gateway资源详解

素颜马尾好姑娘i 2022-12-02 13:49 40阅读 0赞

**istio课程发布：https://edu.csdn.net/course/detail/29911  
这是我目前见过最详细，最有深度的istio课程**

# 学习目标 #

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70_pic_center]

# 什么是gateway #

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70_pic_center 1]

在Kubernetes环境中，Kubernetes Ingress用于配置需要在集群外部公开的服务。但是在Istio服务网格中，更好的方法是使用新的配置模型，即Istio Gateway。Gateway允许将Istio流量管理的功能应用于进入集群的流量。

gateway 分为两种，分别是ingress-gateway和egress-gateway，分别用来处理入口流量和出口流量。gateway本质也是一个envoy pod。

# 资源详解 #

## selector ##

1.7.0/gateway/gateway-01.yaml

## servers ##

### hosts ###

#### 所有域名： ####

1.7.0/gateway/gateway-server-hosts-star.yaml

#### 具体域名： ####

1.7.0/gateway/gateway-server-hosts-bookinfo-com.yaml

#### 多个域名： ####

1.7.0/gateway/gateway-server-hosts-multi.yaml

#### 混合域名 ####

1.7.0/gateway/gateway-server-hosts-mix.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 80
          name: http
          protocol: HTTP
        hosts:
        - "*.com"
    ---
    apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: bookinfo
    spec:
      hosts:
      - "bookinfo.com"
      gateways:
      - bookinfo-gateway
      http:
      - match:
        - uri:
            exact: /productpage
        - uri:
            prefix: /static
        - uri:
            exact: /login
        - uri:
            exact: /logout
        - uri:
            prefix: /api/v1/products
        route:
        - destination:
            host: productpage.istio.svc.cluster.local
            port:
              number: 9080

### name ###

1.7.0/gateway/gateway-server-name.yaml

### port ###

<table> 
 <thead> 
  <tr> 
   <th>Field</th> 
   <th>Type</th> 
   <th>Description</th> 
   <th>Required</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>number</td> 
   <td>uint32</td> 
   <td>一个有效的端口号</td> 
   <td>是</td> 
  </tr> 
  <tr> 
   <td>protocol</td> 
   <td>string</td> 
   <td>所使用的协议，支持HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS.</td> 
   <td>是</td> 
  </tr> 
  <tr> 
   <td>name</td> 
   <td>string</td> 
   <td>给端口分配一个名称</td> 
   <td>是</td> 
  </tr> 
 </tbody> 
</table>

istio支持的协议：

*  `grpc`
 *  `grpc-web`
 *  `http`
 *  `http2`
 *  `https`
 *  `mongo`
 *  `mysql`\*
 *  `redis`\*
 *  `tcp`
 *  `tls`
 *  `udp`

\* These protocols are disabled by default to avoid accidentally enabling experimental features. To enable them, configure the corresponding Pilot [environment variables][].

#### http ####

1部署gateway

1.7.0/gateway/gateway-01.yaml

2部署vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: bookinfo
    spec:
      hosts:
      - "*"
      gateways:
      - bookinfo-gateway
      http:
      - match:
        - uri:
            exact: /productpage
        - uri:
            prefix: /static
        - uri:
            exact: /login
        - uri:
            exact: /logout
        - uri:
            prefix: /api/v1/products
        route:
        - destination:
            host: productpage.istio.svc.cluster.local
            port:
              number: 9080

3访问浏览器

#### https ####

1创建secret

kubectl create -n istio-system secret tls istio-ingressgateway-certs --key ./cert.key --cert=./cert.crt

kubectl exec deploy/istio-ingressgateway -n istio-system – ls /etc/istio/ingressgateway-certs

2创建gateway

1.7.0/gateway/gateway-https.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 443
          name: https
          protocol: HTTPS
        hosts:
        - "bookinfo.demo"
        - "ratings.demo"
        tls:
          mode: SIMPLE
          serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
          privateKey: /etc/istio/ingressgateway-certs/tls.key

3创建vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

4访问浏览器

#### tcp ####

1创建gateway

1.7.0/gateway/gateway-tcp.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: tcp-echo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 31400
          name: tcp
          protocol: TCP
        hosts:
        - "*"

