无法在Istio网关中设置https
无法在Istio网关中设置https
提问于 2018-10-18 21:19:03
使用http设置Istio网关很好。
但我不能设置https。我跟着指南https://istio.io/docs/tasks/traffic-management/secure-ingress/走了
Istio: 1.0.2 (使用Helm安装) Kubernetes 1.10.3 eks
我用的是科莫多的证书。
只有第一次，我可以使用https访问该页面。访问页面后，如果我尝试再次连接，在浏览器中会出现以下错误。
mycompany.com unexpectedly closed the connection.
Try:
Checking the connection
Checking the proxy and the firewall如果我使用curl，我会得到以下错误。
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to qa-web.ffau.to:443如果我使用openssl进行测试，
openssl s_client -tls1 -connect mycompany.com:443 -msg
错误
140735917949896:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.50.2/libressl/ssl/s3_pkt.c:522:这就是我创建secret的方式。
kubectl create -n istio-system secret tls istio-ingressgateway-certs --key ffau.to.key --cert ffau.to.crt 这是网关和虚拟服务的yaml。
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: mycompany-gateway
spec:
selector:
istio: ingressgateway # use istio default controller
servers:
- port:
number: 443
name: https
protocol: HTTPS
tls:
mode: SIMPLE
serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
privateKey: /etc/istio/ingressgateway-certs/tls.key
hosts:
- "mycompany.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: ffau-qa-phoenix-us
spec:
hosts:
- "mycompany.com"
gateways:
- mycompany-gateway
http:
- match:
- uri:
prefix: /us/account
- uri:
prefix: /us/reserve
- uri:
exact: /phoenix-bundle.js
- uri:
exact: /client-env.js
- uri:
exact: /env-variables
- uri:
exact: /graphql
route:
- destination:
host: myui.default.svc.cluster.local
port:
number: 8000回答 1
Stack Overflow用户
发布于 2018-10-19 06:37:47
在堆栈溢出Not able to connect to HTTPS service using ISTIO Gateway and Virtual Service、https://github.com/istio/istio/issues/6071中也存在类似的问题
我在stack-overflow issue中找到了一种解决方法。打开端口80并使用httpsRedirect: true重定向至443
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: my-gateway
spec :
selector:
istio: ingressgateway # use istio default controller
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- "mydomain.com"
tls:
httpsRedirect: true
- port:
number: 443
name: https
protocol: HTTPS
tls:
mode: SIMPLE
serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
privateKey: /etc/istio/ingressgateway-certs/tls.key
hosts:
- "mydomain.com"页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/52875011
复制相关文章
相似问题