kubernetes - 访问HTTPS服务导出，istio v1.0

Question

我正在尝试启用网关 namespace 中的部署以将指标发送到engine-report.apollodata.com的外部服务

我已经按照Istio documentation编写了以下服务条目和虚拟服务规则，但没有流量能够访问端点。

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: apollo-engine-ext
  namespace: {{ .Release.Namespace }}
  labels:
      chart: {{ .Chart.Name }}
      release: {{ .Release.Name }}
      heritage: {{ .Release.Service }}
spec:
  hosts:
  - '*.apollodata.com'
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: apollo-engine-ext
  namespace: {{ .Release.Namespace }}
  labels:
      chart: {{ .Chart.Name }}
      release: {{ .Release.Name }}
      heritage: {{ .Release.Service }}
spec:
  hosts:
  - '*.apollodata.com'
  tls:
  - match:
    - port: 443
      sni_hosts:
      - '*.apollodata.com'
    route:
    - destination:
        host: '*.apollodata.com'
        port:
          number: 443
      weight: 100

是什么导致此问题

Answer 1

使用以下配置，此问题已解决。我仍然不确定是什么原因引起的。在澄清对我原始问题的一些评论。使用原始配置，可以 curl http://engine-report.apollodata.com和https://engine-report.apollodata.com端点，但是按照istio service mesh的预期，外部端点(例如http://www.google.com)不可用。

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: "apollo-engine-ext"
  namespace: {{ .Release.Namespace }}
  labels:
      chart: {{ .Chart.Name }}
      release: {{ .Release.Name }}
      heritage: {{ .Release.Service }}
spec:
  hosts:
  - apollodata.com
  - engine-report.apollodata.com
  - apollographql.com
  location: MESH_EXTERNAL
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS

---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: "apollo-engine-ext"
  namespace: {{ .Release.Namespace }}
  labels:
      chart: {{ .Chart.Name }}
      release: {{ .Release.Name }}
      heritage: {{ .Release.Service }}
spec:
  hosts:
  - apollodata.com
  - engine-report.apollodata.com
  - apollographql.com
  tls:
  - match:
    - port: 443
      sniHosts:
      - apollodata.com
    route:
    - destination:
        host: apollodata.com
  - match:
    - port: 443
      sniHosts:
      - engine-report.apollodata.com
    route:
    - destination:
        host: engine-report.apollodata.com
  - match:
    - port: 443
      sniHosts:
      - apollographql.com
    route:
    - destination:
        host: apollographql.com