kubernetes istio之gateway

 

kubernetes istio之gateway

kubernetes istio之gateway

 

[root@master istio-1.1.5]# kubectl apply -f samples/httpbin/httpbin.yaml 
service/httpbin created
deployment.extensions/httpbin created
[root@master istio-1.1.5]# 
[root@master istio-1.1.5]# kubectl get svc
NAME           TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE
details        ClusterIP      10.106.209.133   <none>        9080/TCP       23h
httpbin        ClusterIP      10.104.20.107    <none>        8000/TCP       9s
kubernetes     ClusterIP      10.96.0.1        <none>        443/TCP        14d
productpage    ClusterIP      10.96.27.39      <none>        9080/TCP       23h
ratings        ClusterIP      10.109.45.236    <none>        9080/TCP       23h
reviews        ClusterIP      10.102.249.50    <none>        9080/TCP       23h


[root@master istio-1.1.5]# kubectl get pod -o wide
NAME                             READY   STATUS    RESTARTS   AGE     IP             NODE     NOMINATED NODE   READINESS GATES
details-v1-79c6548b59-d8448      1/1     Running   0          23h     10.244.3.186   node02   <none>           <none>
httpbin-5446f4d9b4-jtnzw         1/1     Running   0          3m38s   10.244.1.207   node01   <none>           <none>
ratings-v1-7665579b75-jjvv7      1/1     Running   0          23h     10.244.1.203   node01   <none>           <none>
reviews-v1-67446f7d9b-hrhbj      1/1     Running   0          23h     10.244.1.204   node01   <none>           <none>
reviews-v2-6bc7b4f678-vhjwh      1/1     Running   0          23h     10.244.1.206   node01   <none>           <none>
reviews-v3-59b5b6948-sxxhj       1/1     Running   0          23h     10.244.1.205   node01   <none>           <none>
[root@master istio-1.1.5]# curl 10.104.20.107:8000/headers
{
  "headers": {
    "Accept": "*/*", 
    "Host": "10.104.20.107:8000", 
    "User-Agent": "curl/7.29.0"
  }
}
//只有集群内部可以访问,外部不行

//创建网关,让集群外部也可以访问
[root@master istio-1.1.5]# kubectl apply -f samples/httpbin/httpbin-gateway.yaml 
gateway.networking.istio.io/httpbin-gateway created
virtualservice.networking.istio.io/httpbin created
[root@master istio-1.1.5]# kubectl get gateway
NAME               AGE
bookinfo-gateway   23h
httpbin-gateway    3m15s
[root@master istio-1.1.5]# kubectl get virtualservice
NAME       GATEWAYS             HOSTS       AGE
bookinfo   [bookinfo-gateway]   [*]         23h
httpbin    [httpbin-gateway]    [*]         5m22s
reviews                         [reviews]   18h

 kubernetes istio之gateway

 

生成证书

https://istio.io/docs/tasks/traffic-management/secure-ingress/#generate-clinet-and-server-certificates-and-keys

[root@master istio-1.1.5]# wget https://github.com/nicholasjackson/mtls-go-example/archive/master.zip
[root@master istio-1.1.5]# unzip master.zip 
Archive:  master.zip
85f7453487e47c018961ca11f3526fd3e5d888d9
   creating: mtls-go-example-master/
  inflating: mtls-go-example-master/LICENSE  
  inflating: mtls-go-example-master/README.md  
  inflating: mtls-go-example-master/generate.sh  
  inflating: mtls-go-example-master/intermediate_openssl.cnf  
  inflating: mtls-go-example-master/main.go  
  inflating: mtls-go-example-master/openssl.cnf  
[root@master istio-1.1.5]# ls
bin  install  istio.VERSION  LICENSE  master.zip  mtls-go-example-master  README.md  samples  tools
[root@master istio-1.1.5]# cd mtls-go-example-master/
[root@master mtls-go-example-master]# ls
generate.sh  intermediate_openssl.cnf  LICENSE  main.go  openssl.cnf  README.md
[root@master mtls-go-example-master]# ./generate.sh httpbin.example.com 123456
//出现提示时,选择y所有问题。该命令将产生四个目录:1_root, 2_intermediate,3_application,和4_client包含您在下面的程序使用客户端和服务器证书。
[root@master mtls-go-example-master]# ls
1_root  2_intermediate  3_application  4_client  generate.sh  intermediate_openssl.cnf  LICENSE  main.go  openssl.cnf  README.md
//将证书移动到名为的目录中httpbin.example.com
[root@master mtls-go-example-master]# mkdir ../httpbin.example.com && mv 1_root 2_intermediate 3_application 4_client ../httpbin.example.com
[root@master mtls-go-example-master]# ls ../
bin  httpbin.example.com  install  istio.VERSION  LICENSE  master.zip  mtls-go-example-master  README.md  samples  tools

