istio-流量治理

一,istio部署

istioctl install --set profile=demo -y
  kubectl label namespace default istio-injection=enabled
root@master001:~/istio/istio-1.12.0# kubectl apply -f samples/addons/
root@master001:~/istio/istio-1.12.0# kubectl get po -nistio-system
NAME                                   READY   STATUS    RESTARTS   AGE
grafana-6ccd56f4b6-fmnzw               1/1     Running   1          169m
istio-egressgateway-7f4864f59c-nz69w   1/1     Running   4          32d
istio-ingressgateway-55d9fb9f-trmkq    1/1     Running   4          32d
istiod-555d47cb65-dlfs4                1/1     Running   4          32d
jaeger-5d44bc5c5d-bncxw                1/1     Running   1          169m
kiali-79b86ff5bc-mzsxk                 1/1     Running   0          158m
prometheus-64fd8ccd65-gx5cg            2/2     Running   1          158m
root@slave002:~# kubectl run demoapp --image=gexuchuan123/demoapp:v1.0 --restart=Never
root@slave002:~# kubectl exec -it demoapp -- curl localhost:15000/listeners
root@slave002:~# istioctl proxy-status
root@slave002:~# kubectl exec -it demoapp -- curl localhost:15000/clusters
root@slave002:~# kubectl create svc clusterip demoapp --tcp=80:80
service/demoapp created
root@slave002:~# kubectl get svc
NAME         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
demoapp      ClusterIP   10.100.169.192   <none>        80/TCP    2s
kubernetes   ClusterIP   10.100.0.1       <none>        443/TCP   67d
root@slave002:~# istioctl proxy-config listener demoapp
root@slave002:~# istioctl proxy-config routes demoapp
NAME                                                          DOMAINS                                              MATCH                  VIRTUAL SERVICE
Available Commands:
  all            Retrieves all configuration for the Envoy in the specified pod
  bootstrap      Retrieves bootstrap configuration for the Envoy in the specified pod
  cluster        Retrieves cluster configuration for the Envoy in the specified pod
  endpoint       Retrieves endpoint configuration for the Envoy in the specified pod
  listener       Retrieves listener configuration for the Envoy in the specified pod
  log            (experimental) Retrieves logging levels of the Envoy in the specified pod
  rootca-compare Compare ROOTCA values for the two given pods
  route          Retrieves route configuration for the Envoy in the specified pod
  secret         Retrieves secret configuration for the Envoy in the specified pod
kubectl describe svc  -n istio-system istio-ingressgateway

二,kiali开放端口57328

root@slave002:~/istio-in-practise/Basics/kiali# cat kiali-gateway.yaml 
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: kiali-gateway
  namespace: istio-system
spec:
  selector:
    app: istio-ingressgateway  #挑选pod
  servers:
  - port:
      number: 80
      name: http-kiali  #http表示7层过滤
      protocol: HTTP
    hosts:
    - "kiali.chuan.com"
---
root@slave002:~/istio-in-practise/Basics/kiali# cat kiali-virtualservice.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: kiali-virtualservice
  namespace: istio-system
spec:
  hosts:
  - "kiali.chuan.com"  #域名
  gateways:
  - kiali-gateway 
  http:
  - match:
    - port: 80  
    route:
    - destination:
        host: kiali  #svc简称
        port:
          number: 20001  #kiali端口
---
root@slave002:~/istio-in-practise/Basics/kiali# cat kiali-destinationrule.yaml 
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: kiali
  namespace: istio-system
spec:
  host: kiali
  trafficPolicy:
    tls:
      mode: DISABLE
---
root@slave001:~# netstat -nutpl|grep 57328
tcp        0      0 0.0.0.0:57328           0.0.0.0:*               LISTEN      880/kube-proxy

