使用 istio 作为外部 TLS 服务的反向代理

Question

Istio 允许您将 a 中的 http 请求路由VirtualService到存在的外部主机ServiceEntry。例如：

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: httpbin-ext
spec:
  hosts:
  - httpbin.org
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.domain.co
  gateways:
  - public-gateway.istio-system.svc.cluster.local
  - mesh
  http:
  - match:
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 443
      host: httpbin.domain.co
    route:
    - destination:
        host: httpbin.org
        port:
          number: 80

但是，这仅允许 HTTP 端点 - 如何将外部端点配置为 TLS/HTTPS？

Answer 1

这花了我几个小时才完成——我觉得非常值得分享。

为了作为 TLS 终止此服务，Destination Rule需要 a。我的最终配置：

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: httpbin-ext
spec:
  hosts:
  - httpbin.org
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.domain.co
  gateways:
  - public-gateway.istio-system.svc.cluster.local
  - mesh
  http:
  - match:
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 443
      host: httpbin.domain.co
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 80
      host: httpbin.domain.co
    route:
    - destination:
        host: httpbin.org
        port:
          number: 443
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: httpbin-org
spec:
  host: httpbin.org
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: SIMPLE