istio - 为 kiali、tracing、grafana 创建 VirtualService

Question

我正在尝试在我的默认网关上公开 kiali。我有其他服务适用于默认命名空间中的应用程序，但无法将流量路由到 istio 命名空间中的任何内容

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: gateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - '*'
      tls:
        httpsRedirect: true
    - port:
        number: 443
        name: https
        protocol: HTTPS
      hosts:
        - '*'
      tls:
        mode: SIMPLE
        privateKey: /etc/istio/ingressgateway-certs/tls.key
        serverCertificate: /etc/istio/ingressgateway-certs/tls.crt

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: kiali
  namespace: default
spec:
  hosts:
    - kiali.dev.example.com
  gateways:
    - gateway
  http:
    - route:
        - destination:
            host: kiali.istio-system.svc.cluster.local
            port:
              number: 20001

Answer 1

问题是我启用了 mTLS，而 kiali 没有 sidecar，因此无法通过 mTLS 验证。解决方案是添加一个目标规则，为它禁用 mTLS。

apiVersion: 'networking.istio.io/v1alpha3'
kind: DestinationRule
metadata:
  name: kiali
  namespace: istio-system
spec:
  host: kiali.istio-system.svc.cluster.local
  trafficPolicy:
    tls:
      mode: DISABLE