kong目前提供了37个插件，其中商业收费7个，30个开源免费的插件，可以设定到api/服务/路由粒度上。

环境设定

插件功能

api信息

[root@kong ~]# curl http://localhost:8001/apis
{"total":2,"data":[{"created_at":1527303008505,"strip_uri":true,"id":"28513d56-43d7-49f2-9e64-9a7a0698e24f","hosts":["userhost"],"name":"userapi","http_if_terminated":false,"https_only":false,"retries":5,"preserve_host":false,"upstream_connect_timeout":60000,"upstream_read_timeout":60000,"upstream_send_timeout":60000,"upstream_url":"http://192.168.163.117:9001/"},{"created_at":1527303019963,"strip_uri":true,"id":"992b9c3b-889a-4c15-94b5-561ac9fb1cc9","hosts":["orghost"],"name":"orgapi","http_if_terminated":false,"https_only":false,"retries":5,"preserve_host":false,"upstream_connect_timeout":60000,"upstream_read_timeout":60000,"upstream_send_timeout":60000,"upstream_url":"http://192.168.163.117:9002/"}]}
[root@kong ~]#

设定ip-restriction插件

事前插件信息确认

[root@kong ~]# curl http://localhost:8001/plugins
{"total":0,"data":[]}
[root@kong ~]# 

设定ip-restriction插件

[root@kong ~]# curl -X POST http://localhost:8001/apis/userapi/plugins 
>      --data "name=ip-restriction"  
>      --data "config.blacklist=172.17.0.3/16"
{"created_at":1527303305000,"config":{"blacklist":["172.17.0.3/16"]},"id":"3341a3f8-1d87-4960-9da1-232718d2b89d","name":"ip-restriction","api_id":"28513d56-43d7-49f2-9e64-9a7a0698e24f","enabled":true}
[root@kong ~]# 

设定后插件信息确认

[root@kong ~]# curl http://localhost:8001/plugins
{"total":1,"data":[{"created_at":1527303305000,"config":{"blacklist":["172.17.0.3/16"]},"id":"3341a3f8-1d87-4960-9da1-232718d2b89d","name":"ip-restriction","api_id":"28513d56-43d7-49f2-9e64-9a7a0698e24f","enabled":true}]}
[root@kong ~]# 

blacklist确认

由于设定blacklist为172.17.0.3/16，所以IP为172.17.0.3和172.17.0.2的两个容器内都被限制了访问，从如下的容器中得到了确认

172.17.0.3被限制

[root@kong ~]# docker exec -it trusting_liskov sh
/ # ip ad |grep 172
    inet 172.17.0.3/16 scope global eth0
/ # 
/ # curl -H 'Host: userhost' http://192.168.163.117:8000
{"message":"Your IP address is not allowed"}
/ #

172.17.0.2被限制

[root@kong ~]# docker exec -it optimistic_stallman sh
/ # ip ad |grep 172
    inet 172.17.0.2/16 scope global eth0
/ # 
/ # curl -H 'Host: userhost' http://192.168.163.117:8000
{"message":"Your IP address is not allowed"}
/ #

192.168.163.117可正常访问

[root@kong ~]# curl -H 'Host: userhost' http://192.168.163.117:8000
Hello, Service :User Service
[root@kong ~]# ip ad |grep 192
    inet 192.168.163.117/24 brd 192.168.163.255 scope global enp0s3
[root@kong ~]#