gateway资源详解

最新推荐文章于 2024-07-24 23:22:47 发布
最新推荐文章于 2024-07-24 23:22:47 发布
阅读量2.3k 收藏
点赞数 2
分类专栏： kubernetes
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/hxpjava1/article/details/108318712
版权

istio课程发布：https://edu.csdn.net/course/detail/29911
这是我目前见过最详细，最有深度的istio课程

学习目标

在这里插入图片描述

什么是gateway

在这里插入图片描述

在Kubernetes环境中，Kubernetes Ingress用于配置需要在集群外部公开的服务。但是在Istio服务网格中，更好的方法是使用新的配置模型，即Istio Gateway。Gateway允许将Istio流量管理的功能应用于进入集群的流量。

gateway 分为两种，分别是ingress-gateway和egress-gateway，分别用来处理入口流量和出口流量。gateway本质也是一个envoy pod。

资源详解

selector

1.7.0/gateway/gateway-01.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"

servers

hosts

所有域名：

1.7.0/gateway/gateway-server-hosts-star.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
具体域名：

1.7.0/gateway/gateway-server-hosts-bookinfo-com.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "bookinfo.com"
多个域名：

1.7.0/gateway/gateway-server-hosts-multi.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "bookinfo.com"
    - "bookinfo.demo"
混合域名

1.7.0/gateway/gateway-server-hosts-mix.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "bookinfo.com"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage.istio.svc.cluster.local
        port:
          number: 9080

name

1.7.0/gateway/gateway-server-name.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
    name: bookinfo-gateway

port

FieldTypeDescriptionRequired
numberuint32一个有效的端口号是
protocolstring所使用的协议，支持HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS.是
namestring给端口分配一个名称是

istio支持的协议：

  • grpc
  • grpc-web
  • http
  • http2
  • https
  • mongo
  • mysql*
  • redis*
  • tcp
  • tls
  • udp

* These protocols are disabled by default to avoid accidentally enabling experimental features. To enable them, configure the corresponding Pilot environment variables.

http

1部署gateway

1.7.0/gateway/gateway-01.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"

2部署vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "*"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage.istio.svc.cluster.local
        port:
          number: 9080

3访问浏览器

https

1创建secret

kubectl create -n istio-system secret tls istio-ingressgateway-certs --key ./cert.key --cert=./cert.crt

kubectl exec deploy/istio-ingressgateway -n istio-system – ls /etc/istio/ingressgateway-certs

2创建gateway

1.7.0/gateway/gateway-https.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "bookinfo.demo"
    - "ratings.demo"
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key

3创建vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "*"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage.istio.svc.cluster.local
        port:
          number: 9080

4访问浏览器

tcp

1创建gateway

1.7.0/gateway/gateway-tcp.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: tcp-echo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 31400
      name: tcp
      protocol: TCP
    hosts:
    - "*"

2创建vs dr

1.7.0/gateway/protocol/vs-dr-tcp-echo.yaml

kind: DestinationRule
metadata:
  name: tcp-echo-destination
spec:
  host: tcp-echo
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: tcp-echo
spec:
  hosts:
  - "*"
  gateways:
  - tcp-echo-gateway
  tcp:
  - match:
    - port: 31400
    route:
    - destination:
        host: tcp-echo
        port:
          number: 9000
        subset: v1

3添加端口

kubectl edit svc istio-ingressgateway -n istio-system

4测试

telnet 10.68.12.164 31400

http2

1创建gateway

1.7.0/gateway/gateway-http2.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 15444
      name: http2
      protocol: HTTP2
      targetPort: 15444
    hosts:
    - "*"

2部署vs

1.7.0/virtaulservice/ vs-bookinfo-hosts-star.yaml

kubectl apply -f vs-bookinfo-hosts-star.yaml -n istio

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "*"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage.istio.svc.cluster.local
        port:
          number: 9080

3访问浏览器

mongo

1部署gateway

1.7.0/gateway/gateway-mongo.yaml

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: mongo
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 27017
      name: mongo
      protocol: MONGO
    hosts:
    - "*"

