.2 "><ul id="cce_10_0832__ul1379019285196"><li id="cce_10_0832__cce_10_0687_li3858186912"><strong id="cce_10_0832__cce_10_0687_b1181325161413">Domain Name</strong>: Enter an actual domain name to be accessed. If it is left blank, the ingress can be accessed through the IP address. Ensure that the domain name has been registered and licensed. Once a forwarding policy is configured with a domain name specified, you must use the domain name for access.</li><li id="cce_10_0832__cce_10_0687_li2086218897"><strong id="cce_10_0832__cce_10_0687_b2360193614371">Path Matching Rule</strong>: Select <strong id="cce_10_0832__cce_10_0687_b8367172203911">Prefix match</strong>, <strong id="cce_10_0832__cce_10_0687_b1698532315392">Exact match</strong>, or <strong id="cce_10_0832__cce_10_0687_b167151527103913">RegEx match</strong>.</li><li id="cce_10_0832__cce_10_0687_li188619181495"><strong id="cce_10_0832__cce_10_0687_b127871335104915">Path</strong>: Enter the path provided by a backend application for external access. The path added must be valid in the backend application, or the forwarding cannot take effect.</li><li id="cce_10_0832__cce_10_0687_li386818791"><strong id="cce_10_0832__cce_10_0687_b95168033875837">Destination Service</strong>: Select an existing Service. Only Services that meet the requirements are automatically displayed in the Service list. </li><li id="cce_10_0832__cce_10_0687_li118614181492"><strong id="cce_10_0832__cce_10_0687_b619633162520">Destination Service Port</strong>: Select the access port of the destination Service.</li></ul>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="23.34%" headers="mcps1.3.5.2.3.2.2.2.4.1.3 "><ul id="cce_10_0832__ul16620123141913"><li id="cce_10_0832__li8620123131914">Domain Name: You do not need to configure this parameter.</li><li id="cce_10_0832__li039919537193">Path Matching Rule: Prefix match</li><li id="cce_10_0832__li13620153113197">Path: /</li><li id="cce_10_0832__li5620331171920">Destination Service: nginx</li><li id="cce_10_0832__li3620143161918">Destination Service Port: 80</li></ul>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</p></li><li id="cce_10_0832__li681316239350"><span>Click <span class="uicontrol" id="cce_10_0832__uicontrol619411181086"><b>OK</b></span>.</span></li></ol>
|
|
</div>
|
|
<div class="section" id="cce_10_0832__section776311276199"><h4 class="sectiontitle">Using kubectl to Configure a Blocklist/Trustlist Access Policy</h4><ol id="cce_10_0832__ol18588159121215"><li id="cce_10_0832__li5499103219119"><span>Use kubectl to access the cluster. For details, see <a href="cce_10_0107.html">Accessing a Cluster Using kubectl</a>.</span></li><li id="cce_10_0832__li128720461410"><span>Create a YAML file named <strong id="cce_10_0832__b29531855144410">ingress-test.yaml</strong>. The file name can be customized.</span><p><pre class="screen" id="cce_10_0832__screen146351106288">vi ingress-test.yaml</pre>
|
|
<div class="p" id="cce_10_0832__p2165188113219">An example YAML file of an ingress created using an existing load balancer is as follows:<pre class="screen" id="cce_10_0832__screen16732951370">apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: ingress-test
|
|
annotations:
|
|
kubernetes.io/elb.id: <i><span class="varname" id="cce_10_0832__varname1221712351012"><your_elb_id></span></i> # Load balancer ID. Replace it with the actual value.
|
|
kubernetes.io/elb.class: <i><span class="varname" id="cce_10_0832__varname32171354114">performance</span></i> # Load balancer type
|
|
kubernetes.io/elb.port: <i><span class="varname" id="cce_10_0832__varname61553425376">'80</span></i>' # External port of the load balancer listener
|
|
<strong id="cce_10_0832__b132178351119">kubernetes.io/elb.acl-id: <i><span class="varname" id="cce_10_0832__varname13217203519117"><your_acl_id></span></i></strong> # ID of an IP address group for accessing a load balancer
|
|
<strong id="cce_10_0832__b1721717359116">kubernetes.io/elb.acl-status: <i><span class="varname" id="cce_10_0832__varname102176352116">'on'</span></i></strong> # Enable access control.
