azure - Istio - 通过网关公开虚拟服务

Question

我已经使用 Helm Chart 设置了 Istio，并且正在尝试向 istio-ingressgateway 公开服务。

这是我决定采用的配置:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: grafana-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 31400
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: kiali-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 15029
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: prometheus-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 15030
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana-vts
  namespace: istio-system
spec:
  hosts:
  - "*"
  gateways:
  - grafana-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: grafana.istio-system.svc.cluster.local
        port: 
          number: 3000
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: kiali-vts
  namespace: istio-system
spec:
  hosts:
  - "*"
  gateways:
  - kiali-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: kiali.istio-system.svc.cluster.local
        port: 
          number: 20001
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: prometheus-vts
  namespace: istio-system
spec:
  hosts:
  - "*"
  gateways:
  - prometheus-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: prometheus.istio-system.svc.cluster.local
        port: 
          number: 9090

但是 - 这仅通过端口 31400、15029 和 15030 路由 grafana，而它应该只针对 31400 这样做。

如果我只使用一个网关并重写 uri，它会抛出 404 错误/告诉我反向代理未正确设置

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: all-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana-vts
  namespace: istio-system
spec:
  hosts:
  - "*"
  gateways:
  - all-gateway
  http:
  - match:
    - uri:
        prefix: "/grafana"
      rewrite:
        uri: /
    route:
    - destination:
        host: grafana.istio-system.svc.cluster.local
        port: 
          number: 3000
and etc...

我对 istio 有点陌生，我浏览过的示例并没有完全讨论这些。如果您有一个想法，那就太棒了 - 是因为我对主机进行了通配吗？

Answer 1

您的网关和虚拟服务是混合的，因为它们都使用相同的主机 (*)，因此它们的行为在 Istio 中未定义。我会分配假主机名，例如 my-grafana.com、my-kiali.com 并在网关和虚拟服务定义中使用它们。我会将这些假主机名添加到 /etc/hosts/ 文件中，并使用它们从我的计算机访问 Grafana 和 Kiali。