2创建vs dr

1.7.0/gateway/protocol/vs-dr-tcp-echo.yaml

kind: DestinationRule
    metadata:
      name: tcp-echo-destination
    spec:
      host: tcp-echo
      subsets:
      - name: v1
        labels:
          version: v1
      - name: v2
        labels:
          version: v2
    ---
    apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: tcp-echo
    spec:
      hosts:
      - "*"
      gateways:
      - tcp-echo-gateway
      tcp:
      - match:
        - port: 31400
        route:
        - destination:
            host: tcp-echo
            port:
              number: 9000
            subset: v1

3添加端口

kubectl edit svc istio-ingressgateway -n istio-system

4测试

telnet 10.68.12.164 31400

#### http2 ####

1创建gateway

1.7.0/gateway/gateway-http2.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 15444
          name: http2
          protocol: HTTP2
          targetPort: 15444
        hosts:
        - "*"

2部署vs

1.7.0/virtaulservice/ vs-bookinfo-hosts-star.yaml

kubectl apply -f vs-bookinfo-hosts-star.yaml -n istio

3访问浏览器

#### mongo ####

1部署gateway

1.7.0/gateway/gateway-mongo.yaml

apiVersion: networking.istio.io/v1beta1
    kind: Gateway
    metadata:
      name: mongo
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 27017
          name: mongo
          protocol: MONGO
        hosts:
        - "*"

2部署vs

1.7.0/gateway/protocol/vs-mongodb.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: mongo
    spec:
      hosts:
      - "*"
      gateways:
      - mongo
      tcp:
      - match:
        - port: 27017
        route:
        - destination:
            host: mongodb.istio.svc.cluster.local
            port:
              number: 27017

3添加端口

kubectl edit svc istio-ingressgateway -n istio-system

4测试

#### tls ####

1创建gateway

1.7.0/gateway/gateway-tls.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 15443
          name: tls
          protocol: TLS
        hosts:
        - "bookinfo.com"
        tls:
          mode: SIMPLE
          serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
          privateKey: /etc/istio/ingressgateway-certs/tls.key

2创建vs

1.7.0/gateway/protocol/vs-tls-protocol-echo.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: tcp-echo
    spec:
      hosts:
      - "*"
      gateways:
      - bookinfo-gateway
      tcp:
      - match:
        - port: 15443
        route:
        - destination:
            host: tcp-echo
            port:
              number: 9000

3修改/etc/hosts

10.68.12.164 bookinfo.com

4测试

openssl s\_client -connect bookinfo.com:15443 -servername bookinfo.com

#### mysql ####

1创建gateway

1.7.0/gateway/gateway-mysql.yaml

apiVersion: networking.istio.io/v1beta1
    kind: Gateway
    metadata:
      name: mysql
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 3306
          name: mysql
          protocol: MYSQL
        hosts:
        - "*"
    ~

2创建vs

1.7.0/gateway/protocol/vs-mysql.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: mysql
    spec:
      hosts:
      - "*"
      gateways:
      - mysql
      tcp:
      - match:
        - port: 3306
        route:
        - destination:
            host: mysqldb.istio.svc.cluster.local
            port:
              number: 3306

3新增端口

kubectl edit svc istio-ingressgateway -nistio-system

4istio启用mysql协议

kubectl set env deploy istiod -n istio-system PILOT\_ENABLE\_MYSQL\_FILTER=true

5测试

mysql -h 192.168.198.154 --port 37031 -uroot -p

#### redis ####

1创建gateway

1.7.0/gateway/gateway-redis.yaml

apiVersion: networking.istio.io/v1beta1
    kind: Gateway
    metadata:
      name: redis
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 6379
          name: redis
          protocol: REDIS
        hosts:
        - "*"
    ~

