将 Ingress 资源转换为 Istio VirtualService 或 ServiceEntry

Question

我有一个应用程序，其 Ingress 资源如下所示。

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ $fullName }}-stateful
  labels: 
    app: oxauth
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.org/ssl-services: "oxtrust"
    nginx.ingress.kubernetes.io/app-root: "/identity"
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/session-cookie-name: "route"
    nginx.ingress.kubernetes.io/session-cookie-hash: "sha1"
    nginx.ingress.kubernetes.io/proxy-next-upstream: "error timeout invalid_header http_500 http_502 http_503 http_504"
spec:
{{- if .Values.ingress.tls }}
  tls:
  {{- range .Values.ingress.tls }}
    - hosts:
      {{- range .hosts }}
        - {{ . | quote }}
      {{- end }}
      secretName: {{ .secretName }}
  {{- end }}
{{- end }}
  rules:
  {{- range .Values.ingress.hosts }}
    - host: {{ . | quote }}
      http:
        paths:
          - path: /identity
            backend:
              serviceName: oxtrust
              servicePort: 8080
          - path: /idp
            backend:
              serviceName: oxshibboleth
              servicePort: 8080
          - path: /passport
            backend:
              serviceName: oxpassport
              servicePort: 8090

我想把它翻译成一个VirtualService 供 Istio 网关使用。但是一旦我这样做，服务oxpassport 总是在日志中返回503 错误。这意味着无法到达部署。

下面是Service的定义

apiVersion: v1
kind: Service
metadata:
  creationTimestamp: "2020-04-15T18:21:12Z"
  labels:
    app: oxpassport
    app.kubernetes.io/instance: kk
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/version: 4.1.0_01
    helm.sh/chart: oxpassport-1.0.0
  name: oxpassport
  namespace: test
spec:
  clusterIP: 10.111.71.120
  ports:
  - name: tcp-oxpassport
    port: 8090
    protocol: TCP
    targetPort: 8090
  selector:
    app: oxpassport
    release: kk
  type: ClusterIP
status:
  loadBalancer: {}

最后是我尝试使用的VS：

VirtualService

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: {{ include "istio.fullname" . }}-oxpassport
  namespace: {{ .Release.Namespace }}
spec:
  hosts:
    - oxpassport.{{ .Release.Namespace }}.svc.cluster.local
  gateways:
    - {{ .Release.Name }}-global-gtw
  http:
  - match:
    - uri:
        prefix: /passport
    rewrite:
      uri: /identity
    route:
    - destination:
        host: oxpassport.{{ .Release.Namespace }}.svc.cluster.local
        port:
          number: 8090

Gatewaysn-p:

  - port:
      number: 8090
      name: tcp-oxpassport
      protocol: HTTP
    hosts:
    - oxpassport.{{ .Release.Namespace }}.svc.cluster.local

注意事项：

1. 有一个带有这些标签的后端应用程序。这有它自己的 VS 并且它正在工作：

    labels: 
       app: oxauth
   

2. Oxpassport 有一个带有标签的部署

     labels: 
        app: oxpassport
   

我知道这是一个很长的帖子，但它现在已经有好几天了。如果可以，请解释一下。

谢谢

Answer 1

网关应该和虚拟服务在同一个命名空间，如果它和虚拟服务不在同一个命名空间，你应该像下面的例子一样添加它。

查看spec.gateways 部分

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo-Mongo
  namespace: bookinfo-namespace
spec:
  gateways:
  - some-namespace/my-gateway 

---

在您的入口中，您有 3 条路径，然后基于该入口的虚拟服务应该看起来像那里

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: {{ include "istio.fullname" . }}-oxpassport
  namespace: {{ .Release.Namespace }}
spec:
  hosts:
    - oxpassport.{{ .Release.Namespace }}.svc.cluster.local
  gateways:
    - {{ .Release.Name }}-global-gtw
  http:
  - name: a
    match:
    - uri:
        prefix: /identity
    route:
    - destination:
        host: oxtrust.{{ .Release.Namespace }}.svc.cluster.local
        port:
          number: 8080
  - name: b
    match:
    - uri:
        prefix: /idp
    route:
    - destination:
        host: oxshibboleth.{{ .Release.Namespace }}.svc.cluster.local
        port:
          number: 8080
  - name: c
    match:
    - uri:
        prefix: /passport
    route:
    - destination:
        host: oxpassport.{{ .Release.Namespace }}.svc.cluster.local
        port:
          number: 8090  

---

出现问题 503 时值得检查的案例。

• https://istio.io/docs/ops/common-problems/network-issues/#503-errors-after-setting-destination-rule

• Accessing service using istio ingress gives 503 error when mTLS is enabled

• https://istio.io/docs/ops/best-practices/traffic-management/#avoid-503-errors-while-reconfiguring-service-routes

• how to terminate ssl at ingress-gateway in istio?

• Kubernetes Istio ingress gateway responds with 503 always

---

编辑

---

你考虑过这个 nginx.ingress.kubernetes.io/app-root: "/identity" 吗？

错过了 /identity 应用程序根目录，您始终可以像以前一样重写所有这些。

另外，我们可以将整个 - big - vs 分成不同的 VS 文件是否有特殊原因？

不，您应该能够创建单独的较小虚拟服务而不是大型虚拟服务，我只是复制了您提供的入口。