workshop

istio workshop

安裝istio-snippets

安裝User-agent Switcher

what's my user agent

Kubernetes Ingress controllers comparison

URL

Components of URLs

Service mesh

service mesh

Envoy

envoy

術語 說明
Downstream 前端
Upstream 後端

envoy

術語 說明 ex
Listener 前端監聽的位址 www.example.com, 123.123.123.123
Router 路由規則 443 -> 80, path strip, add/remove header
Cluster 後端服務的集合 web server cluster
Endpoint 後端服務的port 80 port
Host 服務主體 web01, web02, web03

Envoy xDS API

  • CDS(Cluster Discovery Service)
  • EDS(Endpoint Discovery Service)
  • HDS(Health Discovery Service)
  • LDS(Listener Discovery Service)
  • MS(Metric Service)
  • RLS(Rate Limit Service)
  • RDS(Route Discovery Service)
  • SDS(Secret Discovery Service)
  • ADS (Aggregated Discovery Service)

Istio

  • Mixer: 負責整個服務網格中的存取控制,使用策略,數據收集
  • Pilot: 提供流量控制,路由,超時,重試,斷路器
  • Citadel: 負責服務之間認證以及憑證管理等功能

istio architecture

istio

術語 縮寫 說明
ingress gateway gw 前端
VirtualService vs 後端
DestinationRule dr 路由規則
egress gateway x 外部資源
serviceEntry x 外部資源

Install istio

下載最新版本

curl -L https://istio.io/downloadIstio | sh -

下載指定版本

curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.6.8 TARGET_ARCH=x86_64 sh -

設定環境變數

export PATH=$HOME/istio-1.7.3/bin:$PATH

istio安裝參數

istioctl install \ --set values.global.proxy.holdApplicationUntilProxyStarts=true \ --set values.gateways.istio-ingressgateway.type=NodePort \ --set meshConfig.accessLogFile=/dev/stdout \ --set meshConfig.accessLogEncoding=JSON
參數 說明
holdApplicationUntilProxyStarts 啟動完istio元件後,再啟動app pod
istio-ingressgateway.type ingressgateway type
meshConfig.accessLogFile 啟動envoy log
meshConfig.accessLogEncoding log type

更新ingress-gateway的nodeport為30080

kubectl patch svc istio-ingressgateway --patch '{"spec":{"ports":[{"port": 80, "nodePort":30080}]}}' -n istio-system

Addon

kubectl apply -f istio-1.7.3/samples/addons

Sidecar injection

# 手動注入 istioctl kube-inject -f deployment.yaml | kubectl apply -f - # 自動注入 kubectl label namespace default istio-injection=enabled # spec.temeplate.metadata.annotation sidecar.istio.io/inject: "false"

