Istio实战(六)- Istio 部署

部署Istio方法

  1. Istioctl
  2. Istio Operator
  3. Helm

4.2 使用Istioctl 部署

# mkdir /apps
# cd /apps
# curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.13.3 TARGET_ARCH=x86_64 sh -
# ln -sf /apps/istio-1.13.3 /apps/istio
# ln -sf /apps/istio/bin/istioctl /usr/bin/

4.3 查看Istio内置档案

# istioctl profile list
Istio configuration profiles:
    default
    demo
    empty
    external
    minimal
    openshift
    preview
    remote

4.4 部署Istio集群

# istioctl install -s profile=demo -y
✔ Istio core installed                                                                                                                                       
✔ Istiod installed                                                                                                                                           
✔ Ingress gateways installed                                                                                                                                 
✔ Egress gateways installed                                                                                                                                  
✔ Installation complete                                                                                                                                      
Making this installation the default for injection and validation.

Thank you for installing Istio 1.13.  Please take a few minutes to tell us about your install/upgrade experience!  https://forms.gle/pzWZpAvMVBecaQ9h9
# kubectl get pods -n istio-system 
NAME                                   READY   STATUS    RESTARTS   AGE
istio-egressgateway-5c597cdb77-48bj8   1/1     Running   0          95s
istio-ingressgateway-8d7d49b55-bmbx5   1/1     Running   0          95s
istiod-54c54679d7-78f2d                1/1     Running   0          119s

4.5 安装组件

# kubectl apply -f samples/addons/
serviceaccount/grafana created
configmap/grafana created
service/grafana created
deployment.apps/grafana created
configmap/istio-grafana-dashboards created
configmap/istio-services-grafana-dashboards created
deployment.apps/jaeger created
service/tracing created
service/zipkin created
service/jaeger-collector created
serviceaccount/kiali created
configmap/kiali created
clusterrole.rbac.authorization.k8s.io/kiali-viewer created
clusterrole.rbac.authorization.k8s.io/kiali created
clusterrolebinding.rbac.authorization.k8s.io/kiali created
role.rbac.authorization.k8s.io/kiali-controlplane created
rolebinding.rbac.authorization.k8s.io/kiali-controlplane created
service/kiali created
deployment.apps/kiali created
serviceaccount/prometheus created
configmap/prometheus created
clusterrole.rbac.authorization.k8s.io/prometheus configured
clusterrolebinding.rbac.authorization.k8s.io/prometheus configured
service/prometheus created
deployment.apps/prometheus created
# kubectl get svc -n istio-system 
NAME                   TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                      AGE
grafana                ClusterIP      10.200.62.191    <none>        3000/TCP                                                                     70s
istio-egressgateway    ClusterIP      10.200.29.127    <none>        80/TCP,443/TCP                                                               8m58s
istio-ingressgateway   LoadBalancer   10.200.239.76    <pending>     15021:49708/TCP,80:42116/TCP,443:61970/TCP,31400:56204/TCP,15443:45720/TCP   8m58s
istiod                 ClusterIP      10.200.249.97    <none>        15010/TCP,15012/TCP,443/TCP,15014/TCP                                        9m23s
jaeger-collector       ClusterIP      10.200.4.90      <none>        14268/TCP,14250/TCP,9411/TCP                                                 70s
kiali                  ClusterIP      10.200.132.85    <none>        20001/TCP,9090/TCP                                                           69s
prometheus             ClusterIP      10.200.99.200    <none>        9090/TCP                                                                     69s
tracing                ClusterIP      10.200.160.255   <none>        80/TCP,16685/TCP                                                             70s
zipkin                 ClusterIP      10.200.92.91     <none>        9411/TCP                                                                     70s
# kubectl get pods -n istio-system 
NAME                                   READY   STATUS    RESTARTS   AGE
grafana-6c5dc6df7c-96cwc               1/1     Running   0          2m31s
istio-egressgateway-5c597cdb77-48bj8   1/1     Running   0          10m
istio-ingressgateway-8d7d49b55-bmbx5   1/1     Running   0          10m
istiod-54c54679d7-78f2d                1/1     Running   0          10m
jaeger-9dd685668-hmg9c                 1/1     Running   0          2m31s
kiali-699f98c497-wjtwl                 1/1     Running   0          2m30s
prometheus-699b7cc575-5d7gk            2/2     Running   0          2m30s

4.6 建立命名空间

root@k8s-master-01:/apps/istio# kubectl create ns hr
namespace/hr created
root@k8s-master-01:/apps/istio# kubectl label ns hr istio-injection=enabled
namespace/hr labeled

