mongodb - 通过 istio ingress gateway 连接到 ssl 上的 mongodb

Question

我的 istio 入口网关中有以下代码

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
  namespace: staging
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - hosts:
    - "my.mongodb.com"
    port:
      number: 27018
      protocol: MONGO
      name: mongo

---      

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: myname
  namespace: staging
spec:
  hosts:
    - "my.mongodb.com"
  gateways:
  - my-gateway
  tcp:
  - match:
    - port: 27018
    route:
    - destination:
        host: my-service
        port:
          number: 27018     

当我不注入(inject) sidecar 时，我可以使用 my.mongodb.com:27018 --ssl 连接到这个 mongodb

但是，当我有 sidecar 时，我收到以下错误:

$ mongo my.mongodb.com:27018 --ssl
MongoDB shell version v4.0.2
connecting to: mongodb://my.mongodb.com:27018/test
2019-02-13T23:30:44.201+1100 E QUERY    [js] Error: couldn't connect to server proxy.provendb.com:27018, connection attempt failed: SocketException: Secure.Transport: handshake failure :
connect@src/mongo/shell/mongo.js:257:13
@(connect):1:6
exception: connect failed

在 istio 上设置启用 ssl 的 mongodb 的正确方法是什么？

编辑

我试过了

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
  namespace: staging
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - hosts:
    - "my.mongodb.com"
    port:
      number: 443
      protocol: TLS
      name: tls-mongo
    tls:
      mode: PASSTHROUGH  


apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: myvs
  namespace: staging
spec:
  hosts:
    - "my.mongodb.com"
  gateways:
  - my-gateway
  tcp:
  - match:
    - port: 443
    route:
    - destination:
        host: my-service
        port:
          number: 27018
          # name: proxy-port 

我无法访问主机

2019-02-14T05:38:08.392+1100 E QUERY    [js] Error: couldn't connect to server my.mongodb.com:443, connection attempt failed: HostUnreachable: Connection was closed :
connect@src/mongo/shell/mongo.js:257:13
@(connect):1:6
exception: connect failed

Answer 1

使用 TLS 作为协议(protocol)，请参阅 an example 。只需将 HTTPS 替换为 TLS，并修复端口和主机即可。使用端口 443，并在目标中指定端口 27018。通过 mongo my.mongodb.com:443 --ssl 访问它。