AKS内部负载均衡失效排查：Istio Ingress Gateway及VirtualService问题

在AKS集群中部署了由Istio Ingress Gateway提供的内部负载均衡器，配置文件如下：

profile.yaml #

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio-controlplane
spec:
  meshConfig:
    accessLogFile: /dev/stdout
  components:
    egressGateways:
    - name: istio-egressgateway
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 10m
            memory: 40Mi
    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 10m
            memory: 40Mi
        serviceAnnotations:
          service.beta.kubernetes.io/azure-load-balancer-internal: "true"
        service:
          type: LoadBalancer
          loadBalancerIP: 10.1.2.254
          ports:
            - port: 5000
              targetPort: 5000
              name: store-front
            - port: 5001
              targetPort: 5001
              name: web-service
    pilot:
      k8s:
        env:
          - name: PILOT_TRACE_SAMPLING
            value: "100"
        resources:
          requests:
            cpu: 10m
            memory: 100Mi
  values:
    global:
      proxy:
        resources:
          requests:
            cpu: 10m
            memory: 40Mi
    pilot:
      autoscaleEnabled: false
    gateways:
      istio-egressgateway:
        autoscaleEnabled: false
      istio-ingressgateway:
        autoscaleEnabled: false

gateway.yaml #

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: app-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 5000
      name: sample
      protocol: HTTP
    hosts:
      - "*"
  - port:
      number: 5001
      name: app
      protocol: HTTP
    hosts:
      - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: store-front
spec:
  hosts:
  - "*"
  gateways:
  - app-gateway
  http:
  - match:
    - uri:
        prefix: /sample
    route:
    - destination:
        host: store-front.default.svc.cluster.local
        port:
          number: 5000
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: web-service
spec:
  hosts:
  - "*"
  gateways:
  - app-gateway
  http:
  - match:
    - uri:
        prefix: /app
    route:
    - destination:
        host: web-service.default.svc.cluster.local
        port:
          number: 5001

通过VNet对等连接的虚拟机访问http://10.1.2.254/app或http://10.1.2.254/sample均失败，在集群内部署测试Pod执行curl请求也无响应，怀疑VirtualService未正常工作。

相关版本：

• kubectl version: v1.30.0
• istioctl version: 1.22.3

• Ingress Gateway端口命名不符合Istio规范：Istio要求HTTP端口的名称必须以http-开头，HTTPS端口以https-开头，否则Gateway无法正确关联服务端口。当前配置中name: store-front和name: web-service不符合要求，需修改为http-store-front、http-web-service。
• 后端服务状态异常：VirtualService指定的store-front.default.svc.cluster.local和web-service.default.svc.cluster.local可能未部署、Pod未处于Running状态，或健康检查失败。可通过kubectl get pods、kubectl get svc确认服务和Pod状态。
• Gateway与Ingress Gateway标签不匹配：检查Istio Ingress Gateway Pod的标签是否包含istio: ingressgateway，执行kubectl get pods -n istio-system -l istio=ingressgateway验证，标签不匹配会导致Gateway无法绑定到Ingress实例。
• 后端服务未注入Istio Sidecar：若后端Pod没有istio-proxy容器，流量无法被Istio路由。可通过kubectl describe pod <pod-name>查看容器列表，或检查命名空间是否开启自动注入（kubectl get namespace default -o yaml查看istio-injection: enabled标签）。
• 网络策略或安全组限制：AKS集群的网络策略可能阻止了Ingress Gateway到后端服务的流量，Azure NSG可能限制了VNet对等虚拟机与内部负载均衡器的通信，需检查对应端口的流量规则是否允许。
• Istio配置未生效：可能存在配置未正确应用的情况，可通过istioctl verify-install检查安装状态，kubectl get gateway、kubectl get virtualservice确认资源存在，或istioctl analyze排查配置错误。

内容的提问来源于stack exchange，提问作者Y H