2部署vs

1.7.0/gateway/protocol/vs-mongodb.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: mongo
spec:
  hosts:
  - "*"
  gateways:
  - mongo
  tcp:
  - match:
    - port: 27017
    route:
    - destination:
        host: mongodb.istio.svc.cluster.local
        port:
          number: 27017

3添加端口

kubectl edit svc istio-ingressgateway -n istio-system

4测试

tls

1创建gateway

1.7.0/gateway/gateway-tls.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 15443
      name: tls
      protocol: TLS
    hosts:
    - "bookinfo.com"
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key

2创建vs

1.7.0/gateway/protocol/vs-tls-protocol-echo.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: tcp-echo
spec:
  hosts:
  - "*"
  gateways:
  - bookinfo-gateway
  tcp:
  - match:
    - port: 15443
    route:
    - destination:
        host: tcp-echo
        port:
          number: 9000

3修改/etc/hosts

10.68.12.164 bookinfo.com

4测试

openssl s_client -connect bookinfo.com:15443 -servername bookinfo.com

mysql

1创建gateway

1.7.0/gateway/gateway-mysql.yaml

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: mysql
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 3306
      name: mysql
      protocol: MYSQL
    hosts:
    - "*"
~

2创建vs

1.7.0/gateway/protocol/vs-mysql.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: mysql
spec:
  hosts:
  - "*"
  gateways:
  - mysql
  tcp:
  - match:
    - port: 3306
    route:
    - destination:
        host: mysqldb.istio.svc.cluster.local
        port:
          number: 3306

3新增端口

kubectl edit svc istio-ingressgateway -nistio-system

4istio启用mysql协议

kubectl set env deploy istiod -n istio-system PILOT_ENABLE_MYSQL_FILTER=true

5测试

mysql -h 192.168.198.154 --port 37031 -uroot -p

redis

1创建gateway

1.7.0/gateway/gateway-redis.yaml

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: redis
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 6379
      name: redis
      protocol: REDIS
    hosts:
    - "*"
~

2部署redis

1.7.0/gateway/protocol/redis-deploy.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: bcia
    ms-name: redis
  name: bcia-redis
spec:
  replicas: 1
  selector:
    matchLabels:
      app: bcia
      ms-name: redis
  template:
    metadata:
      labels:
        app: bcia
        ms-name: redis
      name: bcia-redis
    spec:
     containers:
     - name: bcia-redis
       image: redis:5.0.8
       command:
         - "redis-server"
---
apiVersion: v1
kind: Service
metadata:
  name: redis
spec:
  selector:
    app: bcia
    ms-name: redis
  ports:
  - port: 6379
    targetPort: 6379

3创建vs

1.7.0/gateway/protocol/vs-redis.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: redis
spec:
  hosts:
  - "*"
  gateways:
  - redis
  tcp:
  - match:
    - port: 6379
    route:
    - destination:
        host: redis.istio.svc.cluster.local
        port:
          number: 6379

4新增端口

kubectl edit svc istio-ingressgateway -nistio-system

5istio启用redis协议

kubectl set env deploy istiod -n istio-system PILOT_ENABLE_REDIS_FILTER=true

6测试

redis-cli -h 192.168.198.154 -p 29525

tls

FieldTypeDescriptionRequired
httpsRedirectbool是否要做 HTTP 重定向否
modeTLSmode在配置的外部端口上使用 TLS 服务时，可以取 PASSTHROUGH、SIMPLE、MUTUAL、AUTO_PASSTHROUGH 这 4 种模式否
serverCertificatestring服务端证书的路径。当模式是 SIMPLE 和 MUTUAL 时必须指定否
privateKeystring服务端密钥的路径。当模式是 SIMPLE 和 MUTUAL 时必须指定否
caCertificatesstringCA 证书路径。当模式是 MUTUAL 时指定否
credentialNamestring用于唯一标识服务端证书和秘钥。Gateway 使用 credentialName从远端的凭证存储中获取证书和秘钥，而不是使用 Mount 的文件否
subjectAltNamesstring[]SAN 列表，SubjectAltName 允许一个证书指定多个域名否
verifyCertificateSpkistring[]授权客户端证书的SKPI的base64编码的SHA-256哈希值的可选列表否
verifyCertificateHashstring[]授权客户端证书的十六进制编码SHA-256哈希值的可选列表否
minProtocolVersionTLSProtocolTLS 协议的最小版本否
maxProtocolVersionTLSProtocolTLS 协议的最大版本否
cipherSuitesstring[]指定的加密套件，默认使用 Envoy 支持的加密套件否
httpsRedirect

