如何拦截对 Kubernetes 中服务的请求？

Question

Let's say I define a Service named my-backend in Kubernetes. I would like to intercept every request sent to this service, what is the proper way to do it? For example, another container under the same namespace sends a request through http://my-backend .

I tried to use Admission Controller with a validation Webhook. However, it can intercept the CRUD operations on service resources, but it fails to intercept any connection to a specific service.

Answer 1

There is no direct way to intercept the requests to a service in Kubernetes.

For workaround this is what you can do-

1. Create a sidecar container just to log the each incoming request. logging

2. Run tcpdump -i eth0 -n in your containers and filter out requests

3. Use Zipkin

4. Creating service on cloud providers, will have their own logging mechanism. for ex - load balancer service on aws will have its logs generated on S3. aws elb logs

Answer 2

You can use a service mesh such as istio . An istio service mesh deploys a envoy proxy sidecar along with every pod. Envoy intercepts all the incoming requests to the pod and can provide you metrics such as number of requests etc. A service mesh brings in more features such as distributed tracing, rate limiting etc.

Answer 3

Kubernetes NetworkPolicy object will help on this. A network policy controls how group of pods can communicate with each other and other network endpoints. You can only allow the ingress traffic to the my-backend service based on pod selector. Below is the example that will allow the ingress traffic from specific

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
   name: ingress-only-from-frontend-to-my-backend
   namespace: default    
spec:
   podSelector:
      matchLabels:
          <my-backend pod label>
   policyTypes:
   - Ingress
   ingress:
    - from:  
      - podSelector:
          matchLabels:
            <Frontend web pod label>