4.7 部署测试镜像

启动一个测试pod,可以看到会自动注入一个container

ot@k8s-master-01:/apps/istio# kubectl apply -f samples/sleep/sleep.yaml -n hr
serviceaccount/sleep created
service/sleep created
deployment.apps/sleep created
root@k8s-master-01:/apps/istio# kubectl get pods -n hr
NAME                     READY   STATUS    RESTARTS   AGE
sleep-557747455f-k8qzc   2/2     Running   0          32s
oot@k8s-master-01:/apps/istio# kubectl get pods -n hr sleep-557747455f-k8qzc -o yaml
...略
  containerStatuses:
  - containerID: docker://4f376791fe667e23910a512710839e82913df2191fc8fc288e9bfd441e9f1b23
    image: istio/proxyv2:1.13.3
    imageID: docker-pullable://istio/proxyv2@sha256:e8986efce46a7e1fcaf837134f453ea2b5e0750a464d0f2405502f8ddf0e2cd2
    lastState: {}
    name: istio-proxy
    ready: true
    restartCount: 0
    started: true
    state:
      running:
        startedAt: "2022-10-11T09:05:13Z"
root@k8s-master-01:/apps/istio# istioctl ps
NAME                                                  CLUSTER        CDS        LDS        EDS        RDS          ISTIOD                      VERSION
istio-egressgateway-5c597cdb77-48bj8.istio-system     Kubernetes     SYNCED     SYNCED     SYNCED     NOT SENT     istiod-54c54679d7-78f2d     1.13.3
istio-ingressgateway-8d7d49b55-bmbx5.istio-system     Kubernetes     SYNCED     SYNCED     SYNCED     NOT SENT     istiod-54c54679d7-78f2d     1.13.3
sleep-557747455f-k8qzc.hr                             Kubernetes     SYNCED     SYNCED     SYNCED     SYNCED       istiod-54c54679d7-78f2d     1.13.3