sidecar injection
Istio injector annotations don't work

結論: 啟用namespace自動注入,再用annotation控制

Ingress Gateway

cd ~/istio-1.7.3/samples/addons kubectl apply -f prometheus.yaml kubectl apply -f grafana.yaml kubectl apply -f jaeger.yaml kubectl get pod,svc -n istio-system
NAME READY STATUS RESTARTS AGE pod/grafana-75b5cddb4d-r4jd6 1/1 Running 0 82s pod/istio-ingressgateway-78b6cf98f4-5dm5j 1/1 Running 0 2m41s pod/istiod-fb4fbff6b-v7mcv 1/1 Running 0 2m45s pod/jaeger-5795c4cf99-8c969 1/1 Running 0 67s pod/prometheus-9d5676d95-5h2gr 2/2 Running 0 75s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/grafana ClusterIP 10.100.49.43 <none> 3000/TCP 82s service/istio-ingressgateway LoadBalancer 10.108.59.56 localhost 15021:32386/TCP,80:30018/TCP,443:30012/TCP,15443:31938/TCP 2m41s service/istiod ClusterIP 10.97.134.135 <none> 15010/TCP,15012/TCP,443/TCP,15014/TCP,853/TCP 2m45s service/prometheus ClusterIP 10.100.21.203 <none> 9090/TCP 75s service/tracing ClusterIP 10.98.158.159 <none> 80/TCP 66s service/zipkin ClusterIP 10.110.33.86 <none> 9411/TCP 66s
apiVersion: networking.istio.io/v1alpha3 kind: Gateway metadata: name: addon-gateway spec: selector: istio: ingressgateway servers: - port: number: 80 name: http protocol: HTTP hosts: - prometheus.127.0.0.1.nip.io - grafana.127.0.0.1.nip.io - jaeger.127.0.0.1.nip.io - whoami.127.0.0.1.nip.io --- apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: grafana spec: hosts: - grafana.127.0.0.1.nip.io gateways: - addon-gateway http: - route: - destination: host: grafana.istio-system.svc.cluster.local --- apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: jaeger spec: hosts: - jaeger.127.0.0.1.nip.io gateways: - addon-gateway http: - name: default match: - uri: prefix: /jaeger route: - destination: host: tracing.istio-system.svc.cluster.local --- apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: prometheus spec: hosts: - prometheus.127.0.0.1.nip.io gateways: - addon-gateway http: - match: - headers: user-agent: exact: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0" route: - destination: host: prometheus.istio-system.svc.cluster.local
kubectl get gw,vs
NAME AGE gateway.networking.istio.io/addon-gateway 2s NAME GATEWAYS HOSTS AGE virtualservice.networking.istio.io/grafana [addon-gateway] [grafana.127.0.0.1.nip.io] 2s virtualservice.networking.istio.io/jaeger [addon-gateway] [jaeger.127.0.0.1.nip.io] 2s virtualservice.networking.istio.io/prometheus [addon-gateway] [prometheus.127.0.0.1.nip.io] 2s

Traffic Management

traefik/whoami github

deployment

  • template.metadata.annotations
  • labes: app, version
apiVersion: apps/v1 kind: Deployment metadata: name: whoami-v1 spec: selector: matchLabels: app: whoami version: v1 template: metadata: annotations: sidecar.istio.io/inject: "true" labels: app: whoami version: v1 spec: containers: - name: whoami image: whoami:v1 ports: - containerPort: 80 --- apiVersion: apps/v1 kind: Deployment metadata: name: whoami-v2 spec: selector: matchLabels: app: whoami version: v2 template: metadata: labels: app: whoami version: v2 annotations: sidecar.istio.io/inject: "true" spec: containers: - name: whoami image: whoami:v2 ports: - containerPort: 80

service

apiVersion: v1 kind: Service metadata: name: whoami spec: selector: app: whoami ports: - port: 80 targetPort: 80

virtual service

# See more at https://istio.io/docs/reference/config/networking/virtual-service/ apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: whoami spec: hosts: - whoami.127.0.0.1.nip.io gateways: - addon-gateway http: - name: v1 timeout: 2s route: - destination: host: whoami subset: v1 weight: 90 - destination: host: whoami subset: v2 weight: 10

destination rule

# See more at https://istio.io/docs/reference/config/networking/destination-rule/ apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: whoami spec: host: whoami subsets: - name: v1 labels: version: v1 - name: v2 labels: version: v2

kubectl get pod,svc,vs,dr

NAME READY STATUS RESTARTS AGE pod/whoami-v1-79f555c9bf-xlxcw 2/2 Running 0 62s pod/whoami-v2-5d4956f4c7-cnb9j 2/2 Running 0 62s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 6d1h service/whoami ClusterIP 10.109.26.84 <none> 80/TCP 62s NAME GATEWAYS HOSTS AGE virtualservice.networking.istio.io/grafana [addon-gateway] [grafana.127.0.0.1.nip.io] 31m virtualservice.networking.istio.io/jaeger [addon-gateway] [jaeger.127.0.0.1.nip.io] 31m virtualservice.networking.istio.io/prometheus [addon-gateway] [prometheus.127.0.0.1.nip.io] 31m virtualservice.networking.istio.io/whoami [addon-gateway] [whoami.127.0.0.1.nip.io] 62s NAME HOST AGE destinationrule.networking.istio.io/whoami whoami 62s