如何创建Flask Rest API服务器来限制Kubernetes Rest API访问

Question

我使用Flask和Gunicorn编写Restful API，以最大限度地减少对Kubernetes REST的访问。例如，KubernetREST给出了可用URL的列表：

{
"paths": [
..
..
..
"/apis/xxxx.io",
"/apis/xxxx.io/v1alpha1",
..
.   ..
"/metrics",
"/swagger-2.0.0.json",
"/swagger-2.0.0.pb-v1",
"/swagger-2.0.0.pb-v1.gz",
"/swagger-ui/",
"/swagger.json",
"/swaggerapi",
"/ui",
"/ui/",
"/version"
]
}

我想限制只访问：

"/apis/xxxx.io",
"/apis/xxxx.io/v1alpha1",

以及在访问之后的返回中在这两个URL下(子URL(提供的任何GET。

问题：我想允许访问。我发现http://flask.pocoo.org/snippets/57/，它似乎不适用于以下代码：

import json
import logging

from flask import Flask, jsonify
from flask_cors import CORS
from kubernetes import client, config
app = Flask(__name__)
CORS(app)
config.load_incluster_config()
api_instance = client.CoreV1Api()
def read_file(filename):
with open(filename, 'r') as content_file:
content = content_file.read()
return content
def set_configuration():
configuration = client.Configuration()
configuration.verify_ssl = False
configuration.debug = True
return configuration
@app.route('/', defaults={'path': ''})
@app.route('/<path:path>')
def catch_all(path):
logger.info("Request Path: " + path)
bearer_header = {"Authorization": "Bearer %s" % read_file('/etc/token')}
client.Configuration.set_default(set_configuration())
v1 = client.CoreV1Api()
ret = v1.api_client.rest_client.GET('https://kubernetes/', bearer_header)
return jsonify(requests.get(url).json())
if __name__ == "__main__":
logging.basicConfig(level=10)
logger = logging.getLogger(__name__)
app.run(host="0.0.0.0", port="5000")

作为Python中Flask/Restful的初学者，你会给出你的见解或线索吗？

问候，

Answer 1

看起来我已经想好了如何绕过，但仍然需要想好如何限制访问。我认为Kubernetes服务帐户或规则可能有答案：

@app.route("/"，默认值=｛'路径'："｝(@app.route('/'(def fms_rest(路径(：bearer_header=｛"Authorization"："bearer%s"%read_file('/etc/token'(｝

client.Configuration.set_default(set_configuration())
v1 = client.CoreV1Api()
ret = v1.api_client.rest_client.GET('https://kubernetes/', bearer_header)
data = json.loads(ret.data)
if '/' + path in data["paths"]:
return jsonify(json.loads(v1.api_client.rest_client.GET('https://kubernetes/' + path, bearer_header).data))
data["url"] = path
return jsonify(data)