azure - Istio Ingress Controller 虚拟服务返回 503

Question

我创建了一个具有以下版本的 AKS 集群。

Kubernetes version: 1.12.6
Istio version: 1.1.4
Cloud Provider: Azure

我还成功使用外部 IP 地址安装了 Istio 作为我的 Ingress 网关。我还为部署服务的命名空间启用了 istio-injection。我看到 sidecar 注入(inject)正在成功进行。它正在显示。

NAME                                      READY   STATUS    RESTARTS   AGE
club-finder-deployment-7dcf4479f7-8jlpc   2/2     Running   0          11h
club-finder-deployment-7dcf4479f7-jzfv7   2/2     Running   0          11h

我的 tls 网关

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: tls-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "*"

注意:我使用自签名证书进行测试。

我申请了以下虚拟服务

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: club-finder-service-rules
  namespace: istio-system
spec:
  # https://istio.io/docs/reference/config/istio.networking.v1alpha3/#VirtualService
  gateways: # The default `mesh` value for when left blank is doesn't seem to propigate the rule properly. For now, always use a list of FQDN gateways
    - tls-gateway
  hosts:
    - "*" # APIM Manager URL
  http:
  - match:
    - uri:
        prefix: /dev/clubfinder/service/clubs
    rewrite:
      uri: /v1/clubfinder/clubs/
    route:
    - destination:
        host: club-finder.club-finder-service-dev.svc.cluster.local
        port:
          number: 8080
  - match:
    - uri:
        prefix: /dev/clubfinder/service/status
    rewrite:
      uri: /status
    route:
    - destination:
        host: club-finder.club-finder-service-dev.svc.cluster.local
        port:
          number: 8080

现在，当我尝试使用 Ingress 外部 IP 测试我的服务时，例如

curl -kv https://<external-ip-of-ingress>/dev/clubfinder/service/status

我收到以下错误

* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x7fe5e800d600)
> GET /dev/clubfinder/service/status HTTP/2
> Host: x.x.x.x --> Replacing IP intentionally
> User-Agent: curl/7.54.0
> Accept: */*
> 
* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 503 
< date: Tue, 07 May 2019 05:15:01 GMT
< server: istio-envoy
< 
* Connection #0 to host x.x.x.x left intact

有人可以指出我这里出了什么问题吗

Answer 1

我错误地定义了我的“VirtualService”yaml。我没有使用默认的 HTTP 端口 80，而是提到了 8080，这是我的应用程序监听端口。下面的 yaml 对我有用

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: club-finder-service-rules
  namespace: istio-system
spec:
  # https://istio.io/docs/reference/config/istio.networking.v1alpha3/#VirtualService
  gateways: # The default `mesh` value for when left blank is doesn't seem to propigate the rule properly. For now, always use a list of FQDN gateways
    - tls-gateway
  hosts:
    - "*" # APIM Manager URL
  http:
  - match:
    - uri:
        prefix: /dev/clubfinder/service/clubs
    rewrite:
      uri: /v1/clubfinder/clubs/
    route:
    - destination:
        host: club-finder.club-finder-service-dev.svc.cluster.local
        port:
          number: 80
  - match:
    - uri:
        prefix: /dev/clubfinder/service/status
    rewrite:
      uri: /status
    route:
    - destination:
        host: club-finder.club-finder-service-dev.svc.cluster.local
        port:
          number: 80