Istio Gateway Gagal Terhubung Melalui HTTPS

Question

Deployment dalam cluster GKE dengan Istio berfungsi dengan benar melalui HTTP. Tetapi ketika saya mencoba mengamankannya dengan manajer-sertifikat dengan sumber daya berikut, permintaan HTTPS gagal dalam status seperti di curl

`Immediate connect fail for 64:ff9b::2247:fd8a: Network is unreachable
* connect to 34.71.253.138 port 443 failed: Connection refused`.

Apa yang harus saya lakukan untuk membuatnya berfungsi dengan HTTPS juga.

ClusterIssuer dengan konfigurasi berikut

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
  namespace: istio-system
spec:
  acme:
    # The ACME server URL
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: [email protected]
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
    # ACME DNS-01 provider configurations
    - dns01:
        # Google Cloud DNS
        clouddns:
          # Secret from the google service account key
          serviceAccountSecretRef:
            name: cert-manager-credentials
            key: gcp-dns-admin.json
          # The project in which to update the DNS zone
          project: iprocure-server

Konfigurasi sertifikat seperti itu, yang membuat sertifikat dalam status Siap: Benar

apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
  name: letsencrypt-staging
  namespace: istio-system
spec:
  secretName: letsencrypt-staging
  commonName: "*.iprocure.tk"
  dnsNames:
  - '*.iprocure.tk'
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer

Dan terakhir sebuah Gateway

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: iprocure-gateway
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
    tls:
      httpsRedirect: false
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "*"
    tls:
      mode: SIMPLE
      credentialName: letsencrypt-staging

Bila saya lakukan, kubectl describe certificate -n istio-system

    Name:         letsencrypt-staging
    Namespace:    istio-system
    Labels:       <none>
    Annotations:  <none>
    API Version:  cert-manager.io/v1
    Kind:         Certificate
    Metadata:
    Creation Timestamp:  2020-10-13T13:32:37Z
    Generation:          1
    Resource Version:    28030994
    Self Link:           /apis/cert-manager.io/v1/namespaces/istio-system/certificates/letsencrypt-staging
    UID:                 ad838d28-5349-4aaa-a618-cc3bfc316e6e
    Spec:
    Common Name:  *.iprocure.tk
    Dns Names:
        *.iprocure.tk
    Issuer Ref:
        Kind:       ClusterIssuer
        Name:       letsencrypt-staging-clusterissuer
    Secret Name:  letsencrypt-staging-cert-secret
    Status:
    Conditions:
        Last Transition Time:  2020-10-13T13:35:05Z
        Message:               Certificate is up to date and has not expired
        Reason:                Ready
        Status:                True
        Type:                  Ready
    Not After:               2021-01-11T12:35:05Z
    Not Before:              2020-10-13T12:35:05Z
    Renewal Time:            2020-12-12T12:35:05Z
    Revision:                1
    Events:                    <none>

Berlari kubectl get certificates -o wide -n istio-system, hasil

NAME                  READY   SECRET                            ISSUER                              STATUS                                          AGE
letsencrypt-staging   True    letsencrypt-staging-cert-secret   letsencrypt-staging-clusterissuer   Certificate is up to date and has not expired   17h

Answer 1

Isu

Saya berasumsi bahwa https tidak berfungsi karena persyaratan yang harus diaktifkan jika Anda ingin menggunakan cert-menager dengan istio di versi yang lebih lama.

Larutan

Seperti yang disebutkan @Yunus Einsteinium di komentar

Terima kasih telah membimbing saya ke arah yang benar. Menggunakan OSS Istio, bukan GKE, adalah caranya! Saya berhasil membuat HTTPS berfungsi!

Jadi solusinya di sini adalah menggunakan OOS istio yang diinstal dengan istioctl alih-alih addon istio gke yang lebih lama.