'istio unable to access kubernetes dashboard

I am trying to access the Kubernetes Dashboard through an Istio Gateway + Virtual Service.

However, all I get is 404 page not found when I try to access the dashboard with browser. Accessing the Dashboard through k8s NodePort or k8s LoadBalancer service works just as expected. The pod, however, complains in the logs about http: TLS handshake error from 127.0.0.6:52483: remote error: tls: bad certificate.

Running httpbin through Istio (as given in their documentation) works as expected, so Istio seem to be working fine as well.

I am using the official Kubernetes Dashboard YAML-s. I am giving the service below (with type: LoadBalancer added, although it doesn't seem to make a difference for Istio, although it allows me to access the Dashboard through a separate IP).

Just for the record, my k8s cluster is comprised of VirtualBox machines running MetalLB.

kubectl get services --all-namespaces returns the following:

NAMESPACE              NAME                              TYPE           CLUSTER-IP       EXTERNAL-IP     PORT(S)                                      AGE
default                kubernetes                        ClusterIP      10.96.0.1        <none>          443/TCP                                      11d
httpbin                httpbin                           ClusterIP      10.100.186.188   <none>          8000/TCP                                     47h
istio-system           istio-egressgateway               ClusterIP      10.109.231.163   <none>          80/TCP,443/TCP                               5d3h
istio-system           istio-ingressgateway              LoadBalancer   10.111.188.94    192.168.56.46   15021:31440/TCP,80:31647/TCP,443:32715/TCP   5d3h
istio-system           istiod                            ClusterIP      10.104.236.247   <none>          15010/TCP,15012/TCP,443/TCP,15014/TCP        5d3h
kube-system            kube-dns                          ClusterIP      10.96.0.10       <none>          53/UDP,53/TCP,9153/TCP                       11d
kubernetes-dashboard   dashboard-metrics-scraper         ClusterIP      10.101.131.136   <none>          8000/TCP                                     43h
kubernetes-dashboard   kubernetes-dashboard-service      LoadBalancer   10.103.130.244   192.168.56.47   443:30041/TCP                                43h
kubernetes-dashboard   kubernetes-dashboard-service-np   NodePort       10.100.49.224    <none>          8443:30002/TCP                               43h

If I try to access the LoadBalancer directly via the IP from above and through browser, I get the usual Kubernetes Dashboard login page. The browser url is https://192.168.56.47.

YAML-s:

istio-gateway.yaml:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: kubernetes-dashboard-gateway
  namespace: kubernetes-dashboard
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: PASSTHROUGH
      hosts:
        - "*"

istio-virtual-service.yaml:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: kubernetes-dashboard-virtual-service
  namespace: kubernetes-dashboard
spec:
  hosts:
    - "*"
  gateways:
    - kubernetes-dashboard-gateway
  tls:
    - match:
        - sniHosts: ["*"]
      route:
        - destination:
            host: kubernetes-dashboard-service
            port:
              number: 443

dashboard-service.yaml:

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard-service
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 443
      targetPort: 8443
    # - port: 8000
    #   targetPort: 9090
  selector:
    k8s-app: kubernetes-dashboard
  type: LoadBalancer
kubernetesnetworkinghttpsistioistio-gateway


Solution 1:[1]

User suren has mentioned:

your gateway is listening 443. not 80

Yes, this could be a problem. You are trying to reach port 80, but you are exposing only port 443. Try to change your configuration or change your port during request.

See albo documentation about Deploy and Access the Kubernetes Dashboard.

Solution 2:[2]

Hm, I got it working with the configuration as above and with explicitly specifying a host in all places where I have previously placed a "*". I had to add that host in /etc/hosts to be able to access it in browser.

It seems that this last part was key, as well as specifying the sniHost in the Virtual Service. The other problems were mostly configuration issues with the TLS. Setting it to PASSTHROUGH seems to work, because it forces Istio to sort of forward the HTTPS request to the Kubernetes Dashboard, which is responsible for decrypting etc.

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source
Solution 1 Miko?aj G?odziak
Solution 2 cyau

Related Questions