Istio流量染色配置在非default命名空间失效问题排查

核心问题 #

配置的Istio网关、虚拟服务（VS）和目标规则（DR）在default命名空间可正常实现流量染色，但在test-istio命名空间中功能异常，请求路由不符合预期。

预期行为 #

• 访问testaaa时携带project-version请求头，能精准路由到对应版本的testaaa实例
• 该请求头会传递到下游的testbbb服务，同样路由到对应版本的实例
• 执行命令curl "http://gateway:gatewayport/" --header 'project-version: release-v1'时，应稳定返回release-v1（返回值为testbbb Pod的标签内容）

实际行为 #

无报错，但请求随机返回release或release-v1，流量染色规则未生效。

已验证操作 #

• 将testaaa、testbbb服务及Istio配置迁移至default命名空间后，流量染色功能恢复正常

配置文件与测试结果 #

Istio配置清单 #

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: gateway
  namespace: test-istio
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: testaaa
  namespace: test-istio
spec:
  gateways:
    - gateway
  hosts:
    - "*"
  http:
    - match:
        - headers:
            project-version:
              exact: release-v1
      route:
        - destination:
            host: testaaa.test-istio.svc.cluster.local
            subset: release-v1
    - route:
        - destination:
            host: testaaa.test-istio.svc.cluster.local
            subset: release
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: testaaa
  namespace: test-istio
spec:
  host: testaaa.test-istio.svc.cluster.local
  subsets:
    - labels:
        version: release
      name: release
    - labels:
        version: release-v1
      name: release-v1
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: testbbb
  namespace: test-istio
spec:
  hosts:
    - testbbb.test-istio.svc.cluster.local
  http:
    - match:
        - headers:
            project-version:
              exact: release-v1
      route:
        - destination:
            host: testbbb.test-istio.svc.cluster.local
            subset: release-v1
    - route:
        - destination:
            host: testbbb.test-istio.svc.cluster.local
            subset: release
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: testbbb
  namespace: test-istio
spec:
  host: testbbb.test-istio.svc.cluster.local
  subsets:
    - labels:
        version: release
      name: release
    - labels:
        version: release-v1
      name: release-v1
---

curl测试输出 #

[root@k3s-release-server1 ~]# curl  "http://10.1.4.5:31380/" --header 'project-version: release-v1'
release-v1[root@k3s-release-server1 ~]# curl  "http://10.1.4.5:31380/" --header 'project-version: release-v1'
release[root@k3s-release-server1 ~]# curl  "http://10.1.4.5:31380/" --header 'project-version: release-v1'
release[root@k3s-release-server1 ~]# curl  "http://10.1.4.5:31380/" --header 'project-version: release-v1'
release-v1[root@k3s-release-server1 ~]# curl  "http://10.1.4.5:31380/" --header 'project-version: release-v1'
release[root@k3s-release-server1 ~]# curl  "http://10.1.4.5:31380/" --header 'project-version: release-v1'
release-v1[root@k3s-release-server1 ~]# curl  "http://10.1.4.5:31380/" --header 'project-version: release-v1'
release

注：返回结果为testbbb服务器的标签内容

内容的提问来源于stack exchange，提问作者Zi Wang