Azure Kubernetes - Istio 出口不工作

Question

我使用以下配置來設置 Istio

cat << EOF | kubectl apply -f -
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: istio-control-plane
spec:
  # Use the default profile as the base
  # More details at: https://istio.io/docs/setup/additional-setup/config-profiles/
  profile: default
  # Enable the addons that we will want to use
  addonComponents:
    grafana:
      enabled: true
    prometheus:
      enabled: true
    tracing:
      enabled: true
    kiali:
      enabled: true
  values:
    global:
      # Ensure that the Istio pods are only scheduled to run on Linux nodes
      defaultNodeSelector:
        beta.kubernetes.io/os: linux
    kiali:
      dashboard:
        auth:
          strategy: anonymous
  components:
    egressGateways:
    - name: istio-egressgateway
      enabled: true
EOF

我可以看到 istio 服務

kubectl get svc -n istio-system

我已經部署了睡眠應用

kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.7/samples/sleep/sleep.yaml
-n akv2k8s-test

並且已經部署了 ServiceEntry

kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: httpbin-ext
  namespace: akv2k8s-test
spec:
  hosts:
  - httpbin.org
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  location: MESH_EXTERNAL
EOF

並嘗試訪問外部 URL

export SOURCE_POD=$(kubectl get -n  akv2k8s-test  pod -l app=sleep -o jsonpath='{.items..metadata.name}')
kubectl exec "$SOURCE_POD"  -n  akv2k8s-test  -c sleep -- curl -sI http://httpbin.org/headers | grep  "HTTP/"; 

但是我看不到代理上報告的任何日志

kubectl logs "$SOURCE_POD" -n  akv2k8s-test -c istio-proxy | tail

根據文檔，我應該看到這個

但是我沒有看到標題

我在這里錯過了什么嗎？

Answer 1

我讓它按照下面提到的方式工作

cat << EOF | kubectl apply -f -
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: istio-control-plane
spec:
  # Use the default profile as the base
  # More details at: https://istio.io/docs/setup/additional-setup/config-profiles/
  profile: default
  # Enable the addons that we will want to use
  addonComponents:
    grafana:
      enabled: true
    prometheus:
      enabled: true
    tracing:
      enabled: true
    kiali:
      enabled: true
  values:
    global:
      # Ensure that the Istio pods are only scheduled to run on Linux nodes
      defaultNodeSelector:
        beta.kubernetes.io/os: linux
    kiali:
      dashboard:
        auth:
          strategy: anonymous
  components:
    egressGateways:
    - name: istio-egressgateway
      enabled: true
  meshConfig:
    accessLogFile: /dev/stdout
    outboundTrafficPolicy:
      mode: REGISTRY_ONLY
EOF


cat << EOF | kubectl apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: akv2k8s-test
  labels:
    istio-injection: enabled
    azure-key-vault-env-injection: enabled
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: cnn
  namespace: akv2k8s-test
spec:
  hosts:
  - edition.cnn.com
  ports:
  - number: 80
    name: http-port
    protocol: HTTP
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-egressgateway
  namespace: akv2k8s-test
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - edition.cnn.com
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: egressgateway-for-cnn
  namespace: akv2k8s-test
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  subsets:
  - name: cnn
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: direct-cnn-through-egress-gateway
  namespace: akv2k8s-test
spec:
  hosts:
  - edition.cnn.com
  gateways:
  - istio-egressgateway
  - mesh
  http:
  - match:
    - gateways:
      - mesh
      port: 80
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
        subset: cnn
        port:
          number: 80
      weight: 100
  - match:
    - gateways:
      - istio-egressgateway
      port: 80
    route:
    - destination:
        host: edition.cnn.com
        port:
          number: 80
      weight: 100
EOF

kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.7/samples/sleep/sleep.yaml -n akv2k8s-test
export SOURCE_POD=$(kubectl get pod -l app=sleep -n akv2k8s-test -o jsonpath={.items..metadata.name})
kubectl exec "$SOURCE_POD" -n akv2k8s-test -c sleep -- curl -sL -o /dev/null -D - http://edition.cnn.com/politics
kubectl logs -l istio=egressgateway -c istio-proxy -n istio-system | tail


kubectl delete -n akv2k8s-test gateway istio-egressgateway
kubectl delete -n akv2k8s-test serviceentry cnn
kubectl delete -n akv2k8s-test virtualservice direct-cnn-through-egress-gateway
kubectl delete -n akv2k8s-test destinationrule egressgateway-for-cnn

Answer 2

只是為了澄清 Karthikeyan Vijayakumar 為完成這項工作所做的工作。

理論上 istio Egress Gateway 在這里不起作用，因為你沒有使用它，你只是使用 istio Service Entry 從你的 Istio 集群中訪問可公開訪問的服務 edition.cnn.com。

看看這里的文檔，你需要更多的組件來實際使用它。

根據上述文檔第 3 點和第 4 點，您缺少出口網關、目標規則和虛擬服務。

服務條目允許在 Istio 的內部服務注冊表中添加額外的條目，以便網格中自動發現的服務可以訪問/路由到這些手動指定的服務。 這不像您啟用出口網關，並且每個流量都通過出口網關。

當您添加以下依賴項時，流量如下所示，我假設您正在使用集群內的 pod 與外部服務進行通信。

[sleep pod - envoy sidecar] -> Mesh 網關 -> egress gateway -> 外部服務