kubernetes - 使用 istio 作为外部 TLS 服务的反向代理

Question

如果存在 ServiceEntry，Istio 允许您将 VirtualService 中的 http 请求路由到外部主机。例如:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: httpbin-ext
spec:
  hosts:
  - httpbin.org
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.domain.co
  gateways:
  - public-gateway.istio-system.svc.cluster.local
  - mesh
  http:
  - match:
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 443
      host: httpbin.domain.co
    route:
    - destination:
        host: httpbin.org
        port:
          number: 80

然而，这只允许使用 HTTP 端点 - 如何将外部端点配置为 TLS/HTTPS？

Answer 1

这花了我几个小时才算出来 - 我觉得非常值得分享。

为了终止此服务作为 TLS，需要 Destination Rule。我的最终配置:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: httpbin-ext
spec:
  hosts:
  - httpbin.org
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.domain.co
  gateways:
  - public-gateway.istio-system.svc.cluster.local
  - mesh
  http:
  - match:
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 443
      host: httpbin.domain.co
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 80
      host: httpbin.domain.co
    route:
    - destination:
        host: httpbin.org
        port:
          number: 443
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: httpbin-org
spec:
  host: httpbin.org
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: SIMPLE