[root@master istio-1.1.5]# kubectl apply -f samples/httpbin/httpbin.yaml service/httpbin created deployment.extensions/httpbin created [root@master istio-1.1.5]# [root@master istio-1.1.5]# kubectl get svc NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE details ClusterIP 10.106.209.133 <none> 9080/TCP 23h httpbin ClusterIP 10.104.20.107 <none> 8000/TCP 9s kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 14d productpage ClusterIP 10.96.27.39 <none> 9080/TCP 23h ratings ClusterIP 10.109.45.236 <none> 9080/TCP 23h reviews ClusterIP 10.102.249.50 <none> 9080/TCP 23h [root@master istio-1.1.5]# kubectl get pod -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES details-v1-79c6548b59-d8448 1/1 Running 0 23h 10.244.3.186 node02 <none> <none> httpbin-5446f4d9b4-jtnzw 1/1 Running 0 3m38s 10.244.1.207 node01 <none> <none> ratings-v1-7665579b75-jjvv7 1/1 Running 0 23h 10.244.1.203 node01 <none> <none> reviews-v1-67446f7d9b-hrhbj 1/1 Running 0 23h 10.244.1.204 node01 <none> <none> reviews-v2-6bc7b4f678-vhjwh 1/1 Running 0 23h 10.244.1.206 node01 <none> <none> reviews-v3-59b5b6948-sxxhj 1/1 Running 0 23h 10.244.1.205 node01 <none> <none> [root@master istio-1.1.5]# curl 10.104.20.107:8000/headers { "headers": { "Accept": "*/*", "Host": "10.104.20.107:8000", "User-Agent": "curl/7.29.0" } } //只有集群内部可以访问，外部不行 //创建网关，让集群外部也可以访问 [root@master istio-1.1.5]# kubectl apply -f samples/httpbin/httpbin-gateway.yaml gateway.networking.istio.io/httpbin-gateway created virtualservice.networking.istio.io/httpbin created [root@master istio-1.1.5]# kubectl get gateway NAME AGE bookinfo-gateway 23h httpbin-gateway 3m15s [root@master istio-1.1.5]# kubectl get virtualservice NAME GATEWAYS HOSTS AGE bookinfo [bookinfo-gateway] [*] 23h httpbin [httpbin-gateway] [*] 5m22s reviews [reviews] 18h
生成证书
https://istio.io/docs/tasks/traffic-management/secure-ingress/#generate-clinet-and-server-certificates-and-keys [root@master istio-1.1.5]# wget https://github.com/nicholasjackson/mtls-go-example/archive/master.zip [root@master istio-1.1.5]# unzip master.zip Archive: master.zip 85f7453487e47c018961ca11f3526fd3e5d888d9 creating: mtls-go-example-master/ inflating: mtls-go-example-master/LICENSE inflating: mtls-go-example-master/README.md inflating: mtls-go-example-master/generate.sh inflating: mtls-go-example-master/intermediate_openssl.cnf inflating: mtls-go-example-master/main.go inflating: mtls-go-example-master/openssl.cnf [root@master istio-1.1.5]# ls bin install istio.VERSION LICENSE master.zip mtls-go-example-master README.md samples tools [root@master istio-1.1.5]# cd mtls-go-example-master/ [root@master mtls-go-example-master]# ls generate.sh intermediate_openssl.cnf LICENSE main.go openssl.cnf README.md [root@master mtls-go-example-master]# ./generate.sh httpbin.example.com 123456 //出现提示时，选择y所有问题。该命令将产生四个目录：1_root， 2_intermediate，3_application，和4_client包含您在下面的程序使用客户端和服务器证书。 [root@master mtls-go-example-master]# ls 1_root 2_intermediate 3_application 4_client generate.sh intermediate_openssl.cnf LICENSE main.go openssl.cnf README.md //将证书移动到名为的目录中httpbin.example.com [root@master mtls-go-example-master]# mkdir ../httpbin.example.com && mv 1_root 2_intermediate 3_application 4_client ../httpbin.example.com [root@master mtls-go-example-master]# ls ../ bin httpbin.example.com install istio.VERSION LICENSE master.zip mtls-go-example-master README.md samples tools
创建证书