2部署redis

1.7.0/gateway/protocol/redis-deploy.yaml

apiVersion: apps/v1
    kind: Deployment
    metadata:
      labels:
        app: bcia
        ms-name: redis
      name: bcia-redis
    spec:
      replicas: 1
      selector:
        matchLabels:
          app: bcia
          ms-name: redis
      template:
        metadata:
          labels:
            app: bcia
            ms-name: redis
          name: bcia-redis
        spec:
         containers:
         - name: bcia-redis
           image: redis:5.0.8
           command:
             - "redis-server"
    ---
    apiVersion: v1
    kind: Service
    metadata:
      name: redis
    spec:
      selector:
        app: bcia
        ms-name: redis
      ports:
      - port: 6379
        targetPort: 6379

3创建vs

1.7.0/gateway/protocol/vs-redis.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: redis
    spec:
      hosts:
      - "*"
      gateways:
      - redis
      tcp:
      - match:
        - port: 6379
        route:
        - destination:
            host: redis.istio.svc.cluster.local
            port:
              number: 6379

4新增端口

kubectl edit svc istio-ingressgateway -nistio-system

5istio启用redis协议

kubectl set env deploy istiod -n istio-system PILOT\_ENABLE\_REDIS\_FILTER=true

6测试

redis-cli -h 192.168.198.154 -p 29525

####  ####

### tls ###

<table> 
 <thead> 
  <tr> 
   <th>Field</th> 
   <th>Type</th> 
   <th>Description</th> 
   <th>Required</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>httpsRedirect</td> 
   <td>bool</td> 
   <td>是否要做 HTTP 重定向</td> 
   <td>否</td> 
  </tr> 
  <tr> 
   <td>mode</td> 
   <td>TLSmode</td> 
   <td>在配置的外部端口上使用 TLS 服务时，可以取 PASSTHROUGH、SIMPLE、MUTUAL、AUTO_PASSTHROUGH 这 4 种模式</td> 
   <td>否</td> 
  </tr> 
  <tr> 
   <td>serverCertificate</td> 
   <td>string</td> 
   <td>服务端证书的路径。当模式是 SIMPLE 和 MUTUAL 时必须指定</td> 
   <td>否</td> 
  </tr> 
  <tr> 
   <td>privateKey</td> 
   <td>string</td> 
   <td>服务端密钥的路径。当模式是 SIMPLE 和 MUTUAL 时必须指定</td> 
   <td>否</td> 
  </tr> 
  <tr> 
   <td>caCertificates</td> 
   <td>string</td> 
   <td>CA 证书路径。当模式是 MUTUAL 时指定</td> 
   <td>否</td> 
  </tr> 
  <tr> 
   <td>credentialName</td> 
   <td>string</td> 
   <td>用于唯一标识服务端证书和秘钥。Gateway 使用 credentialName从远端的凭证存储中获取证书和秘钥，而不是使用 Mount 的文件</td> 
   <td>否</td> 
  </tr> 
  <tr> 
   <td>subjectAltNames</td> 
   <td>string[]</td> 
   <td>SAN 列表，SubjectAltName 允许一个证书指定多个域名</td> 
   <td>否</td> 
  </tr> 
  <tr> 
   <td>verifyCertificateSpki</td> 
   <td>string[]</td> 
   <td>授权客户端证书的SKPI的base64编码的SHA-256哈希值的可选列表</td> 
   <td>否</td> 
  </tr> 
  <tr> 
   <td>verifyCertificateHash</td> 
   <td>string[]</td> 
   <td>授权客户端证书的十六进制编码SHA-256哈希值的可选列表</td> 
   <td>否</td> 
  </tr> 
  <tr> 
   <td>minProtocolVersion</td> 
   <td>TLSProtocol</td> 
   <td>TLS 协议的最小版本</td> 
   <td>否</td> 
  </tr> 
  <tr> 
   <td>maxProtocolVersion</td> 
   <td>TLSProtocol</td> 
   <td>TLS 协议的最大版本</td> 
   <td>否</td> 
  </tr> 
  <tr> 
   <td>cipherSuites</td> 
   <td>string[]</td> 
   <td>指定的加密套件，默认使用 Envoy 支持的加密套件</td> 
   <td>否</td> 
  </tr> 
 </tbody> 
</table>

