Question

我已经在安装了Istio（1.5.6，默认配置文件）的K8s环境中部署了演示服务（在端口8000上运行）。当我从群集外部调用公用地址时，它成功了。当我从群集内的Pod呼叫内部群集地址时，它失败，响应代码为503。

当我将虚拟服务更改为使用端口而不是子集时，则在两种情况（外部和内部调用）中都会成功。

有什么想法我在做什么错吗？

apiVersion: v1
kind: Namespace
metadata:
  labels:
    dgp-origin: demo-app
    istio-injection: enabled
  name: demo
---
apiVersion: v1
kind: Service
metadata:
  name: demo
  namespace: demo
  labels:
    app: demo
    version: v1
  annotations:
    networking.istio.io/exportTo: "*"
spec:
  ports:
  - name: http
    port: 8000
  selector:
    app: demo
    version: v1
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo
  namespace: demo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
      labels:
        app: demo
        version: v1
    spec:
      containers:
      - name: echo
        image: paddycarey/go-echo
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8000
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: demo
  namespace: demo
spec:
  exportTo:
  - "*"
  host: demo.demo.svc.cluster.local
  subsets:
  - name: v1
    labels:
      app: demo
      version: v1
---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: demo
  namespace: demo
spec:
  selector:
    app: istio-ingressgateway
  servers:
  - hosts:
    - demo.external.com
    port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      mode: SIMPLE
      privateKey: /etc/istio/ingressgateway-certs/tls.key
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
  - hosts:
    - demo.demo.svc.cluster.local
    port:
      name: http
      number: 80
      protocol: HTTP
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demo
  namespace: demo
spec:
  exportTo:
  - "*"
  hosts:
  - demo.external.com
  - demo.demo.svc.cluster.local
  gateways:
  - mesh
  - demo/demo
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: demo.demo.svc.cluster.local
#        port: 
#          number: 8000
        subset: v1
    timeout: 55s

日志信息（来自另一个容器的istio-proxy）

外部呼叫：确定

{
    "authority": "-",
    "bytes_received": "511",
    "bytes_sent": "4744",
    "downstream_local_address": "172.19.2.100:443",
    "downstream_remote_address": "172.18.140.129:37992",
    "duration": "43",
    "istio_policy_status": "-",
    "method": "-",
    "path": "-",
    "protocol": "-",
    "request_id": "-",
    "requested_server_name": "-",
    "response_code": "0",
    "response_flags": "-",
    "route_name": "-",
    "start_time": "2020-08-10T10:32:25.149Z",
    "upstream_cluster": "PassthroughCluster",
    "upstream_host": "172.19.2.100:443",
    "upstream_local_address": "172.18.140.129:37994",
    "upstream_service_time": "-",
    "upstream_transport_failure_reason": "-",
    "user_agent": "-",
    "x_forwarded_for": "-"
}

内部通话：不正常

{
    "authority": "demo.demo.svc.cluster.local",
    "bytes_received": "0",
    "bytes_sent": "0",
    "downstream_local_address": "172.18.212.107:80",
    "downstream_remote_address": "172.18.140.129:37802",
    "duration": "0",
    "istio_policy_status": "-",
    "method": "GET",
    "path": "/",
    "protocol": "HTTP/1.1",
    "request_id": "f875b032-f7d4-4f36-9ce1-38166aced074",
    "requested_server_name": "-",
    "response_code": "503",
    "response_flags": "NR",
    "route_name": "-",
    "start_time": "2020-08-10T10:33:51.262Z",
    "upstream_cluster": "-",
    "upstream_host": "-",
    "upstream_local_address": "-",
    "upstream_service_time": "-",
    "upstream_transport_failure_reason": "-",
    "user_agent": "curl/7.61.1",
    "x_forwarded_for": "-"
}

更新：当服务在端口80上工作时

apiVersion: v1
kind: Service
metadata:
  name: demo
  namespace: demo
  labels:
    app: demo
    version: v1
  annotations:
    networking.istio.io/exportTo: "*"
spec:
  ports:
  - name: http
    port: 80
    targetPort: 8000
  selector:
    app: demo
    version: v1

Answer 1

基于istio bookinfo应用，我要说的问题是部署中缺少标签。

有一个产品页面example

apiVersion: apps/v1
kind: Deployment
metadata:
  name: details-v1
  labels:
    app: details
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: details
      version: v1
  template:
    metadata:
      labels:
        app: details
        version: v1
    spec:
      serviceAccountName: bookinfo-details
      containers:
      - name: details
        image: docker.io/istio/examples-bookinfo-details-v1:1.16.2
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 9080

编辑后，您可以尝试使用部署吗？

apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo
  namespace: demo
  labels:
    app: demo
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo
      version: v1
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
      labels:
        app: demo
        version: v1
    spec:
      containers:
      - name: echo
        image: paddycarey/go-echo
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8000

编辑

我已经测试了您的Yaml，此外，我还使用nginx pod创建了自己的示例。

我和您有同样的问题，仅当我将端口8000添加到虚拟服务中时，网格内部调用才有效。

在我使用nginx的示例中，一切正常。

因此，据此我认为这有问题

paddycarey / go-echo图像是上次更新于4年前。
网格网关要求虚拟服务中的端口（如果端口不是80）。

我的Yamls要与Nginx一起测试。

apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: demo-app

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-v1
  namespace: demo-app
spec:
  selector:
    matchLabels:
      app: nginx1
      version: v1
  replicas: 1
  template:
    metadata:
      labels:
        version: v1
        app: nginx1
    spec:
      containers:
      - name: nginx1
        image: nginx
        ports:
        - containerPort: 80
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh", "-c", "echo Hello nginx1 > /usr/share/nginx/html/index.html"]

---

apiVersion: v1
kind: Service
metadata:
  name: nginx
  namespace: demo-app
  labels:
    app: nginx1
spec:
  ports:
  - name: http-front
    port: 80
    protocol: TCP
  selector:
    app: nginx1

---

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: simpleexample
  namespace: demo-app
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - '*'
    port:
      name: http
      number: 80
      protocol: HTTP

---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginxvirt
  namespace: demo-app
spec:
  gateways:
  - simpleexample
  - mesh
  hosts:
  - 'nginx.demo-app.svc.cluster.local'
  - 'example.com' 
  http:
  - route:
    - destination:
        host: nginx
        subset: v1

  
---

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: nginxdest
  namespace: demo-app
spec:
  host: nginx
  subsets:
  - name: v1
    labels:
      version: v1

---

apiVersion: v1
kind: Pod
metadata:
  name: ubu1
  namespace: demo-app
spec:
  containers:
  - name: ubu1
    image: ubuntu
    command: ["/bin/sh"]
    args: ["-c", "apt-get update && apt-get install curl -y && sleep 3000"]

外部通话测试

curl -v -H "host: example.com" xx.xx.xx.xx/
HTTP/1.1 200 OK
Hello nginx1

内部通话测试

root@ubu1:/# curl nginx/
Hello nginx1

让我知道是这样还是您需要进一步的帮助。

从群集内部调用时的503响应代码

1 个答案: