我正在遵循Istio文档(https://istio.io/docs/examples/advanced-egress/egress-gateway/)来设置出口网关。我得到的结果与文档描述的结果不同,我想知道如何解决它。
我有一个简单的docker容器,其中注入了sidecar。在为google.com
应用类似于文档提供的网关配置之后:
cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: google
spec:
hosts:
- google.com
ports:
- number: 80
name: http-port
protocol: HTTP
- number: 443
name: https
protocol: HTTPS
resolution: DNS
EOF
我仍然无法从容器中到达它:
$ kubectl exec -it $SOURCE_POD -c $CONTAINER_NAME -- curl -sL -o /dev/null -D - http://google.com
HTTP/1.1 301 Moved Permanently
location: http://www.google.com/
content-type: text/html; charset=UTF-8
...
HTTP/1.1 404 Not Found
date: Thu, 18 Oct 2018 22:55:57 GMT
server: envoy
content-length: 0
但是,curl
中的istio-proxy
有效:
$ kubectl exec -it $SOURCE_POD -c istio-proxy -- curl -sL -o /dev/null -D - http://google.com
HTTP/1.1 301 Moved Permanently
Location: http://www.google.com/
Content-Type: text/html; charset=UTF-8
...
HTTP/1.1 200 OK
Date: Thu, 18 Oct 2018 22:55:43 GMT
Expires: -1
...
检查网关是否存在:
$ kubectl describe serviceentry/google
Name: google
Namespace: default
Labels: <none>
Annotations: kubectl.kubernetes.io/last-applied-configuration:
{"apiVersion":"networking.istio.io/v1alpha3","kind":"ServiceEntry","metadata":{"annotations":{},"name":"google","namespace":"default"},"sp...
API Version: networking.istio.io/v1alpha3
Kind: ServiceEntry
Metadata:
Cluster Name:
Creation Timestamp: 2018-10-18T22:36:34Z
Generation: 1
Resource Version: 2569394
Self Link: /apis/networking.istio.io/v1alpha3/namespaces/default/serviceentries/google
UID: 4482d584-...
Spec:
Hosts:
google.com
Ports:
Name: http-port
Number: 80
Protocol: HTTP
Name: https
Number: 443
Protocol: HTTPS
Resolution: DNS
Events: <none>
有什么想法吗?
答案 0 :(得分:1)
您的问题是curl请求将301重定向到www.google.com
,但是您的ServiceEntry仅公开了google.com
。您可以通过将www.google.com
作为ServiceEntry中的另一个主机添加来解决此问题,如下所示:
cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: google
spec:
hosts:
- google.com
- www.google.com
ports:
- number: 80
name: http-port
protocol: HTTP
- number: 443
name: https
protocol: HTTPS
resolution: DNS
EOF
答案 1 :(得分:0)
如果您不想处理通配符,则可以添加通配符。使用HTTP即可。 您可以尝试使用* .google.com之类的东西,现在您可以使用google的所有服务,而将来不会被阻止。