Istio网关后ASP.NET gRPC服务HTTPS请求失败问题排查

你的ASP.NET gRPC服务在Istio网关使用TCP协议时请求正常，但切换为HTTPS终止SSL模式后请求失败，报错upstream connect error or disconnect/reset before headers. reset reason: remote reset，核心原因大概率是协议不匹配或Istio与后端服务的通信配置错误，以下是针对性排查和修复步骤：

1. 修正后端Service的协议标记 #

gRPC依赖HTTP/2协议，需在Kubernetes Service中明确标记端口的HTTP/2属性，否则Istio可能默认用HTTP/1.1转发请求，导致后端重置连接：

apiVersion: v1
kind: Service
metadata:
  name: app-svc
  namespace: testing
spec:
  ports:
  - name: grpc
    port: 5001
    protocol: TCP
    targetPort: 5001
    appProtocol: http2 # 关键：标记此端口为HTTP/2协议
  selector:
    app: your-grpc-app

2. 调整Istio Gateway，显式启用HTTP/2 #

虽然HTTPS端口默认支持HTTP/2，但显式指定appProtocol可避免Istio协议推断错误：

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: gateway
  namespace: testing
spec:
  selector:
    istio: ingress
  servers:
    - port:
        number: 9093
        name: https-9093
        protocol: HTTPS
        appProtocol: h2 # 显式指定为HTTP/2
      hosts:
        - "mydomain.com"
      tls:
        mode: SIMPLE
        credentialName: my_tls_cred_secret

3. 配置VirtualService的路由协议 #

确保VirtualService转发流量时指定gRPC兼容的协议：

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: grpc-vs
  namespace: testing
spec:
  hosts:
    - "mydomain.com"
  gateways:
    - gateway
  http:
  - match:
    - port: 9093
    route:
    - destination:
        host: app-svc.testing.svc.cluster.local
        port:
          number: 5001
      headers:
        request:
          set:
            Content-Type: "application/grpc" # 强制设置gRPC请求头
    timeout: 30s

4. 验证TLS Secret有效性 #

• 确认my_tls_cred_secret存在于testing命名空间：

  kubectl get secrets -n testing my_tls_cred_secret
  

• 检查Secret类型为kubernetes.io/tls，且证书包含mydomain.com的SAN字段：

  kubectl get secret my_tls_cred_secret -n testing -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -text -noout
  

5. 确认后端服务监听配置 #

确保ASP.NET gRPC服务监听HTTP端口（Istio已终止SSL），在Program.cs中检查：

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddGrpc();

var app = builder.Build();
app.MapGrpcService<GreeterService>();

// 确保监听HTTP而非HTTPS
app.Run("http://0.0.0.0:5001");

如果后端强制要求HTTPS，需在DestinationRule中配置TLS转发：

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: grpc-dr
  namespace: testing
spec:
  host: app-svc.testing.svc.cluster.local
  trafficPolicy:
    tls:
      mode: SIMPLE # 若后端用双向认证则改为MUTUAL

日志辅助验证 #

从你的Istio网关日志可见：

"POST /greet.Greeter/SayHello HTTP/2" 200 UR upstream_reset_before_response_started{remote_reset}

说明Istio已接收HTTP/2请求，但转发到后端10.244.0.41:5001时被重置，进一步验证了后端不接受Istio转发的请求协议，优先检查上述Service和VirtualService的协议配置。

内容的提问来源于stack exchange，提问作者Prata