AKS ISTIO 網關不可訪問

Question

賞金將在 5 天后到期。 此問題的答案有資格獲得+100聲望賞金。 一位開發人員希望引起更多人注意這個問題：

在 Azure kube.netes 服務 (AKS) 中無法訪問 ISTIO 網關。

我使用以下 Terraform 代碼創建了一個 AKS 集群

resource "azurerm_virtual_network" "test" {
  name                = var.virtual_network_name
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  address_space       = [var.virtual_network_address_prefix]

  subnet {
    name           = var.aks_subnet_name
    address_prefix = var.aks_subnet_address_prefix
  }

  subnet {
    name           = "appgwsubnet"
    address_prefix = var.app_gateway_subnet_address_prefix
  }

  tags = var.tags
}

data "azurerm_subnet" "kubesubnet" {
  name                 = var.aks_subnet_name
  virtual_network_name = azurerm_virtual_network.test.name
  resource_group_name  = azurerm_resource_group.rg.name
  depends_on           = [azurerm_virtual_network.test]
}

resource "azurerm_kubernetes_cluster" "k8s" {
  name       = var.aks_name
  location   = azurerm_resource_group.rg.location
  dns_prefix = var.aks_dns_prefix

  resource_group_name = azurerm_resource_group.rg.name

  http_application_routing_enabled = false

  linux_profile {
    admin_username = var.vm_user_name

    ssh_key {
      key_data = file(var.public_ssh_key_path)
    }
  }

  default_node_pool {
    name            = "agentpool"
    node_count      = var.aks_agent_count
    vm_size         = var.aks_agent_vm_size
    os_disk_size_gb = var.aks_agent_os_disk_size
    vnet_subnet_id  = data.azurerm_subnet.kubesubnet.id
  }

  service_principal {
    client_id     = local.client_id
    client_secret = local.client_secret
  }

  network_profile {
    network_plugin     = "azure"
    dns_service_ip     = var.aks_dns_service_ip
    docker_bridge_cidr = var.aks_docker_bridge_cidr
    service_cidr       = var.aks_service_cidr
  }

  # Enabled the cluster configuration to the Azure kubernets with RBAC
  azure_active_directory_role_based_access_control { 
    managed                     = var.azure_active_directory_role_based_access_control_managed
    admin_group_object_ids      = var.active_directory_role_based_access_control_admin_group_object_ids
    azure_rbac_enabled          = var.azure_rbac_enabled
  }

  oms_agent {
    log_analytics_workspace_id  = module.log_analytics_workspace[0].id
  }

  timeouts {
    create = "20m"
    delete = "20m"
  }  

  depends_on = [data.azurerm_subnet.kubesubnet,module.log_analytics_workspace]
  tags       = var.tags
}

resource "azurerm_role_assignment" "ra1" {
  scope                = data.azurerm_subnet.kubesubnet.id
  role_definition_name = "Network Contributor"
  principal_id         = local.client_objectid
  depends_on = [data.azurerm_subnet.kubesubnet]
}

並按照以下步驟按照ISTIO 文檔安裝 ISTIO

#Prerequisites
helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo update

#create namespace
kubectl create namespace istio-system

# helm install istio-base and istiod
helm install istio-base istio/base -n istio-system
helm install istiod istio/istiod -n istio-system --wait

# Check the installation status
helm status istiod -n istio-system

#create namespace and enable istio-injection for envoy proxy containers
kubectl create namespace istio-ingress
kubectl label namespace istio-ingress istio-injection=enabled

## helm install istio-ingress for traffic management
helm install istio-ingress istio/gateway -n istio-ingress --wait

## Mark the default namespace as istio-injection=enabled
kubectl label namespace default istio-injection=enabled

## Install the App and Gateway
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.16/samples/bookinfo/platform/kube/bookinfo.yaml
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.16/samples/bookinfo/networking/bookinfo-gateway.yaml

# Check the Services, Pods and Gateway
kubectl get services
kubectl get pods
kubectl get gateway

# Ensure the app is running
kubectl exec "$(kubectl get pod -l app=ratings -o jsonpath='{.items[0].metadata.name}')" -c ratings -- curl -sS productpage:9080/productpage | grep -o "<title>.*</title>"

它的響應如下所示

# Check the 
$INGRESS_NAME="istio-ingress"
$INGRESS_NS="istio-ingress"
kubectl get svc "$INGRESS_NAME" -n "$INGRESS_NS"

它返回外部 IP 如下所示

但是，我無法訪問該應用程序

此外，我在嘗試運行以下命令以查找端口時遇到錯誤

kubectl -n "$INGRESS_NS" get service "$INGRESS_NAME" -o jsonpath='{.spec.ports[?(@.name=="http2")].port}'
kubectl -n "$INGRESS_NS" get service "$INGRESS_NAME" -o jsonpath='{.spec.ports[?(@.name=="https")].port}'
kubectl -n "$INGRESS_NS" get service "$INGRESS_NAME" -o jsonpath='{.spec.ports[?(@.name=="tcp")].port}'

Answer 1

這是因為與 Helm 一起安裝時入口網關選擇器是istio: ingress ，而不是與 istioctl 一起安裝時的istio: ingressgateway ingressgateway 。

如果您修改網關以反映這一點，那么它應該可以工作：

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: bookinfo-gateway
  namespace: default
spec:
  selector:
    istio: ingress
...

顯示這一點的一種方法（之前不知道這個問題）是使用istioctl analyze ：

$ istioctl analyze
Error [IST0101] (Gateway default/bookinfo-gateway) Referenced selector not found: "istio=ingressgateway"
Error: Analyzers found issues when analyzing namespace: default.
See https://istio.io/v1.16/docs/reference/config/analysis for more information about causes and resolutions.

Answer 2

我試圖在我的環境中重現相同的內容以創建示例 Bookinginfo 應用程序，因為我遇到了同樣的錯誤。

要解決應用程序問題，請按照以下步驟操作。

使用以下 cmdlet 安裝ISTIO 。

#Prerequisites
helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo update

#create namespace
kubectl create namespace istio-system

# helm install istio-base and istiod

helm install istio-base istio/base -n istio-system
helm install istiod istio/istiod -n istio-system --wait

# Check the installation status
helm status istiod -n istio-system

#create namespace and enable istio-injection for envoy proxy containers

kubectl create namespace istio-ingress
kubectl label namespace istio-ingress istio-injection=enabled

## helm install istio-ingress for traffic management
helm install istio-ingress istio/gateway -n istio-ingress --wait

## Mark the default namespace as istio-injection=enabled
kubectl label namespace default istio-injection=enabled

#Install the Application 
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.16/samples/bookinfo/platform/kube/bookinfo.yaml

使用以下 cmdlet 檢查服務、Pod 。

    kubectl get services
    kubectl get pods
  

使用以下命令將應用程序公開到 inte.net。

kubectl expose svc productpage --type=LoadBalancer --name=productpage-external --port=9080 --target-port=9080

使用以下命令檢查服務的外部 IP 。

kubectl get svc productpage-external

在瀏覽器中使用外部 IP和端口訪問應用程序。

Ex url: http://20.121.165.179:9080/productpage

Answer 3

這是因為您遇到了 istio- prefix get stripe 的普遍擔憂，從使用istio-ingress的逐步安裝將使用ingress進行條帶化，因此如果您使用可以與應用程序選擇器匹配的istio-ingressgateway ，或者將應用程序選擇器更改為與之匹配。