配置AWS ACM与Istio后访问返回Empty reply from server问题求助

1. 核心问题定位：NLB与IngressGateway的协议/端口不匹配 #

你的NLB配置了aws-load-balancer-backend-protocol: "http"，意味着NLB在443端口终止SSL后，会用HTTP协议转发到IngressGateway的443端口，但Istio IngressGateway的443端口默认是处理HTTPS（TLS）流量的，收到HTTP请求会无法解析，直接返回空响应，这就是curl: (52) Empty reply from server的原因。

两种修复方案 #

方案一：NLB终止SSL后转发到IngressGateway的80端口（推荐）

• 修改istio-ingressgateway的Service注解，指定后端转发到80端口：

  annotations:
    service.beta.kubernetes.io/aws-load-balancer-name: "name"
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
    service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:ap-south-1:xxxxxx:certificate/e050b0fc-7117-444a-a296-ebcdc01d3ab2"
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
    service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60"
    service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
    # 新增：指定NLB转发到IngressGateway的80端口
    service.beta.kubernetes.io/aws-load-balancer-target-port: "80"
  

• 同步修改Gateway配置，监听80端口：

  apiVersion: networking.istio.io/v1alpha3
  kind: Gateway
  metadata:
    name: jenkins-gateway
    namespace: jenkins
  spec:
    selector:
      istio: ingressgateway
    servers:
    - port:
        number: 80
        name: http-jenkins
        protocol: HTTP
      hosts:
      - "cicd.domain.com"
  

方案二：让Istio Gateway处理SSL终止（NLB做纯TCP转发）

如果希望由Istio来管理证书，修改NLB为TCP转发模式：

• 更新istio-ingressgateway的Service注解：

  annotations:
    # 其他注解保留，仅修改以下两项
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "tcp"
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
  

• 修改Gateway为HTTPS模式，提前在jenkins namespace创建包含ACM证书的Kubernetes Secret（需将ACM证书导出为PEM格式）：

  apiVersion: networking.istio.io/v1alpha3
  kind: Gateway
  metadata:
    name: jenkins-gateway
    namespace: jenkins
  spec:
    selector:
      istio: ingressgateway
    servers:
    - port:
        number: 443
        name: https-jenkins
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: jenkins-tls # 对应你创建的Secret名称
      hosts:
      - "cicd.domain.com"
  

2. 额外验证步骤 #

• 检查Jenkins服务可用性：从IngressGateway Pod内部测试是否能访问Jenkins服务

  # 进入IngressGateway Pod
  kubectl exec -it $(kubectl get pods -n istio-system -l istio=ingressgateway -o jsonpath='{.items[0].metadata.name}') -n istio-system -- bash
  # 测试服务连通性
  curl http://jenkins.jenkins.svc.cluster.local:8080
  

• 验证Istio配置合法性：检查Gateway和VirtualService是否有语法或逻辑错误

  istioctl analyze -n jenkins
  

• 查看IngressGateway日志：确认流量是否到达及具体错误信息

  kubectl logs $(kubectl get pods -n istio-system -l istio=ingressgateway -o jsonpath='{.items[0].metadata.name}') -n istio-system -f
  

内容的提问来源于stack exchange，提问作者Frankie Tseng