57328--80--8080 --20001

kiali.chuan.com:57328

三,配置查看

root@slave002:~/istio-in-practise/Basics/kiali# kubectl api-resources --api-group=networking.istio.io
NAME               SHORTNAMES   APIVERSION                     NAMESPACED   KIND
destinationrules   dr           networking.istio.io/v1beta1    true         DestinationRule
envoyfilters                    networking.istio.io/v1alpha3   true         EnvoyFilter
gateways           gw           networking.istio.io/v1beta1    true         Gateway
serviceentries     se           networking.istio.io/v1beta1    true         ServiceEntry
sidecars                        networking.istio.io/v1beta1    true         Sidecar
virtualservices    vs           networking.istio.io/v1beta1    true         VirtualService
workloadentries    we           networking.istio.io/v1beta1    true         WorkloadEntry
workloadgroups     wg           networking.istio.io/v1alpha3   true         WorkloadGroup
root@slave002:~/istio-in-practise/Basics/kiali# kubectl explain gw
root@slave002:~/istio-in-practise/Basics/kiali# kubectl get po -l app=istio-ingressgateway -nistio-system
NAME                                  READY   STATUS    RESTARTS   AGE
istio-ingressgateway-55d9fb9f-trmkq   1/1     Running   4          33d
root@slave002:~/istio-in-practise/Basics/kiali# kubectl get po -A  --show-labels

 

InGW=$(kubectl get po -l app=istio-ingressgateway -nistio-system -o jsonpath={.items[0].metadata.name})
root@slave001:~# kubectl describe svc istio-ingressgateway -nistio-system
Port:                     http2  80/TCP
TargetPort:               8080/TCP
NodePort:                 http2  57328/TCP
Endpoints:                10.200.122.231:8080
root@slave002:~/istio-in-practise/Basics/kiali# istioctl proxy-config listener $InGW -n istio-system
ADDRESS PORT  MATCH DESTINATION
0.0.0.0 8080  ALL   Route: http.8080  #ingress gateway pod监听端口
0.0.0.0 15021 ALL   Inline Route: /healthz/ready*
0.0.0.0 15090 ALL   Inline Route: /stats/prometheus*
root@slave002:~/istio-in-practise/Basics/kiali# istioctl proxy-config routes $InGW -n istio-system
NAME          DOMAINS             MATCH                  VIRTUAL SERVICE
http.8080     kiali.chuan.com     /*                     kiali-virtualservice.istio-system  #
              *                   /stats/prometheus*     
              *                   /healthz/ready*

四,简单示例

root@slave002:~/istio-in-practise/demo# kubectl create deploy demoappv10 --image=gexuchuan123/demoapp:v1.0 --replicas=3 --dry-run=client -o yaml > demoappv10.yaml
root@slave002:~/istio-in-practise/demo# kubectl create svc clusterip  demoappv10 --tcp=8080:8080  --dry-run=client -o yaml > server-demoappv10.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: demoappv10
  name: demoappv10
spec:
  replicas: 3
  selector:
    matchLabels:
      app: demoapp
      version: v1.0
  strategy: {}
  template:
    metadata:
      labels:
        app: demoapp
        version: v1.0
    spec:
      containers:
      - image: gexuchuan123/demoapp:v1.0
        name: demoapp
        env:
        - name: PORT
          value: "8080" 
        resources: {}
apiVersion: v1
kind: Service
metadata:
  labels:
    app: demoappv10
  name: demoappv10
spec:
  ports:
  - name: http-8080
    port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    app: demoapp
    version: v1.0
  type: ClusterIP

 

Demoapp=$(kubectl get po -l app=demoapp -o jsonpath={.items[0].metadata.name})

 

root@slave002:~# kubectl run client7 --image=gexuchuan123/admin-box -it --rm --restart=Never --command -- /bin/sh
If you don't see a command prompt, try pressing enter.
root@client7 # curl demoappv10:8080
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-5db4f99f74-z8f9x, ServerIP: 10.200.111.8!
while true;do curl demoappv10:8080;sleep 1;done

