0

我安装了 Istio

gateways.istio-egressgateway.enabled = true

我有一个使用外部服务的服务，所以我定义了以下出口规则。

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-service1
spec:
  hosts:
  - external-service1.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL

但是使用 Jaeger 我看不到外部服务的流量，因此能够检测到网络中的问题。

我将适当的标头转发到外部服务（x-request-id、x-b3-traceid、x-b3-spanid、b3-parentspanid、x-b3-sampled、x-b3-flags、x-ot-跨度上下文）

这是正确的行为吗？怎么了？我只能有内部通话的统计信息吗？如何获得出口流量的统计信息？

4

1 回答 1

2

Assuming that your services are defined in Istio’s internal service registry. If not please configure it according to instruction service-defining.

In HTTPS all the HTTP-related information like method, URL path, response code, is encrypted so Istio cannot see and cannot monitor that information for HTTPS. If you need to monitor HTTP-related information in access to external HTTPS services, you may want to let your applications issue HTTP requests and configure Istio to perform TLS origination.

First you have to redefine your ServiceEntry and create VirtualService to rewrite the HTTP request port and add a DestinationRule to perform TLS origination.

kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-service1
spec:
  hosts:
  - external-service1.com
  ports:
  - number: 80
    name: http-port
    protocol: HTTP
  - number: 443
    name: http-port-for-tls-origination
    protocol: HTTP
  resolution: DNS
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: external-service1
spec:
  hosts:
  - external-service1.com
  http:
  - match:
    - port: 80
    route:
    - destination:
        host: external-service1.com
        port:
          number: 443
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: external-service1
spec:
  host: external-service1.com
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: SIMPLE # initiates HTTPS when accessing external-service1.com
EOF

The VirtualService redirects HTTP requests on port 80 to port 443 where the corresponding DestinationRule then performs the TLS origination. Unlike the previous ServiceEntry, this time the protocol on port 443 is HTTP, instead of HTTPS, because clients will only send HTTP requests and Istio will upgrade the connection to HTTPS.

I hope it helps.

于 2019-06-05T14:23:36.510 回答