您正在对Kubernetes中启用SSL的服务器端口说纯HTTP

Question

我的网关文件为

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway-secure
  namespace: myapp
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
      #caCertificates: /etc/istio/ingressgateway-ca-certs/kbundle.crt
    hosts:
    - "*"

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-gateway-service-secure
  namespace:myapp
spec:
  hosts:
  - "sub.domaincom"
  gateways:
  - my-gateway-secure
  http:
  - route:
    - destination:
        host: my-mono
        port:
          number: 443
          protocol: TCP

apiVersion: v1
kind: Service
metadata:
  name: my-mono
  namespace: myapp
  labels:
    tier: backend
spec:
  selector:
    app: my-mono
    tier: backend
  ports:
    - port: 443
      name: https
      protocol: TCP

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-mono
  namespace: myapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: my-mono
  template:
    metadata:
      labels:
        app: my-mono
    spec:
      containers:
      - name: my-mono
        image: myapacheimage
        imagePullPolicy: Never   
        ports:  
        - containerPort: 443

Bad Request
Your browser sent a request that this server could not understand.
Reason: You're speaking plain HTTP to an SSL-enabled server port.
Instead use the HTTPS scheme to access this URL, please.
Apache/2.4.38 (Debian) Server at 10.0.159.77 Port 443

我可以确认apache只侦听443，并且配置正确

Answer 1

您的配置在istio网关上使用TLS端接。因此进入istio入口的HTTPS流量在到达服务endpoint之前被解密为普通HTTP流量。

要解决此问题，您需要配置对https服务的https入口访问，即配置入口网关对传入请求执行SNI通过，而不是TLS终止。

您可以在这里的istio文档指南中找到没有TLS终止的入口网关示例。

您的网关和虚拟服务应该如下所示：

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway-secure
  namespace: myapp
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: PASSTHROUGH
    hosts:
    - "*"

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-gateway-service-secure
  namespace:myapp
spec:
  hosts:
  - "sub.domaincom"
  gateways:
  - my-gateway-secure
  tls:
  - match:
    - port: 443
      sni_hosts:
      - "sub.domaincom"
    route:
    - destination:
        host: my-mono
        port:
          number: 443

希望有帮助。