MacOS下Docker Desktop与Istio无法访问端点问题排查

问题描述 #

基于Istio搭建包含demo-1-app和demo-2-app的示例项目，已部署对应的Deployment、Service及ServiceAccount资源，同时配置了Istio Gateway与VirtualService规则。访问localhost/demo1/getDetails或127.0.0.1/demo1/getDetails时始终返回404错误，但istioctl analyse未检测到任何异常。

相关配置 #

应用资源配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-1-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo-1-app
  template:
    metadata:
      labels:
        app: demo-1-app
    spec:
      containers:
        - name: demo-1-app
          image: muzimil:demo-1
          ports:
            - containerPort: 8080
          imagePullPolicy: Never
---

apiVersion: v1
kind: Service
metadata:
  name: demo-1-app
spec:
  selector:
    app: demo-1-app
  ports:
    - port: 8080
      name: http

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: demo-1-app
  labels:
    account: demo-1-app
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-2-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo-2-app
  template:
    metadata:
      labels:
        app: demo-2-app
    spec:
      containers:
        - name: demo-2-app
          image: muzimil:demo2-1
          ports:
            - containerPort: 8080
          imagePullPolicy: Never
---

apiVersion: v1
kind: Service
metadata:
  name: demo-2-app
spec:
  selector:
    app: demo-2-app
  ports:
    - port: 8080
      name: http

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: demo-2-app
  labels:
    account: demo-2-app

Istio网关与虚拟服务配置 #

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: demo-app-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: demo-service1
spec:
  hosts:
  - "*"
  gateways:
  - demo-app-gateway
  http:
  - match:
    - uri:
        exact: /demo1
    route:
    - destination:
        host: demo-1-app
        port:
          number: 8080
  - match:
    - uri:
        exact: /demo2
    route:
    - destination:
        host: demo-2-app
        port:
          number: 8080

问题原因与解决方法 #

原因 #

当前VirtualService中使用exact: /demo1的URI匹配规则，仅能精确匹配/demo1路径，无法匹配/demo1/getDetails这类以/demo1开头的子路径，导致请求无法被路由到后端服务，返回404。

解决方法 #

修改VirtualService的匹配规则，将exact改为prefix，同时根据后端应用的接口路径情况选择是否添加路径重写：

方案1：仅匹配前缀（后端应用接口包含/demo1前缀）

如果后端demo-1-app的接口路径是/demo1/getDetails，直接修改匹配规则为前缀匹配即可：

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: demo-service1
spec:
  hosts:
  - "*"
  gateways:
  - demo-app-gateway
  http:
  - match:
    - uri:
        prefix: /demo1
    route:
    - destination:
        host: demo-1-app
        port:
          number: 8080
  - match:
    - uri:
        prefix: /demo2
    route:
    - destination:
        host: demo-2-app
        port:
          number: 8080

方案2：匹配前缀并移除前缀（后端应用接口无/demo1前缀）

如果后端demo-1-app的接口路径是/getDetails，需要添加rewrite规则将请求路径中的/demo1前缀移除，确保后端能正确接收请求：

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: demo-service1
spec:
  hosts:
  - "*"
  gateways:
  - demo-app-gateway
  http:
  - match:
    - uri:
        prefix: /demo1
    rewrite:
      uri: "/"
    route:
    - destination:
        host: demo-1-app
        port:
          number: 8080
  - match:
    - uri:
        prefix: /demo2
    rewrite:
      uri: "/"
    route:
    - destination:
        host: demo-2-app
        port:
          number: 8080

修改后重新应用VirtualService配置：

kubectl apply -f <your-virtualservice-file.yaml>

内容的提问来源于stack exchange，提问作者Patan