Istio：HTTPS Pod 之間的流量僅在未注入 sidecar 時有效

Question

我完成的步驟：

• 我有兩個命名空間，一個注入了 istio，另一個沒有
• 現在在兩個命名空間中使用這個 yaml 部署簡單的 nginx 服務器

apiVersion: v1
kind: Service
metadata:
  name: software-upgrader
  labels:
    app: software-upgrader
    service: software-upgrader
spec:
  ports:
    - name: http
      port: 25301
  selector:
    app: software-upgrader
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: software-upgrader
spec:
  selector:
    matchLabels:
      app: software-upgrader
      version: v1
  template:
    metadata:
      labels:
        app: software-upgrader
        version: v1
    spec:
      containers:
      - image: gcr.io/mesh7-public-images/scalability/nginx
        imagePullPolicy: IfNotPresent
        name: software-upgrader
        resources:
          limits:
            cpu: 20m
            memory: 32Mi
          requests:
            cpu: 20m
            memory: 32Mi

• 現在通過此步驟在兩個命名空間中部署 HTTPS 服務器部署 HTTPS 服務器的步驟
• 現在 curl 來自兩個命名空間中的另一個 pod
• 未注入 istio 的 Pod 會得到 200 OK，而注入了 istio 的 pod 會得到

curl: (56) OpenSSL SSL_read: error:1409445C:SSL routines:ssl3_read_bytes:tlsv13 alert certificate required, errno 0
command terminated with exit code 56

• 請原諒我的無知，如果注入 istio，我是否必須為 HTTPS 創建一些服務條目或虛擬服務以在同一命名空間中的 Pod 之間發生？

Answer 1

您必須將協議添加到服務端口定義

apiVersion: v1
kind: Service
metadata:
  name: test-https-server
  labels:
    app: test-https-server
    service: test-https-server
spec:
  ports:
    - name: test-https
      port: 25302
      appProtocol: https
  selector:
    app: test-https-server
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-https-server
spec:
  selector:
    matchLabels:
      app: test-https-server
  template:
    metadata:
      labels:
        app: test-https-server
    spec:
      containers:
      - image: gcr.io/mesh7-public-images/scalability/nginx
        command: ["bash", "-c", "python3 ThreadedHTTPSServer.py 25302"]
        imagePullPolicy: Always
        name: test-https-server
        resources:
          limits:
            cpu: 20m
            memory: 32Mi
          requests:
            cpu: 20m
            memory: 32Mi

這有一個工作示例的示例

  ports:
    - name: http
      port: 25302
      appProtocol: https # Should Specify Protocol

Istio appProtocol 配置文檔