错误：1400410B：SSL 例程：CONNECT_CR_SRVR_HELLO：Istio ingressgateway 上 https 的版本号错误

Question

我正在尝试在入口网关的端口 443 上设置 SSL。我可以通过非常基本的设置来始终如一地重现。我知道这可能是我做错了，但一直无法弄清楚。

我的 k8s 集群在 EKS 上运行。 k version 1.19

我使用 AWS Certificate Manager 为域 api.foo.com 和其他名称 *.api.foo.com 创建了一个证书 证书已成功创建并具有 ARN arn:aws:acm:us-west-2:<some-numbers>:certificate/<id>

然后我对 istio 进行了原版安装： istioctl install --set meshConfig.accessLogFile=/dev/stdout

有版本：

client version: 1.7.0
control plane version: 1.7.0

这是我的网关定义：

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: foo-gateway
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-west-2:<some-numbers>:certificate/<id>"
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
    service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60"
    service.beta.kubernetes.io/aws-load-balancer-type: "elb"
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
  - port:
      number: 443
      name: https-443
      protocol: HTTP
    hosts:
      - "*"

请注意，端口 443 具有 HTTP 协议，我认为这不是问题（因为我想使用 SSL 终止）。此外，即使我将其更改为 HTTPS，我也会得到：

Resource: "networking.istio.io/v1alpha3, Resource=gateways", GroupVersionKind: "networking.istio.io/v1alpha3, Kind=Gateway"
Name: "foo-gateway", Namespace: "default"
for: "foo-gateway.yaml": admission webhook "validation.istio.io" denied the request: configuration is invalid: server must have TLS settings for HTTPS/TLS protocols

那么 tls 设置是什么？我需要通过未放置在/etc 中的注释（来自 AWS CM）获取证书密钥。顺便说一句，有没有办法在不终止 ssl 的情况下做到这一点？

我的 VirtualService 定义是这样的：

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: foo-api
spec:
  hosts:
  - "*"
  gateways:
  - foo-gateway
  http:
  - match:
    - uri:
        prefix: /users
    route:
    - destination:
        host: https-user-manager
        port:
          number: 7070

然后我在端口 7070 上 k apply -f 一个名为 https-user-manager 的超级简单 REST 服务。然后我从 k get svc -n istio-system 中找到负载均衡器的主机名，这会产生：

NAME                   TYPE           CLUSTER-IP      EXTERNAL-IP                                                               PORT(S)                                                      AGE
istio-ingressgateway   LoadBalancer   <cluster-ip>    blahblahblah.us-west-2.elb.amazonaws.com   15021:30048/TCP,80:30210/TCP,443:31349/TCP,15443:32587/TCP   32m

我可以成功地使用 http，例如： curl http://blahblahblah.us-west-2.elb.amazonaws.com/users 并获得有效回复

但是如果我这样做： curl -vi https://blahblahblah.us-west-2.elb.amazonaws.com/users我得到以下信息：

*   Trying <ip>...
* TCP_NODELAY set
* Connected to api.foo.com (<ip>) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
* Closing connection 0
curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number

我做错了什么？我见过这些https://medium.com/faun/managing-tls-keys-and-certs-in-istio-using-amazons-acm-8ff9a0b99033、Istio-ingressgateway with https - Connection refused、Setting up istio ingressgateway、SSL Error - wrong version number (HTTPS to HTTP)、Updating Istio-IngressGateway TLS Cert、https://github.com/kubernetes/ingress-nginx/issues/3556、https://github.com/istio/istio/issues/14264、https://preliminary.istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/、https://preliminary.istio.io/latest/docs/tasks/traffic-management/ingress/ingress-sni-passthrough/，还有很多我都不记得了了。非常感谢任何帮助！

Answer 1

low level nginx  
ssl on;  
high level nginx  
listen 443 ssl;  

这对我有用