访问部署在kubernetes上的Istio-Enbody时，Nginx坏网关502

Question

服务器{

listen ip-address:80 ;

      server_name subdomain.domain.com;
    server_name www.subdomain.domain.com;
    server_name ipv4.subdomain.domain.com;

location / {
proxy_pass http://ip-address:32038/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

proxy_http_version 1.1;


  fastcgi_read_timeout 3000;
}

}

服务器{

    listen ip-address:443 ssl http2;  

    server_name subdomain.domain.com;
    server_name www.subdomain.domain.com;
    server_name ipv4.subdomain.domain.com;

    ssl_certificate /opt/psa/var/certificates/scf83NyxP;
    ssl_certificate_key /opt/psa/var/certificates/scf83NyxP;
    ssl_client_certificate /opt/psa/var/certificates/scfrr8L8y;

    proxy_read_timeout 60;

    location / {
      proxy_pass https://ip-address:30588/;
      proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }

curl-v-hhost：subdomain.mydomain.com https://subdomain.mydomain.com:30588

curl-v-hhost：subdomain.mydomain.com--解析subdomain.mydomain.com:30588:ip-address--cacert/opt/psa/var/certificates/scf83nyxp https://subdomain.mydomain.com:30588

任何帮助都将非常感激。

谢谢

Answer 1

在不了解后端服务的情况下，我猜测它可能没有配备HTTPS。你可能只需要改变这一行...

proxy_pass https://ip-address:30588/;

到...

proxy_pass http://ip-address:30588/;

如果后端服务实际上需要通过https调用（不常见），那么我们需要查看该服务是如何配置的，因为nginx错误提示它没有正确处理SSL连接。