编辑

Question

我的istio入口网关中有以下代码

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
  namespace: staging
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - hosts:
    - "my.mongodb.com"
    port:
      number: 27018
      protocol: MONGO
      name: mongo

---      

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: myname
  namespace: staging
spec:
  hosts:
    - "my.mongodb.com"
  gateways:
  - my-gateway
  tcp:
  - match:
    - port: 27018
    route:
    - destination:
        host: my-service
        port:
          number: 27018

当我不注入边车时，可以使用my.mongodb.com:27018 --ssl

连接到此mongodb

但是，当我有挎斗时，会出现以下错误：

$ mongo my.mongodb.com:27018 --ssl
MongoDB shell version v4.0.2
connecting to: mongodb://my.mongodb.com:27018/test
2019-02-13T23:30:44.201+1100 E QUERY    [js] Error: couldn't connect to server proxy.provendb.com:27018, connection attempt failed: SocketException: Secure.Transport: handshake failure :
connect@src/mongo/shell/mongo.js:257:13
@(connect):1:6
exception: connect failed

在istio上设置启用ssl的mongodb的正确方法是什么？

编辑

我尝试过

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
  namespace: staging
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - hosts:
    - "my.mongodb.com"
    port:
      number: 443
      protocol: TLS
      name: tls-mongo
    tls:
      mode: PASSTHROUGH  


apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: myvs
  namespace: staging
spec:
  hosts:
    - "my.mongodb.com"
  gateways:
  - my-gateway
  tcp:
  - match:
    - port: 443
    route:
    - destination:
        host: my-service
        port:
          number: 27018
          # name: proxy-port

我无法访问主机

2019-02-14T05:38:08.392+1100 E QUERY    [js] Error: couldn't connect to server my.mongodb.com:443, connection attempt failed: HostUnreachable: Connection was closed :
connect@src/mongo/shell/mongo.js:257:13
@(connect):1:6
exception: connect failed

Answer 1

使用TLS作为协议，请参见an example。只需将HTTPS替换为TLS，然后修复端口和主机即可。使用端口443，并在目标位置指定端口27018。通过mongo my.mongodb.com:443 --ssl进行访问。

通过istio入口网关连接到SSL上的mongodb

编辑

1 个答案: