欢迎关注我的公众号：

 目前刚开始写一个月，一共写了18篇原创文章，文章目录如下：

istio多集群探秘，部署了50次多集群后我得出的结论

istio多集群链路追踪，附实操视频

istio防故障利器，你知道几个,istio新手不要读，太难！

istio业务权限控制，原来可以这么玩

istio实现非侵入压缩，微服务之间如何实现压缩

不懂envoyfilter也敢说精通istio系列-http-rbac-不要只会用AuthorizationPolicy配置权限

不懂envoyfilter也敢说精通istio系列-02-http-corsFilter-不要只会vs

不懂envoyfilter也敢说精通istio系列-03-http-csrf filter-再也不用再代码里写csrf逻辑了

不懂envoyfilter也敢说精通istio系列http-jwt_authn-不要只会RequestAuthorization

不懂envoyfilter也敢说精通istio系列-05-fault-filter-故障注入不止是vs

不懂envoyfilter也敢说精通istio系列-06-http-match-配置路由不只是vs

不懂envoyfilter也敢说精通istio系列-07-负载均衡配置不止是dr

不懂envoyfilter也敢说精通istio系列-08-连接池和断路器

不懂envoyfilter也敢说精通istio系列-09-http-route filter

不懂envoyfilter也敢说精通istio系列-network filter-redis proxy

不懂envoyfilter也敢说精通istio系列-network filter-HttpConnectionManager

不懂envoyfilter也敢说精通istio系列-ratelimit-istio ratelimit完全手册

 

————————————————

//创建auth命令
func NewCmdAuth(f cmdutil.Factory, streams genericclioptions.IOStreams) *cobra.Command {// Parent command to which all subcommands are added.cmds := &cobra.Command{//创建cobra命令Use:   "auth",Short: "Inspect authorization",Long:  `Inspect authorization`,Run:   cmdutil.DefaultSubCommandRun(streams.ErrOut),}cmds.AddCommand(NewCmdCanI(f, streams))//添加can-i子命令cmds.AddCommand(NewCmdReconcile(f, streams))//添加reconcile子命令return cmds
}

type CanIOptions struct {//can-i结构体AllNamespaces   boolQuiet           boolNoHeaders       boolNamespace       stringAuthClient      authorizationv1client.AuthorizationV1InterfaceDiscoveryClient discovery.DiscoveryInterfaceVerb           stringResource       schema.GroupVersionResourceNonResourceURL stringSubresource    stringResourceName   stringList           boolgenericclioptions.IOStreams
}

//创建can-i命令
func NewCmdCanI(f cmdutil.Factory, streams genericclioptions.IOStreams) *cobra.Command {o := &CanIOptions{//初始化结构体IOStreams: streams,}cmd := &cobra.Command{//创建cobra命令Use:                   "can-i VERB [TYPE | TYPE/NAME | NONRESOURCEURL]",DisableFlagsInUseLine: true,Short:                 "Check whether an action is allowed",Long:                  canILong,Example:               canIExample,Run: func(cmd *cobra.Command, args []string) {cmdutil.CheckErr(o.Complete(f, args))//准备cmdutil.CheckErr(o.Validate())//校验var err errorif o.List {//如果指定--listerr = o.RunAccessList()//运行list} else {var allowed boolallowed, err = o.RunAccessCheck()//运行checkif err == nil {if !allowed {os.Exit(1)}}}cmdutil.CheckErr(err)},}cmd.Flags().BoolVarP(&o.AllNamespaces, "all-namespaces", "A", o.AllNamespaces, "If true, check the specified action in all namespaces.")//all-namespaces选项cmd.Flags().BoolVarP(&o.Quiet, "quiet", "q", o.Quiet, "If true, suppress output and just return the exit code.")//quiet选项cmd.Flags().StringVar(&o.Subresource, "subresource", o.Subresource, "SubResource such as pod/log or deployment/scale")//subresource选项cmd.Flags().BoolVar(&o.List, "list", o.List, "If true, prints all allowed actions.")//list选项cmd.Flags().BoolVar(&o.NoHeaders, "no-headers", o.NoHeaders, "If true, prints allowed actions without headers")//no-headers选项return cmd
}

