Question

使用http设置Istio Gateway很好。

但是我无法设置https。我遵循了指南https://istio.io/docs/tasks/traffic-management/secure-ingress/

Istio：1.0.2（使用Helm安装） Kubernetes 1.10.3 eks

我正在使用COMODO的证书。

只有第一次，我可以使用https访问页面。访问页面后，如果尝试再次连接，则在浏览器中出现以下错误。

mycompany.com unexpectedly closed the connection.
Try:

Checking the connection
Checking the proxy and the firewall

如果我使用curl，则出现以下错误。

curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to qa-web.ffau.to:443

如果我正在使用openssl进行测试，

openssl s_client -tls1 -connect mycompany.com:443 -msg

错误

140735917949896:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.50.2/libressl/ssl/s3_pkt.c:522:

这就是我创建秘密的方式。

kubectl create -n istio-system secret tls istio-ingressgateway-certs --key ffau.to.key  --cert ffau.to.crt

这是网关和虚拟服务的名称。

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: mycompany-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
servers:
 - port:
     number: 443
     name: https
     protocol: HTTPS
   tls:
     mode: SIMPLE
     serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
     privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
   - "mycompany.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ffau-qa-phoenix-us
spec:
  hosts:
  - "mycompany.com"
  gateways:
  - mycompany-gateway
  http:
  - match:
    - uri:
       prefix: /us/account
    - uri:
        prefix: /us/reserve
    - uri:
        exact: /phoenix-bundle.js
    - uri:
       exact: /client-env.js
    - uri:
       exact: /env-variables
    - uri:
       exact: /graphql
    route:
    - destination:
        host: myui.default.svc.cluster.local
        port:
          number: 8000

Answer 1

堆栈溢出中存在类似的问题 Not able to connect to HTTPS service using ISTIO Gateway and Virtual Service，https://github.com/istio/istio/issues/6071

我在stack-overflow issue中找到了解决方法。打开端口80并使用httpsRedirect重定向到443：true

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
spec :
  selector:
    istio: ingressgateway # use istio default controller
  servers:
 - port:
     number: 80
     name: http
     protocol: HTTP
   hosts:
   - "mydomain.com"
   tls:
     httpsRedirect: true
 - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "mydomain.com"

无法在Istio Gateway中设置https

1 个答案: