Istio跨命名空间流量负载均衡配置问题求助

我尝试用Istio实现dev、staging、production三个命名空间下同前缀应用的流量负载均衡，目标是访问http://example.com时，流量能在三个命名空间的应用间均衡分配，但目前始终只收到dev命名空间应用的响应。我已经在不同命名空间部署了VirtualService、DestinationRule和Gateway资源，也试过在istio-system命名空间部署单个Gateway并在所有VirtualService中配置正确关联路径，但问题仍未解决。

当前配置文件 #

VirtualService配置 #

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: istio-nginx-vs
  namespace: dev
spec:
  hosts:
  - xxx.elb.amazonaws.com
  gateways:
  - dev/istio-nginx-gw
  http:
  - route:
    - destination:
        host: istio-nginx.dev.svc.cluster.local
        port:
          number: 80
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: istio-nginx-vs
  namespace: staging
spec:
  hosts:
  - xxx.elb.amazonaws.com
  gateways:
  - staging/istio-nginx-gw
  http:
  - route:
    - destination:
        host: istio-nginx.staging.svc.cluster.local
        port:
          number: 80
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: istio-nginx-vs
  namespace: production
spec:
  hosts:
  - xxx.elb.amazonaws.com
  gateways:
  - production/istio-nginx-gw
  http:
  - route:
    - destination:
        host: istio-nginx.production.svc.cluster.local
        port:
          number: 80

DestinationRule配置 #

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: istio-nginx-dr
  namespace: dev
spec:
  host: istio-nginx.svc.dev.cluster.local
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: istio-nginx-dr
  namespace: staging
spec:
  host: istio-nginx.staging.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: istio-nginx-dr
  namespace: production
spec:
  host: istio-nginx.production.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN

Gateway配置 #

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-nginx-gw
  namespace: dev
spec:
  selector:
    app: istio-gateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - xxx.elb.amazonaws.com
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-nginx-gw
  namespace: staging
spec:
  selector:
    app: istio-gateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - xxx.elb.amazonaws.com
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-nginx-gw
  namespace: production
spec:
  selector:
    app: istio-gateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - xxx.amazonaws.com

问题分析与解决方案 #

核心问题点 #

1. 多Gateway冲突：三个命名空间都部署了绑定同一选择器的Gateway，导致Istio网关无法正确匹配所有VirtualService，通常仅需一个全局Gateway即可。
2. VirtualService路由范围受限：每个VirtualService仅路由到自身命名空间的服务，未配置跨命名空间的多目标路由规则。
3. DestinationRule格式错误：dev命名空间的DestinationRule中host格式错误，正确Kubernetes服务FQDN应为{service-name}.{namespace}.svc.cluster.local。
4. production Gateway域名不一致：production的Gateway配置中host与其他两个命名空间不统一，导致流量无法匹配。

修正后的配置示例 #

全局Gateway（部署在istio-system命名空间）

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: global-istio-gw
  namespace: istio-system
spec:
  selector:
    app: istio-gateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - xxx.elb.amazonaws.com

跨命名空间VirtualService（部署在istio-system命名空间）

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: cross-namespace-nginx-vs
  namespace: istio-system
spec:
  hosts:
  - xxx.elb.amazonaws.com
  gateways:
  - istio-system/global-istio-gw
  http:
  - route:
    - destination:
        host: istio-nginx.dev.svc.cluster.local
        port:
          number: 80
      weight: 33
    - destination:
        host: istio-nginx.staging.svc.cluster.local
        port:
          number: 80
      weight: 33
    - destination:
        host: istio-nginx.production.svc.cluster.local
        port:
          number: 80
      weight: 34

修正后的DestinationRule

# dev命名空间
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: istio-nginx-dr
  namespace: dev
spec:
  host: istio-nginx.dev.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
---
# staging命名空间
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: istio-nginx-dr
  namespace: staging
spec:
  host: istio-nginx.staging.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
---
# production命名空间
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: istio-nginx-dr
  namespace: production
spec:
  host: istio-nginx.production.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN

内容的提问来源于stack exchange，提问作者Валерий Сиволапенко