#### httpsRedirect ####

1.7.0/gateway/tls/gw-httpsRedirect.yaml

apiVersion: networking.istio.io/v1beta1
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 80
          name: http
          protocol: HTTP
        hosts:
        - "*"
        tls:
          httpsRedirect: true
      - port:
          number: 443
          name: https-443
          protocol: HTTPS
        hosts:
        - "*"
        tls:
          mode: SIMPLE
          serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
          privateKey: /etc/istio/ingressgateway-certs/tls.key

wget http://bookinfo.com:80/productpage --no-check-certificate

测试访问浏览器

#### mode ####

<table> 
 <thead> 
  <tr> 
   <th>Name</th> 
   <th>Description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>PASSTHROUGH</td> 
   <td>客户端提供的SNI字符串将用作VirtualService TLS路由中的匹配条件，以根据服务注册表确定目标服务</td> 
  </tr> 
  <tr> 
   <td>SIMPLE</td> 
   <td>使用标准TLS语义的安全连接</td> 
  </tr> 
  <tr> 
   <td>MUTUAL</td> 
   <td>通过提供服务器证书进行身份验证，使用双边TLS来保护与下游的连接</td> 
  </tr> 
  <tr> 
   <td>AUTO_PASSTHROUGH</td> 
   <td>与直通模式相似，不同之处在于具有此TLS模式的服务器不需要关联的VirtualService即可从SNI值映射到注册表中的服务。目标详细信息（例如服务/子集/端口）被编码在SNI值中。代理将转发到SNI值指定的上游（Envoy）群集（一组端点）。</td> 
  </tr> 
  <tr> 
   <td>ISTIO_MUTUAL</td> 
   <td>通过提供用于身份验证的服务器证书，使用相互TLS使用来自下游的安全连接</td> 
  </tr> 
 </tbody> 
</table>

##### PASSTHROUGH #####

1创建证书

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj ‘/O=example Inc./CN=example.com’ -keyout example.com.key -out example.com.crt

openssl req -out nginx.example.com.csr -newkey rsa:2048 -nodes -keyout nginx.example.com.key -subj “/CN=nginx.example.com/O=some organization”

openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set\_serial 0 -in nginx.example.com.csr -out nginx.example.com.crt

2创建secret

kubectl create secret tls nginx-server-certs --key nginx.example.com.key --cert nginx.example.com.crt -n istio

3创建nginx配置文件

events {
    }
    
    http {
      log_format main '$remote_addr - $remote_user [$time_local]  $status '
      '"$request" $body_bytes_sent "$http_referer" '
      '"$http_user_agent" "$http_x_forwarded_for"';
      access_log /var/log/nginx/access.log main;
      error_log  /var/log/nginx/error.log;
    
      server {
        listen 443 ssl;
    
        root /usr/share/nginx/html;
        index index.html;
    
        server_name nginx.example.com;
        ssl_certificate /etc/nginx-server-certs/tls.crt;
        ssl_certificate_key /etc/nginx-server-certs/tls.key;
      }
    }

kubectl create configmap nginx-configmap --from-file=nginx.conf=./nginx.conf -nistio

4创建deploy

apiVersion: v1
    kind: Service
    metadata:
      name: my-nginx
      labels:
        run: my-nginx
    spec:
      ports:
      - port: 443
        protocol: TCP
      selector:
        run: my-nginx
    ---
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: my-nginx
    spec:
      selector:
        matchLabels:
          run: my-nginx
      replicas: 1
      template:
        metadata:
          labels:
            run: my-nginx
        spec:
          containers:
          - name: my-nginx
            image: nginx
            ports:
            - containerPort: 443
            volumeMounts:
            - name: nginx-config
              mountPath: /etc/nginx
              readOnly: true
            - name: nginx-server-certs
              mountPath: /etc/nginx-server-certs
              readOnly: true
          volumes:
          - name: nginx-config
            configMap:
              name: nginx-configmap
          - name: nginx-server-certs
            secret:
              secretName: nginx-server-certs

5创建gateway

apiVersion: networking.istio.io/v1beta1
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 443
          name: https-443
          protocol: HTTPS
        hosts:
        - "nginx.example.com"
        tls:
          mode: PASSTHROUGH

6创建vs

apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: nginx
    spec:
      hosts:
      - nginx.example.com
      gateways:
      - bookinfo-gateway
      tls:
      - match:
        - port: 443
          sniHosts:
          - nginx.example.com
        route:
        - destination:
            host: my-nginx
            port:
              number: 443

