Azure AKS 上的 Istio 多集群主远程

Question

我正在尝试创建多群集ISTIO主示例。

首先创建了两个集群Azure Aks。用于网络配置的Azurecni和以下是集群的设置。

第一个群集

vnet istioclusterone - 10.10.0.0/20
subnet default - 10.10.0.0/20
k8s service address range 10.100.0.0/16
DNS service ip - 10.100.0.10
Docker Bridge address - 172.17.0.1/16
DNS-prefix - app-cluster-dns

第二个群集

vnet istioclusterone - 10.11.0.0/20
subnet default - 10.11.0.0/20
k8s service address range 10.101.0.0/16
DNS service ip - 10.101.0.10
Docker Bridge address - 172.18.0.1/16
DNS-prefix - processing-cluster-dns

除此之外，

除了默认设置而消失。接下来的下面是文章以设置多ISTIO群集。

”

priendar-remote

第二个文章中的最后一步设置了cluster2，因为远程失败了。

在Istio-ingressgateway Pod的日志中找到以下错误。

2022-04-11T07:51:00.352057Z     warning envoy config    StreamAggregatedResources gRPC config stream closed since 431s ago: 14, connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority (possibly because of \"crypto/rsa: verification error\" while trying to verify candidate authority certificate \"cluster.local\")"
2022-04-11T07:51:08.514428Z     warning envoy config    StreamAggregatedResources gRPC config stream closed since 439s ago: 14, connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority (possibly because of \"crypto/rsa: verification error\" while trying to verify candidate authority certificate \"cluster.local\")"
2022-04-11T07:51:12.462140Z     warning envoy config    StreamAggregatedResources gRPC config stream closed since 443s ago: 14, connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority (possibly because of \"crypto/rsa: verification error\" while trying to verify candidate authority certificate \"cluster.local\")"
2022-04-11T07:51:39.950935Z     warning envoy config    StreamAggregatedResources gRPC config stream closed since 471s ago: 14, connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority (possibly because of \"crypto/rsa: verification error\" while trying to verify candidate authority certificate \"cluster.local\")" 

有没有人尝试过这种情况，请分享您的见解。

谢谢。

更新：

已经解决了两个簇的自定义证书。

然后在两个簇中创建了一个网关。

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: cluster-aware-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: tls
      protocol: TLS
    tls:
      mode: AUTO_PASSTHROUGH
    hosts:
    - "*.local"

现在有新的错误。在下面查看cluster2的Pod istio-ingressgateway-575ccb4d79的日志。

2022-04-13T09:14:04.650502Z     warning envoy config    StreamAggregatedResources gRPC config stream closed since 60s ago: 14, connection error: desc = "transport: Error while dialing dial tcp <publicIPofEastWestgateway>:15012: i/o timeout"
2022-04-13T09:14:27.026016Z     warning envoy config    StreamAggregatedResources gRPC config stream closed since 83s ago: 14, connection error: desc = "transport: Error while dialing dial tcp <publicIPofEastWestgateway:15012: i/o timeout"

我在这里承担的措施，我在cluster1中安装了EastWestgateway，如文档 linktodoc

cluster2试图访问cluster1。使用失败的港口15012上的East West-Gateway的Publicip。

打开检查的安全组端口。从群集内的测试吊舱中尝试了telnet进行检查。它的失败。

任何人都可以在这里帮助我。

谢谢

Answer 1

这看起来像是防火墙问题。不确定它是否有帮助，但尝试在远程集群的出站上打开端口 15012 和 15443 到 eastwestgateway elb ip（主集群）