1.7.0/gateway/tls/gw-httpsRedirect.yaml

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
    tls:
      httpsRedirect: true
  - port:
      number: 443
      name: https-443
      protocol: HTTPS
    hosts:
    - "*"
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key

wget http://bookinfo.com:80/productpage --no-check-certificate

测试访问浏览器

mode
NameDescription
PASSTHROUGH客户端提供的SNI字符串将用作VirtualService TLS路由中的匹配条件，以根据服务注册表确定目标服务
SIMPLE使用标准TLS语义的安全连接
MUTUAL通过提供服务器证书进行身份验证，使用双边TLS来保护与下游的连接
AUTO_PASSTHROUGH与直通模式相似，不同之处在于具有此TLS模式的服务器不需要关联的VirtualService即可从SNI值映射到注册表中的服务。目标详细信息（例如服务/子集/端口）被编码在SNI值中。代理将转发到SNI值指定的上游（Envoy）群集（一组端点）。
ISTIO_MUTUAL通过提供用于身份验证的服务器证书，使用相互TLS使用来自下游的安全连接
PASSTHROUGH

1创建证书

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj ‘/O=example Inc./CN=example.com’ -keyout example.com.key -out example.com.crt

openssl req -out nginx.example.com.csr -newkey rsa:2048 -nodes -keyout nginx.example.com.key -subj “/CN=nginx.example.com/O=some organization”

openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 0 -in nginx.example.com.csr -out nginx.example.com.crt

2创建secret

kubectl create secret tls nginx-server-certs --key nginx.example.com.key --cert nginx.example.com.crt -n istio

3创建nginx配置文件

events {
}

http {
  log_format main '$remote_addr - $remote_user [$time_local]  $status '
  '"$request" $body_bytes_sent "$http_referer" '
  '"$http_user_agent" "$http_x_forwarded_for"';
  access_log /var/log/nginx/access.log main;
  error_log  /var/log/nginx/error.log;

  server {
    listen 443 ssl;

    root /usr/share/nginx/html;
    index index.html;

    server_name nginx.example.com;
    ssl_certificate /etc/nginx-server-certs/tls.crt;
    ssl_certificate_key /etc/nginx-server-certs/tls.key;
  }
}

kubectl create configmap nginx-configmap --from-file=nginx.conf=./nginx.conf -nistio

4创建deploy

apiVersion: v1
kind: Service
metadata:
  name: my-nginx
  labels:
    run: my-nginx
spec:
  ports:
  - port: 443
    protocol: TCP
  selector:
    run: my-nginx
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-nginx
spec:
  selector:
    matchLabels:
      run: my-nginx
  replicas: 1
  template:
    metadata:
      labels:
        run: my-nginx
    spec:
      containers:
      - name: my-nginx
        image: nginx
        ports:
        - containerPort: 443
        volumeMounts:
        - name: nginx-config
          mountPath: /etc/nginx
          readOnly: true
        - name: nginx-server-certs
          mountPath: /etc/nginx-server-certs
          readOnly: true
      volumes:
      - name: nginx-config
        configMap:
          name: nginx-configmap
      - name: nginx-server-certs
        secret:
          secretName: nginx-server-certs

5创建gateway

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https-443
      protocol: HTTPS
    hosts:
    - "nginx.example.com"
    tls:
      mode: PASSTHROUGH

6创建vs

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx
spec:
  hosts:
  - nginx.example.com
  gateways:
  - bookinfo-gateway
  tls:
  - match:
    - port: 443
      sniHosts:
      - nginx.example.com
    route:
    - destination:
        host: my-nginx
        port:
          number: 443