7访问url

https://nginx.example.com:39329/

##### SIMPLE #####

1创建gateway

1.7.0/gateway/tls/simple/gateway-simple.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 443
          name: https
          protocol: HTTPS
        hosts:
        - "bookinfo.demo"
        - "ratings.demo"
        - "nginx.example.com"
        tls:
          mode: SIMPLE
          serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
          privateKey: /etc/istio/ingressgateway-certs/tls.key

2创建vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

3访问 https://bookinfo.demo:39329/productpage

##### MUTUAL #####

1创建证书

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj ‘/O=example Inc./CN=example.com’ -keyout example.com.key -out example.com.crt

openssl req -out bookinfo.example.com.csr -newkey rsa:2048 -nodes -keyout bookinfo.example.com.key -subj “/CN=bookinfo.example.com/O=some organization”

openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set\_serial 0 -in bookinfo.example.com.csr -out bookinfo.example.com.crt

2创建secret

kubectl create -n istio-system secret generic bookinfo-credential --from-file=tls.key=bookinfo.example.com.key --from-file=tls.crt=bookinfo.example.com.crt --from-file=ca.crt=example.com.crt

3创建gateway

1.7.0/gateway/tls/mutual/gateway-mutual.yaml

4创建vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

5生成客户端证书

openssl req -out client.example.com.csr -newkey rsa:2048 -nodes -keyout client.example.com.key -subj “/CN=client.example.com/O=client organization”

openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set\_serial 1 -in client.example.com.csr -out client.example.com.crt

6访问

curl -v -HHost:bookinfo.example.com --resolve “bookinfo.example.com:39329:192.168.198.154” --cacert example.com.crt --cert client.example.com.crt --key client.example.com.key “https://bookinfo.example.com:39329/productpage”

##### AUTO\_PASSTHROUGH #####

http://www.finbit.org/docs/examples/multicluster/split-horizon-eds//eAEFwUEKwCAMBMAX2b37m6IBF2IjboTS13dmZC5VgErGxUCPJth7z-UmzOPJ5kdpG1rOLCM2v3iKdeEH6-4X5Q,

主要用于多k8s集群，单istio控制面

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 443
          name: tls
          protocol: TLS
        tls:
          mode: AUTO_PASSTHROUGH
        hosts:
        - "*.local"

##### ISTIO\_MUTUAL #####

1创建证书

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj ‘/O=example Inc./CN=example.com’ -keyout example.com.key -out example.com.crt

openssl req -out bookinfo.example.com.csr -newkey rsa:2048 -nodes -keyout bookinfo.example.com.key -subj “/CN=bookinfo.example.com/O=some organization”

openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set\_serial 0 -in bookinfo.example.com.csr -out bookinfo.example.com.crt

2创建secret

kubectl create -n istio-system secret generic bookinfo-credential --from-file=tls.key=bookinfo.example.com.key --from-file=tls.crt=bookinfo.example.com.crt --from-file=ca.crt=example.com.crt

3创建gateway

1.7.0/gateway/tls/istio-mutual/gateway-istio-mutual.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 443
          name: https
          protocol: HTTPS
        tls:
          mode: ISTIO_MUTUAL
          credentialName: "bookinfo-credential"
        hosts:
        - "*"

4创建vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

5访问

curl -v -HHost:bookinfo.example.com --resolve “bookinfo.example.com:39329:192.168.198.154” --cacert example.com.crt “https://bookinfo.example.com:39329/productpage”

#### credentialName ####

1创建secret

cd 1.7.0/gateway/certs

kubectl create -n istio-system secret tls bookinfo-secret --key ./cert.key --cert=./cert.crt

2创建gateway

kubectl apply -f gateway-credentialName.yaml -n istio

1.7.0/gateway/tls/gateway-credentialName.yaml

3创建vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

4访问 https://bookinfo.demo:39329/productpage

#### caCertificates ####

1生成证书

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj ‘/O=example Inc./CN=example.com’ -keyout example.com.key -out example.com.crt

openssl req -out bookinfo.example.com.csr -newkey rsa:2048 -nodes -keyout bookinfo.example.com.key -subj “/CN=bookinfo.example.com/O=some organization”

openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set\_serial 0 -in bookinfo.example.com.csr -out bookinfo.example.com.crt

