Istio多外部主机通过出口网关路由失效问题求助

架构老林

2026-7-15

Istio多外部主机通过出口网关访问时出现连接重置问题

我们的业务场景需要通过Istio出口网关访问多个外部主机。按照官方文档配置后，单外部主机场景可正常工作，但多主机时出现连接重置错误：

curl: (35) Recv failure: Connection reset by peer                                                                                                                                                             
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                                                                                                                               
                                 Dload  Upload   Total   Spent    Left  Speed                                                                                                                               
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0  0     0    0     0    0     0      0      0 --:
curl: (35) Recv failure: Connection reset by peer                                                                                                                                                             
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                                                                                                                               
                                 Dload  Upload   Total   Spent    Left  Speed                                                                                                                               
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0                                                  
curl: (35) Recv failure: Connection reset by peer

预期流量能正常路由至www.google.com和www.paymenttools.com。

复现步骤及配置信息

1. 外部网站的ServiceEntry配置

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  annotations:
    meta.helm.sh/release-name: test-egress-networking
    meta.helm.sh/release-namespace: test
  creationTimestamp: "2023-07-04T09:48:00Z"
  generation: 1
  labels:
    app.kubernetes.io/managed-by: Helm
    helm.toolkit.fluxcd.io/name: test-egress-networking
    helm.toolkit.fluxcd.io/namespace: flux-system
  name: test-egress-networking-www.google.com-443
  namespace: test
  resourceVersion: "402044469"
  uid: 3cc0c95d-f4fb-4bd8-a87f-00d552105458
spec:
  exportTo:
  - .
  hosts:
  - www.google.com
  location: MESH_EXTERNAL
  ports:
  - name: https
    number: 443
    protocol: TLS
  resolution: DNS
---

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  annotations:
    meta.helm.sh/release-name: test-egress-networking
    meta.helm.sh/release-namespace: test
  creationTimestamp: "2023-07-05T08:16:04Z"
  generation: 1
  labels:
    app.kubernetes.io/managed-by: Helm
    helm.toolkit.fluxcd.io/name: test-egress-networking
    helm.toolkit.fluxcd.io/namespace: flux-system
  name: test-egress-networking-www.paymenttools.com-443
  namespace: test
  resourceVersion: "403158012"
  uid: 838580e7-0982-4ef4-903a-6ab738a1e051
spec:
  exportTo:
  - .
  hosts:
  - www.paymenttools.com
  location: MESH_EXTERNAL
  ports:
  - name: https
    number: 443
    protocol: TLS
  resolution: DNS

2. 对应VirtualService配置

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  annotations:
    meta.helm.sh/release-name: test-egress-networking
    meta.helm.sh/release-namespace: test
  creationTimestamp: "2023-07-04T09:52:02Z"
  generation: 5
  labels:
    app: test-egress
    app.kubernetes.io/instance: test-egress-networking
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: test-egress
    helm.sh/chart: network-3.12.1
    helm.toolkit.fluxcd.io/name: test-egress-networking
    helm.toolkit.fluxcd.io/namespace: flux-system
  name: www.google.com-443
  namespace: test
  resourceVersion: "404913509"
  uid: 39c8513b-4a82-4f48-a319-b538f4d0ff53
spec:
  gateways:
  - mesh
  - istio-bf7f5eb02957dae90addc9c99754ff5d2aedf1821-egress-gateway
  hosts:
  - www.google.com
  tls:
  - match:
    - gateways:
      - mesh
      port: 443
      sniHosts:
      - www.google.com
    route:
    - destination:
        host: istio-test-egress-networking-egress-gateway.test.svc.cluster.local
        port:
          number: 443
        subset: bf7f5eb02957dae90addc9c99754ff5d2aedf1821f5dd513f720b15f4ae3
  - match:
    - gateways:
      - istio-bf7f5eb02957dae90addc9c99754ff5d2aedf1821-egress-gateway
      port: 443
      sniHosts:
      - www.google.com
    route:
    - destination:
        host: www.google.com
        port:
          number: 443
---

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  annotations:
    meta.helm.sh/release-name: test-egress-networking
    meta.helm.sh/release-namespace: test
  creationTimestamp: "2023-07-05T08:16:04Z"
  generation: 3
  labels:
    app: test-egress
    app.kubernetes.io/instance: test-egress-networking
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: test-egress
    helm.sh/chart: network-3.12.1
    helm.toolkit.fluxcd.io/name: test-egress-networking
    helm.toolkit.fluxcd.io/namespace: flux-system
  name: www.paymenttools.com-443
  namespace: test
  resourceVersion: "404913970"
  uid: 73f5cf05-45e3-415d-8e5a-62f8e64b0592
spec:
  gateways:
  - mesh
  - istio-9b2f56608b26eca7193652502e7d626c9771601a0-egress-gateway
  hosts:
  - www.paymenttools.com
  tls:
  - match:
    - gateways:
      - mesh
      port: 443
      sniHosts:
      - www.paymenttools.com
    route:
    - destination:
        host: istio-test-egress-networking-egress-gateway.test.svc.cluster.local
        port:
          number: 443
        subset: 9b2f56608b26eca7193652502e7d626c9771601a0d95c1594eb39262610c
  - match:
    - gateways:
      - istio-9b2f56608b26eca7193652502e7d626c9771601a0-egress-gateway
      port: 443
      sniHosts:
      - www.paymenttools.com
    route:
    - destination:
        host: www.paymenttools.com
        port:
          number: 443

3. Gateway配置

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  annotations:
    meta.helm.sh/release-name: test-egress-networking
    meta.helm.sh/release-namespace: test
  creationTimestamp: "2023-07-05T08:16:04Z"
  generation: 4
  labels:
    app: test-egress
    app.kubernetes.io/instance: test-egress-networking
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: test-egress
    helm.sh/chart: network-3.12.1
    helm.toolkit.fluxcd.io/name: test-egress-networking
    helm.toolkit.fluxcd.io/namespace: flux-system
  name: istio-9b2f56608b26eca7193652502e7d626c9771601a0-egress-gateway
  namespace: test
  resourceVersion: "404902076"
  uid: 8ab999fa-f9d8-4103-9f26-fdcfc0fa1ae8
spec:
  selector:
    istio: test-egress-networking-egress-gateway
  servers:
  - hosts:
    - www.paymenttools.com
    port:
      name: http
      number: 80
      protocol: HTTP
---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  annotations:
    meta.helm.sh/release-name: test-egress-networking
    meta.helm.sh/release-namespace: test
  creationTimestamp: "2023-07-04T09:48:00Z"
  generation: 6
  labels:
    app: test-egress
    app.kubernetes.io/instance: test-egress-networking
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: test-egress
    helm.sh/chart: network-3.12.1
    helm.toolkit.fluxcd.io/name: test-egress-networking
    helm.toolkit.fluxcd.io/namespace: flux-system
  name: istio-bf7f5eb02957dae90addc9c99754ff5d2aedf1821-egress-gateway
  namespace: test
  resourceVersion: "404902432"
  uid: 2f89af05-8ce8-43f1-b34d-534cf8e1ca8c
spec:
  selector:
    istio: test-egress-networking-egress-gateway
  servers:
  - hosts:
    - www.google.com
    port:
      name: http
      number: 80
      protocol: HTTP

4. DestinationRule配置

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  annotations:
    meta.helm.sh/release-name: test-egress-networking
    meta.helm.sh/release-namespace: test
  creationTimestamp: "2023-07-04T09:48:00Z"
  generation: 6
  labels:
    app: test-egress
    app.kubernetes.io/instance: test-egress-networking
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: test-egress
    helm.sh/chart: network-3.12.1
    helm.toolkit.fluxcd.io/name: test-egress-networking
    helm.toolkit.fluxcd.io/namespace: flux-system
  name: istio-test-egress-networking-egress-gateway
  namespace: test
  resourceVersion: "404915054"
  uid: 1f6f140b-8002-40ff-8ef8-042e4721f489
spec:
  exportTo:
  - .
  host: istio-test-egress-networking-egress-gateway.test.svc.cluster.local
  subsets:
  - name: bf7f5eb02957dae90addc9c99754ff5d2aedf1821f5dd513f720b15f4ae3
    trafficPolicy:
      loadBalancer:
        simple: ROUND_ROBIN
      portLevelSettings:
      - port:
          number: 443
        tls:
          mode: ISTIO_MUTUAL
          sni: www.google.com
  - name: 9b2f56608b26eca7193652502e7d626c9771601a0d95c1594eb39262610c
    trafficPolicy:
      loadBalancer:
        simple: ROUND_ROBIN
      portLevelSettings:
      - port:
          number: 443
        tls:
          mode: ISTIO_MUTUAL
          sni: www.paymenttools.com

环境信息

Istio版本：客户端1.16.1，控制面1.18.0，数据面1.18.0（63个代理），通过Helm安装
Kubernetes版本：客户端v1.25.4，服务端v1.26.5-gke.1400

已提交Issue但未收到反馈，寻求遇到类似问题的用户或解决方案建议。

内容的提问来源于stack exchange，提问作者kmukherjee2005

Istio多外部主机通过出口网关路由失效问题求助

复现步骤及配置信息 #

1. 外部网站的ServiceEntry配置 #

2. 对应VirtualService配置 #

3. Gateway配置 #

4. DestinationRule配置 #