内容简介:本文作者:ServiceMesher 社区成员沈旭光
本文作者:ServiceMesher 社区成员沈旭光
-
gateway定义用于配置在mesh边缘,到mesh的tcp和http的负载均衡。
非TLS单主机环境
相关拓扑
-
使用azure aks环境。
-
ingress gateway的service类型为loadbalancer。
-
ingress gateway的service enternal ip为104.211.54.62。
-
通过该external ip对应的域名,访问ingress gateway svc。
-
增加gateway定义。
-
gateway定义中的selector会将该设置与相应的gateway pod绑定。
-
gateway定义中的servers会在相应的pod中生成listener实例,该拓扑中的监听端口为80。
-
需要将80端口注册到该gateway pod对应的服务中(默认已注册)。
-
gateway定义中的hosts表示listener会向哪些特定的虚拟主机转发流量,在该示例中为httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io。
-
增加virtualservice定义。
-
virtualservice定义中的hosts与gateway中的hosts相对应,表示该服务可以注册到gateway的监听中,这个host写会更新到gateway pod路由表的虚拟主机条目中。
-
virtualservice定义中的gateways将virtualservice与gateway关联起来。
-
virtualservice定义中的http定义了路由规则,路由规则会写入到相应gateway pod的路由表中。
相关配置
apiVersion: networking.istio.io/v1alpha3kind: Gatewaymetadata: name: httpbin-gatewayspec: selector: istio: ingressgateway servers: - port: number: 80 name: http-httpbin protocol: HTTP hosts: - "httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io"复制代码
-
gateway相关配置。
-
该定义与包含istio: ingressgateway label的ingress gateway pod绑定。
-
新建80端口监听。
-
监听主机为httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io的请求。
apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata: name: httpbin-vsspec: hosts: - "httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io" gateways: - httpbin-gateway http: - match: - uri: prefix: /status - uri: prefix: /delay - uri: prefix: /headers route: - destination: port: number: 8000 host: httpbin.default.svc.cluster.local复制代码
-
virtualservice相关配置。
-
将该配置应用到名称为httpbin-gateway的实例中。
-
定义路由规则和相关转发目的地。
[~/K8s/istio/istio-azure-1.0.2/samples/httpbin]$ http http://httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io/status/418HTTP/1.1 418 Unknownaccess-control-allow-credentials: trueaccess-control-allow-origin: *content-length: 135date: Sat, 03 Nov 2018 16:20:59 GMTserver: envoyx-envoy-upstream-service-time: 4x-more-info: http://tools.ietf.org/html/rfc2324 -=[ teapot ]=- _...._ .' _ _ `. | ."` ^ `". _, \_;`"---"`|// | ;/ \_ _/ `"""`[~/K8s/istio/istio-azure-1.0.2/samples/httpbin]$复制代码
-
测试结果。
-
通过主机httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io,可以正常访问httpbin pod。
TLS单主机环境
相关拓扑
-
使用azure aks环境。
-
ingress gateway的service类型为loadbalancer。
-
ingress gateway的service enternal ip为104.211.54.62。
-
通过该external ip对应的域名,访问ingress gateway svc。
-
客户端使用tls方式访问主机。
-
tls请求在ingress gateway处被卸载,并转化为http请求。
-
增加gateway定义。
-
gateway定义中的监听端口包括80和443。
-
在80中启用httpsredirect。
-
在443中启用simple tls。
-
指定443的key和cert。
-
增加virtualservice定义,并定义相应路由规则。
相关配置
openssl req \-newkey rsa:4096 -nodes -sha256 -keyout ca.key \-x509 -days 3655 -out ca.crtopenssl req \-newkey rsa:4096 -nodes -sha256 -keyout httpbin-tls.key \-out httpbin-tls.csrecho subjectAltName = DNS:httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io > extfile-httpbin-tls.cnfopenssl x509 \-req -days 3655 -in httpbin-tls.csr -CA ca.crt -CAkey ca.key \-CAcreateserial -extfile extfile-httpbin-tls.cnf -out httpbin-tls.crtkubectl create -n istio-system secret tls istio-ingressgateway-certs --key ./httpbin-tls.key --cert ./httpbin-tls.crt复制代码
-
自签名证书相关配置。
-
k8s secret相关配置。
