Istio网关未应用于istio-ingressgateway

Question

我正在尝试让istio与我的mssql服务一起工作。istio-ingressgateway似乎没有使用正确的端口值进行更新。

我在1.10+上运行GKE

apiVersion: v1
kind: Service
metadata:
  name: mssql
  labels:
    app: mssql
    service: mssql
spec:
  selector:
    app: mssql
  ports:
    - protocol: TCP
      port: 1433
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: public-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 1433
      protocol: TCP
      name: tcp-1433
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: vservice-mssql
spec:
  hosts:
  - "*"
  gateways:
  - public-gateway
  tcp:
  - match:
    - port: 1433
    route:
    - destination:
        host: mssql
        port: 
          number: 1433

在运行时应用配置后，我希望在istio-ingressgateway上打开端口，但结果是：

istio-ingressgateway   LoadBalancer   10.8.1.100   **REDACTED** 80:31380/TCP,443:31390/TCP,31400:31400/TCP,15011:30160/TCP,8060:32736/TCP,853:30641/TCP,15030:31124/TCP,15031:30849/TCP   90d

未列出我在网关上打开的端口。

Answer 1

使用以下资源定义

apiVersion: v1
kind: Service
metadata:
  name: mssql
  labels:
    app: mssql
    service: mssql
spec:
  selector:
    app: mssql
  ports:
    - protocol: TCP
      port: 1433
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: public-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 15011
      protocol: TCP
      name: tcp-15011
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: vservice-mssql
spec:
  hosts:
  - "*"
  gateways:
  - public-gateway
  tcp:
  - match:
    - port: 15011
    route:
    - destination:
        host: mssql
        port: 
          number: 1433
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: mssql
  namespace: istio-system
spec:
  host: mssql`enter code here`
  trafficPolicy:
    tls:
      mode: DISABLE

使用节点端口30160访问mssql

15011:30160/TCP

istio-ingressgateway   LoadBalancer   10.8.1.100   **REDACTED** 80:31380/TCP,443:31390/TCP,31400:31400/TCP,15011:30160/TCP,8060:32736/TCP,853:30641/TCP,15030:31124/TCP,15031:30849/TCP   90d

Answer 2

如果使用操作符安装istio，则必须手动将端口添加到操作符规范中：

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: istio-control-plane
spec:
  values:
    ingressGateways:
      - enabled: true
        name: istio-ingressgateway
        k8s:
          service:
            ports:
              - name: status-port
                port: 15021
                targetPort: 15021
              - name: http2
                port: 80
                targetPort: 8080
              - name: https
                port: 443
                targetPort: 8443
              - name: tcp
                port: 31400
                targetPort: 31400
              - name: tls
                port: 15443
                targetPort: 15443
              - # ADD PORTS HERE

此处列出的端口是默认端口。我不确定是否删除它们，istio-operator是否会将默认端口与您要添加的端口“合并”。但是你可以尝试一下(让我们知道！)