root@k8s-master-01:/apps/istio# istioctl pc listener sleep-557747455f-k8qzc.hr
ADDRESS        PORT  MATCH                                                                                         DESTINATION
10.200.0.2     53    ALL                                                                                           Cluster: outbound|53||kube-dns.kube-system.svc.cluster.local
0.0.0.0        80    Trans: raw_buffer; App: http/1.1,h2c                                                          Route: 80
0.0.0.0        80    ALL                                                                                           PassthroughCluster
10.200.103.146 80    Trans: raw_buffer; App: http/1.1,h2c                                                          Route: tomcat-service.default.svc.cluster.local:80
10.200.103.146 80    ALL                                                                                           Cluster: outbound|80||tomcat-service.default.svc.cluster.local
10.200.0.1     443   ALL                                                                                           Cluster: outbound|443||kubernetes.default.svc.cluster.local
10.200.133.113 443   Trans: raw_buffer; App: http/1.1,h2c                                                          Route: kubernetes-dashboard.kubernetes-dashboard.svc.cluster.local:443
10.200.133.113 443   ALL                                                                                           Cluster: outbound|443||kubernetes-dashboard.kubernetes-dashboard.svc.cluster.local
10.200.176.11  443   ALL                                                                                           Cluster: outbound|443||ingress-nginx-controller-admission.ingress-nginx.svc.cluster.local
10.200.239.76  443   ALL                                                                                           Cluster: outbound|443||istio-ingressgateway.istio-system.svc.cluster.local
10.200.249.97  443   ALL                                                                                           Cluster: outbound|443||istiod.istio-system.svc.cluster.local
10.200.29.127  443   ALL                                                                                           Cluster: outbound|443||istio-egressgateway.istio-system.svc.cluster.local
10.200.91.80   443   ALL                                                                                           Cluster: outbound|443||metrics-server.kube-system.svc.cluster.local
10.200.62.191  3000  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: grafana.istio-system.svc.cluster.local:3000
10.200.62.191  3000  ALL                                                                                           Cluster: outbound|3000||grafana.istio-system.svc.cluster.local
192.168.31.101 4194  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: kubelet.kube-system.svc.cluster.local:4194
192.168.31.101 4194  ALL                                                                                           Cluster: outbound|4194||kubelet.kube-system.svc.cluster.local
192.168.31.102 4194  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: kubelet.kube-system.svc.cluster.local:4194
192.168.31.102 4194  ALL                                                                                           Cluster: outbound|4194||kubelet.kube-system.svc.cluster.local
192.168.31.103 4194  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: kubelet.kube-system.svc.cluster.local:4194
192.168.31.103 4194  ALL                                                                                           Cluster: outbound|4194||kubelet.kube-system.svc.cluster.local
192.168.31.111 4194  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: kubelet.kube-system.svc.cluster.local:4194
192.168.31.111 4194  ALL                                                                                           Cluster: outbound|4194||kubelet.kube-system.svc.cluster.local
192.168.31.112 4194  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: kubelet.kube-system.svc.cluster.local:4194
192.168.31.112 4194  ALL                                                                                           Cluster: outbound|4194||kubelet.kube-system.svc.cluster.local
192.168.31.113 4194  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: kubelet.kube-system.svc.cluster.local:4194
192.168.31.113 4194  ALL                                                                                           Cluster: outbound|4194||kubelet.kube-system.svc.cluster.local
192.168.31.114 4194  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: kubelet.kube-system.svc.cluster.local:4194
192.168.31.114 4194  ALL                                                                                           Cluster: outbound|4194||kubelet.kube-system.svc.cluster.local
10.200.41.11   8000  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: dashboard-metrics-scraper.kubernetes-dashboard.svc.cluster.local:8000
10.200.41.11   8000  ALL                                                                                           Cluster: outbound|8000||dashboard-metrics-scraper.kubernetes-dashboard.svc.cluster.local
0.0.0.0        8080  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: 8080
0.0.0.0        8080  ALL                                                                                           PassthroughCluster
10.200.98.90   8080  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: kube-state-metrics.kube-system.svc.cluster.local:8080
10.200.98.90   8080  ALL                                                                                           Cluster: outbound|8080||kube-state-metrics.kube-system.svc.cluster.local
0.0.0.0        9090  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: 9090
0.0.0.0        9090  ALL                                                                                           PassthroughCluster
10.200.241.145 9090  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: prometheus.monitoring.svc.cluster.local:9090
10.200.241.145 9090  ALL                                                                                           Cluster: outbound|9090||prometheus.monitoring.svc.cluster.local
0.0.0.0        9100  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: 9100
0.0.0.0        9100  ALL                                                                                           PassthroughCluster
10.200.0.2     9153  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: kube-dns.kube-system.svc.cluster.local:9153
10.200.0.2     9153  ALL                                                                                           Cluster: outbound|9153||kube-dns.kube-system.svc.cluster.local
0.0.0.0        9411  Trans: raw_buffer; App: http/1.1,h2c                                                          Route: 9411
0.0.0.0        9411  ALL                                                                                           PassthroughCluster
192.168.31.101 10250 ALL                                                                                           Cluster: outbound|10250||kubelet.kube-system.svc.cluster.local
192.168.31.102 10250 ALL                                                                                           Cluster: outbound|10250||kubelet.kube-system.svc.cluster.local
192.168.31.103 10250 ALL                                                                                           Cluster: outbound|10250||kubelet.kube-system.svc.cluster.local
192.168.31.111 10250 ALL                                                                                           Cluster: outbound|10250||kubelet.kube-system.svc.cluster.local
192.168.31.112 10250 ALL                                                                                           Cluster: outbound|10250||kubelet.kube-system.svc.cluster.local
192.168.31.113 10250 ALL                                                                                           Cluster: outbound|10250||kubelet.kube-system.svc.cluster.local
192.168.31.114 10250 ALL                                                                                           Cluster: outbound|10250||kubelet.kube-system.svc.cluster.local
0.0.0.0        10255 Trans: raw_buffer; App: http/1.1,h2c                                                          Route: 10255
0.0.0.0        10255 ALL                                                                                           PassthroughCluster
10.200.4.90    14250 Trans: raw_buffer; App: http/1.1,h2c                                                          Route: jaeger-collector.istio-system.svc.cluster.local:14250
10.200.4.90    14250 ALL                                                                                           Cluster: outbound|14250||jaeger-collector.istio-system.svc.cluster.local
10.200.4.90    14268 Trans: raw_buffer; App: http/1.1,h2c                                                          Route: jaeger-collector.istio-system.svc.cluster.local:14268
10.200.4.90    14268 ALL                                                                                           Cluster: outbound|14268||jaeger-collector.istio-system.svc.cluster.local
0.0.0.0        15001 ALL                                                                                           PassthroughCluster
0.0.0.0        15001 Addr: *:15001                                                                                 Non-HTTP/Non-TCP
0.0.0.0        15006 Addr: *:15006                                                                                 Non-HTTP/Non-TCP
0.0.0.0        15006 Trans: tls; App: istio-http/1.0,istio-http/1.1,istio-h2; Addr: 0.0.0.0/0                      InboundPassthroughClusterIpv4
0.0.0.0        15006 Trans: raw_buffer; App: http/1.1,h2c; Addr: 0.0.0.0/0                                         InboundPassthroughClusterIpv4
0.0.0.0        15006 Trans: tls; App: TCP TLS; Addr: 0.0.0.0/0                                                     InboundPassthroughClusterIpv4
0.0.0.0        15006 Trans: raw_buffer; Addr: 0.0.0.0/0                                                            InboundPassthroughClusterIpv4
0.0.0.0        15006 Trans: tls; Addr: 0.0.0.0/0                                                                   InboundPassthroughClusterIpv4
0.0.0.0        15006 Trans: tls; App: istio,istio-peer-exchange,istio-http/1.0,istio-http/1.1,istio-h2; Addr: *:80 Cluster: inbound|80||
0.0.0.0        15006 Trans: raw_buffer; Addr: *:80                                                                 Cluster: inbound|80||
0.0.0.0        15010 Trans: raw_buffer; App: http/1.1,h2c                                                          Route: 15010
0.0.0.0        15010 ALL                                                                                           PassthroughCluster
10.200.249.97  15012 ALL                                                                                           Cluster: outbound|15012||istiod.istio-system.svc.cluster.local
0.0.0.0        15014 Trans: raw_buffer; App: http/1.1,h2c                                                          Route: 15014
0.0.0.0        15014 ALL                                                                                           PassthroughCluster
0.0.0.0        15021 ALL                                                                                           Inline Route: /healthz/ready*
10.200.239.76  15021 Trans: raw_buffer; App: http/1.1,h2c                                                          Route: istio-ingressgateway.istio-system.svc.cluster.local:15021
10.200.239.76  15021 ALL                                                                                           Cluster: outbound|15021||istio-ingressgateway.istio-system.svc.cluster.local
0.0.0.0        15090 ALL                                                                                           Inline Route: /stats/prometheus*
10.200.239.76  15443 ALL                                                                                           Cluster: outbound|15443||istio-ingressgateway.istio-system.svc.cluster.local
0.0.0.0        16685 Trans: raw_buffer; App: http/1.1,h2c                                                          Route: 16685
0.0.0.0        16685 ALL                                                                                           PassthroughCluster
0.0.0.0        20001 Trans: raw_buffer; App: http/1.1,h2c                                                          Route: 20001
0.0.0.0        20001 ALL                                                                                           PassthroughCluster
10.200.239.76  31400 ALL                                                                                           Cluster: outbound|31400||istio-ingressgateway.istio-system.svc.cluster.local