apiVersion: networking.istio.io/v1alpha3kind: Gatewaymetadata: name: httpbin-tls-gatewayspec: selector: istio: ingressgateway servers: - port: number: 80 name: http-httpbin protocol: HTTP hosts: - "httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io" tls: httpsRedirect: true - port: number: 443 name: https-httpbin protocol: HTTPS tls: mode: SIMPLE serverCertificate: /etc/istio/ingressgateway-certs/tls.crt privateKey: /etc/istio/ingressgateway-certs/tls.key hosts: - "httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io"复制代码
-
gateway相关配置。
-
新建监听端口包括80和443。
-
在80中启用httpsredirect。
-
在443中启用simple tls。
-
指定443的key和cert。
apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata: name: httpbin-tls-vsspec: hosts: - "httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io" gateways: - httpbin-tls-gateway http: - match: - uri: prefix: /status route: - destination: port: number: 8000 host: httpbin.default.svc.cluster.local复制代码
-
virtualservice相关配置。
-
配置相关路由。
[~/K8s/istio/istio-azure-1.0.2/samples/httpbin]$ http http://httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io/status/418 --verify no --follow -vGET /status/418 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateConnection: keep-aliveHost: httpbin.7cb9a9b7b318440399a0.eastus.aksapp.ioUser-Agent: HTTPie/0.9.9HTTP/1.1 301 Moved Permanentlycontent-length: 0date: Sat, 03 Nov 2018 19:25:25 GMTlocation: https://httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io/status/418server: envoyGET /status/418 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateConnection: keep-aliveHost: httpbin.7cb9a9b7b318440399a0.eastus.aksapp.ioUser-Agent: HTTPie/0.9.9HTTP/1.1 418 Unknownaccess-control-allow-credentials: trueaccess-control-allow-origin: *content-length: 135date: Sat, 03 Nov 2018 19:25:26 GMTserver: envoyx-envoy-upstream-service-time: 6x-more-info: http://tools.ietf.org/html/rfc2324 -=[ teapot ]=- _...._ .' _ _ `. | ."` ^ `". _, \_;`"---"`|// | ;/ \_ _/ `"""`[~/K8s/istio/istio-azure-1.0.2/samples/httpbin]$复制代码
-
httpsredirect测试结果。
-
通过http方式访问httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io,可以正常访问httpbin pod。
[~/K8s/istio/istio-azure-1.0.2/samples/httpbin]$ http https://httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io/status/418 --verify no -vGET /status/418 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateConnection: keep-aliveHost: httpbin.7cb9a9b7b318440399a0.eastus.aksapp.ioUser-Agent: HTTPie/0.9.9HTTP/1.1 418 Unknownaccess-control-allow-credentials: trueaccess-control-allow-origin: *content-length: 135date: Sat, 03 Nov 2018 19:26:21 GMTserver: envoyx-envoy-upstream-service-time: 5x-more-info: http://tools.ietf.org/html/rfc2324 -=[ teapot ]=- _...._ .' _ _ `. | ."` ^ `". _, \_;`"---"`|// | ;/ \_ _/ `"""`[~/K8s/istio/istio-azure-1.0.2/samples/httpbin]$复制代码
-
https测试结果。
-
通过https方式访问httpbin.7cb9a9b7b318440399a0.eastus.aksapp.io,可以正常访问httpbin pod。
mTLS单主机环境
相关拓扑
-
使用azure aks环境。
-
ingress gateway的service类型为loadbalancer。
-
ingress gateway的service enternal ip为104.211.54.62。
-
通过该external ip对应的域名,访问ingress gateway svc。
-
客户端使用mtls方式访问主机。
-
mtls请求在ingress gateway处被卸载,并转化为http请求。
-
增加gateway定义。
-
gateway定义中的监听端口443。
-
在443中启用mtls。
-
指定443的key和cert。
-
指定443的ca cert。
-
指定允许连接443的san。
-
增加virtualservice定义,并定义相应路由规则。
相关配置
