Admission Controller supports dynamic configuration via Web API.
An admission controller can be set on each service to control client access.
admission option, each rule is a comma-separated IP, CIDR, or domain, domain will be resolved to IP.
admission property in the service to use the specified admission controller by referencing the admission controller name.
Blacklist And Whitelist¶
Similar to the bypass, the admission controller can also set the blacklist or whitelist mode, the default is the blacklist mode.
Set the admission controller to whitelist mode by adding the
~ prefix to the
Admission Control Group¶
Multiple controllers can be used by specifying a list of admission controllers using the
admissions option. When any one of the controllers rejects, it means the rejection.
The admission controller can configure multiple data sources, currently supported data sources are: inline, file, redis.
An inline data source means setting the data directly in the configuration file via the
Specify an external file as the data source. Specify the file path via the
The file format is a list of addresses separated by lines, and the part starting with
# is the comment information.
Specify the redis service as the data source, and the redis data type must be Set.
- redis server address.
- database name.
- redis key
Specify the HTTP service as the data source. For the requested URL, if HTTP returns a 200 status code, it is considered valid, and the returned data format is the same as the file data source.
- request URL
- request timeout
File, redis and HTTP data sources support hot reloading. Enable hot loading by setting the
reload property, which specifies the period for synchronizing the data source data.
The admission controller can be configured to use an external plugin service, and the controller will forward the request to the plugin server for processing. Other parameters are invalid when using plugin.
- plugin server address.
- TLS encryption will be used for transmission, TLS encryption is not used by default.