查看endpoint

root@k8s-master-01:~# istioctl pc ep sleep-557747455f-k8qzc.hr
ENDPOINT                         STATUS      OUTLIER CHECK     CLUSTER
10.200.92.91:9411                HEALTHY     OK                zipkin
127.0.0.1:15000                  HEALTHY     OK                prometheus_stats
127.0.0.1:15020                  HEALTHY     OK                agent
172.100.109.65:8443              HEALTHY     OK                outbound|443||kubernetes-dashboard.kubernetes-dashboard.svc.cluster.local
172.100.109.66:8080              HEALTHY     OK                outbound|8080||kube-state-metrics.kube-system.svc.cluster.local
172.100.109.73:9090              HEALTHY     OK                outbound|9090||prometheus.istio-system.svc.cluster.local
172.100.109.74:9411              HEALTHY     OK                outbound|9411||jaeger-collector.istio-system.svc.cluster.local
172.100.109.74:9411              HEALTHY     OK                outbound|9411||zipkin.istio-system.svc.cluster.local
172.100.109.74:14250             HEALTHY     OK                outbound|14250||jaeger-collector.istio-system.svc.cluster.local
172.100.109.74:14268             HEALTHY     OK                outbound|14268||jaeger-collector.istio-system.svc.cluster.local
172.100.109.74:16685             HEALTHY     OK                outbound|16685||tracing.istio-system.svc.cluster.local
172.100.109.74:16686             HEALTHY     OK                outbound|80||tracing.istio-system.svc.cluster.local
172.100.109.82:8080              HEALTHY     OK                outbound|8080||ehelp-tomcat-service.ehelp.svc.cluster.local
172.100.109.87:4443              HEALTHY     OK                outbound|443||metrics-server.kube-system.svc.cluster.local
172.100.140.74:8080              HEALTHY     OK                outbound|8080||ehelp-tomcat-service.ehelp.svc.cluster.local
172.100.183.184:15010            HEALTHY     OK                outbound|15010||istiod.istio-system.svc.cluster.local
172.100.183.184:15012            HEALTHY     OK                outbound|15012||istiod.istio-system.svc.cluster.local
172.100.183.184:15014            HEALTHY     OK                outbound|15014||istiod.istio-system.svc.cluster.local
172.100.183.184:15017            HEALTHY     OK                outbound|443||istiod.istio-system.svc.cluster.local
172.100.183.185:8080             HEALTHY     OK                outbound|80||istio-ingressgateway.istio-system.svc.cluster.local
172.100.183.185:8443             HEALTHY     OK                outbound|443||istio-ingressgateway.istio-system.svc.cluster.local
172.100.183.185:15021            HEALTHY     OK                outbound|15021||istio-ingressgateway.istio-system.svc.cluster.local
172.100.183.185:15443            HEALTHY     OK                outbound|15443||istio-ingressgateway.istio-system.svc.cluster.local
172.100.183.185:31400            HEALTHY     OK                outbound|31400||istio-ingressgateway.istio-system.svc.cluster.local
172.100.183.186:8080             HEALTHY     OK                outbound|80||istio-egressgateway.istio-system.svc.cluster.local
172.100.183.186:8443             HEALTHY     OK                outbound|443||istio-egressgateway.istio-system.svc.cluster.local
172.100.183.187:3000             HEALTHY     OK                outbound|3000||grafana.istio-system.svc.cluster.local
172.100.183.188:9090             HEALTHY     OK                outbound|9090||kiali.istio-system.svc.cluster.local
172.100.183.188:20001            HEALTHY     OK                outbound|20001||kiali.istio-system.svc.cluster.local
172.100.183.189:80               HEALTHY     OK                outbound|80||sleep.hr.svc.cluster.local
172.100.76.163:53                HEALTHY     OK                outbound|53||kube-dns.kube-system.svc.cluster.local
172.100.76.163:9153              HEALTHY     OK                outbound|9153||kube-dns.kube-system.svc.cluster.local
172.100.76.165:8000              HEALTHY     OK                outbound|8000||dashboard-metrics-scraper.kubernetes-dashboard.svc.cluster.local
172.100.76.167:9090              HEALTHY     OK                outbound|9090||prometheus.monitoring.svc.cluster.local
192.168.31.101:6443              HEALTHY     OK                outbound|443||kubernetes.default.svc.cluster.local
192.168.31.101:8443              HEALTHY     OK                outbound|443||ingress-nginx-controller-admission.ingress-nginx.svc.cluster.local
192.168.31.101:9100              HEALTHY     OK                outbound|9100||node-exporter.monitoring.svc.cluster.local
192.168.31.102:6443              HEALTHY     OK                outbound|443||kubernetes.default.svc.cluster.local
192.168.31.102:8443              HEALTHY     OK                outbound|443||ingress-nginx-controller-admission.ingress-nginx.svc.cluster.local
192.168.31.102:9100              HEALTHY     OK                outbound|9100||node-exporter.monitoring.svc.cluster.local
192.168.31.103:6443              HEALTHY     OK                outbound|443||kubernetes.default.svc.cluster.local
192.168.31.103:8443              HEALTHY     OK                outbound|443||ingress-nginx-controller-admission.ingress-nginx.svc.cluster.local
192.168.31.103:9100              HEALTHY     OK                outbound|9100||node-exporter.monitoring.svc.cluster.local
192.168.31.111:8443              HEALTHY     OK                outbound|443||ingress-nginx-controller-admission.ingress-nginx.svc.cluster.local
192.168.31.111:9100              HEALTHY     OK                outbound|9100||node-exporter.monitoring.svc.cluster.local
192.168.31.112:8443              HEALTHY     OK                outbound|443||ingress-nginx-controller-admission.ingress-nginx.svc.cluster.local
192.168.31.112:9100              HEALTHY     OK                outbound|9100||node-exporter.monitoring.svc.cluster.local
192.168.31.113:8443              HEALTHY     OK                outbound|443||ingress-nginx-controller-admission.ingress-nginx.svc.cluster.local
192.168.31.113:9100              HEALTHY     OK                outbound|9100||node-exporter.monitoring.svc.cluster.local
192.168.31.114:8443              HEALTHY     OK                outbound|443||ingress-nginx-controller-admission.ingress-nginx.svc.cluster.local
192.168.31.114:9100              HEALTHY     OK                outbound|9100||node-exporter.monitoring.svc.cluster.local
unix://./etc/istio/proxy/SDS     HEALTHY     OK                sds-grpc
unix://./etc/istio/proxy/XDS     HEALTHY     OK                xds-grpc
root@k8s-master-01:~# kubectl get pods -o wide -n hr
NAME                     READY   STATUS    RESTARTS   AGE   IP                NODE             NOMINATED NODE   READINESS GATES
sleep-557747455f-k8qzc   2/2     Running   0          15h   172.100.183.189   192.168.31.103   <none>           <none>

