Istio 错误: 502 UPE upstream_reset_before_response_started{protocol_error}

以下是使用 curl 命令请求 istio-proxy 中输出的错误日志

[2022-06-15T01:52:04.608Z] "GET /headers HTTP/1.1" 502 UPE upstream_reset_before_response_started{protocol_error} - "-" 0 87 3 - "-" "curl/7.83.1-DEV" "c1e77399-9dd6-9261-9e8a-3f4ebc8ecd87" "egress-httpbin.com:32505" "192.168.2.224:32505" outbound|32505||egress-httpbin.com 10.250.90.191:59768 240.240.0.1:32505 10.250.90.191:35884 - default
[2022-06-15T01:52:11.942Z] "GET /headers HTTP/1.1" 502 UPE upstream_reset_before_response_started{protocol_error} - "-" 0 87 2 - "-" "curl/7.83.1-DEV" "69ec264c-4706-95e3-ae49-422e224d0b6f" "egress-httpbin.com:32505" "192.168.2.224:32505" outbound|32505||egress-httpbin.com 10.250.90.191:59874 240.240.0.1:32505 10.250.90.191:35990 - default
[2022-06-15T01:52:12.510Z] "GET /headers HTTP/1.1" 502 UPE upstream_reset_before_response_started{protocol_error} - "-" 0 87 2 - "-" "curl/7.83.1-DEV" "f8bb8432-a0bd-9e29-9fc6-261c96969ed4" "egress-httpbin.com:32505" "192.168.2.224:32505" outbound|32505||egress-httpbin.com 10.250.90.191:59886 240.240.0.1:32505 10.250.90.191:36002 - default

场景就是使用 service entry 引入了网格外的服务然后测试就发生了错误。经过排查发现在 service entry ports 中端口协议设置错误

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: ext-egress-httpbin
  namespace: servicemesh-sleep
spec:
  endpoints:
  - address: 192.168.2.224
    ports:
      http-32505: 32505
  exportTo:
  - '*'
  hosts:
  - egress-httpbin.com
  ports:
  - name: http-32505
    number: 32505
    protocol: grpc
  resolution: DNS

更新为

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: ext-egress-httpbin
  namespace: servicemesh-sleep
spec:
  endpoints:
  - address: 192.168.2.224
    ports:
      http-32505: 32505
  exportTo:
  - '*'
  hosts:
  - egress-httpbin.com
  ports:
  - name: http-32505
    number: 32505
    protocol: http
  resolution: DNS