修改了helm chart的alerta，使其在启用了istio的GKE群集上旋转。
创建Alerta吊舱和它的挎包OK
▶ k get pods | grep alerta
alerta-758bc87dcf-tp5nv 2/2 Running 0 22m
[当我尝试访问我的虚拟服务指向的URL
我收到以下错误
上游连接错误或在标头之前断开连接/重置。重置原因：连接终止
▶ k get vs alerta-virtual-service -o yaml
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
annotations:
helm.fluxcd.io/antecedent: mynamespace:helmrelease/alerta
creationTimestamp: "2020-04-23T14:45:04Z"
generation: 1
name: alerta-virtual-service
namespace: mynamespace
resourceVersion: "46844125"
selfLink: /apis/networking.istio.io/v1alpha3/namespaces/mynamespace/virtualservices/alerta-virtual-service
uid: 2a3caa13-3900-4da1-a3a1-9f07322b52b0
spec:
gateways:
- mynamespace/istio-ingress-gateway
hosts:
- alerta.myurl.com
http:
- appendHeaders:
x-request-start: t=%START_TIME(%s.%3f)%
match:
- uri:
prefix: /
route:
- destination:
host: alerta
port:
number: 80
timeout: 60s
这里是服务
▶ k get svc alerta -o yaml
apiVersion: v1
kind: Service
metadata:
annotations:
helm.fluxcd.io/antecedent: mynamespace:helmrelease/alerta
creationTimestamp: "2020-04-23T14:45:04Z"
labels:
app: alerta
chart: alerta-0.1.0
heritage: Tiller
release: alerta
name: alerta
namespace: mynamespace
resourceVersion: "46844120"
selfLink: /api/v1/namespaces/mynamespace/services/alerta
uid: 4d4a3c73-ee42-49e3-a4cb-8c51536a0508
spec:
clusterIP: 10.8.58.228
ports:
- name: http
port: 80
protocol: TCP
targetPort: http
selector:
app: alerta
release: alerta
sessionAffinity: None
type: ClusterIP
status:
loadBalancer: {}
但是，当我通过另一个Pod执行到集群中并尝试到达alerta svc端点时：
/ # curl -IL http://alerta
curl: (56) Recv failure: Connection reset by peer
/ # nc -zv -w 3 alerta 80
alerta (10.8.58.228:80) open
尽管显然端口是开放的
任何建议？
可能是这两个代理服务器的链接正在产生问题？特使背后的nginx？
容器日志似乎很正常
2020-04-23 15:34:40,272 DEBG 'nginx' stdout output:
ip=\- [\23/Apr/2020:15:34:40 +0000] "\GET / HTTP/1.1" \200 \994 "\-" "\kube-probe/1.15+"
/web | /index.html | > GET / HTTP/1.1
edit：这是详细的curl，其中主机头已明确设置
/ # curl -v -H "host: alerta.myurl.com" http://alerta:80
* Rebuilt URL to: http://alerta:80/
* Trying 10.8.58.228...
* TCP_NODELAY set
* Connected to alerta (10.8.58.228) port 80 (#0)
> GET / HTTP/1.1
> host: alerta.myurl.com
> User-Agent: curl/7.57.0
> Accept: */*
>
* Recv failure: Connection reset by peer
* Closing connection 0
curl: (56) Recv failure: Connection reset by peer
app / pod使用的nginx配置文件是以下FWIW
worker_processes 4;
pid /tmp/nginx.pid;
daemon off;
error_log /dev/stderr info;
events {
worker_connections 1024;
}
http {
client_body_temp_path /tmp/client_body;
fastcgi_temp_path /tmp/fastcgi_temp;
proxy_temp_path /tmp/proxy_temp;
scgi_temp_path /tmp/scgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
include /etc/nginx/mime.types;
gzip on;
gzip_disable "msie6";
log_format main 'ip=\$http_x_real_ip [\$time_local] '
'"\$request" \$status \$body_bytes_sent "\$http_referer" '
'"\$http_user_agent"' ;
log_format scripts '$document_root | $uri | > $request';
default_type application/octet-stream;
server {
listen 8080 default_server;
access_log /dev/stdout main;
access_log /dev/stdout scripts;
location ~ /api {
include /etc/nginx/uwsgi_params;
uwsgi_pass unix:/tmp/uwsgi.sock;
proxy_set_header Host $host:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
root /web;
index index.html;
location / {
try_files $uri $uri/ /index.html;
}
}
}
edit 2：尝试获取istio身份验证策略
✔ 18h55m ⍉
▶ kubectl get peerauthentication.security.istio.io
No resources found.
✔ 18h55m
▶ kubectl get peerauthentication.security.istio.io/default -o yaml
Error from server (NotFound): peerauthentications.security.istio.io "default" not found
edit 3：当从istio代理容器中对服务执行curl时
▶ k exec -it alerta-758bc87dcf-jzjgj -c istio-proxy bash
istio-proxy@alerta-758bc87dcf-jzjgj:/$ curl -v http://alerta:80
* Rebuilt URL to: http://alerta:80/
* Trying 10.8.58.228...
* Connected to alerta (10.8.58.228) port 80 (#0)
> GET / HTTP/1.1
> Host: alerta
> User-Agent: curl/7.47.0
> Accept: */*
>
* Recv failure: Connection reset by peer
* Closing connection 0
curl: (56) Recv failure: Connection reset by peer
执行到相应的istio-proxy容器并打开trace-级别登录时>
curl http://localhost:15000/logging?level=trace我看到以下错误：
alerta-758bc87dcf-jzjgj istio-proxy [2020-04-24 13:15:21.180][29][debug][connection] [external/envoy/source/extensions/transport_sockets/tls/ssl_socket.cc:168] [C1484] handshake error: 1
alerta-758bc87dcf-jzjgj istio-proxy [2020-04-24 13:15:21.180][29][debug][connection] [external/envoy/source/extensions/transport_sockets/tls/ssl_socket.cc:201] [C1484] TLS error: 268435612:SSL routines:OPENSSL_internal:HTTP_REQUEST
我用istio 1.5.2创建了新的gke集群，实际上，如果您检查mtls，则找不到资源