4.8 通过网格访问

进入pod,通过网格访问kiali和grafana

root@k8s-master-01:~# kubectl exec -it sleep-557747455f-k8qzc -n hr sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ $ curl kiali.istio-system:20001
<a href="/kiali/">Found</a>.
## 访问grafana
/ $ curl grafana.istio-system:3000
<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"/><meta name="viewport" content="width=device-width"/><meta name="theme-color" content="#000"/><title>Grafana</title><base href="/"/><link rel="preload" href="public/fonts/roboto/RxZJdnzeo3R5zSexge8UUVtXRa8TVwTICgirnJhmVJw.woff2" as="font" crossorigin/><link rel="icon" type="image/png" href="public/img/fav32.png"/><link rel="apple-touch-icon" sizes="180x180" href="public/img/apple-touch-icon.png"/><link rel="mask-icon" href="public/img/grafana_mask_icon.svg" color="#F05A28"/><link rel="stylesheet" href="public/build/grafana.dark.fab5d6bbd438adca1160.css"/><script nonce="">performance.mark('frontend_boot_css_time_seconds');</script><meta name="apple-mobile-web-app-capable" content="yes"/><meta name="apple-mobile-web-app-status-bar-style" content="black"/><meta name="msapplication-TileColor" content="#2b5797"/><
略

5. 网格内的服务发现

5.1 deployment.yaml

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: demoappv10
    version: v1.0
  name: demoappv10
spec:
  progressDeadlineSeconds: 600
  replicas: 3
  selector:
    matchLabels:
      app: demoapp
      version: v1.0
  template:
    metadata:
      labels:
        app: demoapp
        version: v1.0
    spec:
      containers:
      - image: ikubernetes/demoapp:v1.0
        imagePullPolicy: IfNotPresent
        name: demoapp
        env:
        - name: "PORT"
          value: "8080"
        ports:
        - containerPort: 8080
          name: web
          protocol: TCP
        resources:
          limits:
            cpu: 50m
---
apiVersion: v1
kind: Service
metadata:
  name: demoappv10
spec:
  ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: 8080
  selector:
    app: demoapp
    version: v1.0
  type: ClusterIP
---

# kubectl apply -f deploy-demoapp.yaml
deployment.apps/demoappv10 created
service/demoappv10 created
# kubectl get pod -n hr -o wide
NAME                          READY   STATUS    RESTARTS   AGE     IP                NODE             NOMINATED NODE   READINESS GATES
demoappv10-6ff964cbff-bnlgx   2/2     Running   0          4m25s   172.100.183.190   192.168.31.103   <none>           <none>
demoappv10-6ff964cbff-ccsnc   2/2     Running   0          4m25s   172.100.76.166    192.168.31.113   <none>           <none>
demoappv10-6ff964cbff-vp7gw   2/2     Running   0          4m25s   172.100.109.77    192.168.31.111   <none>           <none>
sleep-557747455f-k8qzc        2/2     Running   0          15h     172.100.183.189   192.168.31.103   <none>           <none>
# kubectl get svc -n hr -o wide
NAME         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE     SELECTOR
demoappv10   ClusterIP   10.200.156.253   <none>        8080/TCP   2m55s   app=demoapp,version=v1.0
sleep        ClusterIP   10.200.210.162   <none>        80/TCP     15h     app=sleep

