Istio网关无法通过HTTPS连接
通过Istio网关无法通过HTTPS连接,https,google-kubernetes-engine,kubernetes-ingress,istio,cert-manager,Https,Google Kubernetes Engine,Kubernetes Ingress,Istio,Cert Manager,通过HTTP,在带有Istio的GKE集群中的部署工作正常。但当我尝试使用cert manager和以下资源来保护它时,HTTPS请求失败状态如下: `Immediate connect fail for 64:ff9b::2247:fd8a: Network is unreachable * connect to 34.71.253.138 port 443 failed: Connection refused`. 我应该怎么做才能使它也能使用HTTPS 具有以下配置的群集服务器 apiVe
HTTP
,在带有Istio的GKE集群中的部署工作正常。但当我尝试使用cert manager和以下资源来保护它时,HTTPS请求失败状态如下:
`Immediate connect fail for 64:ff9b::2247:fd8a: Network is unreachable
* connect to 34.71.253.138 port 443 failed: Connection refused`.
我应该怎么做才能使它也能使用HTTPS
具有以下配置的群集服务器
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
namespace: istio-system
spec:
acme:
# The ACME server URL
server: https://acme-staging-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: iprocureservers@iprocu.re
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-staging
solvers:
# ACME DNS-01 provider configurations
- dns01:
# Google Cloud DNS
clouddns:
# Secret from the google service account key
serviceAccountSecretRef:
name: cert-manager-credentials
key: gcp-dns-admin.json
# The project in which to update the DNS zone
project: iprocure-server
这样的证书配置,使证书处于就绪状态:True
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
name: letsencrypt-staging
namespace: istio-system
spec:
secretName: letsencrypt-staging
commonName: "*.iprocure.tk"
dnsNames:
- '*.iprocure.tk'
issuerRef:
name: letsencrypt-staging
kind: ClusterIssuer
最后是一个网关
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: iprocure-gateway
namespace: default
spec:
selector:
istio: ingressgateway
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- "*"
tls:
httpsRedirect: false
- port:
number: 443
name: https
protocol: HTTPS
hosts:
- "*"
tls:
mode: SIMPLE
credentialName: letsencrypt-staging
如果我这样做,kubectl描述证书-istio系统
Name: letsencrypt-staging
Namespace: istio-system
Labels: <none>
Annotations: <none>
API Version: cert-manager.io/v1
Kind: Certificate
Metadata:
Creation Timestamp: 2020-10-13T13:32:37Z
Generation: 1
Resource Version: 28030994
Self Link: /apis/cert-manager.io/v1/namespaces/istio-system/certificates/letsencrypt-staging
UID: ad838d28-5349-4aaa-a618-cc3bfc316e6e
Spec:
Common Name: *.iprocure.tk
Dns Names:
*.iprocure.tk
Issuer Ref:
Kind: ClusterIssuer
Name: letsencrypt-staging-clusterissuer
Secret Name: letsencrypt-staging-cert-secret
Status:
Conditions:
Last Transition Time: 2020-10-13T13:35:05Z
Message: Certificate is up to date and has not expired
Reason: Ready
Status: True
Type: Ready
Not After: 2021-01-11T12:35:05Z
Not Before: 2020-10-13T12:35:05Z
Renewal Time: 2020-12-12T12:35:05Z
Revision: 1
Events: <none>
问题
我假设https不起作用,因为若要在旧版本中使用带有istio的cert menager,必须启用它
解决方案
正如@Yunus Einsteinium在评论中提到的那样
谢谢你给我指引了正确的方向。使用OSS Istio,而不是GKE,才是最好的选择!我设法使HTTPS工作
因此,这里的解决方案是使用旧的istio gke插件。如前所述,
my.example.com#这应该与证书中的DNS名称相匹配
。能否尝试将网关中的主机从*
更改为'*.iprocure.tk'
,并检查其是否工作?@Jakub感谢您的回复。我做了您请求的更改,删除了证书和网关,然后重新应用它们,但没有更改<代码>http://staging.iprocure.tk如果不使用https,但是当我做https://staging.iprocure.tk
上面说无法访问此站点。staging.iprocure.tk拒绝连接。
1.能否将kubectl description certificate-n istio system
或kubectl get certificates-n istio system-o wide
的输出添加到您的问题中?2.您是否可以检查是否运行了kubectl get pods--所有名称空间,是否有多个cert manager pods?3.什么是istio版本?@Jakub,我已经按照您的要求添加了kubectl descripe certificate-n istio system
的输出。关于运行kubectl get pods--all namespaces
,是的,它运行并显示所有名称空间的pods列表
NAME READY SECRET ISSUER STATUS AGE
letsencrypt-staging True letsencrypt-staging-cert-secret letsencrypt-staging-clusterissuer Certificate is up to date and has not expired 17h