openssl req \-newkey rsa:4096 -nodes -sha256 -keyout ca.key \-x509 -days 3655 -out ca.crtopenssl req \-newkey rsa:4096 -nodes -sha256 -keyout httpbin-mtls.key \-out httpbin-mtls.csrecho subjectAltName = DNS:httpbin.6491dea3ce6b4d17b109.eastus.aksapp.io > extfile-httpbin-mtls.cnfopenssl x509 \-req -days 3655 -in httpbin-mtls.csr -CA ca.crt -CAkey ca.key \-CAcreateserial -extfile extfile-httpbin-mtls.cnf -out httpbin-mtls.crtopenssl req \-newkey rsa:4096 -nodes -sha256 -keyout client.key \-out client.csrecho subjectAltName = DNS:is5.istio.client > client-extfile.cnfopenssl x509 \-req -days 3655 -in client.csr -CA ca.crt -CAkey ca.key \-CAcreateserial -extfile client-extfile.cnf -out client.crtkubectl create -n istio-system secret tls istio-ingressgateway-certs --key ./httpbin-mtls.key --cert ./httpbin-mtls.crtkubectl create -n istio-system secret generic istio-ingressgateway-ca-certs --from-file ./ca.crt复制代码
-
server端自签名证书相关配置。
-
client端自签名证书相关配置。
-
k8s secret相关配置。
apiVersion: networking.istio.io/v1alpha3kind: Gatewaymetadata: name: httpbin-mtls-gatewayspec: selector: istio: ingressgateway servers: - port: number: 443 name: https-httpbin protocol: HTTPS tls: mode: MUTUAL serverCertificate: /etc/istio/ingressgateway-certs/tls.crt privateKey: /etc/istio/ingressgateway-certs/tls.key caCertificates: /etc/istio/ingressgateway-ca-certs/ca.crt subjectAltNames: - is5.istio.client hosts: - "httpbin.6491dea3ce6b4d17b109.eastus.aksapp.io"复制代码
-
gateway相关配置。
-
新建监听端口443。
-
在443中启用mtls。
-
指定443的key和cert。
-
指定443的ca cert。
-
指定允许连接443的san。
apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata: name: httpbin-tls-vsspec: hosts: - "httpbin.6491dea3ce6b4d17b109.eastus.aksapp.io" gateways: - httpbin-mtls-gateway http: - match: - uri: prefix: /status route: - destination: port: number: 8000 host: httpbin.default.svc.cluster.local复制代码
-
virtualservice相关配置。
-
配置相关路由。
[~/K8s/istio/istio-azure-1.0.2/samples/httpbin/ssl]$ http https://httpbin.6491dea3ce6b4d17b109.eastus.aksapp.io/status/418 --verify no --cert ./client.crt --cert-key ./client.keyHTTP/1.1 418 Unknownaccess-control-allow-credentials: trueaccess-control-allow-origin: *content-length: 135date: Sun, 04 Nov 2018 15:28:47 GMTserver: envoyx-envoy-upstream-service-time: 6x-more-info: http://tools.ietf.org/html/rfc2324 -=[ teapot ]=- _...._ .' _ _ `. | ."` ^ `". _, \_;`"---"`|// | ;/ \_ _/ `"""`[~/K8s/istio/istio-azure-1.0.2/samples/httpbin/ssl]复制代码
-
测试结果。
-
通过https mtls方式访问httpbin.6491dea3ce6b4d17b109.eastus.aksapp.io,可以正常访问httpbin pod。
非TLS多主机环境
相关拓扑
-
使用azure aks环境。
-
ingress gateway的service类型为loadbalancer。
-
ingress gateway的service enternal ip为104.211.54.62。
-
通过该external ip对应的域名,访问ingress gateway svc。
-
2个主机,分别为:httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io和httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io。
-
客户端使用http方式访问主机。
-
为2个主机配置统一的gateway定义。
-
为2个主机分别配置virtualservice定义。
-
主机httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io被路由至pod httpbin-a的/status uri。
-
主机httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io被路由至pod httpbin-b的/headers uri。
-
在gateway的listnener中生成统一的监听0.0.0.0_80。
-
在gateway的route中分别生成针对httpbin-a和httpbin-b的虚拟主机。
相关配置
apiVersion: networking.istio.io/v1alpha3kind: Gatewaymetadata: name: httpbin-dual-gatewayspec: selector: istio: ingressgateway servers: - port: number: 80 name: http-httpbin protocol: HTTP hosts: - "httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io" - "httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io"apiVersion: networking.istio.io/v1alpha3kind: Gatewaymetadata: name: httpbin-dual-gatewayspec: selector: istio: ingressgateway servers: - port: number: 80 name: http-httpbina protocol: HTTP hosts: - "httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io" - port: number: 80 name: http-httpbinb protocol: HTTP hosts: - "httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io"复制代码
