时间戳

首页 > 解决方案 > Istio，端口相同时没有注册监听器

amazon-web-services - Istio，端口相同时没有注册监听器

问题描述

我有一个带有 2 个 EC2 节点的 EKS 集群。我想将 Istio 与 ALB 一起使用，而不是经典的 ELB，因此我修改了 Istio helm 图表中的网关以使用 NodePort，如下所示：

apiVersion: v1
kind: Service
metadata:
  name: istio-ingressgateway
  namespace: istio-system
  annotations:
  labels:
    app: istio-ingressgateway
    istio: ingressgateway
    release: istio
    istio.io/rev: default
    install.operator.istio.io/owning-resource: unknown
    operator.istio.io/component: "IngressGateways"
spec:
  type: NodePort
  selector:
    app: istio-ingressgateway
    istio: ingressgateway
  ports:
    -
      name: status-port
      port: 15021
      protocol: TCP
      nodePort: 32767
    -
      name: http2
      port: 80
      protocol: TCP
      nodePort: 31231
    -
      name: https
      port: 443
      protocol: TCP
      nodePort: 31312

另外，我为网关添加了 Ingress：


    ---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  namespace: istio-system
  name: aws-load-balancer
spec:
  controller: ingress.k8s.aws/alb
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: istio-system
  name: ingress
  labels:
    app: ingress
  annotations:
    alb.ingress.kubernetes.io/healthcheck-port: "32767"
    alb.ingress.kubernetes.io/healthcheck-path: /healthz/ready
    alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
    alb.ingress.kubernetes.io/subnets: subnet-foo,subnet-bar
spec:
  ingressClassName: aws-load-balancer
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: istio-ingressgateway
            port:
              number: 80

ALB 和 TargetGroup 已按预期创建，节点根据 TargetGroup 健康检查是健康的。

示例 bookinfo堆栈和网关安装到带标签的命名空间

% kubectl get ns bookinfo --show-labels                          
NAME       STATUS   AGE   LABELS
bookinfo   Active   18h   istio-injection=enabled

Istioctl 显示代理状态

% istioctl proxy-status
NAME                                                   CDS        LDS        EDS        RDS          ISTIOD                      VERSION
details-v1-79f774bdb9-2scfv.bookinfo                   SYNCED     SYNCED     SYNCED     SYNCED       istiod-75c795985d-pwx9j     1.10.0
istio-ingressgateway-8579cc48f8-2d5sd.istio-system     SYNCED     SYNCED     SYNCED     NOT SENT     istiod-75c795985d-pwx9j     1.10.0
productpage-v1-6b746f74dc-l795c.bookinfo               SYNCED     SYNCED     SYNCED     SYNCED       istiod-75c795985d-pwx9j     1.10.0
ratings-v1-b6994bb9-l2vcp.bookinfo                     SYNCED     SYNCED     SYNCED     SYNCED       istiod-75c795985d-pwx9j     1.10.0
reviews-v1-545db77b95-shzkj.bookinfo                   SYNCED     SYNCED     SYNCED     SYNCED       istiod-75c795985d-pwx9j     1.10.0
reviews-v2-7bf8c9648f-6k6mk.bookinfo                   SYNCED     SYNCED     SYNCED     SYNCED       istiod-75c795985d-pwx9j     1.10.0
reviews-v3-84779c7bbc-6mw5f.bookinfo                   SYNCED     SYNCED     SYNCED     SYNCED       istiod-75c795985d-pwx9j     1.10.0

但是当我尝试达到它时，它会返回 502。

% curl http://internal-k8s-istiosys-ingress-foo-bar.eu-west-1.elb.amazonaws.com/productpage
<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
</body>
</html>

Istio 版本：1.10 Kubernetes 版本：1.19 EKS 版本：eks.5

编辑：

原来没有附加听众：

% istioctl proxy-config listeners -n istio-system istio-ingressgateway-8579cc48f8-2d5sd.istio-system
ADDRESS PORT  MATCH DESTINATION
0.0.0.0 15021 ALL   Inline Route: /healthz/ready*
0.0.0.0 15090 ALL   Inline Route: /stats/prometheus*

但是，如果我将网关的端口从 80 更改为 9000，则会创建侦听器，但它需要与 ingress-gateway 端口匹配

% istioctl proxy-config listeners -n istio-system istio-ingressgateway-8579cc48f8-qzn59
ADDRESS PORT  MATCH DESTINATION
0.0.0.0 9000  ALL   Route: http.9000
0.0.0.0 15021 ALL   Inline Route: /healthz/ready*
0.0.0.0 15090 ALL   Inline Route: /stats/prometheus*

标签： amazon-web-serviceskubernetesistioamazon-eks

解决方案

如果有人遇到同样的问题，事实证明默认的 istio 入口网关无法绑定到 80，因为它是一个非特权 pod，更新了部署规范，现在可以正常运行了。

推荐阅读