[root@master istio-1.1.5]# kubectl create -n istio-system secret tls istio-ingressgateway-certs --key httpbin.example.com/3_application/private/httpbin.example.com.key.pem --cert httpbin.example.com/3_application/certs/httpbin.example.com.cert.pem secret/istio-ingressgateway-certs created //验证tls.crt并tls.key已安装在入口网关pod中： [root@master istio-1.1.5]# kubectl exec -it -n istio-system $(kubectl -n istio-system get pods -l istio=ingressgateway -o jsonpath='{.items[0].metadata.name}') -- ls -al /etc/istio/ingressgateway-certs total 4 drwxrwxrwt 3 root root 120 May 25 09:34 . drwxr-xr-x 1 root root 4096 May 24 08:12 .. drwxr-xr-x 2 root root 80 May 25 09:34 ..2019_05_25_09_34_54.605006539 lrwxrwxrwx 1 root root 31 May 25 09:34 ..data -> ..2019_05_25_09_34_54.605006539 lrwxrwxrwx 1 root root 14 May 25 09:34 tls.crt -> ..data/tls.crt lrwxrwxrwx 1 root root 14 May 25 09:34 tls.key -> ..data/tls.key //删掉之前创建的httpbin-gateway [root@master istio-1.1.5]# kubectl delete -f samples/httpbin/httpbin-gateway.yaml gateway.networking.istio.io "httpbin-gateway" deleted virtualservice.networking.istio.io "httpbin" deleted //创建新的 [root@master istio-1.1.5]# vim samples/httpbin/httpbin-gateway-https.yaml apiVersion: networking.istio.io/v1alpha3 kind: Gateway metadata: name: httpbin-gateway spec: selector: istio: ingressgateway # use istio default ingress gateway servers: - port: number: 443 name: https protocol: HTTPS tls: mode: SIMPLE serverCertificate: /etc/istio/ingressgateway-certs/tls.crt privateKey: /etc/istio/ingressgateway-certs/tls.key hosts: - "httpbin.example.com" --- apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: httpbin spec: hosts: - "httpbin.example.com" gateways: - httpbin-gateway http: - match: - uri: prefix: /status - uri: prefix: /delay route: - destination: port: number: 8000 host: httpbin
[root@master istio-1.1.5]# kubectl apply -f samples/httpbin/httpbin-gateway-https.yaml gateway.networking.istio.io/httpbin-gateway created virtualservice.networking.istio.io/httpbin created [root@master istio-1.1.5]# kubectl get gateway NAME AGE bookinfo-gateway 24h httpbin-gateway 58s [root@master istio-1.1.5]# kubectl get virtualservice NAME GATEWAYS HOSTS AGE bookinfo [bookinfo-gateway] [*] 24h httpbin [httpbin-gateway] [httpbin.example.com] 70s reviews [reviews] 20h [root@master istio-1.1.5]# curl -v -HHost:httpbin.example.com --resolve httpbin.example.com:31390:10.0.1.133 --cacert httpbin.example.com/2_intermediate/certs/ca-chain.cert.pem https://httpbin.example.com:31390/status/418 * Added httpbin.example.com:31390:10.0.1.133 to DNS cache * About to connect() to httpbin.example.com port 31390 (#0) * Trying 10.0.1.133... * Connected to httpbin.example.com (10.0.1.133) port 31390 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: httpbin.example.com/2_intermediate/certs/ca-chain.cert.pem CApath: none * SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 * Server certificate: * subject: CN=httpbin.example.com,O=Dis,L=Springfield,ST=Denial,C=US * start date: May 25 09:24:18 2019 GMT * expire date: Jun 03 09:24:18 2020 GMT * common name: httpbin.example.com * issuer: CN=httpbin.example.com,O=Dis,ST=Denial,C=US > GET /status/418 HTTP/1.1 > User-Agent: curl/7.29.0 > Accept: */* > Host:httpbin.example.com > < HTTP/1.1 418 Unknown < server: istio-envoy < date: Sat, 25 May 2019 10:12:24 GMT < x-more-info: http://tools.ietf.org/html/rfc2324 < access-control-allow-origin: * < access-control-allow-credentials: true < content-length: 135 < x-envoy-upstream-service-time: 2 < -=[ teapot ]=- _...._ .' _ _ `. | ."` ^ `". _, \_;`"---"`|// | ;/ \_ _/ `"""` * Connection #0 to host httpbin.example.com left intact [root@master istio-1.1.5]#