Istio 게이트웨이가 HTTPS를 통해 연결하지 못함

Question

Istio를 사용하는 GKE 클러스터의 배포는 HTTP. 하지만 다음 리소스로 cert-manager로 보안을 시도했을 때 HTTPS 요청이 curl과 같은 상태로 실패합니다.

`Immediate connect fail for 64:ff9b::2247:fd8a: Network is unreachable
* connect to 34.71.253.138 port 443 failed: Connection refused`.

HTTPS에서도 작동하도록하려면 어떻게해야합니까.

다음 구성의 ClusterIssuer

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
  namespace: istio-system
spec:
  acme:
    # The ACME server URL
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: [email protected]
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
    # ACME DNS-01 provider configurations
    - dns01:
        # Google Cloud DNS
        clouddns:
          # Secret from the google service account key
          serviceAccountSecretRef:
            name: cert-manager-credentials
            key: gcp-dns-admin.json
          # The project in which to update the DNS zone
          project: iprocure-server

Ready : True 상태로 인증서를 만든 이와 같은 인증서 구성

apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
  name: letsencrypt-staging
  namespace: istio-system
spec:
  secretName: letsencrypt-staging
  commonName: "*.iprocure.tk"
  dnsNames:
  - '*.iprocure.tk'
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer

그리고 마지막으로 게이트웨이

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: iprocure-gateway
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
    tls:
      httpsRedirect: false
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "*"
    tls:
      mode: SIMPLE
      credentialName: letsencrypt-staging

만약 내가한다면, kubectl describe certificate -n istio-system

    Name:         letsencrypt-staging
    Namespace:    istio-system
    Labels:       <none>
    Annotations:  <none>
    API Version:  cert-manager.io/v1
    Kind:         Certificate
    Metadata:
    Creation Timestamp:  2020-10-13T13:32:37Z
    Generation:          1
    Resource Version:    28030994
    Self Link:           /apis/cert-manager.io/v1/namespaces/istio-system/certificates/letsencrypt-staging
    UID:                 ad838d28-5349-4aaa-a618-cc3bfc316e6e
    Spec:
    Common Name:  *.iprocure.tk
    Dns Names:
        *.iprocure.tk
    Issuer Ref:
        Kind:       ClusterIssuer
        Name:       letsencrypt-staging-clusterissuer
    Secret Name:  letsencrypt-staging-cert-secret
    Status:
    Conditions:
        Last Transition Time:  2020-10-13T13:35:05Z
        Message:               Certificate is up to date and has not expired
        Reason:                Ready
        Status:                True
        Type:                  Ready
    Not After:               2021-01-11T12:35:05Z
    Not Before:              2020-10-13T12:35:05Z
    Renewal Time:            2020-12-12T12:35:05Z
    Revision:                1
    Events:                    <none>

실행 kubectl get certificates -o wide -n istio-system, 수익률

NAME                  READY   SECRET                            ISSUER                              STATUS                                          AGE
letsencrypt-staging   True    letsencrypt-staging-cert-secret   letsencrypt-staging-clusterissuer   Certificate is up to date and has not expired   17h

Answer 1

발행물

이전 버전에서 istio와 함께 cert-menager를 사용하려는 경우 활성화해야하는 요구 사항 때문에 https가 작동하지 않는다고 가정합니다 .

해결책

@Yunus Einsteinium이 의견에서 언급했듯이

저를 올바른 방향으로 인도 해주셔서 감사합니다. GKE가 아닌 OSS Istio를 사용하는 것이 좋습니다. HTTPS가 작동하도록 관리했습니다!

따라서 여기서 해결책 은 이전 istio gke 애드온 대신 istioctl과 함께 설치된 OOS istio 를 사용하는 것입니다.