Kubernetes 503从集群内部调用时的响应代码

我已经在安装了Istio（1.5.6，默认配置文件）的K8s环境中部署了一个演示服务（在端口8000上运行）。 当我从集群外部呼叫公共地址时，它成功了。 当我从集群内的pod呼叫内部集群地址时，它失败，响应代码为503

当我将虚拟服务更改为使用端口而不是子集时，它在两种情况下都会成功（外部调用和内部调用）

知道我做错了什么吗

apiVersion: v1
kind: Namespace
metadata:
  labels:
    dgp-origin: demo-app
    istio-injection: enabled
  name: demo
---
apiVersion: v1
kind: Service
metadata:
  name: demo
  namespace: demo
  labels:
    app: demo
    version: v1
  annotations:
    networking.istio.io/exportTo: "*"
spec:
  ports:
  - name: http
    port: 8000
  selector:
    app: demo
    version: v1
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo
  namespace: demo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
      labels:
        app: demo
        version: v1
    spec:
      containers:
      - name: echo
        image: paddycarey/go-echo
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8000
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: demo
  namespace: demo
spec:
  exportTo:
  - "*"
  host: demo.demo.svc.cluster.local
  subsets:
  - name: v1
    labels:
      app: demo
      version: v1
---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: demo
  namespace: demo
spec:
  selector:
    app: istio-ingressgateway
  servers:
  - hosts:
    - demo.external.com
    port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      mode: SIMPLE
      privateKey: /etc/istio/ingressgateway-certs/tls.key
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
  - hosts:
    - demo.demo.svc.cluster.local
    port:
      name: http
      number: 80
      protocol: HTTP
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demo
  namespace: demo
spec:
  exportTo:
  - "*"
  hosts:
  - demo.external.com
  - demo.demo.svc.cluster.local
  gateways:
  - mesh
  - demo/demo
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: demo.demo.svc.cluster.local
#        port: 
#          number: 8000
        subset: v1
    timeout: 55s

日志信息（来自另一个容器的istio代理）

外线电话：好的

{
    "authority": "-",
    "bytes_received": "511",
    "bytes_sent": "4744",
    "downstream_local_address": "172.19.2.100:443",
    "downstream_remote_address": "172.18.140.129:37992",
    "duration": "43",
    "istio_policy_status": "-",
    "method": "-",
    "path": "-",
    "protocol": "-",
    "request_id": "-",
    "requested_server_name": "-",
    "response_code": "0",
    "response_flags": "-",
    "route_name": "-",
    "start_time": "2020-08-10T10:32:25.149Z",
    "upstream_cluster": "PassthroughCluster",
    "upstream_host": "172.19.2.100:443",
    "upstream_local_address": "172.18.140.129:37994",
    "upstream_service_time": "-",
    "upstream_transport_failure_reason": "-",
    "user_agent": "-",
    "x_forwarded_for": "-"
}

内部通话：不正常

{
    "authority": "demo.demo.svc.cluster.local",
    "bytes_received": "0",
    "bytes_sent": "0",
    "downstream_local_address": "172.18.212.107:80",
    "downstream_remote_address": "172.18.140.129:37802",
    "duration": "0",
    "istio_policy_status": "-",
    "method": "GET",
    "path": "/",
    "protocol": "HTTP/1.1",
    "request_id": "f875b032-f7d4-4f36-9ce1-38166aced074",
    "requested_server_name": "-",
    "response_code": "503",
    "response_flags": "NR",
    "route_name": "-",
    "start_time": "2020-08-10T10:33:51.262Z",
    "upstream_cluster": "-",
    "upstream_host": "-",
    "upstream_local_address": "-",
    "upstream_service_time": "-",
    "upstream_transport_failure_reason": "-",
    "user_agent": "curl/7.61.1",
    "x_forwarded_for": "-"
}

更新：当服务在端口80上时，它工作

apiVersion: v1
kind: Service
metadata:
  name: demo
  namespace: demo
  labels:
    app: demo
    version: v1
  annotations:
    networking.istio.io/exportTo: "*"
spec:
  ports:
  - name: http
    port: 80
    targetPort: 8000
  selector:
    app: demo
    version: v1

基于istio应用程序，我认为这里的问题是部署中缺少标签

有一个productpage

您能在我编辑后尝试使用部署吗

apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo
  namespace: demo
  labels:
    app: demo
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo
      version: v1
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
      labels:
        app: demo
        version: v1
    spec:
      containers:
      - name: echo
        image: paddycarey/go-echo
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8000

编辑

我已经测试了您的YAML，此外，我还使用nginx pod创建了自己的示例

我和你有同样的问题，mesh internall调用只有在我将端口8000添加到虚拟服务时才起作用

---

在我使用nginx的例子中，一切都很好

---

因此，基于此，我假设

• 据我检查，上次更新是在4年前
• mesh网关需要虚拟服务中的端口，如果它不是80端口

---

有我的YAML要用nginx测试

apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: demo-app

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-v1
  namespace: demo-app
spec:
  selector:
    matchLabels:
      app: nginx1
      version: v1
  replicas: 1
  template:
    metadata:
      labels:
        version: v1
        app: nginx1
    spec:
      containers:
      - name: nginx1
        image: nginx
        ports:
        - containerPort: 80
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh", "-c", "echo Hello nginx1 > /usr/share/nginx/html/index.html"]

---

apiVersion: v1
kind: Service
metadata:
  name: nginx
  namespace: demo-app
  labels:
    app: nginx1
spec:
  ports:
  - name: http-front
    port: 80
    protocol: TCP
  selector:
    app: nginx1

---

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: simpleexample
  namespace: demo-app
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - '*'
    port:
      name: http
      number: 80
      protocol: HTTP

---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginxvirt
  namespace: demo-app
spec:
  gateways:
  - simpleexample
  - mesh
  hosts:
  - 'nginx.demo-app.svc.cluster.local'
  - 'example.com' 
  http:
  - route:
    - destination:
        host: nginx
        subset: v1

  
---

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: nginxdest
  namespace: demo-app
spec:
  host: nginx
  subsets:
  - name: v1
    labels:
      version: v1

---

apiVersion: v1
kind: Pod
metadata:
  name: ubu1
  namespace: demo-app
spec:
  containers:
  - name: ubu1
    image: ubuntu
    command: ["/bin/sh"]
    args: ["-c", "apt-get update && apt-get install curl -y && sleep 3000"]

---

外部呼叫测试

curl -v -H "host: example.com" xx.xx.xx.xx/
HTTP/1.1 200 OK
Hello nginx1

root@ubu1:/# curl nginx/
Hello nginx1

内部呼叫测试

curl -v -H "host: example.com" xx.xx.xx.xx/
HTTP/1.1 200 OK
Hello nginx1

root@ubu1:/# curl nginx/
Hello nginx1

---

---

如果是这样，请告诉我您是否需要进一步帮助。

仍然503:-（，所以看起来它不是一个标签issue@Peter克莱斯，你能检查一下这是否是因为或吗？另外，我用nginx复制编辑了我的答案，但它起作用了，不能让你的例子起作用。我想你是对的：当我将服务定义更改为端口80时，它就起作用了。但是如果我需要另一个端口，我想使用它呢目的地规则？（我认为端口80需要容器的根访问权限，如果我们的infra人员不再希望我们以根用户身份运行容器，那么我需要另一个端口（例如8080））当然：服务定义中端口映射的技巧解决了非根用户问题：-）。但是，如果需要另一个端口怎么办？我想说，您应该在虚拟服务中同时使用端口和子集。无论如何，目标规则都应该有效。