![Istio 入口网关无法连接到服务的多个副本](https://linux22.com/image/776156/Istio%20%E5%85%A5%E5%8F%A3%E7%BD%91%E5%85%B3%E6%97%A0%E6%B3%95%E8%BF%9E%E6%8E%A5%E5%88%B0%E6%9C%8D%E5%8A%A1%E7%9A%84%E5%A4%9A%E4%B8%AA%E5%89%AF%E6%9C%AC.png)
我正在新的 AWS EKS 集群中设置 Istio,并创建了一个基本的 nginx 部署进行测试。当部署只有一个副本时,它运行良好,响应时间不到 100 毫秒。当我添加一个副本时,新 pod 的响应时间会疯狂增加,平均约为 10 秒。
根据其他地方的建议,我更新了网格配置禁用自动重试:
meshConfig:
defaultHttpRetryPolicy: {}
发生这种情况后,我发现对第二个 pod 的请求总是失败:
"GET / HTTP/1.1" 503 UF upstream_reset_before_response_started{connection_failure} - "-" 0 91 10003 - "108.249.9.111,10.1.0.117" "curl/7.68.0" "6fa51be8-1441-4454-8d 1b-a03c93b257dc" "example.com" "10.1.52.62:80" outbound|80||nginx.my-namespace.svc.cluster.local - 10.1.108.189:8080 10.1.0.117:21410 - -
我的设置如下:
# AWS ALB Ingress -> istio-ingressgateway (ClusterIP) -> gateway -> virtualservice -> service -> nginx
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
name: default
spec:
selector:
istio: ingressgateway
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- "*"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: nginx
spec:
hosts:
- "example.com"
gateways:
- default
http:
- route:
- destination:
host: nginx
---
apiVersion: v1
kind: Service
metadata:
name: nginx
labels:
app: nginx
spec:
selector:
app: nginx
ports:
- port: 80
name: http
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx
labels:
app: nginx
version: v1
spec:
replicas: 2
revisionHistoryLimit: 1
selector:
matchLabels:
app: nginx
version: v1
template:
metadata:
labels:
app: nginx
version: v1
spec:
containers:
- name: nginx
image: nginx:latest
ports:
- containerPort: 80
resources:
requests:
memory: 100Mi
cpu: 100m
limits:
memory: 1500Mi
cpu: 1000m
版本:
$ istioctl version
client version: 1.13.2
control plane version: 1.13.2
data plane version: 1.13.2 (1 proxies)
$ kubectl version --short
Client Version: v1.21.11
Server Version: v1.21.5-eks-bc4871b
答案1
我发现我的问题是由于节点的安全组规则配置错误造成的。我不允许节点到节点的流量,从而阻止 istio 入口网关与其他节点中的 pod 进行通信。
使用 AWS EKS Terraform 模块,我添加了以下内容:
node_security_group_additional_rules = {
ingress_self_all = {
description = "Node to node all ports/protocols"
protocol = "-1"
from_port = 0
to_port = 0
type = "ingress"
self = true
}
egress_all = {
description = "Node all egress"
protocol = "-1"
from_port = 0
to_port = 0
type = "egress"
cidr_blocks = ["0.0.0.0/0"]
}
}