Kubernetes Istio暴露不适用于Virtualservice和Gateway [英] Kubernetes Istio exposure not working with Virtualservice and Gateway

问题描述

因此，我们在Istio 1.8.2/Kubernetes 1.18上运行以下用例:

So we have the following use case running on Istio 1.8.2/Kubernetes 1.18:

我们的群集通过Azure上的外部负载平衡器公开.当我们通过以下方式公开该应用程序时，它将起作用:

Our cluster is exposed via a External Loadbalancer on Azure. When we expose the app the following way, it works:

        ---
    apiVersion: apps/v1
    kind: ReplicaSet
    metadata:
      annotations:
        ...
      name: frontend
      namespace: frontend
    spec:
      replicas: 1
      selector:
        matchLabels:
          app: applicationname
      template:
        metadata:
          labels:
            app: appname
            name: frontend
            customer: customername
        spec:
          imagePullSecrets:
            - name: yadayada
          containers:
          - name: frontend
            image: yadayada
            imagePullPolicy: Always
            ports:
            - name: https
              protocol: TCP
              containerPort: 80
            resources: {}
          dnsPolicy: ClusterFirst
          restartPolicy: Always
          schedulerName: default-scheduler

---
apiVersion: v1
kind: Service
metadata:
  name: frontend-svc
  namespace: frontend
  labels:
    name: frontend-svc
    customer: customername
spec:
  type: LoadBalancer
  ports:
  - name: http
    port: 80
    targetPort: 80
  selector:
    name: frontend
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: frontend
  namespace: frontend
  annotations:
    kubernetes.io/ingress.class: istio
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  rules:
  - host: "customer.domain.com"
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          serviceName: frontend-svc
          servicePort: 80
  tls:
  - hosts:
    - "customer.domain.com"
    secretName: certificate

当我们开始使用虚拟服务和网关时，由于某种原因，我们无法使其正常工作.我们想使用VSVC和网关，因为它们提供了更多的灵活性和选项(例如url重写).其他应用程序没有在istio上运行此问题(也更加简单)，我们还没有适当的网络策略.我们根本无法访问该网页.有人有主意吗?虚拟服务和网关在下面.其余两个副本集未提及则不是问题:

When we start using a Virtualservice and Gateway, we fail to make it work for some reason. We wanna use VSVC and Gateways cause they offer more flexibility and options (like url rewriting). Other apps dont have this issue running on istio (much simpler as well), we dont have networkpolicy in place (yet). We simply cannot reach the webpage. Anyone has an idea? Virtualservice and Gateway down below. with the other 2 replicasets not mentioned cause they are not the problem:

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  creationTimestamp: null
  name: virtualservice-name
  namespace: frontend
spec:
  gateways:
  - frontend
  hosts:
  - customer.domain.com
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: frontend
        port:
          number: 80
      weight: 100
  - match:
    - uri:
        prefix: /api/
    route:
    - destination:
        host: backend
        port:
          number: 8080
      weight: 100
  - match:
    - uri:
        prefix: /auth/
    route:
    - destination:
        host: keycloak
        port:
          number: 8080
      weight: 100
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: frontend
  namespace: frontend
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http2
      protocol: HTTP
    tls:
      httpsRedirect: True
    hosts:
    - "customer.domain.com"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: PASSTHROUGH
      credentialName: customer-cert
    hosts:
    - "customer.domain.com"

推荐答案

您的网关指定了 PASSTHROUGH ，但是您的VirtualService提供了 HttpRoute .这意味着TLS连接不会被网关终止，但是VirtualService需要终止的TLS.另请参见这个有点类似的问题.

Your Gateway specifies PASSTHROUGH, however your VirtualService provides an HttpRoute. This means the TLS connection is not terminated by the Gateway, but the VirtualService expects terminated TLS. See also this somewhat similar question.

如何正确进行HTTPS使用Istio可以保护应用程序安全吗?

这篇关于Kubernetes Istio暴露不适用于Virtualservice和Gateway的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！