7访问url

https://nginx.example.com:39329/

SIMPLE

1创建gateway

1.7.0/gateway/tls/simple/gateway-simple.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "bookinfo.demo"
    - "ratings.demo"
    - "nginx.example.com"
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key

2创建vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "*"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage.istio.svc.cluster.local
        port:
          number: 9080

3访问 https://bookinfo.demo:39329/productpage

MUTUAL

1创建证书

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj ‘/O=example Inc./CN=example.com’ -keyout example.com.key -out example.com.crt

openssl req -out bookinfo.example.com.csr -newkey rsa:2048 -nodes -keyout bookinfo.example.com.key -subj “/CN=bookinfo.example.com/O=some organization”

openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 0 -in bookinfo.example.com.csr -out bookinfo.example.com.crt

2创建secret

kubectl create -n istio-system secret generic bookinfo-credential --from-file=tls.key=bookinfo.example.com.key --from-file=tls.crt=bookinfo.example.com.crt --from-file=ca.crt=example.com.crt

3创建gateway

1.7.0/gateway/tls/mutual/gateway-mutual.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
 name: bookinfo-gateway
spec:
 selector:
   istio: ingressgateway 
 servers:
 - port:
     number: 443
     name: https
     protocol: HTTPS
   tls:
     mode: MUTUAL
     credentialName: bookinfo-credential 
   hosts:
   - bookinfo.example.com

4创建vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "*"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage.istio.svc.cluster.local
        port:
          number: 9080

5生成客户端证书

openssl req -out client.example.com.csr -newkey rsa:2048 -nodes -keyout client.example.com.key -subj “/CN=client.example.com/O=client organization”

openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 1 -in client.example.com.csr -out client.example.com.crt

6访问

curl -v -HHost:bookinfo.example.com --resolve “bookinfo.example.com:39329:192.168.198.154” --cacert example.com.crt --cert client.example.com.crt --key client.example.com.key “https://bookinfo.example.com:39329/productpage”

AUTO_PASSTHROUGH

http://www.finbit.org/docs/examples/multicluster/split-horizon-eds//eAEFwUEKwCAMBMAX2b37m6IBF2IjboTS13dmZC5VgErGxUCPJth7z-UmzOPJ5kdpG1rOLCM2v3iKdeEH6-4X5Q,

主要用于多k8s集群，单istio控制面

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: tls
      protocol: TLS
    tls:
      mode: AUTO_PASSTHROUGH
    hosts:
    - "*.local"
ISTIO_MUTUAL

1创建证书

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj ‘/O=example Inc./CN=example.com’ -keyout example.com.key -out example.com.crt

openssl req -out bookinfo.example.com.csr -newkey rsa:2048 -nodes -keyout bookinfo.example.com.key -subj “/CN=bookinfo.example.com/O=some organization”

openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 0 -in bookinfo.example.com.csr -out bookinfo.example.com.crt

2创建secret

kubectl create -n istio-system secret generic bookinfo-credential --from-file=tls.key=bookinfo.example.com.key --from-file=tls.crt=bookinfo.example.com.crt --from-file=ca.crt=example.com.crt

3创建gateway

1.7.0/gateway/tls/istio-mutual/gateway-istio-mutual.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: ISTIO_MUTUAL
      credentialName: "bookinfo-credential"
    hosts:
    - "*"

4创建vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "*"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage.istio.svc.cluster.local
        port:
          number: 9080

5访问

curl -v -HHost:bookinfo.example.com --resolve “bookinfo.example.com:39329:192.168.198.154” --cacert example.com.crt “https://bookinfo.example.com:39329/productpage”

credentialName

1创建secret

cd 1.7.0/gateway/certs

kubectl create -n istio-system secret tls bookinfo-secret --key ./cert.key --cert=./cert.crt

2创建gateway

kubectl apply -f gateway-credentialName.yaml -n istio

1.7.0/gateway/tls/gateway-credentialName.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "*"
    tls:
      credentialName: bookinfo-secret
      mode: SIMPLE

3创建vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "*"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage.istio.svc.cluster.local
        port:
          number: 9080

