Istio istio ingressgateway抛出“不匹配URL '/'”

Question

我在码头桌面上安装了Istio。一般来说，它工作得很好。我试图在一个非常简单的虚拟服务上建立一个基于http的匹配，但是我只能得到404。这是技术细节。

我的端点映像是hashi http-echo，它使用net/http库创建一个简单的http服务器，返回您提供的消息。它工作得很好，再简单不过了。

这是我的吊舱和服务配置：

kind: Pod
apiVersion: v1
metadata:
  name: a
  labels:
    app: a
    version: v1
spec:
  containers:
  - name: a
    image: hashicorp/http-echo
    args:
    - "-text='this is service a: v1'"
    - "-listen=:6789"
---
kind: Service
apiVersion: v1
metadata:
  name: a-service
spec:
  selector:
    app: a
    version: v1
  ports:
  # Default port used by the image
  - port: 6789
    targetPort: 6789
    name: http-echo

下面是我在同一个名称空间中将它从另一个荚中滚动的服务的一个示例：

/ # curl 10.1.0.29:6789
'this is service a: v1'

下面是在码头桌面集群中运行的吊舱：

NAME       READY   STATUS    RESTARTS   AGE     IP          NODE             NOMINATED NODE   READINESS GATES
a          2/2     Running   0          45h     10.1.0.29   docker-desktop   <none>           <none>

下面是登记和管理吊舱的服务：

NAME         TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE     SELECTOR
a-service    ClusterIP   10.101.113.9   <none>        6789/TCP   45h     app=a,version=v1

下面是我通过Helm的istio istio-ingressgateway pod规范(似乎很好)，我列出了它，因为这是我更改的安装的唯一部分，而且更改本身是非常简单的(添加一个新的端口块就可以了，因为监听确实在进行中)：

gateways:
  istio-ingressgateway:
    name: istio-ingressgateway
    labels:
      app: istio-ingressgateway
      istio: ingressgateway
    ports:
    - port: 15021
      targetPort: 15021
      name: status-port
      protocol: TCP
    - port: 80
      targetPort: 8080
      name: http2
      protocol: TCP
    - port: 443
      targetPort: 8443
      name: https
      protocol: TCP
    - port: 6789
      targetPort: 6789
      name: http-echo
      protocol: TCP

这里是ingressgateway上的kubectl get svc，这仅仅是为了表明我确实有一个外部ip，而且事情看起来很正常：

NAME                   TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)                                                     AGE     SELECTOR
istio-ingressgateway   LoadBalancer   10.109.63.15    localhost     15021:30095/TCP,80:32454/TCP,443:31644/TCP,6789:30209/TCP   2d16h   app=istio-ingressgateway,istio=ingressgateway
istiod                 ClusterIP      10.96.155.154   <none>        15010/TCP,15012/TCP,443/TCP,15014/TCP                       2d16h   app=istiod,istio=pilot

这是我的虚拟服务：

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: a-service
  namespace: default
spec:
  hosts:
  - 'a-service.default.svc.cluster.local'
  gateways:
  - gateway
  http:
  - match:
    - port: 6789
    route:
    - destination:
        host: 'a-service.default.svc.cluster.local'
        port:
          number: 6789

这是我的门户

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: gateway
  namespace: default
spec:
  selector:
    app: istio-ingressgateway
  servers:
  - port:
      number: 6789
      name: http-echo
      protocol: http
    hosts:
    - 'a-service.default.svc.cluster.local'

最后，这里有一个来自istio-ingressgateway的调试日志，它显示尽管所有这些看似正确的pod、服务、网关、虚拟服务和ingressgateway都信任，但是ingressgateway只返回404：

2021-09-27T15:34:41.001773Z debug   envoy connection    [C367] closing data_to_write=143 type=2
2021-09-27T15:34:41.001779Z debug   envoy connection    [C367] setting delayed close timer with timeout 1000 ms
2021-09-27T15:34:41.001786Z debug   envoy pool  [C7] response complete
2021-09-27T15:34:41.001791Z debug   envoy pool  [C7] destroying stream: 0 remaining
2021-09-27T15:34:41.001925Z debug   envoy connection    [C367] write flush complete
2021-09-27T15:34:41.002215Z debug   envoy connection    [C367] remote early close
2021-09-27T15:34:41.002279Z debug   envoy connection    [C367] closing socket: 0
2021-09-27T15:34:41.002348Z debug   envoy conn_handler  [C367] adding to cleanup list
2021-09-27T15:34:41.179213Z debug   envoy conn_handler  [C368] new connection from 192.168.65.3:62904
2021-09-27T15:34:41.179594Z debug   envoy http  [C368] new stream
2021-09-27T15:34:41.179690Z debug   envoy http  [C368][S14851390862777765658] request headers complete (end_stream=true):
':authority', '0:6789'
':path', '/'
':method', 'GET'
'user-agent', 'curl/7.64.1'
'accept', '*/*'
'version', 'TESTING'