创建证书

[root@master istio-1.1.5]# kubectl create -n istio-system secret tls istio-ingressgateway-certs --key httpbin.example.com/3_application/private/httpbin.example.com.key.pem --cert httpbin.example.com/3_application/certs/httpbin.example.com.cert.pem
secret/istio-ingressgateway-certs created
//验证tls.crt并tls.key已安装在入口网关pod中:
[root@master istio-1.1.5]# kubectl exec -it -n istio-system $(kubectl -n istio-system get pods -l istio=ingressgateway -o jsonpath='{.items[0].metadata.name}') -- ls -al /etc/istio/ingressgateway-certs
total 4
drwxrwxrwt 3 root root  120 May 25 09:34 .
drwxr-xr-x 1 root root 4096 May 24 08:12 ..
drwxr-xr-x 2 root root   80 May 25 09:34 ..2019_05_25_09_34_54.605006539
lrwxrwxrwx 1 root root   31 May 25 09:34 ..data -> ..2019_05_25_09_34_54.605006539
lrwxrwxrwx 1 root root   14 May 25 09:34 tls.crt -> ..data/tls.crt
lrwxrwxrwx 1 root root   14 May 25 09:34 tls.key -> ..data/tls.key
//删掉之前创建的httpbin-gateway
[root@master istio-1.1.5]# kubectl delete -f samples/httpbin/httpbin-gateway.yaml 
gateway.networking.istio.io "httpbin-gateway" deleted
virtualservice.networking.istio.io "httpbin" deleted
//创建新的
[root@master istio-1.1.5]# vim samples/httpbin/httpbin-gateway-https.yaml
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "httpbin.example.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - "httpbin.example.com"
  gateways:
  - httpbin-gateway
  http:
  - match:
    - uri:
        prefix: /status
    - uri:
        prefix: /delay
    route:
    - destination:
        port:
          number: 8000
        host: httpbin
[root@master istio-1.1.5]# kubectl apply -f samples/httpbin/httpbin-gateway-https.yaml 
gateway.networking.istio.io/httpbin-gateway created
virtualservice.networking.istio.io/httpbin created

[root@master istio-1.1.5]# kubectl get gateway
NAME               AGE
bookinfo-gateway   24h
httpbin-gateway    58s
[root@master istio-1.1.5]# kubectl get virtualservice
NAME       GATEWAYS             HOSTS                   AGE
bookinfo   [bookinfo-gateway]   [*]                     24h
httpbin    [httpbin-gateway]    [httpbin.example.com]   70s
reviews                         [reviews]               20h

[root@master istio-1.1.5]# curl -v -HHost:httpbin.example.com --resolve httpbin.example.com:31390:10.0.1.133 --cacert httpbin.example.com/2_intermediate/certs/ca-chain.cert.pem https://httpbin.example.com:31390/status/418
* Added httpbin.example.com:31390:10.0.1.133 to DNS cache
* About to connect() to httpbin.example.com port 31390 (#0)
*   Trying 10.0.1.133...
* Connected to httpbin.example.com (10.0.1.133) port 31390 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: httpbin.example.com/2_intermediate/certs/ca-chain.cert.pem
  CApath: none
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*     subject: CN=httpbin.example.com,O=Dis,L=Springfield,ST=Denial,C=US
*     start date: May 25 09:24:18 2019 GMT
*     expire date: Jun 03 09:24:18 2020 GMT
*     common name: httpbin.example.com
*     issuer: CN=httpbin.example.com,O=Dis,ST=Denial,C=US
> GET /status/418 HTTP/1.1
> User-Agent: curl/7.29.0
> Accept: */*
> Host:httpbin.example.com
> 
< HTTP/1.1 418 Unknown
< server: istio-envoy
< date: Sat, 25 May 2019 10:12:24 GMT
< x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-origin: *
< access-control-allow-credentials: true
< content-length: 135
< x-envoy-upstream-service-time: 2
< 

    -=[ teapot ]=-

       _...._
     .'  _ _ `.
    | ."` ^ `". _,
    \_;`"---"`|//
      |       ;/
      \_     _/
        `"""`
* Connection #0 to host httpbin.example.com left intact
[root@master istio-1.1.5]# 

 

上一篇:Istio 是什么?


下一篇:Istio Helm Chart 详解 - Galley