0

我想用 istio 网关公开 kibana，因为我使用了这个配置文件

apiVersion: elasticsearch.k8s.elastic.co/v1beta1
kind: Elasticsearch
metadata:
  name: monitoring
  namespace: {{ .Values.kibana.namespace }}  
spec:
  version: 7.4.2
  http:
    tls:
      selfSignedCertificate:
        disabled: true
    service:
      spec:
        ports:
          - name: http
            port: 9200
            targetPort: 9200  
  nodeSets:
  - name: default
    count: 1
    config:
      node.master: true
      node.data: true
      node.ingest: true
      node.store.allow_mmap: false
    podTemplate:
      spec:
        containers:
        - name: elasticsearch
          env:
          - name: ES_JAVA_OPTS
            value: -Xms1g -Xmx1g
          resources:
            requests:
              memory: 1Gi
              cpu: 0.5
            limits:
              memory: 2Gi
              cpu: 2    
      metadata:
        annotations:
          traffic.sidecar.istio.io/excludeOutboundPorts: "9300"
          traffic.sidecar.istio.io/excludeInboundPorts: "9300"

apiVersion: kibana.k8s.elastic.co/v1beta1
kind: Kibana
metadata:
  name: monitoring
  namespace: {{ .Values.kibana.namespace }}  
spec:
  version: 7.4.2
  count: 1
  elasticsearchRef:
    name: monitoring
  http:
    tls:
      selfSignedCertificate:
        disabled: true
  podTemplate:
    spec:
      containers:
      - name: kibana
        env:
          - name: SERVER_BASEPATH
            value: ""      
        resources:
          requests:
            memory: 1Gi
            cpu: 0.5
          limits:
            memory: 2Gi
            cpu: 2 
    metadata:
      annotations:
        sidecar.istio.io/rewriteAppHTTPProbers: "true"

kind: Gateway
apiVersion: networking.istio.io/v1alpha3
metadata:
  name: kibana-gateway
  namespace: elastic-system
spec:
  servers:
    - hosts:
        - kibana.<domain>
      port:
        name: http2
        number: 80
        protocol: HTTP2
    - hosts:
        - kibana.<domain>
      port:
        name: https
        number: 443
        protocol: HTTPS
      tls:
        credentialName: kibana-tls-secret
        mode: SIMPLE
  selector:
    istio: ingressgateway

kind: VirtualService
apiVersion: networking.istio.io/v1alpha3
metadata:
  name: kibana-rule
  namespace: elastic-system
spec:
  hosts:
    - kibana.<domain>
  gateways:
    - kibana-gateway
  http:
    - match:
        - uri:
            prefix: /
      route:
        - destination:
            host: monitoring-kb-http.elastic-system.svc.cluster.local
            port:
              number: 5601

我公开的所有其他应用程序使用相同的配置运行良好，但使用 kibana 我有 http 503，并显示此消息“上游连接错误或在标头之前断开/重置。重置原因：连接终止”

如果我从网关中删除 https 配置并且只保留 http ，它可以工作。 证书是从证书管理器生成的，它们适用于其他应用程序（现在我使用自签名证书进行测试）

apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  selfSigned: {}  

{{ $root := . }}
{{- range list "dashboard" "grafana" "prometheus" "tracing" "kiali" "kibana"}}

{{- if index $root.Values .  }}
{{- if index $root.Values . "tls" }}
---
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: {{ . }}-certificate
  namespace: istio-system
spec:
  secretName: {{ . }}-tls-secret
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  commonName: {{ ( index $root.Values . "host" ) | quote }} 
  dnsNames:
  - {{ ( index $root.Values . "host" ) | quote }} 
  acme:
    config:
    - dns01:
         provider: poc-dns
      domains:
      - {{ ( index $root.Values . "host" ) | quote }} 
{{- end }}
{{- end }} 

{{- end }}

你期待看到什么？

通过 https 暴露的 Kibana

你看到了什么？在什么情况下？

503 错误，此消息“上游连接错误或在标头之前断开/重置。重置原因：连接终止”

环境

ECK 版本：

https://download.elastic.co/downloads/eck/1.0.0-beta1/all-in-one.yaml

Istio 版本：=1.4.0

Kubernetes 信息：

云：EKS Kubernetes 客户端版本：version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.8", GitCommit:"211047e9a1922595eaa3a1127ed365e9299a6c23", GitTreeState:"clean", BuildDate:"2019-10- 15T12:11:03Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"windows/amd64"} 服务器版本：version.Info{Major:"1", Minor:"14+", GitVersion ：“v1.14.9-eks-c0eccc”，GitCommit：“c0eccca51d7500bb03b2f163dd8d534ffeb2f7a2”，GitTreeState：“clean”，BuildDate：“2019-12-22T23:14:11Z”，GoVersion：“go1.12.12”，编译器：“gc” , 平台:"linux/amd64"}

4

1 回答 1

1

我解决了我不得不重命名 http 端口的问题

apiVersion: kibana.k8s.elastic.co/v1beta1
kind: Kibana
metadata:
  name: monitoring
  namespace: {{ .Values.kibana.namespace }}  
spec:
  version: 7.4.2
  count: 1
  elasticsearchRef:
    name: monitoring
  http:
    tls:
      selfSignedCertificate:
        disabled: true
    service:
      spec:
        ports:
          - name: http
            port: 5601
            targetPort: 5601          
  podTemplate:
    spec:
      containers:
      - name: kibana
        env:
          - name: SERVER_BASEPATH
            value: ""      
        resources:
          requests:
            memory: 1Gi
            cpu: 0.5
          limits:
            memory: 2Gi
            cpu: 2 
    metadata:
      annotations:
        sidecar.istio.io/rewriteAppHTTPProbers: "true"
于 2020-01-08T13:06:33.493 回答