4访问 https://bookinfo.demo:39329/productpage

caCertificates

1生成证书

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj ‘/O=example Inc./CN=example.com’ -keyout example.com.key -out example.com.crt

openssl req -out bookinfo.example.com.csr -newkey rsa:2048 -nodes -keyout bookinfo.example.com.key -subj “/CN=bookinfo.example.com/O=some organization”

openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 0 -in bookinfo.example.com.csr -out bookinfo.example.com.crt

2创建secret

kubectl create -n istio-system secret generic istio-ingressgateway-certs --from-file=tls.key=bookinfo.example.com.key --from-file=tls.crt=bookinfo.example.com.crt --from-file=ca.crt=example.com.crt

检查配置是否生效：

kubectl exec deploy/istio-ingressgateway -n istio-system – ls /etc/istio/ingressgateway-certs

3创建gateway

1.7.0/gateway/tls/gateway-caCertificates.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "*"
    tls:
      mode: MUTUAL
      caCertificates: /etc/istio/ingressgateway-certs/ca.crt
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key

4创建vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "*"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage.istio.svc.cluster.local
        port:
          number: 9080

5生成客户端证书

openssl req -out client.example.com.csr -newkey rsa:2048 -nodes -keyout client.example.com.key -subj “/CN=client.example.com/O=client organization”

openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 1 -in client.example.com.csr -out client.example.com.crt

6访问

curl -v -HHost:bookinfo.example.com --resolve “bookinfo.example.com:39329:192.168.198.154” --cacert example.com.crt --cert client.example.com.crt --key client.example.com.key “https://bookinfo.example.com:39329/productpage”

cipherSuites

部署gateway

1.7.0/gateway/tls/gateway-cipherSuites.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "bookinfo.demo"
    - "ratings.demo"
    - "nginx.example.com"
    tls:
      mode: SIMPLE
      cipherSuites: 
      - ECDHE-RSA-AES256-GCM-SHA384
      - ECDHE-RSA-AES128-GCM-SHA256
      credentialName: bookinfo-secret
minProtocolVersion maxProtocolVersion
NameDescription
TLS_AUTO自动选择DLS版本
TLSV1_0TLS 1.0
TLSV1_1TLS 1.1
TLSV1_2TLS 1.2
TLSV1_3TLS 1.3
TLS_AUTO

1.7.0/gateway/tls/protocolVersion/gateway-tls-version-tls_auto.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "*"
    tls:
      credentialName: bookinfo-secret
      mode: SIMPLE
      minProtocolVersion: TLS_AUTO
      maxProtocolVersion: TLS_AUTO
TLSV1_0

1.7.0/gateway/tls/protocolVersion/gateway-tls-version-tlsv1_0.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "*"
    tls:
      credentialName: bookinfo-secret
      mode: SIMPLE
      minProtocolVersion: TLSV1_0
      maxProtocolVersion: TLSV1_0
TLSV1_0 - TLSV1_3
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "*"
    tls:
      credentialName: bookinfo-secret
      mode: SIMPLE
      minProtocolVersion: TLSV1_0
      maxProtocolVersion: TLSV1_3
subjectAltNames

gRPC config for type.googleapis.com/envoy.config.listener.v3.Listener rejected: Error adding/updating listener(s) 0.0.0.0_8443: SAN-based verification of peer certificates without trusted CA is insecure and not allowed

