kong目前提供了37個外掛，其中商業收費7個，30個開源免費的外掛，可以設定到api/服務/路由粒度上。

環境設定

外掛功能

api資訊

[root@kong ~]# curl http://localhost:8001/apis
{"total":2,"data":[{"created_at":1527303008505,"strip_uri":true,"id":"28513d56-43d7-49f2-9e64-9a7a0698e24f","hosts":["userhost"],"name":"userapi","http_if_terminated":false,"https_only":false,"retries":5,"preserve_host":false,"upstream_connect_timeout":60000,"upstream_read_timeout":60000,"upstream_send_timeout":60000,"upstream_url":"http:\/\/192.168.163.117:9001\/"},{"created_at":1527303019963,"strip_uri":true,"id":"992b9c3b-889a-4c15-94b5-561ac9fb1cc9","hosts":["orghost"],"name":"orgapi","http_if_terminated":false,"https_only":false,"retries":5,"preserve_host":false,"upstream_connect_timeout":60000,"upstream_read_timeout":60000,"upstream_send_timeout":60000,"upstream_url":"http:\/\/192.168.163.117:9002\/"}]}
[root@kong ~]#

設定ip-restriction外掛

事前外掛資訊確認

[root@kong ~]# curl http://localhost:8001/plugins
{"total":0,"data":[]}
[root@kong ~]# 

設定ip-restriction外掛

[root@kong ~]# curl -X POST http://localhost:8001/apis/userapi/plugins \
>      --data "name=ip-restriction"  \
>      --data "config.blacklist=172.17.0.3/16"
{"created_at":1527303305000,"config":{"blacklist":["172.17.0.3\/16"]},"id":"3341a3f8-1d87-4960-9da1-232718d2b89d","name":"ip-restriction","api_id":"28513d56-43d7-49f2-9e64-9a7a0698e24f","enabled":true}
[root@kong ~]# 

設定後外掛資訊確認

[root@kong ~]# curl http://localhost:8001/plugins
{"total":1,"data":[{"created_at":1527303305000,"config":{"blacklist":["172.17.0.3\/16"]},"id":"3341a3f8-1d87-4960-9da1-232718d2b89d","name":"ip-restriction","api_id":"28513d56-43d7-49f2-9e64-9a7a0698e24f","enabled":true}]}
[root@kong ~]# 

blacklist確認

由於設定blacklist為172.17.0.3/16，所以IP為172.17.0.3和172.17.0.2的兩個容器內都被限制了訪問，從如下的容器中得到了確認

172.17.0.3被限制

[root@kong ~]# docker exec -it trusting_liskov sh
/ # ip ad |grep 172
    inet 172.17.0.3/16 scope global eth0
/ # 
/ # curl -H 'Host: userhost' http://192.168.163.117:8000
{"message":"Your IP address is not allowed"}
/ #

172.17.0.2被限制

[root@kong ~]# docker exec -it optimistic_stallman sh
/ # ip ad |grep 172
    inet 172.17.0.2/16 scope global eth0
/ # 
/ # curl -H 'Host: userhost' http://192.168.163.117:8000
{"message":"Your IP address is not allowed"}
/ #

192.168.163.117可正常訪問

[root@kong ~]# curl -H 'Host: userhost' http://192.168.163.117:8000
Hello, Service :User Service
[root@kong ~]# ip ad |grep 192
    inet 192.168.163.117/24 brd 192.168.163.255 scope global enp0s3
[root@kong ~]#