我正在使用 Kubernetes/Istio 设置,我的 Pod 和服务列表如下:
NAME READY STATUS RESTARTS AGE
hr--debug-deployment-86575cffb6-wl6rx 2/2 Running 0 33m
hr--hr-deployment-596946948d-jrd7g 2/2 Running 0 33m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
hr--debug-service ClusterIP 10.104.160.61 <none> 80/TCP 33m
hr--hr-service ClusterIP 10.102.117.177 <none> 80/TCP 33m
我正在尝试从 hr--debug-deployment-86575cffb6-wl6rx
curl 到 hr--hr-service
pasan@ubuntu:~/product-vick$ kubectl exec -it hr--debug-deployment-86575cffb6-wl6rx /bin/bash
Defaulting container name to debug.
Use 'kubectl describe pod/hr--debug-deployment-86575cffb6-wl6rx -n default' to see all of the containers in this pod.
root@hr--debug-deployment-86575cffb6-wl6rx:/# curl hr--hr-service -v
* Rebuilt URL to: hr--hr-service/
* Trying 10.102.117.177...
* Connected to hr--hr-service (10.102.117.177) port 80 (#0)
> GET / HTTP/1.1
> Host: hr--hr-service
> User-Agent: curl/7.47.0
> Accept: */*
>
< HTTP/1.1 403 Forbidden
< date: Thu, 03 Jan 2019 04:06:17 GMT
< server: envoy
< content-length: 0
<
* Connection #0 to host hr--hr-service left intact
您能否解释一下为什么我会收到特使禁止的 403 错误以及如何解决该问题?
最佳答案
如果您注入(inject)了 Envoy Sidecar,它实际上取决于 authentication policy 的类型。您的服务之间有。您使用的是MeshPolicy
还是Policy
?
您还可以尝试禁用服务之间的身份验证来进行调试。像这样的东西(如果你的政策是这样定义的):
apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
name: "hr--hr-service"
spec:
targets:
- name: hr--hr-service
peers:
- mTLS:
mode: PERMISSIVE
关于kubernetes - 尝试在启用了 Sidecar 的 Pod 之间 curl 时,从 Envoy 收到 403 Forbidden,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/54016281/