//准备
func (o *CanIOptions) Complete(f cmdutil.Factory, args []string) error {if o.List {//如果指定了--listif len(args) != 0 {//参数不等于0个报错return errors.New("list option must be specified with no arguments")}} else {if o.Quiet {//指定了quieto.Out = ioutil.Discard//设置out}switch len(args) {//判断参数个数case 2://为2个o.Verb = args[0]//第0个位动作if strings.HasPrefix(args[1], "/") {//第1个参数有/开头o.NonResourceURL = args[1]//设置非资源urlbreak}resourceTokens := strings.SplitN(args[1], "/", 2)//用/分割restMapper, err := f.ToRESTMapper()//获取restMapperif err != nil {return err}o.Resource = o.resourceFor(restMapper, resourceTokens[0])//设置资源if len(resourceTokens) > 1 {o.ResourceName = resourceTokens[1]//设置资源名称}default:return errors.New("you must specify two or three arguments: verb, resource, and optional resourceName")//报错}}var err errorclient, err := f.KubernetesClientSet()//获取clientsetif err != nil {return err}o.AuthClient = client.AuthorizationV1()//从clientset获取authCliento.DiscoveryClient = client.Discovery()//从clientset获取discoberyCliento.Namespace = ""//设置namespace为空if !o.AllNamespaces {//没有指定all-namespaceso.Namespace, _, err = f.ToRawKubeConfigLoader().Namespace()//设置namespaceif err != nil {return err}}return nil
}

//校验
func (o *CanIOptions) Validate() error {if o.List {//指定了listif o.Quiet || o.AllNamespaces || o.Subresource != "" {//list不能和这三个同时指定return errors.New("list option can't be specified with neither quiet, all-namespaces nor subresource options")}return nil}if o.NonResourceURL != "" {//指定了非资源urlif o.Subresource != "" {//不能同时指定子资源return fmt.Errorf("--subresource can not be used with NonResourceURL")}if o.Resource != (schema.GroupVersionResource{}) || o.ResourceName != "" {//不能同时指定资源名称return fmt.Errorf("NonResourceURL and ResourceName can not specified together")}} else if !o.Resource.Empty() && !o.AllNamespaces && o.DiscoveryClient != nil {if namespaced, err := isNamespaced(o.Resource, o.DiscoveryClient); err == nil && !namespaced {//判断资源是否集群范围if len(o.Resource.Group) == 0 {//输出告警fmt.Fprintf(o.ErrOut, "Warning: resource '%s' is not namespace scoped\n", o.Resource.Resource)} else {fmt.Fprintf(o.ErrOut, "Warning: resource '%s' is not namespace scoped in group '%s'\n", o.Resource.Resource, o.Resource.Group)}}}if o.NoHeaders {//no-headers必须和list同时指定return fmt.Errorf("--no-headers cannot be set without --list specified")}return nil
}

//执行list
func (o *CanIOptions) RunAccessList() error {sar := &authorizationv1.SelfSubjectRulesReview{//创建SelfSubjectRulesReviewSpec: authorizationv1.SelfSubjectRulesReviewSpec{Namespace: o.Namespace,},}response, err := o.AuthClient.SelfSubjectRulesReviews().Create(sar)//应用SelfSubjectRulesReview到服务端if err != nil {return err}return o.printStatus(response.Status)//输出结果
}

//执行check
func (o *CanIOptions) RunAccessCheck() (bool, error) {var sar *authorizationv1.SelfSubjectAccessReview//定义SelfSubjectAccessReviewif o.NonResourceURL == "" {//非资源url为空sar = &authorizationv1.SelfSubjectAccessReview{//创建SelfSubjectAccessReviewSpec: authorizationv1.SelfSubjectAccessReviewSpec{ResourceAttributes: &authorizationv1.ResourceAttributes{Namespace:   o.Namespace,Verb:        o.Verb,Group:       o.Resource.Group,Resource:    o.Resource.Resource,Subresource: o.Subresource,Name:        o.ResourceName,},},}} else {sar = &authorizationv1.SelfSubjectAccessReview{//创建SelfSubjectAccessReviewSpec: authorizationv1.SelfSubjectAccessReviewSpec{NonResourceAttributes: &authorizationv1.NonResourceAttributes{Verb: o.Verb,Path: o.NonResourceURL,},},}}response, err := o.AuthClient.SelfSubjectAccessReviews().Create(sar)//应用SelfSubjectAccessReview到服务端if err != nil {return false, err}if response.Status.Allowed {//结果为allowed打印yesfmt.Fprintln(o.Out, "yes")} else {fmt.Fprint(o.Out, "no")//打印noif len(response.Status.Reason) > 0 {//打印reasonfmt.Fprintf(o.Out, " - %v", response.Status.Reason)}if len(response.Status.EvaluationError) > 0 {//打印EvaluationErrorfmt.Fprintf(o.Out, " - %v", response.Status.EvaluationError)}fmt.Fprintln(o.Out)}return response.Status.Allowed, nil
}