http - ISTIO HTTPS-HTTP 404 NR route_not_found

Question

我正在尝试通过 Istio HTTPS -> HTTP 配置 TLS 终止。

HTTP 80 工作正常。

HTTPS 443 仅适用于 / 路径。

HTTP 200:

curl https://serviceA.example.com

HTTP 404:

curl https://serviceA.example.com/blabla

Istio 访问日志:

GET /blabla HTTP/2" 404 NR route_not_found

---

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: serviceA-gateway
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: HTTP
        protocol: HTTP
      hosts:
        - "serviceA.example.com"
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: serviceA.example.com
      hosts:
        - "*"

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: serviceA-swearl
  namespace: default
spec:
  hosts:
    - serviceA.example.com
  gateways:
    - serviceA-gateway
  HTTP:
    - route:
        - destination:
            host: serviceA.default.svc.cluster.local
            port:
              number: 80

我不确定我做错了什么。通过查看文档，一切都应该正常工作。在具有 NLB 的 AWS EKS 上设置 ISTIO 运算符。

此外，我在 istio-system 命名空间中有一个证书 - secret。服务和部署具有必需的标签。

修复:问题是我在 Ingress 定义上遇到的问题

pathType: ImplementationSpecific

应该是:

pathType: Prefix

Configure Ingress pathType ImplementationSpecific behavior #26883

Answer 1

社区维基答案以获得更好的可见性。

正如问题中提到的OP，通过设置解决了问题

pathType: Prefix

在入口处。

原始消息:

FIX: The issue was that I had on Ingress definition

pathType: ImplementationSpecific

应该是pathType: Prefix https://github.com/istio/istio/issues/26883

您可以在这个 official documentation 中找到解释:

Each path in an Ingress is required to have a corresponding path type. Paths that do not include an explicit pathType will fail validation. There are three supported path types:

• ImplementationSpecific: With this path type, matching is up to the IngressClass. Implementations can treat this as a separate pathType or treat it identically to Prefix or Exact path types.

• Exact: Matches the URL path exactly and with case sensitivity.

• Prefix: Matches based on a URL path prefix split by /. Matching is case sensitive and done on a path element by element basis. A path element refers to the list of labels in the path split by the / separator. A request is a match for path p if every p is an element-wise prefix of p of the request path.