hxpjava1
关注
专栏目录
Spring Cloud Gateway：路由元数据配置（Route Metadata Configuration）
专注于深入研究多种编程语言，以实战为导向，逐步拓展开发技能，提升工程化编码和思维能力，展现无敌技术实力。
06-21 1155
Spring Cloud Gateway是一个基于Spring Framework的开源网关解决方案，它提供了强大的路由功能和可扩展性，可以用于构建高性能、可靠的微服务架构。在Spring Cloud Gateway中，路由是通过配置文件定义的，但您还可以使用元数据（metadata）来配置每个路由的附加参数。路由元数据配置提供了一种灵活的方式，可以根据需要对特定的路由进行个性化的配置和定制。
【springcloud 微服务】Spring Cloud 微服务网关Gateway使用详解
congge_study的博客
04-16 5926
Spring Cloud 微服务网关Gateway使用详解
es中GatewayMetaState
多看多听多总结
03-10 296
1、概述 GatewayMetaState是在启动时加载集群元数据，并且存储集群数据用于下次重启。 2、启动 2.1 主节点或者数据节点 2.1.1 loadBestOnDiskState 主节点或者数据节点时，通过PersistedClusterStateService#loadBestOnDiskState来加载存在磁盘上的集群元数据。先在当前数据目录下的state目录下通过createDirectory创建基于lucene的Directory，然后调用loadOnDiskState加载元数据
详解网关Gateway
最新发布
博客
07-24 1104
大家都知道，从一个房间走到另一个房间，必然要经过一扇门。同样，从一个网络向另一个网络发送消息，也必须经过一道“关口”，这道关口就是网关。网关又称网间连接器、协议转换器。现实中最常见的就是VPN，它就是一个出口网关。Spring Cloud Gateway 中文文档Spring Cloud Gateway提供了一个建立在Spring生态系统之上的API网关，包括:Spring 6、Spring Boot 3和project Reactor。
Gateway
变成习惯
07-06 431
Gateway Gateway 描述了在网格边缘运行的负载均衡器，接收传入或传出的 HTTP/TCP 连接。其中描述了一组应该公开的端口、要使用的协议类型、负载均衡器的 SNI 配置等。 下面的示例中，Gateway 设置了一个代理作为负载均衡器，以暴露端口 80 和 9080（http）、443（https）、9443（https）、2379（TCP）方便外部访问。该网关将被应用于在带有标签 app: my-gateway-controller 的 Pod 上运行的代理。 apiVersion: netw
关于k8s中ingress、Gateway、nginx之间关系
三朝看客
04-24 3296
Ingress通常是集群内部的一个组件，用于管理应用程序的流量，而Gateway通常是集群之外的一个组件，用于处理入站和出站流量。有许多流行的Ingress控制器，如Nginx Ingress Controller、Traefik、Haproxy Ingress等，你需要选择一个适合你的需求的Ingress控制器并安装它。负责流量路由：Ingress和Gateway都可以将外部请求路由到集群内的应用程序，以及将集群内的应用程序路由到不同的服务。您可以根据您的实际需求选择适合您的技术。
7-4 NetworkPolicy网络策略简介与Ingress及Egress案例
分享云原生，容器，运维等干货知识
09-25 1034
NetworkPolicy网络策略可以在 IP 地址或端口层面（OSI 第 3 层或第 4 层）控制网络流量。NetworkPolicy 是一种以应用为中心的结构，允许你设置如何允许 Pod 与网络上的各类网络“实体”通信。NetworkPolicies 适用于一端或两端与 Pod 的连接，与其他连接无关。其他被允许的 Pods（例外：Pod 无法阻塞对自身的访问）被允许的名字空间IP 组块（例外：与 Pod 运行所在的节点的通信总是被允许的， 无论 Pod 或节点的 IP 地址）
SpringCloud Gateway用法详解
geejkse_seff的博客
06-12 5756
目录零、人在月球一、功能简介1、网关是一个服务：二、Gateway 断言1、path断言2、Query断言3、Method断言4、Host断言5、Cookie断言6、Header断言7、Weight 权重路由8、After 时间路由9、Before 时间路由10、Between时间区间路由11、灰度发布三、Gateway 过滤器1、增加header 请求头2、新增动态header请求头3、设置请求头 过滤器配置，修改移除请求头4、PreserverHostHeader5、重写response加密密码6、re
详解SpringCloudGateway内存泄漏问题
08-18
1. 调整堆外内存大小：将堆外内存大小从 1G 调整到 4G，並且不限制容器资源的情况下， Gateway 的并发稳定，单机 QPS 也很好。 2. 使用 Arthas 分析内存快照，发现堆内存正常，GC 也没有问题。 3. 使用 pmap 查看...
Spring Cloud Gateway使用Token验证详解
08-26
