在集群外使用 istio ingress gateway 访问 TCP 端口

Question

我的网关是这样设置的

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
  namespace: dev
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - hosts:
    - "bitcoin-testnet-zmq.my.net"    
    port:
      number: 48832
      protocol: tcp
      name: bitcoin-zmq-testnet
  - hosts:
    - "*"
    port:
      number: 80
      protocol: http
      name: bitcoin-mainnet

这样的虚拟服务

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bitcoin-testnet-zmq
  namespace: dev
spec:
  hosts:
    - "bitcoin-testnet-zmq.my.net"
  gateways:
  - my-gateway    
  tcp:
  - match:
    - port: 48832
    route:
    - destination:
        port:
          number: 48832
          name: bitcoin-zmq-testnet
        host: bitcoinrpc-testnet-dev-service

而我的服务如下

kind: Service
apiVersion: v1
metadata:
  name: bitcoinrpc-testnet-dev-service
  namespace: dev
spec:
  selector:
    app: bitcoin-node-testnet
  ports:
  - name: bitcoin-testnet
    protocol: TCP
    port: 80
    targetPort: 18332
  - name: bitcoin-zmq-testnet
    protocol: TCP
    port: 48832
    targetPort: 48832    
  type: NodePort

当我登录到同一命名空间中的 pod 并执行telnet bitcoinrpc-testnet-dev-service 48832 时，它可以连接。 另外，发现所有其他http服务都可以通过istio-gateway正确访问

Answer 1

我认为您的配置没有问题，实际上这是使用 istio 网关来允许外部访问您的服务。