Istio injected DB apps, make their service type as NodePort, the nodeport cannot be accessed

1
votes

I am using istio 1.0.2 version with istio-demo-auth.yaml, I have one mssql and activemq deployed in the same namespaces with other applications, both were be injected by istioctl. The applications can connect to those two services inside the cluster, but I make those two services' type as NodePort, it succeeded, but I cannot access those nodeport(52433, 51618, or 58161).

kubectl get svc -n $namespace
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
amq-master-01 NodePort 10.254.176.151 61618:51618/TCP,8161:58161/TCP 4h
mssql-master NodePort 10.254.209.36 2433:52433/TCP 33m

kubectl get deployment -n $namespace
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
activemq 1 1 1 1 4h
mssql-master 1 1 1 1 44m

Then I try to use gateway and virtualservice for using ingressgateway tcp port 31400. It works, as below:

    apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: tcp-gateway
      namespace: multitenancy
    spec:
      selector:
        istio: ingressgateway
      servers:
      - port:
          number: 31400
          name: tcp
          protocol: TCP
        hosts:
        - "*"
    ---
    apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: mssql-tcp
      namespace: multitenancy
    spec:
      gateways:
      - tcp-gateway
      hosts:
      - "*"
      tcp:
      - match:
        - port: 31400
        route:
        - destination:
            host: mssql-master
            port:
              number: 2433

My question is,
1. How to configure for another http connection for 61618 or other tcp connections? Currently I can only use 31400 for one service(mssql-2433).
2. Why is that nodeport is not working after I inject those application into istio, how could it be work?
Thanks.

1
istio

1 Answers

0
votes

Referring to the documentation:

Type NodePort

If you set the type field to NodePort, the Kubernetes master will allocate a port from a range specified by --service-node-port-range flag (default: 30000-32767), and each Node will proxy that port (the same port number on every Node) into your Service. That port will be reported in your Service’s .spec.ports[*].nodePort field.

Just update your config of all masters and you will be able to allocate any port.

Regarding to the second question: I suggest you to create an issue on github, because it looks like a bug, there are no restrictions to use nodePort in the documentation.