|
|
<strong id="cce_10_0832__b52171635214">kubernetes.io/elb.acl-type: <i><span class="varname" id="cce_10_0832__varname16218635112">'white'</span></i></strong> # Trustlist for access control
|
|
spec:
|
|
rules:
|
|
- host: ''
|
|
http:
|
|
paths:
|
|
- path: '/'
|
|
backend:
|
|
service:
|
|
name: <i><span class="varname" id="cce_10_0832__varname143731534173718"><your_service_name></span></i> # Replace it with the name of your target Service.
|
|
port:
|
|
number: <i><span class="varname" id="cce_10_0832__varname15436145634011">80</span></i> # Replace the number with that of your target Service.
|
|
property:
|
|
ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
|
|
pathType: ImplementationSpecific
|
|
ingressClassName: cce </pre>
|
|
</div>
|
|
|
|
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="cce_10_0832__table849411591571" frame="border" border="1" rules="all"><caption><b>Table 2 </b>Annotations for ELB access control</caption><thead align="left"><tr id="cce_10_0832__row12227190135"><th align="left" class="cellrowborder" valign="top" width="19.801980198019802%" id="mcps1.3.6.2.2.2.3.2.4.1.1"><p id="cce_10_0832__p1312062011136">Parameter</p>
|
|
</th>
|
|
<th align="left" class="cellrowborder" valign="top" width="12.871287128712872%" id="mcps1.3.6.2.2.2.3.2.4.1.2"><p id="cce_10_0832__p15121182018133">Type</p>
|
|
</th>
|
|
<th align="left" class="cellrowborder" valign="top" width="67.32673267326733%" id="mcps1.3.6.2.2.2.3.2.4.1.3"><p id="cce_10_0832__p141211920131317">Description</p>
|
|
</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody><tr id="cce_10_0832__row5494859572"><td class="cellrowborder" valign="top" width="19.801980198019802%" headers="mcps1.3.6.2.2.2.3.2.4.1.1 "><p id="cce_10_0832__p24947591377">kubernetes.io/elb.acl-id</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="12.871287128712872%" headers="mcps1.3.6.2.2.2.3.2.4.1.2 "><p id="cce_10_0832__p1349425914711">String</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="67.32673267326733%" headers="mcps1.3.6.2.2.2.3.2.4.1.3 "><ul id="cce_10_0832__ul4586925115613"><li id="cce_10_0832__li1358613256562">If this parameter is not specified, CCE does not modify access control on the ELB.</li><li id="cce_10_0832__li7587142555615">If this parameter is left empty, all IP addresses are allowed to access the load balancer.</li><li id="cce_10_0832__li185871525175616">If this parameter is set to the IP address group ID of the load balancer, access control is enabled and you need to configure an IP address blocklist or trustlist for the load balancer. Additionally, you need to configure both <strong id="cce_10_0832__b1048692211473">kubernetes.io/elb.acl-status</strong> and <strong id="cce_10_0832__b1848642294719">kubernetes.io/elb.acl-type</strong>.<div class="note" id="cce_10_0832__note145222036193320"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="cce_10_0832__cce_10_0385_p1352223643310">For clusters of v1.25.16-r10, v1.27.16-r10, v1.28.15-r0, v1.29.10-r0, v1.30.6-r0, v1.31.1-r0, or later, when using a dedicated load balancer, you can select a maximum of five IP address groups at a time, separated by commas (,).</p>
|
|
</div></div>
|
|
<p id="cce_10_0832__p6726575018"><strong id="cce_10_0832__b1676927826445">How to obtain</strong>:</p>
|
|
<p id="cce_10_0832__p137435719018">Log in to the <span id="cce_10_0832__ph183671902267">ELB console</span>, choose <strong id="cce_10_0832__b104789468694935">Elastic Load Balance</strong> > <strong id="cce_10_0832__b121548080894935">IP Address Groups</strong>, and copy the <span class="uicontrol" id="cce_10_0832__uicontrol184004053194935"><b>ID</b></span> of the target IP address group. </p>
