【发布时间】：2020-10-24 13:22:08
【问题描述】：
我已经使用以下配置安装了 ISTIO
cat << EOF | kubectl apply -f -
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
namespace: istio-system
name: istio-control-plane
spec:
# Use the default profile as the base
# More details at: https://istio.io/docs/setup/additional-setup/config-profiles/
profile: default
# Enable the addons that we will want to use
addonComponents:
grafana:
enabled: true
prometheus:
enabled: true
tracing:
enabled: true
kiali:
enabled: true
values:
global:
# Ensure that the Istio pods are only scheduled to run on Linux nodes
defaultNodeSelector:
beta.kubernetes.io/os: linux
kiali:
dashboard:
auth:
strategy: anonymous
components:
egressGateways:
- name: istio-egressgateway
enabled: true
meshConfig:
accessLogFile: /dev/stdout
outboundTrafficPolicy:
mode: REGISTRY_ONLY
EOF
并已配置 Egress Gateway、Destination Rule 和 Virtual Service，如下所示
cat << EOF | kubectl apply -f -
apiVersion: v1
kind: Namespace
metadata:
name: akv2k8s-test
labels:
istio-injection: enabled
azure-key-vault-env-injection: enabled
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: edition-cnn-com
namespace: akv2k8s-test
spec:
hosts:
- edition.cnn.com
ports:
- number: 443
name: https-port
protocol: HTTPS
resolution: DNS
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: edition-cnn-com
namespace: akv2k8s-test
spec:
hosts:
- edition.cnn.com
tls:
- match:
- port: 443
sniHosts:
- edition.cnn.com
route:
- destination:
host: edition.cnn.com
port:
number: 443
weight: 100
EOF
尝试访问时会引发错误
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.7/samples/sleep/sleep.yaml -n akv2k8s-test
export SOURCE_POD=$(kubectl get pod -l app=sleep -n akv2k8s-test -o jsonpath={.items..metadata.name})
kubectl exec "$SOURCE_POD" -n akv2k8s-test -c sleep -- curl -sL -o /dev/null -D - https://edition.cnn.com/politics
kubectl logs -l istio=egressgateway -c istio-proxy -n istio-system | tail
我该如何解决这个问题？
更新：我也试过下面的，但结果还是一样
kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: svc-entry
namespace: akv2k8s-test
spec:
hosts:
- google.com
ports:
- number: 443
name: https
protocol: HTTPS
location: MESH_EXTERNAL
resolution: DNS
EOF
kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: ext-res-dr
namespace: akv2k8s-test
spec:
host: google.com
EOF
kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: ext-res-gw
namespace: akv2k8s-test
spec:
selector:
istio: egressgateway
servers:
- port:
number: 443
name: tls
protocol: TLS
hosts:
- google.com
tls:
mode: PASSTHROUGH
EOF
kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: ext-res-vs
namespace: akv2k8s-test
spec:
hosts:
- google.com
gateways:
- mesh
- ext-res-gw
tls:
- match:
- gateways:
- mesh
port: 443
sniHosts:
- google.com
route:
- destination:
host: istio-egressgateway.istio-system.svc.cluster.local
subset: google
port:
number: 443
- match:
- gateways:
- ext-res-gw
port: 443
sniHosts:
- google.com
route:
- destination:
host: google.com
port:
number: 443
weight: 100
EOF
【问题讨论】：
-
Egress Gateway 中没有日志，因为您不使用它，您使用 Istio ServiceEntry 从您的 Istio 集群中访问可公开访问的服务 edition.cnn.com。我在新的 gke 集群上使用了你的 yamls，它没有任何问题。您提到您使用目标规则，请您添加 yaml 吗？
-
退出代码 35 来自 curl。 curl 的文档curl.haxx.se/libcurl/c/libcurl-errors.html 说这是 SSL 握手问题。您如何进行 SSL 终止？
-
我该如何解决这个问题？
标签： kubernetes istio istio-sidecar