面对kubernetes集群中两个服务之间的ssl连接问题答案

【问题标题】：Facing ssl connection issue between two services in kubernetes cluster面对kubernetes集群中两个服务之间的ssl连接问题
【发布时间】：2023-01-29 23:29:29
【问题描述】：

我正在尝试在同一个命名空间中的两个服务之间建立 ssl 连接。我在每个 pod 中嵌入了 istio-proxy side car 容器。我已经创建了 peerauthentication 和目标规则。

目的地规则

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
spec:
  host: brand-tool-ui-clone
  trafficPolicy:
    tls:
      mode: SIMPLE
      privateKey: /etc/istio/private/mykey.key
      serverCertificate: /etc/istio/certs/mycert.crt

对等认证

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  creationTimestamp: "2023-01-27T12:48:19Z"
  generation: 2
  name: default
  namespace: https-poc
  resourceVersion: "128521847"
  uid: 9035144f-4ae5-4b2e-89af-c14fc081b96a
spec:
  mtls:
    mode: PERMISSIVE

但无法使用 https 成功调用其他服务，从 curl 获取此错误

$ curl -k  -v https://<hostname>/ecv-status
* Expire in 0 ms for 6 (transfer 0x5597ba492680)
* Expire in 1 ms for 1 (transfer 0x5597ba492680)
* Expire in 0 ms for 1 (transfer 0x5597ba492680)
* Expire in 1 ms for 1 (transfer 0x5597ba492680)
* Expire in 0 ms for 1 (transfer 0x5597ba492680)
* Expire in 0 ms for 1 (transfer 0x5597ba492680)
* Expire in 1 ms for 1 (transfer 0x5597ba492680)
* Expire in 0 ms for 1 (transfer 0x5597ba492680)
* Expire in 0 ms for 1 (transfer 0x5597ba492680)
* Expire in 0 ms for 1 (transfer 0x5597ba492680)
*   Trying 1.199.124.123...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x5597ba492680)
* Connected to <host> (1.199.124.123) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
* Closing connection 0
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

【问题讨论】：

标签： kubernetes istio-gateway

【解决方案1】：

DestinationRule 中使用的属性必须用“clientCertificate”更正。请您参考istio official documentation，其中有正确的示例和目标规则的允许值。

可以使用 istio mTLS 通信（ISTIO_MUTUAL）功能而不是通过部署进行维护，istio 将负责在所有 pod 中加载必要的证书并确保通信安全。以下是可以为所有服务创建的目标规则

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: ratings-istio-mtls
spec:
  host: <service-name>.<namespace-name>.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

并将 PeerAuthentication mtls 模式更改为“STRICT”，这将确保 pod 之间的双向通信。

【讨论】：