帶有自訂憑證的 Istio 出口網關 HANDSHAKE_FAILURE_ON_CLIENT_HELLO

Question

我們試圖實現的是透過出口網關將點網狀流量傳輸到外部服務。

我們嘗試了幾次迭代，現在嘗試在中間設定一個出口網關。

外部服務正在使用我們的憑證運行。

網格 > 出口閘道 > 外部服務。

網關上的錯誤是：

[2020-08-21T14:52:37.523Z] "GET / HTTP/1.1" 503 UF,URX "-" "TLS error: 268436496:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE 268435610:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO" 0 91 62 - "10.32.64.16" "curl/7.61.1" "f57b76e9-99b1-43bd-8905-1226ab2c7e69" "<vm-name>.europe-west1-b.c.<google-project-name>.internal" "10.32.3.207:8123" outbound|8123|notebook-ext|<vm-name>.europe-west1-b.c.<google-project-name>.internal - 10.32.65.2:8123 10.32.64.16:54912 <vm-name>.europe-west1-b.c.<google-project-name>.internal -

山藥：

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: notebook
  namespace: istio-system
spec:
  hosts:
  - <vm-name>.europe-west1-b.c.<google-project-name>.internal
  ports:
  - number: 80
    name: http-port-for-tls-origination
    protocol: http
  - number: 8123
    name: https
    protocol: HTTPS
  resolution: DNS
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-egressgateway-notebook
  namespace: istio-system
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 80
      name: http-port-for-tls-origination
      protocol: HTTP
    hosts:
    - <vm-name>.europe-west1-b.c.<google-project-name>.internal
  - port:
      number: 8123
      name: https
      protocol: HTTPS
    hosts:
    - <vm-name>.europe-west1-b.c.<google-project-name>.internal
    tls:
      mode: MUTUAL
      serverCertificate: /temp-certs/cert-chain.pem
      privateKey: /temp-certs/key.pem
      caCertificates: /temp-certs/root-cert.pem
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: egressgateway-for-notebook
  namespace: istio-system
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  subsets:
  - name: notebook
    trafficPolicy:
      loadBalancer:
        simple: ROUND_ROBIN
      portLevelSettings:
      - port:
          number: 8123
        tls:
          mode: ISTIO_MUTUAL
          sni: <vm-name>.europe-west1-b.c.<google-project-name>.internal
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: direct-notebook-through-egress
  namespace: istio-system
spec:
  hosts:
  - <vm-name>.europe-west1-b.c.<google-project-name>.internal
  gateways:
  - mesh
  - istio-egressgateway-notebook
  http:
  - match:
    - gateways:
      - mesh
      port: 80
      sniHosts:
      - <vm-name>.europe-west1-b.c.<google-project-name>.internal
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
        subset: notebook
        port:
          number: 8123
  - match:
    - gateways:
      - istio-egressgateway-notebook
      port: 8123
      sniHosts:
      - <vm-name>.europe-west1-b.c.<google-project-name>.internal
    route:
    - destination:
        host: <vm-name>.europe-west1-b.c.<google-project-name>.internal
        subset: notebook-ext
        port:
          number: 8123
        weight: 100
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: notebook
  namespace: istio-system
spec:
  #exportTo: ["."]
  host: <vm-name>.europe-west1-b.c.<google-project-name>.internal
  subsets:
  - name: notebook-ext  
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
    - port:
        number: 8123
      tls:
        mode: SIMPLE
        sni: <vm-name>.europe-west1-b.c.<google-project-name>.internal
        serverCertificate: /temp-certs/cert-chain.pem
        privateKey: /temp-certs/key.pem
        caCertificates: /temp-certs/root-cert.pem

最終目標是在 http 上的網格中提供可用的內容，這些內容將通過 egressgateway，並且 TLS 將從那裡發起。這是因為我們希望將來自公共入口網關的流量透過出口網關引導回到網格之外的外部服務。擁有 HTTPS

上述憑證存在於出口網關 Pod 中，如下所示：

如果我在 egressgateway pod 中執行，curl https://<vm-name>.europe-west1-b.c.<google-project-name>.internal:8123 --cacert /temp-certs/root-cert.pem -v我會收到來自外部虛擬機器的回應。

有什麼想法為什麼會發生這種情況嗎？