此时路由已经显示了demoapp的8080

# istioctl pc route sleep-557747455f-k8qzc.hr|grep demo
8080                                                                      demoappv10, demoappv10.hr + 1 more...                /* 
# istioctl pc cluster sleep-557747455f-k8qzc.hr|grep demo
demoappv10.hr.svc.cluster.local                                        8080      -          outbound      EDS    
## 此时后端的ep也被发现
# istioctl pc ep sleep-557747455f-k8qzc.hr|grep demo
172.100.109.77:8080              HEALTHY     OK                outbound|8080||demoappv10.hr.svc.cluster.local
172.100.183.190:8080             HEALTHY     OK                outbound|8080||demoappv10.hr.svc.cluster.local
172.100.76.166:8080              HEALTHY     OK                outbound|8080||demoappv10.hr.svc.cluster.local

5.2 在sleep pod中测试通过网格访问demoapp10

/ $ curl demoappv10:8080
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-bnlgx, ServerIP: 172.100.183.190!
/ $ curl demoappv10:8080
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-vp7gw, ServerIP: 172.100.109.77!
/ $ curl demoappv10:8080
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-vp7gw, ServerIP: 172.100.109.77!
/ $ curl demoappv10:8080
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-ccsnc, ServerIP: 172.100.76.166!
/ $ curl demoappv10:8080
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-bnlgx, ServerIP: 172.100.183.190!

6. 使用Ingress添加端口方式实现kiali对外提供访问

想要将网格内部的服务实现对外提供服务,需要配置:

  1. Gateway
  2. VirtualService
  3. DestinationRule

6.1 gateway

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: kiali-gateway
  namespace: istio-system
spec:
  selector:
    app: istio-ingressgateway
  servers:
  - port:
      number: 20001
      name: http-kiali
      protocol: HTTP
    hosts:
    - "kiali.intra.com"
---

6.2 VirtualService

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: kiali-virtualservice
  namespace: istio-system
spec:
  hosts:
  - "kiali.intra.com"
  gateways:
  - kiali-gateway
  http:
  - match:
    - port: 20001
    route:
    - destination:
        host: kiali
        port:
          number: 20001
---

6.3 DestinationRule

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: kiali
  namespace: istio-system
spec:
  host: kiali
  trafficPolicy:
    tls:
      mode: DISABLE
---

6.4 部署kiali-gateway

# kubectl apply -f .
destinationrule.networking.istio.io/kiali created
gateway.networking.istio.io/kiali-gateway created
virtualservice.networking.istio.io/kiali-virtualservice created
root@k8s-master-01:/apps/istio-in-practise/Traffic-Management-Basics/kiali# kubectl get svc -n istio-system 
NAME                   TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                      AGE
grafana                ClusterIP      10.200.62.191    <none>        3000/TCP                                                                     17h
istio-egressgateway    ClusterIP      10.200.29.127    <none>        80/TCP,443/TCP                                                               17h
istio-ingressgateway   LoadBalancer   10.200.239.76    <pending>     15021:49708/TCP,80:42116/TCP,443:61970/TCP,31400:56204/TCP,15443:45720/TCP   17h
istiod                 ClusterIP      10.200.249.97    <none>        15010/TCP,15012/TCP,443/TCP,15014/TCP                                        17h
jaeger-collector       ClusterIP      10.200.4.90      <none>        14268/TCP,14250/TCP,9411/TCP                                                 17h
kiali                  ClusterIP      10.200.132.85    <none>        20001/TCP,9090/TCP                                                           17h
prometheus             ClusterIP      10.200.99.200    <none>        9090/TCP                                                                     17h
tracing                ClusterIP      10.200.160.255   <none>        80/TCP,16685/TCP                                                             17h
zipkin                 ClusterIP      10.200.92.91     <none>        9411/TCP                                                                     17h

6.5 查看侦听器

可以看到kiali的侦听已经在ingress上生成

# kubectl get pods -n istio-system 
NAME                                   READY   STATUS    RESTARTS   AGE
grafana-6c5dc6df7c-96cwc               1/1     Running   0          20h
istio-egressgateway-5c597cdb77-48bj8   1/1     Running   0          21h
istio-ingressgateway-8d7d49b55-bmbx5   1/1     Running   0          21h
istiod-54c54679d7-78f2d                1/1     Running   0          21h
jaeger-9dd685668-hmg9c                 1/1     Running   0          20h
kiali-699f98c497-wjtwl                 1/1     Running   0          20h
prometheus-699b7cc575-5d7gk            2/2     Running   0          20h
# istioctl pc listener istio-ingressgateway-8d7d49b55-bmbx5.istio-system
ADDRESS PORT  MATCH DESTINATION
0.0.0.0 15021 ALL   Inline Route: /healthz/ready*
0.0.0.0 15090 ALL   Inline Route: /stats/prometheus*
0.0.0.0 20001 ALL   Route: http.20001

6.6 service添加external地址

# kubectl edit svc istio-ingressgateway -n istio-system
### 在spec下追加
spec:
  allocateLoadBalancerNodePorts: true
  clusterIP: 10.200.239.76
  clusterIPs:
  - 10.200.239.76
  ## 追加以下两行
  externalIPs:
  - 192.168.31.163
  #在port:下追加4行
    - name: kiali
    nodePort: 43230
    port: 20001
    protocol: TCP
    targetPort: 20001
# kubectl get svc -n istio-system |grep ingress
istio-ingressgateway   LoadBalancer   10.200.239.76    192.168.31.163   15021:49708/TCP,80:42116/TCP,443:61970/TCP,31400:56204/TCP,15443:45720/TCP,20001:43230/TCP   21h

