kubernetes - 从集群内部调用时的 503 响应代码

Question

我在安装了 Istio(1.5.6，默认配置文件)的 K8s 环境中部署了一个演示服务(在端口 8000 上运行)。
当我从集群外部调用公共(public)地址时，它成功了。
当我从集群内的 pod 调用内部集群地址时，它失败并显示响应代码 503。
当我将虚拟服务更改为使用端口而不是子集时，它在两种情况下(外部和内部调用)都会成功。
任何想法我做错了什么？

apiVersion: v1
kind: Namespace
metadata:
  labels:
    dgp-origin: demo-app
    istio-injection: enabled
  name: demo
---
apiVersion: v1
kind: Service
metadata:
  name: demo
  namespace: demo
  labels:
    app: demo
    version: v1
  annotations:
    networking.istio.io/exportTo: "*"
spec:
  ports:
  - name: http
    port: 8000
  selector:
    app: demo
    version: v1
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo
  namespace: demo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
      labels:
        app: demo
        version: v1
    spec:
      containers:
      - name: echo
        image: paddycarey/go-echo
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8000
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: demo
  namespace: demo
spec:
  exportTo:
  - "*"
  host: demo.demo.svc.cluster.local
  subsets:
  - name: v1
    labels:
      app: demo
      version: v1
---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: demo
  namespace: demo
spec:
  selector:
    app: istio-ingressgateway
  servers:
  - hosts:
    - demo.external.com
    port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      mode: SIMPLE
      privateKey: /etc/istio/ingressgateway-certs/tls.key
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
  - hosts:
    - demo.demo.svc.cluster.local
    port:
      name: http
      number: 80
      protocol: HTTP
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demo
  namespace: demo
spec:
  exportTo:
  - "*"
  hosts:
  - demo.external.com
  - demo.demo.svc.cluster.local
  gateways:
  - mesh
  - demo/demo
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: demo.demo.svc.cluster.local
#        port: 
#          number: 8000
        subset: v1
    timeout: 55s

日志信息(来自另一个容器的 istio-proxy)
外呼:OK

{
    "authority": "-",
    "bytes_received": "511",
    "bytes_sent": "4744",
    "downstream_local_address": "172.19.2.100:443",
    "downstream_remote_address": "172.18.140.129:37992",
    "duration": "43",
    "istio_policy_status": "-",
    "method": "-",
    "path": "-",
    "protocol": "-",
    "request_id": "-",
    "requested_server_name": "-",
    "response_code": "0",
    "response_flags": "-",
    "route_name": "-",
    "start_time": "2020-08-10T10:32:25.149Z",
    "upstream_cluster": "PassthroughCluster",
    "upstream_host": "172.19.2.100:443",
    "upstream_local_address": "172.18.140.129:37994",
    "upstream_service_time": "-",
    "upstream_transport_failure_reason": "-",
    "user_agent": "-",
    "x_forwarded_for": "-"
}

内部通话:不好

{
    "authority": "demo.demo.svc.cluster.local",
    "bytes_received": "0",
    "bytes_sent": "0",
    "downstream_local_address": "172.18.212.107:80",
    "downstream_remote_address": "172.18.140.129:37802",
    "duration": "0",
    "istio_policy_status": "-",
    "method": "GET",
    "path": "/",
    "protocol": "HTTP/1.1",
    "request_id": "f875b032-f7d4-4f36-9ce1-38166aced074",
    "requested_server_name": "-",
    "response_code": "503",
    "response_flags": "NR",
    "route_name": "-",
    "start_time": "2020-08-10T10:33:51.262Z",
    "upstream_cluster": "-",
    "upstream_host": "-",
    "upstream_local_address": "-",
    "upstream_service_time": "-",
    "upstream_transport_failure_reason": "-",
    "user_agent": "curl/7.61.1",
    "x_forwarded_for": "-"
}

更新:当服务在端口 80 上时，它可以工作

apiVersion: v1
kind: Service
metadata:
  name: demo
  namespace: demo
  labels:
    app: demo
    version: v1
  annotations:
    networking.istio.io/exportTo: "*"
spec:
  ports:
  - name: http
    port: 80
    targetPort: 8000
  selector:
    app: demo
    version: v1

Answer 1

基于 istio bookinfo我会说这里的问题是缺少 标签 在您的部署中。
有产品页面example

apiVersion: apps/v1
kind: Deployment
metadata:
  name: details-v1
  labels:
    app: details
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: details
      version: v1
  template:
    metadata:
      labels:
        app: details
        version: v1
    spec:
      serviceAccountName: bookinfo-details
      containers:
      - name: details
        image: docker.io/istio/examples-bookinfo-details-v1:1.16.2
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 9080

您可以在我编辑后尝试使用您的部署吗？

apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo
  namespace: demo
  labels:
    app: demo
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo
      version: v1
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
      labels:
        app: demo
        version: v1
    spec:
      containers:
      - name: echo
        image: paddycarey/go-echo
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8000

编辑
我已经测试了你的 yaml，另外我用 nginx pod 创建了我自己的示例。
我和你有同样的问题，只有当我将端口 8000 添加到虚拟服务时，mesh internall 调用才有效。

在我使用 nginx 的示例中，一切正常。

因此，基于此，我认为要么有问题

paddycarey/go-echo 图像，据我检查，上次更新是 4 年前。

网状网关需要虚拟服务中的端口，如果它不是80端口。

有我的 yamls 可以用 nginx 进行测试。

apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: demo-app

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-v1
  namespace: demo-app
spec:
  selector:
    matchLabels:
      app: nginx1
      version: v1
  replicas: 1
  template:
    metadata:
      labels:
        version: v1
        app: nginx1
    spec:
      containers:
      - name: nginx1
        image: nginx
        ports:
        - containerPort: 80
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh", "-c", "echo Hello nginx1 > /usr/share/nginx/html/index.html"]

---

apiVersion: v1
kind: Service
metadata:
  name: nginx
  namespace: demo-app
  labels:
    app: nginx1
spec:
  ports:
  - name: http-front
    port: 80
    protocol: TCP
  selector:
    app: nginx1

---

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: simpleexample
  namespace: demo-app
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - '*'
    port:
      name: http
      number: 80
      protocol: HTTP

---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginxvirt
  namespace: demo-app
spec:
  gateways:
  - simpleexample
  - mesh
  hosts:
  - 'nginx.demo-app.svc.cluster.local'
  - 'example.com' 
  http:
  - route:
    - destination:
        host: nginx
        subset: v1

  
---

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: nginxdest
  namespace: demo-app
spec:
  host: nginx
  subsets:
  - name: v1
    labels:
      version: v1

---

apiVersion: v1
kind: Pod
metadata:
  name: ubu1
  namespace: demo-app
spec:
  containers:
  - name: ubu1
    image: ubuntu
    command: ["/bin/sh"]
    args: ["-c", "apt-get update && apt-get install curl -y && sleep 3000"]

外呼测试

curl -v -H "host: example.com" xx.xx.xx.xx/
HTTP/1.1 200 OK
Hello nginx1

内部通话测试

root@ubu1:/# curl nginx/
Hello nginx1

让我知道是这样还是您需要进一步的帮助。