在istio入口网关中没有工作的路由

Question

我有一个超V的VM运行库伯内特斯在上面。我设置了ingressgateway，如下所示。

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: tech-ingressgateway
  namespace: tech-ingress-ns
spec:
  selector:
    istio: ingressgateway # default istio ingressgateway defined in istio-system namespace
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - '*'
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: PASSTHROUGH
      hosts:
        - '*'

我打开两个端口，一个用于http，另一个用于https。我有两个后端服务，其虚拟服务定义为；

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: activemq-vs
  namespace: tech-ingress-ns
spec:
  hosts:
    - '*'
  gateways:
    - tech-ingressgateway
  http:
    - match:
      - uri:
          prefix: '/activemq'
      route:
        - destination:
            host: activemq-svc.tech-ns.svc.cluster.local
            port:
              number: 8161

---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: userprofile-vs
  namespace: tech-ingress-ns
spec:
  hosts:
    - '*'
  gateways:
    - tech-ingressgateway
  http:
    - match:
      - uri:
          prefix: '/userprofile'
      route:
        - destination:
            host: userprofile-svc.business-ns.svc.cluster.local
            port:
              number: 7002

istio-ingressgateway成功地使用curl作为curl 192.168.x.x，但是当我尝试点击activemq-backend-service时，它失败了。我也不知道原因。我在访问userprofile service时所面临的同样问题。这是我的卷发命令

curl -i 192.168.x.x/activemq
curl -i 192.168.x.x/userprofile
curl -i 192.168.x.x/userprofile/getUserDetails

userProfile service有三个端点：getUserDetails、verifyNaturalOtp和updateProfile。

编辑

这是部署和服务清单；

apiVersion: apps/v1
kind: Deployment
metadata:
  name:  userprofile-deployment
  namespace: business-ns
  labels:
    app: userprofile
spec:
  replicas: 1
  selector:
    matchLabels:
      app: userprofile
  template:
    metadata:
      labels:
        app: userprofile
    spec:        
      containers: 
        - env: 
            - name: APPLICATION_PORT
              valueFrom:
                configMapKeyRef:
                  name: configmap-cf
                  key: userProfilePort

            - name: APPLICATION_NAME
              valueFrom:
                configMapKeyRef:
                  name: configmap-cf
                  key: userProfileName

            - name: IAM_URL
              valueFrom:
                configMapKeyRef:
                  name: configmap-cf
                  key: userProfileIam

            - name: GRAPHQL_DAO_LAYER_URL
              valueFrom:
                configMapKeyRef:
                  name: configmap-cf
                  key: userProfileGraphqlDao

            - name: EVENT_PUBLISHER_URL
              valueFrom:
                configMapKeyRef:
                  name: configmap-cf
                  key: userProfilePublisher

          name:  userprofile
          image:  'abc/userprofilesvc:tag1'
          imagePullPolicy: IfNotPresent
          resources: {}
          ports:
            - containerPort: 7002
---

apiVersion: v1
kind: Service
metadata:
  name:  userprofile-svc
  namespace: business-ns
  labels:
    app: userprofile
spec:
  selector:
    app: userprofile
  ports:
    - name: http
      protocol: TCP
      port: 7002
      targetPort: 7002

编辑：kubectl describe pod activemq-deployment-5fb57d5f7c-2v9x5 -n tech-ns；

Name:         activemq-deployment-5fb57d5f7c-2v9x5
Namespace:    tech-ns
Priority:     0
Node:         kworker-2/192.168.18.223
Start Time:   Fri, 27 May 2022 06:11:50 +0000
Labels:       app=activemq
              pod-template-hash=5fb57d5f7c
Annotations:  cni.projectcalico.org/containerID: e2a5a843ee02655ed3cfc4fa538abcccc3dae34590cc61dab341465aa78565fb
              cni.projectcalico.org/podIP: 10.233.107.107/32
              cni.projectcalico.org/podIPs: 10.233.107.107/32
              kubesphere.io/restartedAt: 2022-05-27T06:11:42.602Z
Status:       Running
IP:           10.233.107.107
IPs:
  IP:           10.233.107.107
Controlled By:  ReplicaSet/activemq-deployment-5fb57d5f7c
Containers:
  activemq:
    Container ID:   docker://94a1f07489f6d2db51d2fe3bfce0ed3654ea7150eb17223696363c1b7f355cd7
    Image:          vialogic/activemq:cluster1.0
    Image ID:       docker-pullable://vialogic/activemq@sha256:f3954187bf1ead0a0bc91ec5b1c654fb364bd2efaa5e84e07909d0a1ec062743
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Wed, 01 Jun 2022 06:51:19 +0000
    Last State:     Terminated
      Reason:       Error
      Exit Code:    255
      Started:      Mon, 30 May 2022 08:21:52 +0000
      Finished:     Wed, 01 Jun 2022 06:21:43 +0000
    Ready:          True
    Restart Count:  20
    Environment:    <none>
    Mounts:
      /home/alpine/apache-activemq-5.16.4/conf/jetty-realm.properties from active-creds (rw,path="jetty-realm.properties")
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-nvbwv (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  active-creds:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  creds
    Optional:    false
  kube-api-access-nvbwv:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
QoS Class:                   BestEffort
Node-Selectors:              <none>
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason          Age                From     Message
  ----    ------          ----               ----     -------
  Normal  SandboxChanged  55m (x5 over 58m)  kubelet  Pod sandbox changed, it will be killed and re-created.
  Normal  Pulled          51m                kubelet  Container image "vialogic/activemq:cluster1.0" already present on machine
  Normal  Created         51m                kubelet  Created container activemq
  Normal  Started         51m                kubelet  Started container activemq

Answer 1

根据所共享的荚描述，无论是istio还是istio-代理容器都没有注入到应用程序中。因此，路由可能不会发生从网关到应用程序荚。命名空间/部署必须启用istio，以便在创建应用程序荚时将istio注入其中。发布路由将发生在应用程序。

Answer 2

你的Istio侧翼没有被注射进吊舱。您可以在注解部分看到这样的输出，用于已注入的pod：

              pod-template-hash=546859454c
              security.istio.io/tlsMode=istio
              service.istio.io/canonical-name=userprofile
              service.istio.io/canonical-revision=latest
Annotations:  kubectl.kubernetes.io/default-container: svc
              kubectl.kubernetes.io/default-logs-container: svc
              prometheus.io/path: /stats/prometheus
              prometheus.io/port: 15020
              prometheus.io/scrape: true
              sidecar.istio.io/status:
                {"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":["istio-envoy","istio-data","istio-podinfo","istio-token","istiod-...

可以使用以下命令在命名空间级别强制注入：

kubectl label namespace <namespace> istio-injection=enabled --overwrite

由于注入发生在荚的创建阶段，因此在发出命令后，您将需要杀死正在运行的荚。

查看侧射问题文档作为参考。