主要介绍了Spring Cloud Gateway使用Token验证详解，小编觉得挺不错的，现在分享给大家，也给大家做个参考。一起跟随小编过来看看吧
CISCO数据中心虚拟化之VPC技术和配置
Sisyphuss Blog
10-28 6543
CISCO数据中心虚拟化之VPC技术和配置 目录如下： 文章目录CISCO数据中心虚拟化之VPC技术和配置VPC概念实现方式：vpc的缘由VPC的部署拓扑VPC优势VPC术语名词vPC domainvPC peer linkvPC peer keepalive linkvPC peer switchvPC member portvPC vlanOrphan deviceOrphan portCFS...
Cisco VPC peer-gateway 对直连 BFD 邻居建立的影响
去哪儿网技术沙龙
07-02 934
作者简介：冯亚伟，去哪儿网 NETOPS，2014 年 7 月加入去哪儿网，拥有丰富的网络运维经验，现负责公司 IDC和骨干传输网络的运维工作。 一、场景介绍 如下图所示：两台思科 nexus 交 换机通过 VPC 为服务器提供双上联接入；服务器通过 bond0（主备模式）双上联到两台交换机上面。连接 SW1 的网卡为主用网卡，连接 SW2 的网卡为备用网卡；服务器作为 k8s 节点需要与两台接入交换机建立 iBGP ，为了缩短 BGP 的收敛时间用单跳 BFD 进行链路故障检测。两台接入交换机使用 i.
k8s ingress and egress
qq_26464429的博客
02-24 4963
simple architecture of ingress in k8s: create ingress controller To create the ingress controller, use Helm to install nginx-ingress. For added redundancy, two replicas of the NGINX ingress controlle...
K8s-网络原理-下篇
qq_41124175的博客
03-25 1180
如果客户端通过Node2访问Service，则有可能负载到Node1上的endpoint提供服务，则如果不做SNAT则返回的地址为Node1，会导致client接收包失败（client请求的是Node2，响应是Node1）。这条规则设置在 POSTROUTING 检查点，也就是说，它给即将离开这台主机的 IP 包，进行了一次 SNAT 操作，将这个 IP 包的源地址替换成了这台宿主机上的 CNI 网桥地址，或者宿主机本身的 IP 地址。在K8s中，Service和Pod都会被分配对应的DNS记录。
20-【istio】-【流量管理】-【Ingress gateway】Istio ingress gateway
qq_42303254的博客
02-18 2927
这里以istio 1.6.0为例 不同版本的istio安装步骤参考官网：Istio / Ingress Gateways istio ingress gateway是进入集群的大门； istio egress gateway是出去集群的大门。 istio ingress gateway和 istio 中自己定义的gateway资源的关系： 可以把istio ingress gateway理解为：k8s中的traefik ingress controller或nginx ingre.
Ingress 继任者 Gateway API 使用
架构师小秘圈
01-12 942
Gateway API（之前叫 Service API）是由 SIG-NETWORK 社区管理的开源项目，项目地址：https://gateway-api.sigs.k8s.io/。主要原...
istio安全之Citadel
weixin_44833948的博客
09-29 1782
Citadel服务间mTLSCitadel工作原理CA ServerSDS ServerSecret ControllerMonitorCitadel功能演示开始mTLS Citadel 是 Istio 中负责身份认证和证书管理的核心安全组件，1.5 版本之后取消了独立进程，作为一个模块被整合在 istiod 中。 如图，Istio所希望的是在网格中能够使用mTLS进行授权，而在网格外使用JWT+mTLS进行授权。服务间身份认证是使用mTLS，来源身份验证中则是使用JWT。 服务间mTLS istio中的
istio对外暴露服务
开心就好的专栏
06-07 907
istio对外暴露服务
【istio】egressgateway和ingressgateway 俩pod无法启动
突围
08-20 710
istio对资源有要求啊 查看镜像是否可以下载 [root@k2c4g3m-master0 bin]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE quay.io/coreos/flannel ..
Symantec Gateway Enforcer 安装与配置详解
本篇文档是关于Gateway ...这份手册对于初次安装或维护Gateway Enforcer的管理员来说是非常实用的资源，它涵盖了从硬件初始化到系统配置，再到安全设置的全方位指南，确保了设备在企业网络环境中稳定运行和有效防护。
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

hxpjava1

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值