此时在主机的hosts中绑定kiali的域名,进程访问测试

6.7 梳理下访问流程

  1. 浏览器访问ingress service的20001端口

    # kubectl get svc -n istio-system |grep istio-ingressgateway
    istio-ingressgateway   LoadBalancer   10.200.239.76    192.168.31.163   15021:49708/TCP,80:42116/TCP,443:61970/TCP,31400:56204/TCP,15443:45720/TCP,20001:43230/TCP   22h
    
  2. Ingress的svc将流量转给Ingress的pod的20001

    # istioctl pc listener istio-ingressgateway-8d7d49b55-bmbx5.istio-system|grep 20001
    0.0.0.0 20001 ALL   Route: http.20001
    
  3. Ingress再根据kiali-virtualservice.yaml的配置将流量转给kiali的service

    # cat kiali-virtualservice.yaml 
    apiVersion: networking.istio.io/v1beta1
    kind: VirtualService
    metadata:
      name: kiali-virtualservice
      namespace: istio-system
    spec:
      hosts:
      - "kiali.intra.com"
      gateways:
      - kiali-gateway
      http:
      - match:
        - port: 20001
        route:
        - destination:
            host: kiali
            port:
              number: 20001
    ---
    # kubectl get svc -n istio-system |grep kiali
    kiali                  ClusterIP      10.200.132.85    <none>           20001/TCP,9090/TCP                                                                           22h
    
  4. kiali的service再将流量转给后端的ep,最后根据ep对应的pod进行响应

    # kubectl get ep kiali -n istio-system 
    NAME    ENDPOINTS                                    AGE
    kiali   172.100.183.188:9090,172.100.183.188:20001   22h
    # kubectl get pods -n istio-system -o wide|grep kiali
    kiali-699f98c497-wjtwl                 1/1     Running   0          22h   172.100.183.188   192.168.31.103   <none>           <none>
    

7. 通过80端口方式实现kiali对外提供访问

7.1 gateway

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: kiali-gateway
  namespace: istio-system
spec:
  selector:
    app: istio-ingressgateway
  servers:
  - port:
      number: 80
      name: http-kiali
      protocol: HTTP
    hosts:
    - "kiali.intra.com"
---

7.2 VirtualService

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: kiali-virtualservice
  namespace: istio-system
spec:
  hosts:
  - "kiali.intra.com"
  gateways:
  - kiali-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: kiali
        port:
          number: 20001
---

7.3 DestinationRule

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: kiali
  namespace: istio-system
spec:
  host: kiali
  trafficPolicy:
    tls:
      mode: DISABLE
---

此时直接访问http://kiali.intra.com/即可

8. 卸载Istio

8.1 插件卸载

# kubectl delete -f samples/addons/
serviceaccount "grafana" deleted
configmap "grafana" deleted
service "grafana" deleted
deployment.apps "grafana" deleted
configmap "istio-grafana-dashboards" deleted
configmap "istio-services-grafana-dashboards" deleted
deployment.apps "jaeger" deleted
service "tracing" deleted
service "zipkin" deleted
service "jaeger-collector" deleted
serviceaccount "kiali" deleted
configmap "kiali" deleted
clusterrole.rbac.authorization.k8s.io "kiali-viewer" deleted
clusterrole.rbac.authorization.k8s.io "kiali" deleted
clusterrolebinding.rbac.authorization.k8s.io "kiali" deleted
role.rbac.authorization.k8s.io "kiali-controlplane" deleted
rolebinding.rbac.authorization.k8s.io "kiali-controlplane" deleted
service "kiali" deleted
deployment.apps "kiali" deleted
serviceaccount "prometheus" deleted
configmap "prometheus" deleted
clusterrole.rbac.authorization.k8s.io "prometheus" deleted
clusterrolebinding.rbac.authorization.k8s.io "prometheus" deleted
service "prometheus" deleted
deployment.apps "prometheus" deleted

此时只剩下了2个数据平面的gateway和控制平面的istiod

# kubectl get pods -n istio-system 
NAME                                   READY   STATUS    RESTARTS   AGE
istio-egressgateway-5c597cdb77-48bj8   1/1     Running   0          40h
istio-ingressgateway-8d7d49b55-bmbx5   1/1     Running   0          40h
istiod-54c54679d7-78f2d                1/1     Running   0          40h

