502 使用 https 时 ALB 和 Istio 的网关错误

Question

在使用Istio和AWS ALB时，我收到https的502坏网关错误。

出于某种原因，我必须在我的Istio ingressgateway之前使用ALB ingress，我还需要使用https从我的ingress连接到Istio-ingressgateway。但我得到了502坏网关错误。如果我使用http，它工作得很好。

我可以在istio-ingressgateway的日志中找到以下信息："response_code_details"：">filter_chain_not_found">

有人知道吗？

以下是我的入口：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-gateway
namespace: istio-system
annotations:
alb.ingress.kubernetes.io/group.name: <group name>
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
alb.ingress.kubernetes.io/ssl-redirect: '443'
alb.ingress.kubernetes.io/certificate-arn: <my arn>
alb.ingress.kubernetes.io/target-type: ip
alb.ingress.kubernetes.io/subnets: <my subnet>
alb.ingress.kubernetes.io/backend-protocol: HTTPS
spec:
ingressClassName: alb
rules:
- host: "my.hostname.com"
http:
paths:
- path: /*
pathType: ImplementationSpecific
backend:
service:
name: istio-ingressgateway
port:
number: 443
tls:
- hosts:
- "my.hostname.com"

以下是我的istio-ingressgateway

...
serviceAnnotations:
alb.ingress.kubernetes.io/healthcheck-path: /healthz/ready
alb.ingress.kubernetes.io/healthcheck-port: "30218"
service:
type: NodePort
ports:
- name: http
port: 80
protocol: TCP
targetPort: 8080
- name: https
port: 443
protocol: TCP
targetPort: 8443
- name: status-port
nodePort: 30218
port: 15021
protocol: TCP
targetPort: 15021
...

以下是我的Istio网关：

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
name: my-gateway
namespace: istio-system
spec:
selector:
istio: ingressgateway
servers:
- hosts:
- my.hostname.com
port:
name: http
number: 80
protocol: HTTP
- hosts:
- my.hostname.com
port:
name: https
number: 443
protocol: HTTPS
tls:
credentialName: my-tls-cert
mode: SIMPLE
privateKey: sds
serverCertificate: sds

如果我将入口更改为使用http，效果会很好，如下所示：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ingress-gateway
namespace: istio-system
annotations:
alb.ingress.kubernetes.io/group.name: <group name>
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
alb.ingress.kubernetes.io/ssl-redirect: '443'
alb.ingress.kubernetes.io/certificate-arn: <my arn>
alb.ingress.kubernetes.io/target-type: ip
alb.ingress.kubernetes.io/subnets: <my subnet>
spec:
ingressClassName: alb
rules:
- host: "my.hostname.com"
http:
paths:
- path: /*
pathType: ImplementationSpecific
backend:
service:
name: istio-ingressgateway
port:
number: 80
tls:
- hosts:
- "my.hostname.com"

Answer 1

ALB在与Istio Ingress网关执行TLS握手时不包括SNI扩展。当您在网关资源中包含"主机"时，路由匹配需要SNI。这里记录了这一点：

https://istio.io/latest/docs/ops/common-problems/network-issues/#configuring-不发送sni 时的sni路由

解决方法是使用hosts:'*'配置Istio 443侦听器，以避免SNI匹配，然后在VirtualService资源中指定主机进行路由。您也可以在VirtualService资源中进行一些标头匹配。

AWS已经声明，包括来自客户端的SNI->ALB连接在他们的名单上，但他们没有路线图或ETA。

还要检查这些：

https://repost.aws/questions/QUOg0LUwafRFaorbsrYDP7xA/does-alb-send-sni-information-in-tls-handshake-to-a-back-end-server

https://kevin.burke.dev/kevin/amazons-albs-insecure-internal-traffic/