istio-流量治理

五,istio-in-practise

01-demoapp-v10

root@slave002:~/istio-in-practise/Basics/ms-demo/01-demoapp-v10# cat deploy-proxy.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: proxy
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  selector:
    matchLabels:
      app: proxy
  template:
    metadata:
      labels:
        app: proxy
    spec:
      containers:
        - env:
          - name: PROXYURL
            value: http://demoappv10:8080
          image: ikubernetes/proxy:v0.1.1
          imagePullPolicy: IfNotPresent
          name: proxy
          ports:
            - containerPort: 8080
              name: web
              protocol: TCP
          resources:
            limits:
              cpu: 50m
---
apiVersion: v1
kind: Service
metadata:
  name: proxy
spec:
  ports:
    - name: http-80
      port: 80
      protocol: TCP
      targetPort: 8080
  selector:
    app: proxy
---
root@slave002:~/istio-in-practise/Basics/ms-demo/01-demoapp-v10# cat deploy-demoapp.yaml 
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: demoappv10
    version: v1.0
  name: demoappv10
spec:
  progressDeadlineSeconds: 600
  replicas: 3
  selector:
    matchLabels:
      app: demoapp
      version: v1.0
  template:
    metadata:
      labels:
        app: demoapp
        version: v1.0
    spec:
      containers:
      - image: ikubernetes/demoapp:v1.0
        imagePullPolicy: IfNotPresent
        name: demoapp
        env:
        - name: "PORT"
          value: "8080"
        ports:
        - containerPort: 8080
          name: web
          protocol: TCP
        resources:
          limits:
            cpu: 50m
---
apiVersion: v1
kind: Service
metadata:
  name: demoappv10
spec:
  ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: 8080
  selector:
    app: demoapp
    version: v1.0
  type: ClusterIP
---
root@slave002:~/istio-in-practise/Basics/ms-demo/01-demoapp-v10# kubectl get svc
NAME         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
demoappv10   ClusterIP   10.100.4.197    <none>        8080/TCP   5m51s
kubernetes   ClusterIP   10.100.0.1      <none>        443/TCP    76d
proxy        ClusterIP   10.100.239.94   <none>        80/TCP     5m51s
kubectl run client11 --image=gexuchuan123/admin-box -it --rm --restart=Never --command -- /bin/sh
while true;do curl proxy;sleep 1;done

流量调度逻辑

client pod >> sidecar envoy(Egress listener:proxy:80)     >> (Ingress Listener) proxy pod >> (Egress Listener: demoappv10:8080)proxy pod     >> (Ingress Listener) demoappv10 pod

istio-流量治理

02-demoapp-v11

root@slave002:~/istio-in-practise/Basics/ms-demo/02-demoapp-v11# cat deploy-demoapp-v11.yaml 
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: demoappv11
    version: v1.1
  name: demoappv11
spec:
  progressDeadlineSeconds: 600
  replicas: 2
  selector:
    matchLabels:
      app: demoapp
      version: v1.1
  template:
    metadata:
      labels:
        app: demoapp
        version: v1.1
    spec:
      containers:
      - image: ikubernetes/demoapp:v1.1
        imagePullPolicy: IfNotPresent
        name: demoapp
        env:
        - name: "PORT"
          value: "8080"
        ports:
        - containerPort: 8080
          name: web
          protocol: TCP
        resources:
          limits:
            cpu: 50m
---
apiVersion: v1
kind: Service
metadata:
  name: demoappv11
spec:
  ports:
    - name: http-8080
      port: 8080
      protocol: TCP
      targetPort: 8080
  selector:
    app: demoapp
    version: v1.1
  type: ClusterIP
---
root@slave002:~/istio-in-practise/Basics/ms-demo/02-demoapp-v11# cat service-demoapp.yaml 
---
apiVersion: v1
kind: Service
metadata:
  name: demoapp
spec:
  ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: 8080
  selector:
    app: demoapp
  type: ClusterIP
---
root@slave002:~/istio-in-practise/Basics/ms-demo/02-demoapp-v11# cat deploy-proxy.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: proxy
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  selector:
    matchLabels:
      app: proxy
  template:
    metadata:
      labels:
        app: proxy
    spec:
      containers:
        - env:
          - name: PROXYURL
            value: http://demoapp:8080
          image: ikubernetes/proxy:v0.1.1
          imagePullPolicy: IfNotPresent
          name: proxy
          ports:
            - containerPort: 8080
              name: web
              protocol: TCP
          resources:
            limits:
              cpu: 50m
---
apiVersion: v1
kind: Service
metadata:
  name: proxy
spec:
  ports:
    - name: http-80
      port: 80
      protocol: TCP
      targetPort: 8080
  selector:
    app: proxy
---
root@slave002:~/istio-in-practise/Basics/ms-demo/02-demoapp-v11# cat virutalservice-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demoapp
spec:
  hosts:
  - demoapp
  http:
  - name: canary
    match:
    - uri:
        prefix: /canary
    rewrite:
      uri: /
    route:
    - destination:
        host: demoappv11
  - name: default
    route:
    - destination:
        host: demoappv10

