kubernetes - 从集群内部调用时的 503 响应代码
问题描述
我在安装了 Istio(1.5.6,默认配置文件)的 K8s 环境中部署了一个演示服务(在端口 8000 上运行)。当我从集群外部呼叫公共地址时,它成功了。当我从集群内的 pod 调用内部集群地址时,它失败并显示响应代码 503。
当我将虚拟服务更改为使用端口而不是子集时,它在两种情况下(外部和内部调用)都会成功。
任何想法我做错了什么?
apiVersion: v1
kind: Namespace
metadata:
labels:
dgp-origin: demo-app
istio-injection: enabled
name: demo
---
apiVersion: v1
kind: Service
metadata:
name: demo
namespace: demo
labels:
app: demo
version: v1
annotations:
networking.istio.io/exportTo: "*"
spec:
ports:
- name: http
port: 8000
selector:
app: demo
version: v1
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: demo
namespace: demo
spec:
replicas: 1
selector:
matchLabels:
app: demo
template:
metadata:
annotations:
sidecar.istio.io/inject: "true"
labels:
app: demo
version: v1
spec:
containers:
- name: echo
image: paddycarey/go-echo
imagePullPolicy: IfNotPresent
ports:
- containerPort: 8000
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
name: demo
namespace: demo
spec:
exportTo:
- "*"
host: demo.demo.svc.cluster.local
subsets:
- name: v1
labels:
app: demo
version: v1
---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
name: demo
namespace: demo
spec:
selector:
app: istio-ingressgateway
servers:
- hosts:
- demo.external.com
port:
name: https
number: 443
protocol: HTTPS
tls:
mode: SIMPLE
privateKey: /etc/istio/ingressgateway-certs/tls.key
serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
- hosts:
- demo.demo.svc.cluster.local
port:
name: http
number: 80
protocol: HTTP
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: demo
namespace: demo
spec:
exportTo:
- "*"
hosts:
- demo.external.com
- demo.demo.svc.cluster.local
gateways:
- mesh
- demo/demo
http:
- match:
- uri:
prefix: /
route:
- destination:
host: demo.demo.svc.cluster.local
# port:
# number: 8000
subset: v1
timeout: 55s
日志信息(来自另一个容器的 istio-proxy)
外呼:OK
{
"authority": "-",
"bytes_received": "511",
"bytes_sent": "4744",
"downstream_local_address": "172.19.2.100:443",
"downstream_remote_address": "172.18.140.129:37992",
"duration": "43",
"istio_policy_status": "-",
"method": "-",
"path": "-",
"protocol": "-",
"request_id": "-",
"requested_server_name": "-",
"response_code": "0",
"response_flags": "-",
"route_name": "-",
"start_time": "2020-08-10T10:32:25.149Z",
"upstream_cluster": "PassthroughCluster",
"upstream_host": "172.19.2.100:443",
"upstream_local_address": "172.18.140.129:37994",
"upstream_service_time": "-",
"upstream_transport_failure_reason": "-",
"user_agent": "-",
"x_forwarded_for": "-"
}
内部通话:不好
{
"authority": "demo.demo.svc.cluster.local",
"bytes_received": "0",
"bytes_sent": "0",
"downstream_local_address": "172.18.212.107:80",
"downstream_remote_address": "172.18.140.129:37802",
"duration": "0",
"istio_policy_status": "-",
"method": "GET",
"path": "/",
"protocol": "HTTP/1.1",
"request_id": "f875b032-f7d4-4f36-9ce1-38166aced074",
"requested_server_name": "-",
"response_code": "503",
"response_flags": "NR",
"route_name": "-",
"start_time": "2020-08-10T10:33:51.262Z",
"upstream_cluster": "-",
"upstream_host": "-",
"upstream_local_address": "-",
"upstream_service_time": "-",
"upstream_transport_failure_reason": "-",
"user_agent": "curl/7.61.1",
"x_forwarded_for": "-"
}
更新:当服务在端口 80 上时,它可以工作
apiVersion: v1
kind: Service
metadata:
name: demo
namespace: demo
labels:
app: demo
version: v1
annotations:
networking.istio.io/exportTo: "*"
spec:
ports:
- name: http
port: 80
targetPort: 8000
selector:
app: demo
version: v1
解决方案
基于 istio bookinfo应用程序,我想说这里的问题是您的部署中缺少标签。
有一个产品页面示例
apiVersion: apps/v1
kind: Deployment
metadata:
name: details-v1
labels:
app: details
version: v1
spec:
replicas: 1
selector:
matchLabels:
app: details
version: v1
template:
metadata:
labels:
app: details
version: v1
spec:
serviceAccountName: bookinfo-details
containers:
- name: details
image: docker.io/istio/examples-bookinfo-details-v1:1.16.2
imagePullPolicy: IfNotPresent
ports:
- containerPort: 9080
您可以在我编辑后尝试使用您的部署吗?
