无法使用Kubernetes入口istio从NodePort访问容器

Question

我正在学习Istio，所以我遵循了这里的指令

由于我使用terraform，所以我将yaml文件转换为terraform并通过Helm安装istio

locals {
  istio_charts_url = "https://istio-release.storage.googleapis.com/charts"
}

resource "helm_release" "istio-base" {
  name             = "istio-base"
  repository       = local.istio_charts_url
  chart            = "base"
  namespace        = "istio-system"
  create_namespace = true

}
resource "helm_release" "istiod" {
  name       = "istiod"
  repository = local.istio_charts_url
  chart      = "istiod"
  namespace  = "istio-system"
  depends_on = [helm_release.istio-base]
}


resource "kubernetes_namespace" "istio-ingress" {
  metadata {
    labels = {
      istio-injection = "enabled"
    }

    name = "istio-ingress"
  }
}

resource "helm_release" "istio-ingress" {
  repository = local.istio_charts_url
  chart      = "gateway"
  name       = "istio-ingress"
  namespace  = kubernetes_namespace.istio-ingress.id
  depends_on = [helm_release.istiod]
  set {
    name  = "service.type"
    value = "NodePort"
  }
}

和申请：

### blog page frontend
resource "kubernetes_service" "blog_page" {

  metadata {
    name      = "blog-page"
    namespace = kubernetes_namespace.istio-ingress.id
  }
  spec {

    port {
      port     = 5000
      name = "http"
    }
    selector = {
      app = "blog_page"
    }

  }
}


resource "kubernetes_deployment" "blog_page_v1" {
  metadata {
    name      = "blog-page-v1"
    namespace = kubernetes_namespace.istio-ingress.id
  }
  spec {
    replicas = 1
    selector {
      match_labels = {
        app     = "blog_page"
        version = "v1"
      }
    }
    template {
      metadata {
        labels = {
          app     = "blog_page"
          version = "v1"
        }
      }
      spec {
        container {
          image             = "thiv17/blog-service:v1"
          name              = "blog-page"
          image_pull_policy = "Always"

          port {
            container_port = 5000
          }
        }
      }
    }
  }
}


resource "kubernetes_ingress" "istio-app" {
  metadata {
    name        = "istio-app"
    namespace   = kubernetes_namespace.istio-ingress.id
    annotations = {
      "kubernetes.io/ingress.class" = "istio"
    }
  }

  spec {
    rule {
      http {
        path {
          path = "/*"
          backend {
            service_name = kubernetes_service.blog_page.metadata[0].name
            service_port = kubernetes_service.blog_page.spec[0].port[0].port
          }
        }
      }
    }
  }
}

我预期我可以通过节点IP通过节点端口访问10.0.83.140

kubectl describe svc istio-ingress  --namespace=istio-ingress
-----
Port:                     http2  80/TCP
TargetPort:               80/TCP
NodePort:                 http2  30968/TCP
Endpoints:                10.0.91.237:80
Port:                     https  443/TCP

kubectl get pods --selector=“app=istio-ingress” --namespace=istio-ingress --output=wide
NAME                             READY   STATUS    RESTARTS   AGE   IP            NODE                                        NOMINATED NODE   READINESS GATES
istio-ingress-5bd77ffbdf-h25vs   1/1     Running   0          24h   10.0.91.237   ip-10-0-83-140.us-west-2.compute.internal   <none>           <none>

但是，当我ssh到此节点时，即使此节点正在侦听端口30968

[ec2-user@ip-10-0-83-140 ~]$ netstat -plan | grep 30968
(No info could be read for "-p": geteuid()=1000 but you should be root.)
tcp        0      0 0.0.0.0:30968           0.0.0.0:*               LISTEN      - 

但我无法访问地址http://localhost:30968

*  Trying ::1:30968...
* connect to ::1 port 30968 failed: Connection refused
* Failed to connect to localhost port 30968 after 0 ms: Connection refused
* Closing connection 0
curl: (7) Failed to connect to localhost port 30968 after 0 ms: Connection refused
[ec2-user@ip-10-0-83-140 ~]$

我也尝试使用公共IP (将安全组更改为公共端口30968)，甚至更改为使用LoadBlancer，但仍然没有成功地访问它。

Other debug info

kubectl get pods  --namespace=istio-ingress
NAME                             READY   STATUS    RESTARTS   AGE
blog-api-v1-86789596cf-8rh2j     2/2     Running   0          7h58m
blog-page-v1-54d45997f8-q6h6l    2/2     Running   0          7h58m
blog-page-v2-74b6d4b7c9-bgdrm    2/2     Running   0          7h58m
istio-ingress-5bd77ffbdf-h25vs   1/1     Running   0          24h
 kubectl describe ingress istio-app --namespace=istio-ingress
Name:             istio-app
Labels:           <none>
Namespace:        istio-ingress
Address:          
Default backend:  default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
Rules:
  Host        Path  Backends
  ----        ----  --------
  *           
              /*   blog-page:5000 (10.0.81.70:5000,10.0.95.8:5000)
Annotations:  kubernetes.io/ingress.class: istio
Events:       <none>

完整代码：

https://gitlab.com/jimmy-pet-projects/terraform-eks-with-monitoring/-/blob/main/modules/kubernetes/istio.tf

app.tf (编辑)

Answer 1

我发现了一个问题:舵手的名字应该是istio-ingressgateway。我不明白它的文档使用的是istio-ingress

$ helm install istio-ingress istio/gateway -n istio-ingress --wait

Answer 2

对于所有面临Istio模板问题的人来说。下面是相同的工作模板。因为我在这个模板中遇到了几个问题，所以我为我自己的用例编译了它。希望能帮上忙。

provider "helm" {
  kubernetes {
    config_path = "~/.kube/config"
  }
}

provider "kubernetes" {
  config_path    = "~/.kube/config"
}

locals {
  istio_charts_url = "https://istio-release.storage.googleapis.com/charts"
}

resource "kubernetes_namespace" "istio_system" {
  metadata {
    name = "istio-system"
    labels = {
      istio-injection = "enabled"
    }
  }
}

resource "helm_release" "istio-base" {
  repository       = local.istio_charts_url
  chart            = "base"
  name             = "istio-base"
  namespace        = kubernetes_namespace.istio_system.metadata.0.name
  version          = ">= 1.12.1"
  timeout          = 120
  cleanup_on_fail  = true
  force_update     = false
}

resource "helm_release" "istiod" {
  repository       = local.istio_charts_url
  chart            = "istiod"
  name             = "istiod"
  namespace        = kubernetes_namespace.istio_system.metadata.0.name
  version          = ">= 1.12.1"
  timeout          = 120
  cleanup_on_fail  = true
  force_update     = false

  set {
    name = "meshConfig.accessLogFile"
    value = "/dev/stdout"
  }

  depends_on       = [helm_release.istio-base]
}

resource "helm_release" "istio-ingress" {
  repository        = local.istio_charts_url
  chart             = "gateway"
  name              = "istio-ingress"
  namespace         = kubernetes_namespace.istio_system.metadata.0.name
  version           = ">= 1.12.1"
  timeout           = 500
  cleanup_on_fail   = true
  force_update      = false
  depends_on        = [helm_release.istiod]
}