istio-流量治理

 

 istio-流量治理

 

 root@client11 # while true;do curl proxy/hostname;sleep 1;done

                         while true;do curl proxy/canary;sleep 1;done

03-demoapp-subset

root@slave002:~/istio-in-practise/Basics/ms-demo/03-demoapp-subset# kubectl delete vs demoapp
root@slave002:~/istio-in-practise/Basics/ms-demo/03-demoapp-subset# cat destinationrule-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: demoapp
spec:
  host: demoapp
  subsets:
  - name: v10
    labels:
      version: v1.0
  - name: v11
    labels:
      version: v1.1
root@slave002:~/istio-in-practise/Basics/ms-demo/03-demoapp-subset# cat virutalservice-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demoapp
spec:
  hosts:
  - demoapp
  http:
  - name: canary
    match:
    - uri:
        prefix: /canary
    rewrite:
      uri: /
    route:
    - destination:
        host: demoapp
        subset: v11
  - name: default
    route:
    - destination:
        host: demoapp
        subset: v10

 

root@client11 # while true;do curl proxy/canary;sleep 1;done

istio-流量治理

 

root@client11 # while true;do curl proxy/hostname;sleep 1;done

istio-流量治理

 

root@master001:~# Demoapp=$(kubectl get po -l app=demoapp -o jsonpath={.items[0].metadata.name})
root@master001:~# istioctl proxy-config clusters $Demoapp
SERVICE FQDN                                            PORT      SUBSET     DIRECTION     TYPE             DESTINATION RULE
                                                        8080      -          inbound       ORIGINAL_DST     
BlackHoleCluster                                        -         -          -             STATIC           
InboundPassthroughClusterIpv4                           -         -          -             ORIGINAL_DST     
PassthroughCluster                                      -         -          -             ORIGINAL_DST     
agent                                                   -         -          -             STATIC           
demoapp.default.svc.cluster.local                       8080      -          outbound      EDS              demoapp.default
demoapp.default.svc.cluster.local                       8080      v10        outbound      EDS              demoapp.default
demoapp.default.svc.cluster.local                       8080      v11        outbound      EDS              demoapp.default

04-proxy-gateway

root@slave002:~/istio-in-practise/Basics/ms-demo/04-proxy-gateway# cat gateway-proxy.yaml 
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: proxy-gateway
  namespace: istio-system        # 要指定为ingress gateway pod所在名称空间
spec:
  selector:
    app: istio-ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "fe.chuan.com"
root@slave002:~/istio-in-practise/Basics/ms-demo/04-proxy-gateway# cat virtualservice-proxy.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: proxy
spec:
  hosts:
  - "fe.chuan.com"                     # 对应于gateways/proxy-gateway
  gateways:
  - istio-system/proxy-gateway       # 相关定义仅应用于Ingress Gateway上
  #- mesh
  http:
  - name: default
    route:
    - destination:
        host: proxy 

fe.chuan.com 192.168.192.152

istio-流量治理

05-url-redirect-and-rewrite

 

