无法在Istio Gateway中设置https-Java 学习之路

使用http设置Istio网关很好 .

但是我无法设置https . 我按照指南https://istio.io/docs/tasks/traffic-management/secure-ingress/

Istio：1.0.2（使用Helm安装）Kubernetes 1.10.3 eks

我正在使用COMODO的证书 .

只有第一次，我才能使用https访问该页面 . 访问页面后，如果我再次尝试连接，我在浏览器中收到以下错误 .

mycompany.com unexpectedly closed the connection.
Try:

Checking the connection
Checking the proxy and the firewall

如果我使用curl，我收到以下错误 .

curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to qa-web.ffau.to:443

如果我使用openssl进行测试，

openssl s_client -tls1 -connect mycompany.com:443 -msg

错误

140735917949896:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.50.2/libressl/ssl/s3_pkt.c:522:

这就是我创造秘密的方式 .

kubectl create -n istio-system secret tls istio-ingressgateway-certs --key ffau.to.key  --cert ffau.to.crt

这是网关和虚拟服务的yaml .

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: mycompany-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
servers:
 - port:
     number: 443
     name: https
     protocol: HTTPS
   tls:
     mode: SIMPLE
     serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
     privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
   - "mycompany.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ffau-qa-phoenix-us
spec:
  hosts:
  - "mycompany.com"
  gateways:
  - mycompany-gateway
  http:
  - match:
    - uri:
       prefix: /us/account
    - uri:
        prefix: /us/reserve
    - uri:
        exact: /phoenix-bundle.js
    - uri:
       exact: /client-env.js
    - uri:
       exact: /env-variables
    - uri:
       exact: /graphql
    route:
    - destination:
        host: myui.default.svc.cluster.local
        port:
          number: 8000

1 回答

堆栈溢出中存在类似问题Not able to connect to HTTPS service using ISTIO Gateway and Virtual Service，https://github.com/istio/istio/issues/6071

我在stack-overflow issue找到了一个解决方法 . 打开端口80并使用httpsRedirect重定向到443：true

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
spec :
  selector:
    istio: ingressgateway # use istio default controller
  servers:
 - port:
     number: 80
     name: http
     protocol: HTTP
   hosts:
   - "mydomain.com"
   tls:
     httpsRedirect: true
 - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "mydomain.com"

回复于 2024-04-29T11:57:05+08:00

无法在Istio Gateway中设置https

1 回答

相关问题