Istio 网关内部代理

Question

我正在寻找一个内部集群代理，在 Istio 的网关文档中我发现了以下内容:

You can also use a gateway to configure a purely internal proxy

所以我的问题是我该怎么做？我假设具体实现它只是在集群上运行的单个特使。对于网关的 list ，选择器是必需的，大多数时候它是处理来自集群外部的流量的入口网关。在我的情况下，选择器应该是什么，因为我需要内部实现？

Answer 1

您可以为此使用 istio mesh 网关。

在istio中有一个例子documentation , 看一下粗体。

For example, the following VirtualService splits traffic for https://uk.bookinfo.com/reviews, https://eu.bookinfo.com/reviews, http://uk.bookinfo.com:9080/reviews, http://eu.bookinfo.com:9080/reviews into two versions (prod and qa) of an internal reviews service on port 9080. In addition, requests containing the cookie “user: dev-123” will be sent to special port 7777 in the qa version. The same rule is also applicable inside the mesh for requests to the “reviews.prod.svc.cluster.local” service. This rule is applicable across ports 443, 9080. Note that http://uk.bookinfo.com gets redirected to https://uk.bookinfo.com (i.e. 80 redirects to 443).

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo-rule
  namespace: bookinfo-namespace
spec:
  hosts:
  - reviews.prod.svc.cluster.local
  - uk.bookinfo.com
  - eu.bookinfo.com
  gateways:
  - some-config-namespace/my-gateway
  - mesh # applies to all the sidecars in the mesh
  http:
  - match:
    - headers:
        cookie:
          exact: "user=dev-123"
    route:
    - destination:
        port:
          number: 7777
        host: reviews.qa.svc.cluster.local
  - match:
    - uri:
        prefix: /reviews/
    route:
    - destination:
        port:
          number: 9080 # can be omitted if it's the only port for reviews
        host: reviews.prod.svc.cluster.local
      weight: 80
    - destination:
        host: reviews.qa.svc.cluster.local
      weight: 20

---

由于文档中没有很好地描述，我准备了两个使用 nginx pod 的示例，请查看 here和 here .