Kubectl proxy plus token verification

Kubectl proxy plus token verification

Proxy does not support token plus verification, so you can only encapsulate another layer of proxies for additional verification.

Open the proxy kubectl proxy-- port=8089-- address=127.0.0.1-- accept-hosts=' ^ * $'# after this can be removed Do not allow all code mkdir go-proxycd go-proxygo mod init go-proxyvim main.gopackage mainimport ("bytes"fmt"github.com/ouqiang/goproxy"io/ioutil"log"net"net/http"net/url"strings"time") type EventHandler struct {} func (e * EventHandler) Connect (ctx * goproxy.Context, rw http.ResponseWriter) {} func (e * EventHandler) Auth (ctx * goproxy.Context) Rw http.ResponseWriter) {} func (e * EventHandler) BeforeRequest (ctx * goproxy.Context) {if clientIP, _, err: = net.SplitHostPort (ctx.Req.RemoteAddr) Err = = nil {if prior, ok: = ctx.Req.Header ["X-Forwarded-For"] Ok {clientIP = strings.Join (prior, ",") + "," + clientIP} ctx.Req.Header.Set ("X-Forwarded-For", clientIP)} / / read Body body Err: = ioutil.ReadAll (ctx.Req.Body) if err! = nil {/ / error handling return} if ctx.Req.Header.Get ("token")! = "1234" {fmt.Println ("No permission") Disable login ") ctx.Abort () return} / / Request.Body can only be read once, and must be put back after reading / / Response.Body ctx.Req.Body = ioutil.NopCloser (bytes.NewReader (body))} func (e * EventHandler) BeforeResponse (ctx * goproxy.Context, resp * http.Response) Err error) {if err! = nil {return} / / modify response} / / set the superior agent func (e * EventHandler) ParentProxy (req * http.Request) (* url.URL, error) {return url.Parse ("http://127.0.0.1:8089")}func (e * EventHandler) Finish (ctx * goproxy.Context) {log.Printf (" request to end URL:%s\ n " Ctx.Req.URL)} / / record error log func (e * EventHandler) ErrorLog (err error) {log.Println (err)} func main () {proxy: = goproxy.New (goproxy.WithDelegate (& EventHandler {})) server: = & http.Server {Addr: ": 8000", Handler: proxy, ReadTimeout: 1 * time.Minute, WriteTimeout: 1 * time.Minute } err: = server.ListenAndServe () if err! = nil {panic (err)}} go run main.go attention

There are two major changes.

If ctx.Req.Header.Get ("token")! = "1234" {here is the input of your token password return url.Parse ("http://127.0.0.1:8089")" here is your local proxy API request

Request header to add token: 1234