法治建设网站模块网站建设客户资源
张小明 2026/1/1 12:34:50
法治建设网站模块,网站建设客户资源,阿里巴巴运营免费教程,越秀免费网站建设打开链接即可点亮社区Star#xff0c;照亮技术的前进之路。
Github 地址#xff1a;https://github.com/secretflow/kuscia
背景
隐私计算合作机构之间的网络较为复杂#xff0c;经常存在多层次的网关#xff0c;网关根据 Path 将请求路由到真正的业务节点。为了给这种组…打开链接即可点亮社区Star照亮技术的前进之路。Github 地址https://github.com/secretflow/kuscia背景隐私计算合作机构之间的网络较为复杂经常存在多层次的网关网关根据 Path 将请求路由到真正的业务节点。为了给这种组网提供支持Kuscia 能够对业务请求进行 Path Rewrite将对应的路由前缀添加到请求 Path。:::{tip}网关要求机构网关处需要进行 Path 前缀卸载。:::多机部署配置 Path RewriteKuscia 中心化部署参考这里Kuscia 点对点部署参考这里下面以 Alice 机构访问 Bob、Carol 机构的通信配置作为示例其中 Nginx 服务器地址为 1.1.1.1Bob 机构地址为 2.2.2.2Carol 机构地址为 3.3.3.3。# alice accesses bobs addresshttp://1.1.1.1/foo# alice accesses carols addresshttp://1.1.1.1/barNginx 配置示例如下http{# Default is HTTP/1, keepalive is only enabled in HTTP/1.1proxy_http_version1.1;proxy_set_header Connection;proxy_set_header Host$http_host;proxy_pass_request_headers on;access_log /var/log/access.log;# To allow special characters in headersignore_invalid_headers off;# Maximum number of requests through one keep-alive connectionkeepalive_requests1000;keepalive_timeout 20m;client_max_body_size 2m;# To disable bufferingproxy_buffering off;proxy_request_buffering off;upstream bob{server2.2.2.2:11080weight1max_fails5fail_timeout60s;keepalive32;keepalive_timeout 600s;keepalive_requests1000;}upstream carol{server3.3.3.3:21080weight1max_fails5fail_timeout60s;keepalive32;keepalive_timeout 600s;keepalive_requests1000;}# The reverse proxy needs to remove the prefix path before forwardingserver{location /foo/{proxy_read_timeout 10m;proxy_pass https://bob/;}location /bar/{proxy_read_timeout 10m;proxy_pass https://carol/;}}}使用 KusciaAPI 配置 Path Rewrite使用 KusciaAPI 要配置一条 Path Rewrite 路由规则需要设置endpoint的prefix字段。下面以机构 Alice 访问机构 Bob 的场景为例当机构 Bob 网关地址带 Path 时如何调用 KusciaAPI 设置endpoint的prefix字段。# Execute the example inside the container# --cert is the certificate used for mutual authentication with the serverexportCTR_CERTS_ROOT/home/kuscia/var/certscurl-k -X POSThttps://localhost:8082/api/v1/route/create--headerToken:$(cat${CTR_CERTS_ROOT}/token)--headerContent-Type: application/json--cert${CTR_CERTS_ROOT}/kusciaapi-server.crt --key${CTR_CERTS_ROOT}/kusciaapi-server.key --cacert${CTR_CERTS_ROOT}/ca.crt -d{ authentication_type: Token, destination: bob, endpoint: { host: 1.1.1.1, ports: [ { port: 80, protocol: HTTP, isTLS: true, # If the gateway is a domain and supports https, set to true, otherwise set to false path_prefix: /foo } ] }, source: alice, token_config: { token_gen_method: RSA-GEN } }