-
gateway相关配置。
-
这2个gateway的配置,生成的envoy配置是一致的。
-
新建监听端口80。
-
分别针对两个主机httpbin-a和httpbin-b进行监听。
apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata: name: httpbin-a-vsspec: hosts: - "httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io" gateways: - httpbin-dual-gateway http: - match: - uri: prefix: /status route: - destination: port: number: 8000 host: httpbin-a.default.svc.cluster.localapiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata: name: httpbin-b-vsspec: hosts: - "httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io" gateways: - httpbin-dual-gateway http: - match: - uri: prefix: /headers route: - destination: port: number: 8000 host: httpbin-b.default.svc.cluster.local复制代码
-
httpbin-a和httpbin-b的virtualservice相关配置。
-
httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io的/status请求被路由至httpbin-a。
-
httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io的/headers请求被路由至httpbin-b。
[~/K8s/istio/istio-azure-1.0.2/samples/httpbin/ssl]$ http http://httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io/status/418HTTP/1.1 418 Unknownaccess-control-allow-credentials: trueaccess-control-allow-origin: *content-length: 135date: Sun, 04 Nov 2018 16:27:07 GMTserver: envoyx-envoy-upstream-service-time: 10x-more-info: http://tools.ietf.org/html/rfc2324 -=[ teapot ]=- _...._ .' _ _ `. | ."` ^ `". _, \_;`"---"`|// | ;/ \_ _/ `"""`[~/K8s/istio/istio-azure-1.0.2/samples/httpbin/ssl]$ http http://httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io/headersHTTP/1.1 200 OKaccess-control-allow-credentials: trueaccess-control-allow-origin: *content-length: 412content-type: application/jsondate: Sun, 04 Nov 2018 16:27:25 GMTserver: envoyx-envoy-upstream-service-time: 7{ "headers": { "Accept": "*/*", "Accept-Encoding": "gzip, deflate", "Content-Length": "0", "Host": "httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io", "User-Agent": "HTTPie/0.9.9", "X-B3-Sampled": "1", "X-B3-Spanid": "9b6889437bfe02c8", "X-B3-Traceid": "9b6889437bfe02c8", "X-Envoy-Internal": "true", "X-Request-Id": "e43ae114-52dd-9ee4-930b-dbb0405c6fef" }}[~/K8s/istio/istio-azure-1.0.2/samples/httpbin/ssl]$复制代码
-
测试结果。
-
请求httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io/status/418和httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io/headers均可以被正确路由。
TLS多主机环境
相关拓扑
-
使用azure aks环境。
-
ingress gateway的service类型为loadbalancer。
-
ingress gateway的service enternal ip为104.211.54.62。
-
通过该external ip对应的域名,访问ingress gateway svc。
-
2个主机,分别为:httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io和httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io。
-
客户端使用tls方式访问主机。
-
为2个主机分别配置gateway中的server定义。
-
为2个主机的server定义中增加证书的定义,每个server使用不同的证书。
-
为2个主机分别配置virtualservice定义。
-
在gateway的listnener中生成统一的监听0.0.0.0_443。
-
因为gateway中配置的2个server中有不相同的配置,所以在监听0.0.0.0_443中,会生成2个server,分别为httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io和httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io。
-
因为监听中生成2个server,所以在路由中会生成2条不同的路由相对应,在gateway的路由中生成分别的虚拟主机https.443.https-httpbina和https.443.https-httpbinb。
-
监听0.0.0.0_443所属的server httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io被关联至路由https.443.https-httpbina,server httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io被关联至路由https.443.https-httpbinb。
-
主机httpbin-a被路由至pod httpbin-a的/status uri。
-
