istio-处理k8s服务的ExternalName不正确(bug)-CSDN博客

Istio 1.0.5版本中存在处理k8s ExternalName服务不当的Bug，导致网格内服务访问外部服务失败，返回503错误。本文详细介绍了该问题的复现步骤、根本原因及解决方案，包括修改ServiceEntry和VirtualService配置。

istio-1.0.5 k8s服务的ExternalName处理不正确(bug)

在k8s中创建一个外部服务：

$ cat ./nginx-ext-svc.yaml 
apiVersion: v1
kind: Service
metadata:
  name: nginx-ext-svc
  namespace: default
spec:
  externalName: 192.168.5.86 #（也可以使用域名的方式xxx.test.com）
  type: ExternalName

$ kubectl create -f ./nginx-ext-svc.yaml

$ kubectl get svc
NAME            TYPE           CLUSTER-IP   EXTERNAL-IP    PORT(S)   AGE
nginx-ext-svc   ExternalName   <none>       192.168.5.86   <none>    5s

允许网格内的服务可以访问外部服务(ServiceEntry)：

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: nginx-se
spec:
  hosts:
  - 192.168.5.86
  ports:
  - number: 9999
    name: http
    protocol: HTTP
  resolution: DNS

创建gateway和virtualsrvice:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: nginx-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "h1.example.com"
---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx
spec:
  hosts:
  - "h1.example.com"
  gateways:
  - nginx-gateway
  http:
  - match:
    - uri:
        exact: /
    route:
    - destination:
        host: nginx-ext-svc
        port:
          number: 9999

测试访问：

$ curl http://h1.example.com/

查看 istio-gateway日志，返回503错误：

$ kubectl logs istio-ingressgateway-7477597868-5xkdv -n istio-system

[2019-01-21T13:25:22.459Z] "GET /HTTP/1.1" 503 NR 0 0 0 - "172.30.62.1" "curl/7.54.0" "5bce2daf-28b3-493d-bb53-64bae608cf85" "h1.example.com" "-" - - 172.30.62.4:80 172.30.62.1:55954

原因：上面的VirtualService 描述的hosts: nginx-ext-svc ，在目前的版本，存在bug;

解决方法：

1. 删除外部服务：nginx-ext-svc

2. 替换ServiceEntry为(可选)：

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: nginx-se
spec:
  hosts:
  - 192.168.5.86
  endpoints:
  - address: 192.168.5.86
  ports:
  - number: 9999
    name: http
    protocol: HTTP
  location: MESH_INTERNAL
  resolution: DNS

3. 替换VirtualEntry为：

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx
spec:
  hosts:
  - "h1.example.com"
  gateways:
  - nginx-gateway
  http:
  - match:
    - uri:
        exact: /
    route:
    - destination:
        host: 192.168.5.86
        port:
          number: 9999

参考：

istio1.1 将修正这个错误：https://github.com/istio/istio/issues/9950