配置說明 
...

http {
# 日志記錄tcp三次握手的$remote_addr
# 記錄x-real-ip
# 記錄x-forward-ip 用戶的真實ip一定在其中
    log_format access '$remote_addr $server_port - $http_host [$time_local] '
                      '"$request" $status $body_bytes_sent '
                      '"$http_referer" "$http_user_agent" '
                      '$http_x_forwarded_for|$http_x_real_ip|$limit_key';
    access_log /dev/stdout access;
#添加白名單
    geo $limit {
        default 1;
        192.168.0.0/24 0;
        10.0.0.0/8 0;
        127.0.0.0/8 0;
        43.132.198.237/32 0;
    }
# 先匹配x-forwarded-for中的ip，沒匹配到則用remote_addr作為用戶ip
    map $http_x_forwarded_for $real_ip {
        default         $remote_addr;
        "~^(?P<ip>[^,]+)" $ip;
    }
# 白名單不限速
    map $limit $limit_key {
        0 "";
        1 $real_ip;
    }

# 限制每個ip請求頻率
    limit_req_zone $limit_key zone=req_ip:10m rate=5r/s;
# 限制整個服務(wù)的請求頻率
    limit_req_zone $server_name zone=req_svr:1m rate=50r/s;
# 超限斷開連接
    limit_req_status 444;
# 限制單ip并發(fā)連接
    limit_conn_zone $limit_key zone=con_ip:10m;

    server {
# 配置解析dns
        resolver kube-dns.kube-system.svc.cluster.local ipv6=off;
# 配置ssl
        listen 443 ssl;
        ssl_certificate /app/cert.pem;
        ssl_certificate_key /app/cert.key;
        ssl_session_timeout 5m;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
        ssl_prefer_server_ciphers on;
# 配置證書過期驗證在服務(wù)器上驗證
        ssl_stapling on;
        ssl_stapling_verify on;
# 開啟gzip壓縮，節(jié)省流量
        gzip on;
        gzip_types *;
        gzip_comp_level 6;
        gzip_min_length 256;
        gzip_buffers 16 8k;
        gzip_proxied any;
        gzip_vary on;
        gzip_disable "MSIE [1-6]\.(?!.*SV1)";

# 配置服務(wù)匹配的域名
        server_name www.dk8s.com;
        server_name www.dk8s.cn;

# 限制每個鏈接的下載速率
        limit_rate 100k;
        limit_rate_after 1m;
# 限制單ip的并發(fā)連接數(shù)
        limit_conn con_ip 40;

        location / {
# 限制單ip的突發(fā)為100，排隊長度為200
            limit_req zone=req_ip burst=100 delay=200;
# 限制服務(wù)的突發(fā)為1000，排隊長度為2000
            limit_req zone=req_svr burst=1000 delay=2000;
# 傳遞host
            proxy_set_header Host $host;
# 請求ip作為x-real-ip
            proxy_set_header X-Real-IP $remote_addr;
# 追加nginx的ip到x-forward-for中
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# 傳遞請求協(xié)議
            proxy_set_header X-Forwarded-Proto $scheme;
# 傳遞到后端服務(wù)
            proxy_pass http://dk8s-web-svc.default.svc.cluster.local:80;
        }

        location /public/pkg/ {
# 限制客戶端下載并發(fā)為2
            limit_conn con_ip 2;
            limit_req zone=req_ip burst=10;
            limit_req zone=req_svr burst=100;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_pass http://dk8s-res-svc.default.svc.cluster.local:5000/pkg/;
        }
        ...
    }
...
}

}