|
|
</li></ul>
|
|
</td>
|
|
</tr>
|
|
<tr id="cce_10_0832__row1849514595716"><td class="cellrowborder" valign="top" width="19.801980198019802%" headers="mcps1.3.6.2.2.2.3.2.4.1.1 "><p id="cce_10_0832__p349510598719">kubernetes.io/elb.acl-status</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="12.871287128712872%" headers="mcps1.3.6.2.2.2.3.2.4.1.2 "><p id="cce_10_0832__p349519590717">String</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="67.32673267326733%" headers="mcps1.3.6.2.2.2.3.2.4.1.3 "><p id="cce_10_0832__p149555913714">This parameter is mandatory when you configure an IP address blocklist or trustlist for a load balancer. Options:</p>
|
|
<ul id="cce_10_0832__ul136846435392"><li id="cce_10_0832__li8684743173913"><strong id="cce_10_0832__b761733312284">on</strong> or <strong id="cce_10_0832__b10617183392810">true</strong>: Access control is enabled.</li><li id="cce_10_0832__li17684144333916"><strong id="cce_10_0832__b144112454281">off</strong> or <strong id="cce_10_0832__b841144513280">false</strong>: Access control is disabled.</li></ul>
|
|
</td>
|
|
</tr>
|
|
<tr id="cce_10_0832__row349595915711"><td class="cellrowborder" valign="top" width="19.801980198019802%" headers="mcps1.3.6.2.2.2.3.2.4.1.1 "><p id="cce_10_0832__p249511596711">kubernetes.io/elb.acl-type</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="12.871287128712872%" headers="mcps1.3.6.2.2.2.3.2.4.1.2 "><p id="cce_10_0832__p184955591574">String</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="67.32673267326733%" headers="mcps1.3.6.2.2.2.3.2.4.1.3 "><p id="cce_10_0832__p649511591175">This parameter is mandatory when you configure an IP address blocklist or trustlist for a load balancer. Options:</p>
|
|
<ul id="cce_10_0832__ul1249519591373"><li id="cce_10_0832__li349515591277"><strong id="cce_10_0832__b5678793249425">black</strong>: indicates a blocklist. The selected IP address group cannot access the load balancer.</li><li id="cce_10_0832__li194950591176"><strong id="cce_10_0832__b2113312058952">white</strong>: indicates a trustlist. Only the selected IP address group can access the load balancer.</li></ul>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</p></li><li id="cce_10_0832__li13420131462418"><span>Create an ingress.</span><p><pre class="screen" id="cce_10_0832__screen7530152162919">kubectl create -f ingress-test.yaml</pre>
|
|
<p id="cce_10_0832__p5420131416240">If information similar to the following is displayed, the ingress has been created:</p>
|
|
<pre class="screen" id="cce_10_0832__screen1742018145243">ingress/ingress-test created</pre>
|
|
</p></li><li id="cce_10_0832__li17235910124"><span>Check the created ingress.</span><p><pre class="screen" id="cce_10_0832__screen117628192920">kubectl get ingress</pre>
|
|
<p id="cce_10_0832__p224315113121">If information similar to the following is displayed, the ingress has been created:</p>
|
|
<pre class="screen" id="cce_10_0832__screen135291174384">NAME CLASS HOSTS ADDRESS PORTS AGE
|
|
ingress-test cce * 121.**.**.** 80 10s</pre>
|
|
</p></li></ol>
|
|
</div>
|
|
</div>
|
|
<div>
|
|
<div class="familylinks">
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="cce_10_0935.html">Advanced Setting Examples of LoadBalancer Ingresses</a></div>
|
|
</div>
|
|
</div>
|
|
|