向 istio 网格引入入口

Question

我有一个禁用 mtls 的 Istio 网格，并使用以下 pod 和服务。我正在使用 kubeadm。

pasan@ubuntu:~$ kubectl get pods --all-namespaces
NAMESPACE       NAME                                                       READY     STATUS      RESTARTS   AGE
default         debug-tools                                                2/2       Running     0          2h
default         employee--debug-deployment-57947cf67-gwpjq                 2/2       Running     0          2h
default         employee--employee-deployment-5f4d7c9d78-sfmtx             2/2       Running     0          2h
default         employee--gateway-deployment-bc646bd84-wnqwq               2/2       Running     0          2h
default         employee--salary-deployment-d4969d6c8-lz7n7                2/2       Running     0          2h
default         employee--sts-deployment-7bb9b44bf7-lthc8                  1/1       Running     0          2h
default         hr--debug-deployment-86575cffb6-6wrlf                      2/2       Running     0          2h
default         hr--gateway-deployment-8c488ff6-827pf                      2/2       Running     0          2h
default         hr--hr-deployment-596946948d-rzc7z                         2/2       Running     0          2h
default         hr--sts-deployment-694d7cff97-4nz29                        1/1       Running     0          2h
default         stock-options--debug-deployment-68b8fccb97-4znlc           2/2       Running     0          2h
default         stock-options--gateway-deployment-64974b5fbb-rjrwq         2/2       Running     0          2h
default         stock-options--stock-deployment-d5c9d4bc8-dqtrr            2/2       Running     0          2h
default         stock-options--sts-deployment-66c4799599-xx9d4             1/1       Running     0          2h

pasan@ubuntu:~$ kubectl get services
NAME                             TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)             AGE
employee--debug-service          ClusterIP   10.104.23.141    <none>        80/TCP              2h
employee--employee-service       ClusterIP   10.96.203.80     <none>        80/TCP              2h
employee--gateway-service        ClusterIP   10.97.145.188    <none>        80/TCP              2h
employee--salary-service         ClusterIP   10.110.167.162   <none>        80/TCP              2h
employee--sts-service            ClusterIP   10.100.145.102   <none>        8080/TCP,8081/TCP   2h
hr--debug-service                ClusterIP   10.103.81.158    <none>        80/TCP              2h
hr--gateway-service              ClusterIP   10.106.183.101   <none>        80/TCP              2h
hr--hr-service                   ClusterIP   10.107.136.178   <none>        80/TCP              2h
hr--sts-service                  ClusterIP   10.105.184.100   <none>        8080/TCP,8081/TCP   2h
kubernetes                       ClusterIP   10.96.0.1        <none>        443/TCP             2h
stock-options--debug-service     ClusterIP   10.111.51.88     <none>        80/TCP              2h
stock-options--gateway-service   ClusterIP   10.100.81.254    <none>        80/TCP              2h
stock-options--stock-service     ClusterIP   10.96.189.100    <none>        80/TCP              2h
stock-options--sts-service       ClusterIP   10.108.59.68     <none>        8080/TCP,8081/TCP   2h

我使用调试 pod 使用以下命令访问了此服务：

curl -X GET http://hr--gateway-service.default:80/info -H "Authorization: Bearer $token" -v

下一步，我在网格中启用了 mtls。正如预期的那样，上面的 curl 命令失败了。

现在我想设置一个入口控制器，以便像以前一样访问服务网格。

所以我设置网关和虚拟服务如下：

cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: hr-ingress-gateway
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "hr--gateway-service.default"
EOF


cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: hr-ingress-virtual-service
spec:
  hosts:
  - "*"
  gateways:
  - hr-ingress-gateway
  http:
  - match:
    - uri:
        prefix: /info/
    route:
    - destination:
        port:
          number: 80
        host: hr--gateway-service
EOF

但我仍然得到以下输出

wso2carbon@gateway-5bd88fd679-l8jn5:~$ curl -X GET http://hr--gateway-service.default:80/info -H "Authorization: Bearer $token" -v
Note: Unnecessary use of -X or --request, GET is already inferred.
*   Trying 10.106.183.101...
* Connected to hr--gateway-service.default (10.106.183.101) port 80 (#0)
> GET /info HTTP/1.1
> Host: hr--gateway-service.default
> User-Agent: curl/7.47.0
> Accept: */*
...
* Recv failure: Connection reset by peer
* Closing connection 0
curl: (56) Recv failure: Connection reset by peer

请告诉我我的入口设置是否正确，以及设置后如何使用 curl 访问服务。 我的 Ingress 服务如下：

ingress-nginx   default-http-backend                    ClusterIP   10.105.46.168    <none>         80TCP                                                                                                                    3h
ingress-nginx   ingress-nginx                           NodePort    10.110.75.131    172.17.17.100   80:30770/TCP,443:32478/TCP
istio-ingressgateway       NodePort    10.98.243.205    <none>        80:31380/TCP,443:31390/TCP,31400:31400/TCP,15011:31775/TCP,8060:32436/TCP,853:31351/TCP,15030:32149/TCP,15031:32653/TCP   3h

Answer 1

@Pasan 将 Istio CRD (VirtualServices) 应用到您需要使用 Istio 的 Ingress Gateway 作为入口点的传入流量，如下所示：https://istio.io/docs/tasks/traffic-management/ingress/

ingressgateway 是 envoy 的包装器，可使用 Istio 的 CRD 进行配置。

基本上，您不需要第二个入口控制器，并且在安装 istio 的过程中，会安装默认的，通过执行查找：

kubectl get services -n istio-system -l app=istio-ingressgateway

并使用 Ingress Gateway ip 执行：

curl -X GET http://{INGRESSGATEWAY_IP}/info -H "Authorization: Bearer $token" -H "Host: hr--gateway-service.default"

我将主机添加为网关中定义的标头，这意味着仅允许此主机进入。