Istio：HTTPS Pod 之间的流量仅在未注入 sidecar 时有效

Question

我完成的步骤：

• 我有两个命名空间，一个注入了 istio，另一个没有
• 现在在两个命名空间中使用这个 yaml 部署简单的 nginx 服务器

apiVersion: v1
kind: Service
metadata:
  name: software-upgrader
  labels:
    app: software-upgrader
    service: software-upgrader
spec:
  ports:
    - name: http
      port: 25301
  selector:
    app: software-upgrader
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: software-upgrader
spec:
  selector:
    matchLabels:
      app: software-upgrader
      version: v1
  template:
    metadata:
      labels:
        app: software-upgrader
        version: v1
    spec:
      containers:
      - image: gcr.io/mesh7-public-images/scalability/nginx
        imagePullPolicy: IfNotPresent
        name: software-upgrader
        resources:
          limits:
            cpu: 20m
            memory: 32Mi
          requests:
            cpu: 20m
            memory: 32Mi

• 现在通过此步骤在两个命名空间中部署 HTTPS 服务器部署 HTTPS 服务器的步骤
• 现在 curl 来自两个命名空间中的另一个 pod
• 未注入 istio 的 Pod 会得到 200 OK，而注入了 istio 的 pod 会得到

curl: (56) OpenSSL SSL_read: error:1409445C:SSL routines:ssl3_read_bytes:tlsv13 alert certificate required, errno 0
command terminated with exit code 56

• 请原谅我的无知，如果注入 istio，我是否必须为 HTTPS 创建一些服务条目或虚拟服务以在同一命名空间中的 Pod 之间发生？

Answer 1

您必须将协议添加到服务端口定义

apiVersion: v1
kind: Service
metadata:
  name: test-https-server
  labels:
    app: test-https-server
    service: test-https-server
spec:
  ports:
    - name: test-https
      port: 25302
      appProtocol: https
  selector:
    app: test-https-server
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-https-server
spec:
  selector:
    matchLabels:
      app: test-https-server
  template:
    metadata:
      labels:
        app: test-https-server
    spec:
      containers:
      - image: gcr.io/mesh7-public-images/scalability/nginx
        command: ["bash", "-c", "python3 ThreadedHTTPSServer.py 25302"]
        imagePullPolicy: Always
        name: test-https-server
        resources:
          limits:
            cpu: 20m
            memory: 32Mi
          requests:
            cpu: 20m
            memory: 32Mi

这有一个工作示例的示例

  ports:
    - name: http
      port: 25302
      appProtocol: https # Should Specify Protocol

Istio appProtocol 配置文档