root@slave002:~/istio-in-practise/Basics/ms-demo/05-url-redirect-and-rewrite# cat deploy-backend.yaml 
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: backend
    version: v3.6
  name: backendv36
spec:
  progressDeadlineSeconds: 600
  replicas: 2
  selector:
    matchLabels:
      app: backend
      version: v3.6
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: backend
        version: v3.6
    spec:
      containers:
      - image: ikubernetes/gowebserver:v0.1.0
        imagePullPolicy: IfNotPresent
        name: gowebserver
        env:
        - name: "SERVICE_NAME"
          value: "backend"
        - name: "SERVICE_PORT"
          value: "8082"
        - name: "SERVICE_VERSION"
          value: "v3.6"
        ports:
        - containerPort: 8082
          name: web
          protocol: TCP
        resources:
          limits:
            cpu: 50m
---
apiVersion: v1
kind: Service
metadata:
  name: backend
spec:
  ports:
    - name: http-web
      port: 8082
      protocol: TCP
      targetPort: 8082
  selector:
    app: backend
    version: v3.6
---
root@slave002:~/istio-in-practise/Basics/ms-demo/05-url-redirect-and-rewrite# cat virtualservice-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demoapp
spec:
  hosts:
  - demoapp
  http:
  - name: rewrite
    match:
    - uri:
        prefix: /canary
    rewrite:
      uri: /
    route:
    - destination:
        host: demoapp
        subset: v11
  - name: redirect
    match:
    - uri:
        prefix: "/backend"
    redirect:
      uri: /
      authority: backend
      port: 8082
  - name: default
    route:
    - destination:
        host: demoapp
        subset: v10
root@slave002:~/aaa# cat virtualservice-proxy.yaml   #内外部访问
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: proxy
spec:
  hosts:
  - "fe.chuan.com"                     # 对应于gateways/proxy-gateway
  - "proxy"
  gateways:
  - istio-system/proxy-gateway       # 相关定义仅应用于Ingress Gateway上
  - mesh
  http:
  - name: redirect
    match:
    - uri:
        prefix: "/backend"
    redirect:
      uri: /
      authority: backend
      port: 8082
  - name: default
    route:
    - destination:
        host: proxy

 

root@client7 ~# while true;do curl -I  proxy/backend;sleep 0.3;done
HTTP/1.1 301 Moved Permanently
location: http://backend:8082/
date: Tue, 04 Jan 2022 17:09:08 GMT
server: envoy
transfer-encoding: chunked
root@client7 ~# while true;do curl   proxy;sleep 0.3;done
Proxying value: iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-7bctv, ServerIP: 10.200.111.24!
 - Took 4 milliseconds.
Proxying value: iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-256gc, ServerIP: 10.200.163.101!
 - Took 4 milliseconds.
Proxying value: iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-ktlp6, ServerIP: 10.200.163.98!
 - Took 4 milliseconds.
Proxying value: iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-7bctv, ServerIP: 10.200.111.24!
 - Took 4 milliseconds.
^C
root@client7 ~# while true;do curl   proxy/canary;sleep 0.3;done
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-m2njk, ServerIP: 10.200.122.210!
 - Took 5 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-m2njk, ServerIP: 10.200.122.210!
 - Took 4 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-44pqn, ServerIP: 10.200.111.23!
 - Took 3 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-44pqn, ServerIP: 10.200.111.23!

 06-weight-based-routing

root@slave002:~/istio-in-practise/Basics/ms-demo/05-url-redirect-and-rewrite# kubectl delete -f virtualservice-proxy.yaml
root@slave002:~/istio-in-practise/Basics/ms-demo/05-url-redirect-and-rewrite# kubectl apply -f ../04-proxy-gateway/virtualservice-proxy.yaml
root@slave002:~/istio-in-practise/Basics/ms-demo/06-weight-based-routing# cat virtualservice-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demoapp
spec:
  hosts:
  - demoapp
  http:
  - name: weight-based-routing
    route:
    - destination:
        host: demoapp
        subset: v10
      weight: 90
    - destination:
        host: demoapp
        subset: v11
      weight: 10
root@slave002:~/istio-in-practise/Basics/ms-demo/06-weight-based-routing# kubectl apply -f .

istio-流量治理

 

 

