配置Envoy多下游节点时filter_chain_match.server_names匹配失败问题

问题根源 #

你遇到的核心问题是**filter_chain_match.server_names匹配的是TLS握手阶段客户端发送的SNI（Server Name Indication）字段**，如果客户端请求未携带SNI，或者SNI值和配置的sub1.foo.com不匹配，Envoy就找不到对应的filter_chain处理请求，自然会无响应。移除该配置后，这个filter_chain会成为默认匹配项，所有请求都能被正常处理。

解决方案 #

要实现每个子域名使用独立证书的目标，按以下步骤调整配置即可：

1. 确认客户端SNI发送情况 #

现代浏览器、curl等主流客户端都会自动发送SNI，但如果是老旧客户端或自定义请求，需要确认SNI是否正确携带（比如用curl -v https://sub1.foo.com查看输出中的SNI信息）。

2. 为每个子域名配置独立filter_chain #

给每个子域名单独配置带filter_chain_match.server_names的filter_chain，同时必须添加默认兜底filter_chain，用来处理SNI不匹配或未携带SNI的请求，避免请求直接被丢弃。

3. 调整后的完整配置示例 #

以下是包含两个子域名和默认兜底的Listeners配置：

---
static_resources:
  listeners:
    - name: main_listener
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 443
      filter_chains:
        # sub1.foo.com专属filter_chain
        - filter_chain_match:
            server_names: ["sub1.foo.com"]
          transport_socket:
            name: envoy.transport_sockets.tls
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
              common_tls_context:
                tls_certificates:
                  private_key:
                    filename: /etc/envoy/certs/serverkey_family.pem
                    watched_directory:
                      path: /etc/envoy/certs/
                  certificate_chain:
                    filename: /etc/envoy/certs/servercert_family.pem
                    watched_directory:
                      path: /etc/envoy/certs/
                alpn_protocols:
                  - h2,http/1.1
          filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: ingress_http_family
                http_filters:
                  - name: envoy.filters.http.router
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
                route_config:
                  name: route_family
                  virtual_hosts:
                    - name: vm_family
                      domains: ["sub1.foo.com"]
                      routes:
                        - match: { prefix: "/" }
                          route: { cluster: cluster_heritagearchive }
        # sub2.foo.com专属filter_chain
        - filter_chain_match:
            server_names: ["sub2.foo.com"]
          transport_socket:
            name: envoy.transport_sockets.tls
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
              common_tls_context:
                tls_certificates:
                  private_key:
                    filename: /etc/envoy/certs/serverkey_sub2.pem
                    watched_directory:
                      path: /etc/envoy/certs/
                  certificate_chain:
                    filename: /etc/envoy/certs/servercert_sub2.pem
                    watched_directory:
                      path: /etc/envoy/certs/
                alpn_protocols:
                  - h2,http/1.1
          filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: ingress_http_sub2
                http_filters:
                  - name: envoy.filters.http.router
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
                route_config:
                  name: route_sub2
                  virtual_hosts:
                    - name: vm_sub2
                      domains: ["sub2.foo.com"]
                      routes:
                        - match: { prefix: "/" }
                          route: { cluster: cluster_sub2 }
        # 默认兜底filter_chain（处理无SNI或不匹配的请求）
        - transport_socket:
            name: envoy.transport_sockets.tls
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
              common_tls_context:
                tls_certificates:
                  private_key:
                    filename: /etc/envoy/certs/serverkey_default.pem
                    watched_directory:
                      path: /etc/envoy/certs/
                  certificate_chain:
                    filename: /etc/envoy/certs/servercert_default.pem
                    watched_directory:
                      path: /etc/envoy/certs/
                alpn_protocols:
                  - h2,http/1.1
          filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: ingress_http_default
                http_filters:
                  - name: envoy.filters.http.router
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
                route_config:
                  name: route_default
                  virtual_hosts:
                    - name: vm_default
                      domains: ["*"]
                      routes:
                        - match: { prefix: "/" }
                          route: { cluster: cluster_default }

4. 关键注意事项 #

• filter_chain顺序：Envoy按从上到下的顺序匹配filter_chain，需把匹配规则更具体的（比如单个子域名）放在前面，兜底项放在最后。
• SNI通配符规则：server_names支持通配符（如*.foo.com），但仅允许最左侧使用通配符（sub*.foo.com这类写法不合法）。
• 证书对应关系：每个filter_chain的证书必须匹配其server_names中的域名，否则会触发TLS握手失败。

内容的提问来源于stack exchange，提问作者MortalFool