使用群集外部的istio入口网关访问TCP端口

Question

我以这种方式设置了网关

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
  namespace: dev
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - hosts:
    - "bitcoin-testnet-zmq.my.net"    
    port:
      number: 48832
      protocol: tcp
      name: bitcoin-zmq-testnet
  - hosts:
    - "*"
    port:
      number: 80
      protocol: http
      name: bitcoin-mainnet

这样的虚拟服务

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bitcoin-testnet-zmq
  namespace: dev
spec:
  hosts:
    - "bitcoin-testnet-zmq.my.net"
  gateways:
  - my-gateway    
  tcp:
  - match:
    - port: 48832
    route:
    - destination:
        port:
          number: 48832
          name: bitcoin-zmq-testnet
        host: bitcoinrpc-testnet-dev-service

我的服务如下

kind: Service
apiVersion: v1
metadata:
  name: bitcoinrpc-testnet-dev-service
  namespace: dev
spec:
  selector:
    app: bitcoin-node-testnet
  ports:
  - name: bitcoin-testnet
    protocol: TCP
    port: 80
    targetPort: 18332
  - name: bitcoin-zmq-testnet
    protocol: TCP
    port: 48832
    targetPort: 48832    
  type: NodePort

当我登录相同名称空间中的pod并执行telnet bitcoinrpc-testnet-dev-service 48832时，它就可以连接。   另外，发现可以通过http

正确访问所有其他istio-gateway服务

Answer 1

我看不到您的配置有问题，实际上是istio Gateway的使用，以允许外部访问您的服务。