3.5. 第 5 步 - 配置您的网关策略和 HTTP 路由

流程

1. 为您的网关设置 TLSPolicy，如下所示：

   kubectl apply -f - <<EOF
   apiVersion: kuadrant.io/v1
   kind: TLSPolicy
   metadata:
     name: ${gatewayName}-tls
     namespace: ${gatewayNS}
   spec:
     targetRef:
       name: ${gatewayName}
       group: gateway.networking.k8s.io
       kind: Gateway
     issuerRef:
       group: cert-manager.io
       kind: ClusterIssuer
       name: ${clusterIssuerName}
   EOF

2. 检查控制器是否接受了您的 TLS 策略，如下所示：

   kubectl get tlspolicy ${gatewayName}-tls -n ${gatewayNS} -o=jsonpath='{.status.conditions[?(@.type=="Accepted")].message}'

流程

1. 为您的网关设置默认 deny-all AuthPolicy，如下所示：

   kubectl apply -f - <<EOF
   apiVersion: kuadrant.io/v1
   kind: AuthPolicy
   metadata:
     name: ${gatewayName}-auth
     namespace: ${gatewayNS}
   spec:
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
       name: ${gatewayName}
     defaults:
       rules:
         authorization:
           "deny":
             opa:
               rego: "allow = false"
   EOF

2. 检查控制器是否接受您的 auth 策略，如下所示：

   kubectl get authpolicy ${gatewayName}-auth -n ${gatewayNS} -o=jsonpath='{.status.conditions[?(@.type=="Accepted")].message}'

流程

1. 为您的网关设置默认 RateLimitPolicy，如下所示：

   kubectl apply -f  - <<EOF
   apiVersion: kuadrant.io/v1
   kind: RateLimitPolicy
   metadata:
     name: ${gatewayName}-rlp
     namespace: ${gatewayNS}
   spec:
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
       name: ${gatewayName}
     defaults:
       limits:
         "low-limit":
           rates:
           - limit: 2
             window: 10s
   EOF

   注意

   根据您的集群应用 RateLimitPolicy 可能需要几分钟时间。本例中的限制非常低，可轻松地显示它。

2. 要检查您的速率限值已被接受，请输入以下命令：

   kubectl get ratelimitpolicy ${gatewayName}-rlp -n ${gatewayNS} -o=jsonpath='{.status.conditions[?(@.type=="Accepted")].message}'

流程

1. 为您的网关设置 DNSPolicy，如下所示：

   kubectl apply -f - <<EOF
   apiVersion: kuadrant.io/v1
   kind: DNSPolicy
   metadata:
     name: ${gatewayName}-dnspolicy
     namespace: ${gatewayNS}
   spec:
     targetRef:
       name: ${gatewayName}
       group: gateway.networking.k8s.io
       kind: Gateway
     providerRefs:
       - name: aws-credentials
     loadBalancing:
       weight: 120
       geo: EU
       defaultGeo: true
   EOF

   注意

   DNSPolicy 将使用您之前定义的 DNS Provider Secret。本例中的 地理位置是 EU，但您可以更改它以符合您的要求。

2. 检查您的 DNSPolicy 是否已接受，如下所示：

   kubectl get dnspolicy ${gatewayName}-dnspolicy -n ${gatewayNS} -o=jsonpath='{.status.conditions[?(@.type=="Accepted")].message}'

流程

1. 创建一个 HTTPRoute 以测试您的网关，如下所示：

   kubectl apply -f - <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
     name: test
     namespace: ${gatewayNS}
     labels:
       service: toystore
   spec:
     parentRefs:
     - name: ${gatewayName}
       namespace: ${gatewayNS}
     hostnames:
     - "test.${rootDomain}"
     rules:
     - backendRefs:
       - name: toystore
         port: 80
   EOF

2. 检查您的网关策略是否强制实施，如下所示：

   kubectl get dnspolicy ${gatewayName}-dnspolicy -n ${gatewayNS} -o=jsonpath='{.status.conditions[?(@.type=="Enforced")].message}'
   kubectl get authpolicy ${gatewayName}-auth -n ${gatewayNS} -o=jsonpath='{.status.conditions[?(@.type=="Enforced")].message}'
   kubectl get ratelimitpolicy ${gatewayName}-rlp -n ${gatewayNS} -o=jsonpath='{.status.conditions[?(@.type=="Enforced")].message}'

3. 检查您的 HTTPS 侦听器是否已就绪，如下所示：

   kubectl get gateway ${gatewayName} -n ${gatewayNS} -o=jsonpath='{.status.listeners[0].conditions[?(@.type=="Programmed")].message}'