8.2 卸载服务网格

# istioctl x uninstall --purge -y
All Istio resources will be pruned from the cluster

  Removed IstioOperator:istio-system:installed-state.
  Removed PodDisruptionBudget:istio-system:istio-egressgateway.
  Removed PodDisruptionBudget:istio-system:istio-ingressgateway.
  Removed PodDisruptionBudget:istio-system:istiod.
  Removed Deployment:istio-system:istio-egressgateway.
  Removed Deployment:istio-system:istio-ingressgateway.
  Removed Deployment:istio-system:istiod.
  Removed Service:istio-system:istio-egressgateway.
  Removed Service:istio-system:istio-ingressgateway.
  Removed Service:istio-system:istiod.
  Removed ConfigMap:istio-system:istio.
  Removed ConfigMap:istio-system:istio-sidecar-injector.
  Removed Pod:istio-system:istio-egressgateway-5c597cdb77-48bj8.
  Removed Pod:istio-system:istio-ingressgateway-8d7d49b55-bmbx5.
  Removed Pod:istio-system:istiod-54c54679d7-78f2d.
  Removed ServiceAccount:istio-system:istio-egressgateway-service-account.
  Removed ServiceAccount:istio-system:istio-ingressgateway-service-account.
  Removed ServiceAccount:istio-system:istio-reader-service-account.
  Removed ServiceAccount:istio-system:istiod.
  Removed ServiceAccount:istio-system:istiod-service-account.
  Removed RoleBinding:istio-system:istio-egressgateway-sds.
  Removed RoleBinding:istio-system:istio-ingressgateway-sds.
  Removed RoleBinding:istio-system:istiod.
  Removed RoleBinding:istio-system:istiod-istio-system.
  Removed Role:istio-system:istio-egressgateway-sds.
  Removed Role:istio-system:istio-ingressgateway-sds.
  Removed Role:istio-system:istiod.
  Removed Role:istio-system:istiod-istio-system.
  Removed EnvoyFilter:istio-system:stats-filter-1.11.
  Removed EnvoyFilter:istio-system:stats-filter-1.12.
  Removed EnvoyFilter:istio-system:stats-filter-1.13.
  Removed EnvoyFilter:istio-system:tcp-stats-filter-1.11.
  Removed EnvoyFilter:istio-system:tcp-stats-filter-1.12.
  Removed EnvoyFilter:istio-system:tcp-stats-filter-1.13.
  Removed MutatingWebhookConfiguration::istio-revision-tag-default.
  Removed MutatingWebhookConfiguration::istio-sidecar-injector.
  Removed ValidatingWebhookConfiguration::istio-validator-istio-system.
  Removed ValidatingWebhookConfiguration::istiod-default-validator.
  Removed ClusterRole::istio-reader-clusterrole-istio-system.
  Removed ClusterRole::istio-reader-istio-system.
  Removed ClusterRole::istiod-clusterrole-istio-system.
  Removed ClusterRole::istiod-gateway-controller-istio-system.
  Removed ClusterRole::istiod-istio-system.
  Removed ClusterRoleBinding::istio-reader-clusterrole-istio-system.
  Removed ClusterRoleBinding::istio-reader-istio-system.
  Removed ClusterRoleBinding::istiod-clusterrole-istio-system.
  Removed ClusterRoleBinding::istiod-gateway-controller-istio-system.
  Removed ClusterRoleBinding::istiod-istio-system.
  Removed CustomResourceDefinition::authorizationpolicies.security.istio.io.
  Removed CustomResourceDefinition::destinationrules.networking.istio.io.
  Removed CustomResourceDefinition::envoyfilters.networking.istio.io.
  Removed CustomResourceDefinition::gateways.networking.istio.io.
  Removed CustomResourceDefinition::istiooperators.install.istio.io.
  Removed CustomResourceDefinition::peerauthentications.security.istio.io.
  Removed CustomResourceDefinition::proxyconfigs.networking.istio.io.
  Removed CustomResourceDefinition::requestauthentications.security.istio.io.
  Removed CustomResourceDefinition::serviceentries.networking.istio.io.
  Removed CustomResourceDefinition::sidecars.networking.istio.io.
  Removed CustomResourceDefinition::telemetries.telemetry.istio.io.
  Removed CustomResourceDefinition::virtualservices.networking.istio.io.
  Removed CustomResourceDefinition::wasmplugins.extensions.istio.io.
  Removed CustomResourceDefinition::workloadentries.networking.istio.io.
  Removed CustomResourceDefinition::workloadgroups.networking.istio.io.
✔ Uninstall complete                                           

# kubectl get pods -n istio-system 
No resources found in istio-system namespace.
# kubectl get svc -n istio-system 
No resources found in istio-system namespace.

8.3 删除istio-system命名空间

# kubectl delete ns istio-system 
namespace "istio-system" deleted
# kubectl get ns istio-system 
Error from server (NotFound): namespaces "istio-system" not found

其他命名空间下可能还有一些由服务网格创建的残余的sidecar.可以单独进行删除.这里就不一一演示了.

相关推荐
是垚不是土5 天前
Istio分布式链路监控搭建:Jaeger与Zipkin
运维·分布式·云原生·自动化·云计算·istio
牛角上的男孩15 天前
Istio Gateway发布服务
云原生·gateway·istio
是垚不是土17 天前
Istio流量镜像测试
运维·kubernetes·云计算·istio
莱特昂17 天前
virtualBox部署minikube+istio
云原生·istio
牛角上的男孩17 天前
部署istio应用未能产生Envoy sidecar代理
云原生·istio
牛角上的男孩17 天前
部署Prometheus、Grafana、Zipkin、Kiali监控度量Istio
grafana·prometheus·istio
牛角上的男孩23 天前
Istio和Kubernetes版本对应关系
kubernetes·istio
Hello.Reader23 天前
Istio 服务网格深度解析
云原生·istio
风车带走过往1 个月前
微服务网格Istio介绍
微服务·架构·istio
是垚不是土1 个月前
云原生Istio基础
云原生·istio