ssl - 错误 :1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number for https on Istio ingressgateway

Question

我正在尝试在入口网关的端口 443 上设置 SSL。我可以通过非常基本的设置来始终如一地重现。我知道这可能是我做错了，但一直无法弄清楚。
我的 k8s 集群在 EKS 上运行。 k version 1.19我使用 AWS Certificate Manager 为域 api.foo.com 创建了一个证书和其他名称*.api.foo.com证书已成功创建并具有 ARN arn:aws:acm:us-west-2:<some-numbers>:certificate/<id>然后我对 istio 进行了原版安装:istioctl install --set meshConfig.accessLogFile=/dev/stdout有版本:

client version: 1.7.0
control plane version: 1.7.0

这是我的网关定义:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: foo-gateway
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-west-2:<some-numbers>:certificate/<id>"
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
    service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60"
    service.beta.kubernetes.io/aws-load-balancer-type: "elb"
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
  - port:
      number: 443
      name: https-443
      protocol: HTTP
    hosts:
      - "*"

请注意，端口 443 具有 HTTP 协议(protocol)，我认为这不是问题(因为我想使用 SSL 终止)。此外，即使我将其更改为 HTTPS，我也会得到以下信息:

Resource: "networking.istio.io/v1alpha3, Resource=gateways", GroupVersionKind: "networking.istio.io/v1alpha3, Kind=Gateway"
Name: "foo-gateway", Namespace: "default"
for: "foo-gateway.yaml": admission webhook "validation.istio.io" denied the request: configuration is invalid: server must have TLS settings for HTTPS/TLS protocols

但是 tls 设置是什么？我需要通过未放置在 /etc 中的注释(来自 AWS CM)获取证书 key .顺便说一句，有没有办法在没有 ssl 终止的情况下做到这一点？
我的 VirtualService 定义是这样的:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: foo-api
spec:
  hosts:
  - "*"
  gateways:
  - foo-gateway
  http:
  - match:
    - uri:
        prefix: /users
    route:
    - destination:
        host: https-user-manager
        port:
          number: 7070

我然后 k apply -f一个名为 https-user-manager 的 super 简单的 REST 服务在端口 7070 上。然后我从 k get svc -n istio-system 中找到负载平衡器的主机名产生:

NAME                   TYPE           CLUSTER-IP      EXTERNAL-IP                                                               PORT(S)                                                      AGE
istio-ingressgateway   LoadBalancer   <cluster-ip>    blahblahblah.us-west-2.elb.amazonaws.com   15021:30048/TCP,80:30210/TCP,443:31349/TCP,15443:32587/TCP   32m

我可以成功地使用 http，例如: curl http://blahblahblah.us-west-2.elb.amazonaws.com/users并得到有效的回应
但是，如果我这样做: curl -vi https://blahblahblah.us-west-2.elb.amazonaws.com/users我得到以下信息:

*   Trying <ip>...
* TCP_NODELAY set
* Connected to api.foo.com (<ip>) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
* Closing connection 0
curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number

我究竟做错了什么？我看过这些 https://medium.com/faun/managing-tls-keys-and-certs-in-istio-using-amazons-acm-8ff9a0b99033 , Istio-ingressgateway with https - Connection refused , Setting up istio ingressgateway , SSL Error - wrong version number (HTTPS to HTTP) , Updating Istio-IngressGateway TLS Cert , https://github.com/kubernetes/ingress-nginx/issues/3556 , https://github.com/istio/istio/issues/14264 , https://preliminary.istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/ , https://preliminary.istio.io/latest/docs/tasks/traffic-management/ingress/ingress-sni-passthrough/ ，还有许多我什至不记得了。将不胜感激任何帮助!

Answer 1

low level nginx  
ssl on;  
high level nginx  
listen 443 ssl;  

这对我有用