kubernetes - 如何在istio入口后面使港口可达？

Question

我已经如下安装了Harbor:

helm install hub harbor/harbor \
  --version 1.3.2 \
  --namespace tool \
  --set expose.ingress.hosts.core=hub.service.example.io \
  --set expose.ingress.annotations.'kubernetes\.io/ingress\.class'=istio \
  --set expose.ingress.annotations.'cert-manager\.io/cluster-issuer'=letsencrypt-prod \
  --set externalURL=https://hub.service.example.io \
  --set notary.enabled=false \
  --set secretkey=secret \
  --set harborAdminPassword=pw  

一切正常，但无法通过 https://hub.service.example.io访问该页面。此处 Why css and png are not accessible?发生相同的问题，但是如何在Helm中设置通配符 *？

更新

Istio支持入口网关。例如，这在没有网关和VirtualService定义的情况下有效:

apiVersion: v1
kind: Service
metadata:
  name: hello-kubernetes-first
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: 8080
  selector:
    app: hello-kubernetes-first
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-kubernetes-first
spec:
  replicas: 3
  selector:
    matchLabels:
      app: hello-kubernetes-first
  template:
    metadata:
      labels:
        app: hello-kubernetes-first
    spec:
      containers:
        - name: hello-kubernetes
          image: paulbouwer/hello-kubernetes:1.8
          ports:
            - containerPort: 8080
          env:
            - name: MESSAGE
              value: Hello from the first deployment!
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: istio
  name: helloworld-ingress
spec:
  rules:
    - host: "hw.service.example.io"
      http:
        paths:
          - path: "/*"
            backend:
              serviceName: hello-kubernetes-first
              servicePort: 80
---

Answer 1

我会说它不适用于ingress和istio。

就像here

Simple ingress specifications, with host, TLS, and exact path based matches will work out of the box without the need for route rules. However, note that the path used in the ingress resource should not have any . characters.

For example, the following ingress resource matches requests for the example.com host, with /helloworld as the URL.

$ kubectl create -f - <<EOF
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: simple-ingress
annotations:
  kubernetes.io/ingress.class: istio
spec:
rules:
- host: example.com
  http:
    paths:
    - path: /helloworld
      backend:
        serviceName: myservice
        servicePort: grpc
EOF

However, the following rules will not work because they use regular expressions in the path and ingress.kubernetes.io annotations:

$ kubectl create -f - <<EOF
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: this-will-not-work
annotations:
  kubernetes.io/ingress.class: istio
  # Ingress annotations other than ingress class will not be honored
  ingress.kubernetes.io/rewrite-target: /
spec:
rules:
- host: example.com
  http:
    paths:
    - path: /hello(.*?)world/
      backend:
        serviceName: myservice
        servicePort: grpc
EOF

我假设您的hello-world正在运行，因为只有1个注解是Ingress类。

如果您查看一下harbour here的注释，则想在istio中使用ingress可能是问题所在。

but how to set wildcard * in Helm?

通配符在这里无关。正如我在 answer中提到的那样，您可以使用通配符或其他路径，这做得很好。看一下入口路径 here。