istio - 使用 TLS 保护 Istio 入口网关

Question

我的目标是在 istio 入口网关上使用 TLS 终止来保护我当前的 Spring Boot 应用程序。到目前为止，我的整个设置都适用于 HTTP。

但是，当我尝试为特定域设置证书时，对我的请求的响应是“对等方重置连接”。

我的设置在 GKE 集群中运行，我在其中安装了 istio 演示配置。

这是我当前的设置：

我的测试应用程序部署

kind: Deployment
metadata:
  name: test-deployment
  labels:
    app: my-test-app
spec:
  selector:
    matchLabels:
      app:  my-test-app
  template:
    metadata:
      labels:
        app: my-test-app
    spec:
      containers:
        - name: my-test-app-container
          image: ######
          imagePullPolicy: Always
          ports:
            - containerPort: 9080
          env:
            - name: SPRING_PROFILES_ACTIVE
              value: "k8s"
      imagePullSecrets:
        - name: registry.###.com

我的测试应用服务

kind: Service
metadata:
  name: my-test-app-service
spec:
  selector:
    app: my-test-app
  ports:
    - protocol: TCP
      name: http
      port: 9080

入口网关设置

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
spec:
  selector:
    istio: ingressgateway 
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: my-credential 
      hosts:
      - "sub.example.com"

虚拟服务

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-virtual-router
spec:
  hosts:
    - "*"
  gateways:
    - my-gateway
  http:
    - match:
        - uri:
            prefix: /api/v1/sub1/sub2
      route:
        - destination:
            host: my-test-app-service
            port:
              number: 9080

当我在这些设置下进行卷曲时，我得到以下信息：

* Preparing request to https://#########/api/v1/sub1/sub2
* Current time is 2020-12-#####
* Using libcurl/7.69.1 OpenSSL/1.1.1g zlib/1.2.11 brotli/1.0.7 libidn2/2.1.1 libssh2/1.9.0 nghttp2/1.41.0
* Using default HTTP version
* Disable timeout
* Enable automatic URL encoding
* Enable SSL validation
* Enable cookie sending with jar of 0 cookies
* Too old connection (665 seconds), disconnect it
* Connection 24 seems to be dead!
* Closing connection 24
* TLSv1.3 (OUT), TLS alert, close notify (256):
*   Trying ###.###.###.###:443...
* Connected to ###.###.###.### (###.###.###.###) port 443 (#26)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
*   CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: Connection reset by peer in connection to ###.###.###.###:443 
* Closing connection 23

我正在使用在另一台机器上收到的 Let's encrypt 证书，因为 DNS 更新需要一天时间。对于导入，我使用 cert.pem 和 key.pem 在集群中创建了一个秘密。

kubectl create -n istio-system secret tls my-credential --key=sub.example.com-key.pem --cert=sub.example.com-crt.pem

sub.example.com仅当我将主机的入口网关设置更改为*并禁用证书检查时，该方案才有效。

我希望能找到可以帮助我的人！提前致谢！

标签： istio