2创建secret

kubectl create -n istio-system secret generic istio-ingressgateway-certs --from-file=tls.key=bookinfo.example.com.key --from-file=tls.crt=bookinfo.example.com.crt --from-file=ca.crt=example.com.crt

检查配置是否生效：

kubectl exec deploy/istio-ingressgateway -n istio-system – ls /etc/istio/ingressgateway-certs

3创建gateway

1.7.0/gateway/tls/gateway-caCertificates.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 443
          name: https
          protocol: HTTPS
        hosts:
        - "*"
        tls:
          mode: MUTUAL
          caCertificates: /etc/istio/ingressgateway-certs/ca.crt
          serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
          privateKey: /etc/istio/ingressgateway-certs/tls.key

4创建vs

1.7.0/virtaulservice/vs-bookinfo-hosts-star.yaml

5生成客户端证书

openssl req -out client.example.com.csr -newkey rsa:2048 -nodes -keyout client.example.com.key -subj “/CN=client.example.com/O=client organization”

openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set\_serial 1 -in client.example.com.csr -out client.example.com.crt

6访问

#### cipherSuites ####

部署gateway

1.7.0/gateway/tls/gateway-cipherSuites.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 443
          name: https
          protocol: HTTPS
        hosts:
        - "bookinfo.demo"
        - "ratings.demo"
        - "nginx.example.com"
        tls:
          mode: SIMPLE
          cipherSuites: 
          - ECDHE-RSA-AES256-GCM-SHA384
          - ECDHE-RSA-AES128-GCM-SHA256
          credentialName: bookinfo-secret

#### minProtocolVersion maxProtocolVersion ####

<table> 
 <thead> 
  <tr> 
   <th>Name</th> 
   <th>Description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>TLS_AUTO</td> 
   <td>自动选择DLS版本</td> 
  </tr> 
  <tr> 
   <td>TLSV1_0</td> 
   <td>TLS 1.0</td> 
  </tr> 
  <tr> 
   <td>TLSV1_1</td> 
   <td>TLS 1.1</td> 
  </tr> 
  <tr> 
   <td>TLSV1_2</td> 
   <td>TLS 1.2</td> 
  </tr> 
  <tr> 
   <td>TLSV1_3</td> 
   <td>TLS 1.3</td> 
  </tr> 
 </tbody> 
</table>

##### TLS\_AUTO #####

1.7.0/gateway/tls/protocolVersion/gateway-tls-version-tls\_auto.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 443
          name: https
          protocol: HTTPS
        hosts:
        - "*"
        tls:
          credentialName: bookinfo-secret
          mode: SIMPLE
          minProtocolVersion: TLS_AUTO
          maxProtocolVersion: TLS_AUTO

##### TLSV1\_0 #####

1.7.0/gateway/tls/protocolVersion/gateway-tls-version-tlsv1\_0.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 443
          name: https
          protocol: HTTPS
        hosts:
        - "*"
        tls:
          credentialName: bookinfo-secret
          mode: SIMPLE
          minProtocolVersion: TLSV1_0
          maxProtocolVersion: TLSV1_0

##### TLSV1\_0 - TLSV1\_3 #####

apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: bookinfo-gateway
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 443
          name: https
          protocol: HTTPS
        hosts:
        - "*"
        tls:
          credentialName: bookinfo-secret
          mode: SIMPLE
          minProtocolVersion: TLSV1_0
          maxProtocolVersion: TLSV1_3

#### subjectAltNames ####

gRPC config for type.googleapis.com/envoy.config.listener.v3.Listener rejected: Error adding/updating listener(s) 0.0.0.0\_8443: SAN-based verification of peer certificates without trusted CA is insecure and not allowed

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70_pic_center]: /images/20221123/61dc573764094ab2be6281e7eecd95fe.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20221123/c3547ef44ef245e997a364d7c4d43bfe.png
[environment variables]: https://istio.io/latest/docs/reference/commands/pilot-discovery/#envvars