Container Service for Kubernetes:Customize the routing rules of an ALB Ingress by using AScript

Scenario

An application receives frequent malicious and unidentified requests that increase backend load and degrade response times. To block these requests, the ALB Ingress applies the following logic:

If all three conditions are true:

• The request uses the example.com domain name

• The request URI starts with /order/create

• The User-Agent header does not contain the string trusted

The ALB Ingress returns HTTP status code 403 and the message The order data is abnormal. Requests that don't match all three conditions are forwarded to the backend service.

Step 1: Configure a script in a ConfigMap

1. Create a file named ascript_configmap.yaml with the following content. When multiple conditions must all be true simultaneously, wrap them in and(). The eq() function checks for exact string equality, split() strips the query string from the URI, and match_re() tests a value against a regular expression. For the full function reference, see References. In this example, the script is 5 lines, which falls within the 25-line free quota.

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: ascript-rule
     namespace: default
   data:
     scriptContent: |
       if and(eq($host,'example.com'),eq(get(split($request_uri, '?'),1),'/order/create')){
         if not(match_re($http_user_agent,'.*trusted.*')){
             exit(403,'{"code":10063,"msg":"The order data is abnormal","data":{}}')
         }
       }

2. Apply the ConfigMap:

   kubectl apply -f ascript_configmap.yaml

Step 2: Associate the script with an AlbConfig

1. Open the AlbConfig for editing:

   kubectl edit albconfig <ALBCONFIG_NAME>

   Replace <ALBCONFIG_NAME> with the name of your AlbConfig.

2. Add the aScriptConfig field under the listener configuration. Save and exit to apply the changes.

   apiVersion: alibabacloud.com/v1
   kind: AlbConfig
   metadata:
     name: default
   spec:
     config:
       name: alb-test-1
       addressType: Intranet
     listeners:
     - port: 80
       protocol: HTTP
       aScriptConfig:
       - aScriptName: ascript-rule        # The name of the script.
         enabled: true                    # Set to false to disable without removing the config
         position: RequestFoot            # The position at which you want to execute the script. A value of RequestFoot specifies that the script is executed after the routing rules of the Ingress are applied.
         configMapNamespace: default      # Namespace of the ConfigMap

   For more information about execution positions, see AScript.