与Istio一起对Kubernetes的503 UH错误，但服务正在工作

Question

在安装了Istio的Kubernetes(minikube)服务之间，我的通信配置有问题。

我试图将POST请求从我的服务发送到elasticsearch，但我收到的所有时间：

POST /_bulk?timeout=1m HTTP/1.1" 503 UH "-" "-" 0 19 0 - "-" "Apache-HttpAsyncClient/4.1.4 (Java/11.0.9.1)" "1a290357-7b18-9692-9392-d0298ed3276c" "elasticsearch:9200" "-" - - 10.102.10.19:9200 172.18.0.12:39194 - default

Istioctl analyze没有出现任何问题。我还禁用了mtls。

你知道会有什么问题吗？我不明白为什么会有UH (不健康)，因为elasticsearch工作，Kiali仪表板也显示它健康。

我的部署+服务：

弹性搜索

apiVersion: v1
kind: Service
metadata:
  name: elasticsearch
  labels:
    app: elasticsearch
    tier: database
spec:
  selector:
    app: elasticsearch
  ports:
  - name: "http-9200"
    port: 9200
    targetPort: 9200
  - name: "tcp-9300"
    port: 9300
    targetPort: 9300
  selector:
    app: elasticsearch
    tier: database

---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: elasticsearch
  labels:
    service: elasticsearch
spec:
  serviceName: elasticsearch
  replicas: 1
  selector:
    matchLabels:
      service: elasticsearch
  template:
    metadata:
      labels:
        service: elasticsearch
    spec:
      terminationGracePeriodSeconds: 300
      initContainers:
      - name: fix-the-volume-permission
        image: busybox
        command:
        - sh
        - -c
        - chown -R 1000:1000 /usr/share/elasticsearch/data
        securityContext:
          privileged: true
        volumeMounts:
        - name: data
          mountPath: /usr/share/elasticsearch/data
      - name: increase-the-vm-max-map-count
        image: busybox
        command:
        - sysctl
        - -w
        - vm.max_map_count=262144
        securityContext:
          privileged: true
      - name: increase-the-ulimit
        image: busybox
        command:
        - sh
        - -c
        - ulimit -n 65536
        securityContext:
          privileged: true
      containers:
      - name: elasticsearch
        image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.2.4
        ports:
        - containerPort: 9200
          name: "http-9200"
        - containerPort: 9300
          name: "tcp-9300"
        env:
          - name: cluster.name
            value: elasticsearch-cluster
          - name: node.name
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: ES_JAVA_OPTS
            value: -Xms4g -Xmx4g
        volumeMounts:
        - name: data
          mountPath: /usr/share/elasticsearch/data
  volumeClaimTemplates:
  - metadata:
      name: data
      annotations:
        volume.beta.kubernetes.io/storage-class: "standard"
    spec:
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: 1Gi

My-服务

apiVersion: v1
kind: Service
metadata:
  name: scrappers-service
  labels:
    name: scrappers-service
spec:
  ports:
  - nodePort: 30164
    name: "http-8080"
    port: 8080
    targetPort: 8080
  selector:
    app: scrappers-service
  type: NodePort
---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: scrappers-service
  labels:
    name: scrappers-service
spec:
  selector:
    matchLabels:
      app: scrappers-service
  replicas: 1
  template:
    metadata:
      labels:
        app: scrappers-service
    spec:
      containers:
      - image: example/scrappers:master
        imagePullPolicy: Never
        name: scrappers-service
        ports: 
        - containerPort: 8080

Answer 1

如前所述，这里

我决定使用elasticsearch描述的解决方案。我是说弹力操员。我应用了所有的步骤，它只是工作，没有任何更大的问题。

因此，解决方案是遵循elasticsearch 文档，它使用下面的注释使其工作。

annotations:
  traffic.sidecar.istio.io/excludeOutboundPorts: "" 
  traffic.sidecar.istio.io/excludeInboundPorts: ""

要使验证的web钩子在Istio下工作，您需要从代理中排除入站端口9443。这可以通过编辑弹性操作符StatefulSet的模板定义来实现，以便向操作符Pod添加以下注释：

[...]
spec:
  template:
    metadata:
      annotations:
        traffic.sidecar.istio.io/excludeInboundPorts: "9443"
        traffic.sidecar.istio.io/includeInboundPorts: '*'
[...]

如果您已经在许可模式中配置了Istio，那么ECK文档中其他地方定义的示例将继续工作，而不需要进行任何修改。但是，如果您已通过全局()配置或命名空间级别(策略)配置在服务之间启用了严格的互TLS身份验证，则对资源清单的以下修改是正确操作所必需的。

apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: elastic-istio
spec:
  version: 7.10.0
  http:
    tls: 
      selfSignedCertificate:
        disabled: true
  nodeSets:
  - name: default
    count: 3
    podTemplate:
      metadata:
        annotations:
          traffic.sidecar.istio.io/includeInboundPorts: "*"
          traffic.sidecar.istio.io/excludeOutboundPorts: "9300" 
          traffic.sidecar.istio.io/excludeInboundPorts: "9300"
      spec:
        automountServiceAccountToken: true 

如果没有启用自动交互TLS，则可能需要创建目标规则以允许运算符与Elasticsearch集群通信。可以通过查看运算符日志来检测操作员和托管Elasticsearch集群之间的通信问题，以确定是否有任何错误报告为文本503服务不可用。

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: elastic-istio
spec:
  host: "elastic-istio-es-http.default.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

有一些相关的github问题：

• https://github.com/istio/istio/issues/14662
• https://github.com/elastic/cloud-on-k8s/issues/2770