一个 istio-ingressgateway 和多个 TLS 网关

Question

问题简介：

• 如果我尝试附加多个 TLS 网关（使用相同的证书） 对于一个入口网关，只有一个 TLS 可以工作。 （最后一次申请）
• 将多个非 TLS 网关连接到同一个 ingressgateway 可以正常工作。

错误信息：

域 1（正常）：

✗ curl -I https://integration.domain.com
HTTP/2 200 
server: envoy
[...]

域 2（坏）：

✗ curl -vI https://staging.domain.com    
* Rebuilt URL to: https://staging.domain.com/
*   Trying 35.205.120.133...
* TCP_NODELAY set
* Connected to staging.domain.com (35.x.x.x) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* Unknown SSL protocol error in connection to staging.domain.com:443 
* Curl_http_done: called premature == 1
* stopped the pause stream!
* Closing connection 0
curl: (35) Unknown SSL protocol error in connection to staging.domain.com:443 

事实：

我有一个通配符 TLS 证书（可以说是“*.domain.com”），我已将其保密：

kubectl create -n istio-system secret tls istio-ingressgateway-certs --key tls.key --cert tls.crt

我将默认 istio-ingressgateway 附加到静态 IP：

apiVersion: v1
kind: Service
metadata:
  name: istio-ingressgateway
  namespace: istio-system
  annotations:
  labels:
    chart: gateways-1.0.0
    release: istio
    heritage: Tiller
    app: istio-ingressgateway
    istio: ingressgateway
spec:
  loadBalancerIP: "35.x.x.x"
  type: LoadBalancer
  selector:
    app: istio-ingressgateway
    istio: ingressgateway
[...]

然后我在不同的命名空间中有两个网关，用于 TLS 通配符中包含的两个域（staging.domain.com、integration.domain.com）：

分期：

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: domain-web-gateway
  namespace: staging
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "staging.domain.com"
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "staging.domain.com"

整合：

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: domain-web-gateway
  namespace: integration
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "integration.domain.com"
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "integration.domain.com"

Answer 1

问题是您在由相同工作负载（选择器）管理的两个网关中为端口 443 使用相同的名称 (https)。他们需要有唯一的名字。此限制记录在 here。

您可以通过更改第二个网关的名称来修复它，例如：

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: domain-web-gateway
  namespace: integration
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - port:
      number: 443
      name: https-integration
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "integration.domain.com"
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "integration.domain.com"