主机httpbin-b被路由至pod httpbin-b的/headers uri。
相关配置
openssl req \-newkey rsa:4096 -nodes -sha256 -keyout ca.key \-x509 -days 3655 -out ca.crtopenssl req \-newkey rsa:4096 -nodes -sha256 -keyout httpbin-a-tls.key \-out httpbin-a-tls.csrecho subjectAltName = DNS:httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io > extfile-httpbin-a-tls.cnfopenssl x509 \-req -days 3655 -in httpbin-a-tls.csr -CA ca.crt -CAkey ca.key \-CAcreateserial -extfile extfile-httpbin-a-tls.cnf -out httpbin-a-tls.crtopenssl req \-newkey rsa:4096 -nodes -sha256 -keyout httpbin-b-tls.key \-out httpbin-b-tls.csrecho subjectAltName = DNS:httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io > extfile-httpbin-b-tls.cnfopenssl x509 \-req -days 3655 -in httpbin-b-tls.csr -CA ca.crt -CAkey ca.key \-CAcreateserial -extfile extfile-httpbin-b-tls.cnf -out httpbin-b-tls.crtkubectl create -n istio-system secret tls istio-ingressgateway-httpbin-a-certs --key ./httpbin-a-tls.key --cert ./httpbin-a-tls.crtkubectl create -n istio-system secret tls istio-ingressgateway-httpbin-b-certs --key ./httpbin-b-tls.key --cert ./httpbin-b-tls.crt复制代码
-
自签名证书相关配置。
-
k8s secret相关配置。
helm template install/kubernetes/helm/istio/ --name istio-ingressgateway --namespace istio-system -x charts/gateways/templates/deployment.yaml --set gateways.istio-egressgateway.enabled=false \--set gateways.istio-ingressgateway.secretVolumes[0].name=ingressgateway-ca-certs \--set gateways.istio-ingressgateway.secretVolumes[0].secretName=istio-ingressgateway-ca-certs \--set gateways.istio-ingressgateway.secretVolumes[0].mountPath=/etc/istio/ingressgateway-ca-certs \--set gateways.istio-ingressgateway.secretVolumes[1].name=ingressgateway-httpbin-a-certs \--set gateways.istio-ingressgateway.secretVolumes[1].secretName=istio-ingressgateway-httpbin-a-certs \--set gateways.istio-ingressgateway.secretVolumes[1].mountPath=/etc/istio/ingressgateway-httpbin-a-certs \--set gateways.istio-ingressgateway.secretVolumes[2].name=ingressgateway-httpbin-b-certs \--set gateways.istio-ingressgateway.secretVolumes[2].secretName=istio-ingressgateway-httpbin-b-certs \--set gateways.istio-ingressgateway.secretVolumes[2].mountPath=/etc/istio/ingressgateway-httpbin-b-certs > \./helm-ingressgateway-httpbin-dual-tls.yaml... volumeMounts: - name: istio-certs mountPath: /etc/certs readOnly: true - name: ingressgateway-ca-certs mountPath: "/etc/istio/ingressgateway-ca-certs" readOnly: true - name: ingressgateway-httpbin-a-certs mountPath: "/etc/istio/ingressgateway-httpbin-a-certs" readOnly: true - name: ingressgateway-httpbin-b-certs mountPath: "/etc/istio/ingressgateway-httpbin-b-certs" readOnly: true volumes: - name: istio-certs secret: secretName: istio.istio-ingressgateway-service-account optional: true - name: ingressgateway-ca-certs secret: secretName: "istio-ingressgateway-ca-certs" optional: true - name: ingressgateway-httpbin-a-certs secret: secretName: "istio-ingressgateway-httpbin-a-certs" optional: true - name: ingressgateway-httpbin-b-certs secret: secretName: "istio-ingressgateway-httpbin-b-certs" optional: true...复制代码
-
修改了ingress gateway deployment的配置,可以支持多个证书。
-
分别包含域名为httpbin-a和httpbin-b的证书。