2021-09-27T15:34:41.179708Z debug   envoy http  [C368][S14851390862777765658] request end stream
2021-09-27T15:34:41.179828Z debug   envoy router    [C368][S14851390862777765658] no cluster match for URL '/'
2021-09-27T15:34:41.179903Z debug   envoy http  [C368][S14851390862777765658] Sending local reply with details route_not_found
2021-09-27T15:34:41.179949Z debug   envoy http  [C368][S14851390862777765658] encoding headers via codec (end_stream=true):
':status', '404'
'date', 'Mon, 27 Sep 2021 15:34:41 GMT'
'server', 'istio-envoy'

下面是istioct代理状态：

istioctl proxy-status                                                                                                                     ⎈ docker-desktop/istio-system
NAME                                                   CDS        LDS        EDS        RDS        ISTIOD                     VERSION
a.default                                              SYNCED     SYNCED     SYNCED     SYNCED     istiod-b9c8c9487-clkkt     1.11.3
istio-ingressgateway-5797689568-x47ck.istio-system     SYNCED     SYNCED     SYNCED     SYNCED     istiod-b9c8c9487-clkkt     1.11.3

下面是istioctl pc集群$ingressgateway：

SERVICE FQDN                                            PORT      SUBSET     DIRECTION     TYPE           DESTINATION RULE
BlackHoleCluster                                        -         -          -             STATIC
a-service.default.svc.cluster.local                     6789      -          outbound      EDS
agent                                                   -         -          -             STATIC
istio-ingressgateway.istio-system.svc.cluster.local     80        -          outbound      EDS
istio-ingressgateway.istio-system.svc.cluster.local     443       -          outbound      EDS
istio-ingressgateway.istio-system.svc.cluster.local     6789      -          outbound      EDS
istio-ingressgateway.istio-system.svc.cluster.local     15021     -          outbound      EDS
istiod.istio-system.svc.cluster.local                   443       -          outbound      EDS
istiod.istio-system.svc.cluster.local                   15010     -          outbound      EDS
istiod.istio-system.svc.cluster.local                   15012     -          outbound      EDS
istiod.istio-system.svc.cluster.local                   15014     -          outbound      EDS
kube-dns.kube-system.svc.cluster.local                  53        -          outbound      EDS
kube-dns.kube-system.svc.cluster.local                  9153      -          outbound      EDS
kubernetes.default.svc.cluster.local                    443       -          outbound      EDS
prometheus_stats                                        -         -          -             STATIC
sds-grpc                                                -         -          -             STATIC
xds-grpc                                                -         -          -             STATIC
zipkin                                                  -         -          -             STRICT_DNS

下面是位于同一入口的istioctl pc侦听器：

ADDRESS PORT  MATCH DESTINATION
0.0.0.0 6789  ALL   Route: http.6789
0.0.0.0 15021 ALL   Inline Route: /healthz/ready*
0.0.0.0 15090 ALL   Inline Route: /stats/prometheus*

最后，这里是istioctl路线：

NOTE: This output only contains routes loaded via RDS.
NAME          DOMAINS                                 MATCH                  VIRTUAL SERVICE
http.6789     a-service.default.svc.cluster.local     /*                     a-service.default
              *                                       /stats/prometheus*
              *                                       /healthz/ready*

我尝试过许多不同的配置，从更改选择器到确保端口名匹配到尝试不同的端口。如果我将虚拟服务从http更改为tcp，则端口匹配非常有效。但是因为我的最终目标是进行更高级的基于头的匹配，所以我需要在http上进行匹配。任何洞察力都将不胜感激！

Answer 1

事实证明，问题是我在网关和虚拟服务中都在hosts指令中指定了我的服务。将服务指定为主机项几乎肯定是不正确的，尽管可以通过将主机头添加到curl (即curl ... -H 'Host: kubernetes.docker.internal' ... )来“解决”这一问题。但正确的解决方案是简单地添加正确的主机条目，即- mysite.mycompany.com等。在本例中，主机类似于Apache中的vhost；它们是一种fqdn，它解决了网格和集群可以用来发送请求的内容。然而，host在virtualservice destination中是服务，这有点令人费解，也是让我感到困惑的原因。