通过HTTPS访问ISTIO/K8S服务

Question

我对Kubernetes和Istio有点陌生。我正在尝试创建一个服务并通过HTTPS访问它。

• 通过HTTP看起来一切都很好
• 我使用了cert-manager和let's Encrypt来生成证书
• 证书已成功生成
• 我使用以下命令生成了机密

kubectl create secret generic clouddns --namespace=cert-manager --from-literal=GCP_PROJECT=<PROJECT> --from-file=/etc/keys/<KEY>.json

这些是我的网关、虚拟服务、集群颁发者和证书的配置文件。

网关

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: messaging-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "<HOST>"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "<HOST>"
    tls:
      credentialName: messaging-certificate
      mode: SIMPLE
      privateKey: sds
      serverCertificate: sds

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: messaging
spec:
  hosts:
  - "<HOST>"
  gateways:
  - messaging-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: messaging
        port:
          number: 8082

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: messaging-cluster-issuer
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: <EMAIL>
    privateKeySecretRef:
      name: messaging-letsencrypt
    solvers:
    - dns01:
        clouddns:
          serviceAccountSecretRef:
            name: clouddns
            key: <KEY>.json
          project: <PROJECT>

证书

apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: messaging-certificate
spec:
  secretName: messaging-certificate
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  organization:
  - RELE.AI
  commonName: <HOST>
  isCA: false
  keySize: 2048
  keyAlgorithm: rsa
  keyEncoding: pkcs1
  usages:
    - server auth
    - client auth
  dnsNames:
  - <HOST>
  issuerRef:
    name: messaging-cluster-issuer
    kind: ClusterIssuer

当我运行kubectl get secrets messaging-certificate-o yaml时，我可以看到tls.crt和tls.key内容。

有什么想法为什么我不能达到我可以通过HTTPS访问的点吗？

----编辑

完整的istio清单-我已经使用ISTIoctl清单生成生成了清单。希望这是正确的方法

Answer 1

您应该执行以下操作：

1. 启用SDS-请参阅https://istio.io/docs/tasks/traffice-management/ingress/secure-ingress-sds/#configure-a-tls-ingress-gateway-using-sds
中的第一步
2. 从网关的TLS字段中删除serverCertificate和privateKey字段，如https://istio.io/docs/tasks/traffice-management/ingress/secure-ingress-sds/#configure-a-tls-ingress-gateway-for-a-single-host