22

在istio中部署tls网关 -

 5 years ago
source link: https://www.sklinux.com/posts/k8s/istio%E4%B9%8Btls%E7%BD%91%E5%85%B3/?
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

在istio中部署tls网关

Mon Jun 10, 2019

300 Words|Read in about 2 Min
Tags:

在istio中部署进入https流量网关，并且支持多虚拟主机域名以及自己定义上传证书。

1.在istio的项目官网中有这样的一段：

the Istio default ingress gateway will not work out of the box because it is only preconfigured to support one secure host. You’ll need to first configure and redeploy the ingress gateway server with another secret, before you can use it to handle a second host.
https://doc.istio.cn/en/docs/tasks/traffic-management/secure-ingress/

需要重新部署 istio-ingressgateway 服务，示范如下:

$ helm template install/kubernetes/helm/istio/ --name istio-ingressgateway --namespace istio-system -x charts/gateways/templates/deployment.yaml --set gateways.istio-egressgateway.enabled=false \
--set gateways.istio-ingressgateway.secretVolumes[0].name=ingressgateway-certs \
--set gateways.istio-ingressgateway.secretVolumes[0].secretName=istio-ingressgateway-certs \
--set gateways.istio-ingressgateway.secretVolumes[0].mountPath=/etc/istio/ingressgateway-certs \
--set gateways.istio-ingressgateway.secretVolumes[1].name=ingressgateway-ca-certs \
--set gateways.istio-ingressgateway.secretVolumes[1].secretName=istio-ingressgateway-ca-certs \
--set gateways.istio-ingressgateway.secretVolumes[1].mountPath=/etc/istio/ingressgateway-ca-certs \
--set gateways.istio-ingressgateway.secretVolumes[2].name=ingressgateway-bookinfo-certs \  #新增
--set gateways.istio-ingressgateway.secretVolumes[2].secretName=istio-ingressgateway-bookinfo-certs \ #新增
--set gateways.istio-ingressgateway.secretVolumes[2].mountPath=/etc/istio/ingressgateway-bookinfo-certs > \ #新增
$HOME/istio-ingressgateway.yaml

2.然后应用修改

kubectl apply -f $HOME/istio-ingressgateway.yaml

3.创建证书以及校验pod中是否存在新增服务的证书路径

#其中ngressgateway-bookinfo-certs 和上面新增的gateways.istio-ingressgateway.secretVolumes[2].name保持一致

kubectl create -n istio-system secret tls ingressgateway-bookinfo-certs --key server.key --cert server.crt

kubectl exec -it -n istio-system $(kubectl -n istio-system get pods -l istio=ingressgateway -o jsonpath='{.items[0].metadata.name}') -- ls -al /etc/istio/ingressgateway-bookinfo-certs

可以看见tls.crt 和 tls.key 在ingressgateway-bookinfo-certs路径下有这样的两个文件。分别是证书和私钥。

4.在服务中发布tls

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: mygateway
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway
  servers:
    ...
  - port:
      number: 443
      name: https-bookinfo
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-bookinfo-certs/tls.crt #指定自定义证书
      privateKey: /etc/istio/ingressgateway-bookinfo-certs/tls.key  #指定 自定义私钥
    hosts:
    - "bookinfo.com"

5.第2种方法部署单网关多虚拟主机支持ssl的方法
问题：官网说明中讲一个 Gateway 是无法处理两个域名的https的。
a.tls secret 只能包含一个证书对。
b.泛域名证书可以完成这一任务，但因为 Envoy 的限制，这里无法同时使用两个泛域名。
c.使用Generic 类型的证书。

删除缘由
kubectl delete secret istio-ingressgateway-certs \
    -n istio-system

kubectl create secret generic  \
    istio-ingressgateway-certs \
    -n istio-system \
    --from-file=a-crt.pem \
    --from-file=a-key.pem \
    --from-file=b-crt.pem \
    --from-file=b-key.pem

d.应用gw。

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: service-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https-a
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/a-crt.pem
      privateKey: /etc/istio/ingressgateway-certs/a-key.pem
    hosts:
    - "a.sklinux.com"
  - port:
      number: 443
      name: https-b
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/b-crt.pem
      privateKey: /etc/istio/ingressgateway-certs/b-key.pem
    hosts:
    - "b.sklinux.com"

这样就完成了2个虚拟主机并配置上了相应的SSL证书。
在本地没有负载均衡的k8s集群中，我们一般使用nodeport的方式进行发布Istio的ingress GW。
所以31380=80，31390=443。我们还需要在本地建立一个固定的Haproxy到这2个端口。
haproxy->nodeport的架构。


report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK