时间戳

首页 > 解决方案 > 使用 istio 作为外部 TLS 服务的反向代理

kubernetes - 使用 istio 作为外部 TLS 服务的反向代理

问题描述

Istio 允许您将一个 http 请求路由VirtualService到一个存在的外部主机ServiceEntry。例如：

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: httpbin-ext
spec:
  hosts:
  - httpbin.org
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.domain.co
  gateways:
  - public-gateway.istio-system.svc.cluster.local
  - mesh
  http:
  - match:
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 443
      host: httpbin.domain.co
    route:
    - destination:
        host: httpbin.org
        port:
          number: 80

但是，这只允许 HTTP 端点 - 如何将外部端点配置为 TLS/HTTPS？

标签： kubernetesistio

解决方案

这花了我几个小时来锻炼 - 我觉得值得分享。

为了终止此服务作为 TLS，Destination Rule需要 a。我的最终配置：

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: httpbin-ext
spec:
  hosts:
  - httpbin.org
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.domain.co
  gateways:
  - public-gateway.istio-system.svc.cluster.local
  - mesh
  http:
  - match:
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 443
      host: httpbin.domain.co
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 80
      host: httpbin.domain.co
    route:
    - destination:
        host: httpbin.org
        port:
          number: 443
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: httpbin-org
spec:
  host: httpbin.org
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: SIMPLE

推荐阅读