 

root@client7 # while true;do curl proxy;sleep 1;done

07-headers-operation

root@slave002:~/istio-in-practise/Basics/ms-demo/07-headers-operation# cat virtualservice-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demoapp
spec:
  hosts:
  - demoapp
  http:
  - name: canary
    match:
    - headers:
        x-canary: 
          exact: "true"
    route:
    - destination:
        host: demoapp
        subset: v11
      headers:
        request:
          set:
            User-Agent: Chrome
        response:
          add:
            x-canary: "true"
  - name: default
    headers:
      response:
        add:
          X-Envoy: test
    route:
    - destination:
        host: demoapp
        subset: v10
root@client7 # while true;do curl -H "x-canary: true" demoapp:8080;sleep 0.5;done
iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-5pt6n, ServerIP: 10.200.122.220!
iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-dngqd, ServerIP: 10.200.111.31!
root@client7 # while true;do curl -H "x-canary: true" demoapp:8080/user-agent;sleep 0.5;done
User-Agent: Chrome
User-Agent: Chrome
root@client7 # while true;do curl -I  -H "x-canary: true" demoapp:8080;sleep 0.5;done
HTTP/1.1 200 OK
content-type: text/html; charset=utf-8
content-length: 116
server: envoy
date: Wed, 05 Jan 2022 13:53:24 GMT
x-envoy-upstream-service-time: 3
x-canary: true
root@client7 # while true;do curl -I   demoapp:8080;sleep 0.5;done
HTTP/1.1 200 OK
content-type: text/html; charset=utf-8
content-length: 115
server: envoy
date: Wed, 05 Jan 2022 13:58:07 GMT
x-envoy-upstream-service-time: 2
x-envoy: test

08-fault-injection

root@slave002:~/istio-in-practise/Basics/ms-demo/08-fault-injection# cat virtualservice-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demoapp
spec:
  hosts:
  - demoapp
  http:
  - name: canary
    match:
    - uri:
        prefix: /canary
    rewrite:
      uri: /
    route:
    - destination:
        host: demoapp
        subset: v11
    fault:
      abort:
        percentage:
          value: 20
        httpStatus: 555
  - name: default
    route:
    - destination:
        host: demoapp
        subset: v10
    fault:
      delay:
        percentage:
          value: 20
        fixedDelay: 3s

 

root@client7 # while true;do curl proxy;sleep 0.4;done
Proxying value: iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
 - Took 5 milliseconds.
Proxying value: iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
 - Took 3 milliseconds.
Proxying value: iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
root@client7 # while true;do curl proxy/canary;sleep 0.4;done
Proxying value: fault filter abort - Took 10 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-dngqd, ServerIP: 10.200.111.31!
 - Took 4 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-5pt6n, ServerIP: 10.200.122.220!
 - Took 4 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-dngqd, ServerIP: 10.200.111.31!
 - Took 3 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-5pt6n, ServerIP: 10.200.122.220!
 - Took 3 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-dngqd, ServerIP: 10.200.111.31!
 - Took 3 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-5pt6n, ServerIP: 10.200.122.220!
 - Took 3 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-dngqd, ServerIP: 10.200.111.31!
 - Took 4 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-5pt6n, ServerIP: 10.200.122.220!
 - Took 4 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-5pt6n, ServerIP: 10.200.122.220!
 - Took 3 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-dngqd, ServerIP: 10.200.111.31!
 - Took 3 milliseconds.
Proxying value: fault filter abort - Took 11 milliseconds.

istio-流量治理

 

 09-http-retry

root@slave002:~/istio-in-practise/Basics/ms-demo/09-http-retry# cat virtualservice-proxy.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: proxy
spec:
  hosts:
  - "fe.magedu.com"                     # 对应于gateways/proxy-gateway
  gateways:
  - istio-system/proxy-gateway       # 相关定义仅应用于Ingress Gateway上
  #- mesh
  http:
  - name: default
    route:
    - destination:
        host: proxy
    timeout: 1s  #1s不响应返回超时
    retries:
      attempts: 5  #重试次数
      perTryTimeout: 1s #重试超过一秒超时
      retryOn: 5xx,connect-failure,refused-stream
root@slave002:~/istio-in-practise/Basics/ms-demo/09-http-retry# cat virtualservice-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demoapp
spec:
  hosts:
  - demoapp
  http:
  - name: canary
    match:
    - uri:
        prefix: /canary
    rewrite:
      uri: /
    route:
    - destination:
        host: demoapp
        subset: v11
    fault:
      abort:
        percentage:
          value: 50
        httpStatus: 555
  - name: default
    route:
    - destination:
        host: demoapp
        subset: v10
    fault:
      delay:
        percentage:
          value: 50
        fixedDelay: 3s

