0

我的平台版本：

  • AWS EKS 1.18
  • istio 1.7.3

您好，我在通过 https 请求时遇到问题。当我尝试在 ssl 上连接到“https://kinesis.ap-northeast-2.amazonaws.com”时，我收到 ssl3_get_record:wrong version number 错误。但是，对“https://www.amazon.com”的 SSL 请求正在运行。对“kinesis.ap-northeast-2.amazonaws.com:443”的 Http 请求也有效。仅供参考，对路由器代理上的 kinesis 的 https 请求也可以正常工作。我认为 Sidecar 代理会出现这个问题。你能告诉我如何解决吗？

我的调试日志：

istio-proxy@xx-deployment-1:/$ curl https://kinesis.ap-northeast-2.amazonaws.com # SSL ERROR
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

istio-proxy@xx-deployment-1:/$ openssl s_client -connect kinesis.ap-northeast-2.amazonaws.com:443 -prexit -debug
CONNECTED(00000005)
write to 0x55da2e01a630 [0x55da2e02cbb0] (338 bytes => 338 (0x152))
0000 - 16 03 01 01 4d 01 00 01-49 03 03 d1 6c 8f 02 46   ....M...I...l..F
....
0150 - a6 18                                             ..
read from 0x55da2e01a630 [0x55da2e0238a3] (5 bytes => 5 (0x5))
0000 - 15 00 00 00 02                                    .....
140165107823040:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:332:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 338 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
read from 0x55da2e01a630 [0x55da2e011d80] (8192 bytes => 9 (0x9))
0000 - 02 28 15 00 00 00 02 01-00                        .(.......
read from 0x55da2e01a630 [0x55da2e011d80] (8192 bytes => 0 (0x0))
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 14 bytes and written 338 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

端口 443 上的 http 请求测试：

root@xx-deployment-576c874974-g8pnn:/usr/src/app# curl -iv http://kinesis.ap-northeast-2.amazonaws.com:443
* Rebuilt URL to: http://kinesis.ap-northeast-2.amazonaws.com:443/
*   Trying 54.230.155.14...
* TCP_NODELAY set
* Connected to kinesis.ap-northeast-2.amazonaws.com (54.230.155.14) port 443 (#0)
> GET / HTTP/1.1
> Host: kinesis.ap-northeast-2.amazonaws.com:443
> User-Agent: curl/7.52.1
> Accept: */*
> 
< HTTP/1.1 400 Bad Request
HTTP/1.1 400 Bad Request
< Server: CloudFront
Server: CloudFront
< Date: Wed, 10 Mar 2021 07:51:49 GMT
Date: Wed, 10 Mar 2021 07:51:49 GMT
< Content-Type: text/html
Content-Type: text/html
< Content-Length: 915
Content-Length: 915
< Connection: close
Connection: close
< X-Cache: Error from cloudfront
X-Cache: Error from cloudfront
< Via: 1.1 3dd24013b0b99bf4ea490be8808572d8.cloudfront.net (CloudFront)
Via: 1.1 3dd24013b0b99bf4ea490be8808572d8.cloudfront.net (CloudFront)
< X-Amz-Cf-Pop: ICN51-C2
X-Amz-Cf-Pop: ICN51-C2
< X-Amz-Cf-Id: ZffqQUOQWMUZaVaejuWuy0QTeVrpa47cFhWq7ion4aM2jj7nR17v4w==
X-Amz-Cf-Id: ZffqQUOQWMUZaVaejuWuy0QTeVrpa47cFhWq7ion4aM2jj7nR17v4w==

< 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>ERROR: The request could not be satisfied</TITLE>
</HEAD><BODY>
<H1>400 ERROR</H1>
<H2>The request could not be satisfied.</H2>
<HR noshade size="1px">
Bad request.
We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
<BR clear="all">
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
<BR clear="all">
<HR noshade size="1px">
<PRE>
Generated by cloudfront (CloudFront)
Request ID: ZffqQUOQWMUZaVaejuWuy0QTeVrpa47cFhWq7ion4aM2jj7nR17v4w==
</PRE>
<ADDRESS>
</ADDRESS>
* Curl_http_done: called premature == 0
* Closing connection 0

我的 istio 代理配置：

  proxy:
    autoInject: enabled
    clusterDomain: cluster.local
    componentLogLevel: 'misc:error'
    enableCoreDump: false
    excludeIPRanges: ''
    excludeInboundPorts: ''
    excludeOutboundPorts: ''
    image: proxyv2
    logLevel: warning
    privileged: false
    readinessFailureThreshold: 30
    readinessInitialDelaySeconds: 1
    readinessPeriodSeconds: 2
    resources:
      limits:
        cpu: 2000m
        memory: 1024Mi
      requests:
        cpu: 100m
        memory: 128Mi
    statusPort: 15020
    tracer: zipkin
  proxy_init:
    image: proxyv2
    resources:
      limits:
        cpu: 2000m
        memory: 1024Mi
      requests:
        cpu: 10m
        memory: 10Mi

我的边车代理容器规格：

- name: istio-proxy
  image: 'docker.io/istio/proxyv2:1.7.3'
  args:
    - proxy
    - sidecar
    - '--domain'
    - $(POD_NAMESPACE).svc.cluster.local
    - '--serviceCluster'
    - xx.$(POD_NAMESPACE)
    - '--proxyLogLevel=warning'
    - '--proxyComponentLogLevel=misc:error'
    - '--trust-domain=cluster.local'
    - '--concurrency'
    - '2'

我的网关容器规格：

  containers:
    - name: istio-proxy
      image: 'docker.io/istio/proxyv2:1.7.3'
      args:
        - proxy
        - router
        - '--domain'
        - $(POD_NAMESPACE).svc.cluster.local
        - '--proxyLogLevel=warning'
        - '--proxyComponentLogLevel=misc:error'
        - '--log_output_level=default:info'
        - '--serviceCluster'
        - xx-gateway
        - '--trust-domain=cluster.local'
4

1 回答 1

1

我创建了另一个 EKS 集群来测试这个错误。所以，我发现问题出在这个 istio 配置中。

spec:
 values:
  global:
   podDNSSearchNamespaces:
    - global

在我删除“podDNSSearchNamespaces”键后，https 起作用了。

于 2021-03-10T09:58:34.977 回答