apiVersion: apps/v1
kind: Deployment
metadata:
name: demo
namespace: demo
labels:
app: demo
version: v1
spec:
replicas: 1
selector:
matchLabels:
app: demo
version: v1
template:
metadata:
annotations:
sidecar.istio.io/inject: "true"
labels:
app: demo
version: v1
spec:
containers:
- name: echo
image: paddycarey/go-echo
imagePullPolicy: IfNotPresent
ports:
- containerPort: 8000
编辑
我已经测试了你的 yaml,另外我用 nginx pod 创建了我自己的示例。
我和你有同样的问题,只有当我将端口 8000 添加到虚拟服务时,mesh internall 调用才有效。
在我使用 nginx 的示例中,一切正常。
因此,基于此,我认为要么有问题
- paddycarey/go-echo 图像,据我检查,上次更新是 4 年前。
- 网状网关需要虚拟服务中的端口,如果它是 80 以外的端口。
有我的 yamls 可以用 nginx 进行测试。
apiVersion: v1
kind: Namespace
metadata:
labels:
istio-injection: enabled
name: demo-app
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-v1
namespace: demo-app
spec:
selector:
matchLabels:
app: nginx1
version: v1
replicas: 1
template:
metadata:
labels:
version: v1
app: nginx1
spec:
containers:
- name: nginx1
image: nginx
ports:
- containerPort: 80
lifecycle:
postStart:
exec:
command: ["/bin/sh", "-c", "echo Hello nginx1 > /usr/share/nginx/html/index.html"]
---
apiVersion: v1
kind: Service
metadata:
name: nginx
namespace: demo-app
labels:
app: nginx1
spec:
ports:
- name: http-front
port: 80
protocol: TCP
selector:
app: nginx1
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: simpleexample
namespace: demo-app
spec:
selector:
istio: ingressgateway
servers:
- hosts:
- '*'
port:
name: http
number: 80
protocol: HTTP
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: nginxvirt
namespace: demo-app
spec:
gateways:
- simpleexample
- mesh
hosts:
- 'nginx.demo-app.svc.cluster.local'
- 'example.com'
http:
- route:
- destination:
host: nginx
subset: v1
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: nginxdest
namespace: demo-app
spec:
host: nginx
subsets:
- name: v1
labels:
version: v1
---
apiVersion: v1
kind: Pod
metadata:
name: ubu1
namespace: demo-app
spec:
containers:
- name: ubu1
image: ubuntu
command: ["/bin/sh"]
args: ["-c", "apt-get update && apt-get install curl -y && sleep 3000"]
外呼测试
curl -v -H "host: example.com" xx.xx.xx.xx/
HTTP/1.1 200 OK
Hello nginx1
内部通话测试
root@ubu1:/# curl nginx/
Hello nginx1
让我知道是这样还是您需要进一步的帮助。
推荐阅读
- google-oauth - 如果我在 iframe 外部单击,一键登录隐藏
- vba - 在不同的 IDE 中处理 Word 宏
- python -
如何使用 Python获取标签前后的字符串 - java - 尝试在我的 Java Spring API 中实现 Swagger 时出现错误消息
- css - 引导导航居中链接
- d3.js - 如何像geoMercator一样使geoAlbersUSA投影笔直(不弯曲)?
- java - 如何使用注解的值来初始化 bean
- python - 对 API 的 GET 请求
- android-studio - 如何从主要活动调用非静态方法到片段?
- c++ - 从 open62541Client 读取节点的 UA_Arguments