Get real client IP from an HTTP header - Alibaba Cloud Service Mesh

To secure your Alibaba Cloud Service Mesh (ASM) ingress gateway, you must obtain the real client IP address. This enables you to create an authorization policy that uses an IP blacklist or IP whitelist to control access. This topic describes how to configure your ingress gateway to retrieve the real client IP address from an HTTP request header.

Prerequisites

The cluster is added to the ASM instance.
Automatic sidecar injection is enabled for the namespace. For more information, see Enable automatic injection.

Background

Typically, applications rely on a reverse proxy to forward client attributes in requests, such as the X-Forwarded-For header. However, because Istio can be deployed in various network topologies, the ingress gateway may be accessed directly by using the public IP address of a Classic Load Balancer (CLB), through a Web Application Firewall (WAF), or by using other unspecified deployment topologies. To support these various deployment architectures, Service Mesh ASM cannot provide a fixed default value to correctly forward client attributes to the target workload. As a result, you cannot directly obtain the real client IP address from the X-Forwarded-For header.

To resolve this issue, set the numTrustedProxies parameter in the ASM gateway to the number of trusted proxies deployed in front of the gateway proxy. This configuration controls the value that the ingress gateway populates in the X-Envoy-External-Address header so that upstream services can use this value to access the original IP address of the client.

Procedure

Deploy a sample application.

Connect to the cluster using kubectl. For more information, see Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster.

Deploy the httpbin application.

Create a httpbin.yaml file with the following content.

httpbin.yaml

# httpbin service
apiVersion: v1
kind: ServiceAccount
metadata:
  name: httpbin
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
  labels:
    app: httpbin
    service: httpbin
spec:
  ports:
  - name: http
    port: 8000
    targetPort: 80
  selector:
    app: httpbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
      version: v1
  template:
    metadata:
      labels:
        app: httpbin
        version: v1
    spec:
      serviceAccountName: httpbin
      containers:
      - image: registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/httpbin:0.1.0
        imagePullPolicy: IfNotPresent
        name: httpbin
        ports:
        - containerPort: 80

Run the following command to deploy the httpbin application.
```
kubectl apply -f httpbin.yaml
```

Create an ASM gateway.
1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.
3. On the Ingress Gateway page, click Create and configure the basic gateway settings.
  
  Set CLB instance type to Internet Access. Configure other parameters as needed. For more information about the parameters, see Create an ingress gateway service.
4. Click Advanced Options, set External Traffic Policy to Local, and then click Create.

Create a Gateway and a VirtualService.

Use kubectl to manage Istio resources on the control plane. For more information, see Use kubectl on the control plane to access Istio resources.

Create a Gateway resource.

Use the following content to create the httpbin-gateway.yaml file.

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"

Run the following command to create the Gateway resource.
```
kubectl apply -f httpbin-gateway.yaml
```

Create a VirtualService resource.

Use the following content to create the httpbin-virtualservice.yaml file.

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - "*"
  gateways:
  - httpbin-gateway
  http:
  - route:
    - destination:
        host: httpbin
        port:
          number: 8000

Run the following command to create the VirtualService resource.
```
kubectl apply -f httpbin-virtualservice.yaml
```

Obtain the IP address of the ingress gateway on port 80 for the httpbin application. For more information, see Create an ingress gateway service.
In Web Application Firewall, add the ingress gateway address that you obtained in Step 4. For more information, see WAF tutorial.
Add the numTrustedProxies parameter to the ASM gateway.
1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Ingress Gateway.
3. On the Ingress Gateway page, find the target gateway and click View YAML.
4. In the Edit dialog box, under the spec parameter, add the following content, and then click OK.
```
podAnnotations:
    proxy.istio.io/config: '{"gatewayTopology" : { "numTrustedProxies": 2 } }'
```
  Set numTrustedProxies to the number of trusted proxies deployed in front of the gateway proxy based on your actual topology. If you set numTrustedProxies to a value N that is greater than zero, the trusted client address is the (N+1)th address from the right in the X-Forwarded-For header.

Run the following command to access the httpbin application and retrieve the real client IP address.

curl http://{IP address of the ingress gateway}/get?show_env=true

Expected output:

{
  "args": {
    "show_env": "true"
  },
  "headers": {
    "Accept": "*/*",
    ....
    "X-Envoy-Attempt-Count": "1",
    "X-Envoy-External-Address": "106.11.**.**",
    ....
  },
  ....
}

The value of X-Envoy-External-Address is the real client IP address.