apiVersion: networking.istio.io/v1alpha3kind: Gatewaymetadata: name: httpbin-dual-tls-gatewayspec: selector: istio: ingressgateway servers: - port: number: 443 name: https-httpbina protocol: HTTPS tls: mode: SIMPLE serverCertificate: /etc/istio/ingressgateway-httpbin-a-certs/tls.crt privateKey: /etc/istio/ingressgateway-httpbin-a-certs/tls.key hosts: - "httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io" - port: number: 443 name: https-httpbinb protocol: HTTPS tls: mode: SIMPLE serverCertificate: /etc/istio/ingressgateway-httpbin-b-certs/tls.crt privateKey: /etc/istio/ingressgateway-httpbin-b-certs/tls.key hosts: - "httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io"复制代码
-
gateway相关配置。
-
分别定义2个server,每个server配置不同的证书。
apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata: name: httpbin-a-vsspec: hosts: - "httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io" gateways: - httpbin-dual-tls-gateway http: - match: - uri: prefix: /status route: - destination: port: number: 8000 host: httpbin-a.default.svc.cluster.localapiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata: name: httpbin-b-vsspec: hosts: - "httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io" gateways: - httpbin-dual-tls-gateway http: - match: - uri: prefix: /headers route: - destination: port: number: 8000 host: httpbin-b.default.svc.cluster.local复制代码
-
httpbin-a和httpbin-b的virtualservice相关配置。
-
httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io的/status请求被路由至httpbin-a。
-
httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io的/headers请求被路由至httpbin-b。
[~/K8s/istio/istio-azure-1.0.2/samples/httpbin/ssl]$ http https://httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io/status/418 --verify noHTTP/1.1 418 Unknownaccess-control-allow-credentials: trueaccess-control-allow-origin: *content-length: 135date: Sun, 04 Nov 2018 17:36:30 GMTserver: envoyx-envoy-upstream-service-time: 6x-more-info: http://tools.ietf.org/html/rfc2324 -=[ teapot ]=- _...._ .' _ _ `. | ."` ^ `". _, \_;`"---"`|// | ;/ \_ _/ `"""`[~/K8s/istio/istio-azure-1.0.2/samples/httpbin/ssl]$ http https://httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io/headers --verify noHTTP/1.1 200 OKaccess-control-allow-credentials: trueaccess-control-allow-origin: *content-length: 412content-type: application/jsondate: Sun, 04 Nov 2018 17:36:33 GMTserver: envoyx-envoy-upstream-service-time: 8{ "headers": { "Accept": "*/*", "Accept-Encoding": "gzip, deflate", "Content-Length": "0", "Host": "httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io", "User-Agent": "HTTPie/0.9.9", "X-B3-Sampled": "1", "X-B3-Spanid": "27a46e99214fe1e1", "X-B3-Traceid": "27a46e99214fe1e1", "X-Envoy-Internal": "true", "X-Request-Id": "6c1ace56-7f57-9b0d-bb3d-2eb57519c4a2" }}[~/K8s/istio/istio-azure-1.0.2/samples/httpbin/ssl]$复制代码
-
测试结果。
-
请求httpbin-a.6491dea3ce6b4d17b109.eastus.aksapp.io/status/418和httpbin-b.6491dea3ce6b4d17b109.eastus.aksapp.io/headers均可以被正确路由。
ServiceMesher社区信息
微信群:联系我入群
社区官网: www.servicemesher.com
Slack: servicemesher.slack.com 需要邀请才能加入
Twitter: twitter.com/servicemesh…
GitHub: github.com/
更多Service Mesh咨询请扫码关注微信公众号ServiceMesher。
以上就是本文的全部内容,希望对大家的学习有所帮助,也希望大家多多支持 码农网
猜你喜欢:- mybatis源码配置文件解析之三:解析typeAliases标签
- Nginx 源码:配置文件解析
- 解析持续交付之全面配置管理
- Nginx源码阅读笔记-配置解析流程
- Prometheus学习系列(十三)之配置解析
- Vue项目中配置pug解析支持
本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们。
激荡十年,水大鱼大
吴晓波 / 中信出版社 / 2017-11-1 / CNY 58.00
【编辑推荐】 知名财经作者吴晓波新作,畅销十年、销量超过两百万册的《激荡三十年》续篇,至此完成改革开放四十年企业史完整记录。 作为时代记录者,吴晓波有意识地从1978年中国改革开放伊始,记录中国翻天覆地的变化和对我们影响至深的人物与事件,串成一部我们每个人的时代激荡史。而最新的这十年,无疑更壮观,也更扑朔迷离。 很多事情,在当时并未有很深很透的感受,回过头来再看,可能命运的轨迹就......一起来看看 《激荡十年,水大鱼大》 这本书的介绍吧!