 

root@client7 # while true;do curl proxy/canary;sleep 0.4;done
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-dngqd, ServerIP: 10.200.111.31!
 - Took 5 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-5pt6n, ServerIP: 10.200.122.220!
 - Took 8 milliseconds.
Proxying value: fault filter abort - Took 2 milliseconds.
Proxying value: fault filter abort - Took 1 milliseconds.
Proxying value: fault filter abort - Took 1 milliseconds.
Proxying value: iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-dngqd, ServerIP: 10.200.111.31!
 - Took 4 milliseconds.
Proxying value: fault filter abort - Took 1 milliseconds.
Proxying value: fault filter abort - Took 1 milliseconds.
Proxying value: fault filter abort - Took 1 milliseconds.
Proxying value: fault filter abort - Took 1 milliseconds.

延迟

root@client7 # while true;do curl proxy;sleep 0.4;done
Proxying value: iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
 - Took 3003 milliseconds.
Proxying value: iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-zc258, ServerIP: 10.200.122.219!
 - Took 4 milliseconds.
Proxying value: iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
 - Took 3003 milliseconds.
Proxying value: iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!

10-traffic-mirror

root@slave002:~/istio-in-practise/Basics/ms-demo/10-traffic-mirror# cat virtualservice-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demoapp
spec:
  hosts:
  - demoapp
  http:
  - name: traffic-mirror
    route:
    - destination:
        host: demoapp
        subset: v10
    mirror:
      host: demoapp
      subset: v11

istio-流量治理

11-cluster-loadbalancing

root@slave002:~/istio-in-practise/Basics/ms-demo/11-cluster-loadbalancing# cat destinationrule-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: demoapp
spec:
  host: demoapp
  trafficPolicy:
    loadBalancer:
      simple: LEAST_CONN
  subsets:
  - name: v10
    labels:
      version: v1.0
    trafficPolicy:
      loadBalancer:
        consistentHash:
          httpHeaderName: X-User
  - name: v11
    labels:
      version: v1.1
root@slave002:~/istio-in-practise/Basics/ms-demo/03-demoapp-subset# cat virutalservice-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demoapp
spec:
  hosts:
  - demoapp
  http:
  - name: canary
    match:
    - uri:
        prefix: /canary
    rewrite:
      uri: /
    route:
    - destination:
        host: demoapp
        subset: v11
  - name: default
    route:
    - destination:
        host: demoapp
        subset: v10
root@slave002:~/istio-in-practise/Basics/ms-demo/03-demoapp-subset# kubectl apply -f .
root@client7 # while true;do curl demoapp:8080/canary;sleep 0.4;done
iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-5pt6n, ServerIP: 10.200.122.220!
iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-dngqd, ServerIP: 10.200.111.31!
iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-5pt6n, ServerIP: 10.200.122.220!
iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-dngqd, ServerIP: 10.200.111.31!
iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-5pt6n, ServerIP: 10.200.122.220!
iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-dngqd, ServerIP: 10.200.111.31!
iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-dngqd, ServerIP: 10.200.111.31!
^C
root@client7 # while true;do curl demoapp:8080;sleep 0.4;done
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-zc258, ServerIP: 10.200.122.219!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-zc258, ServerIP: 10.200.122.219!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
v10 基于标头转发后端3个pod   /canary转发到v11后端2个pod
root@client7 # while true;do curl -H "x-user: user1" demoapp:8080;sleep 0.5;done
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
^C
root@client7 # while true;do curl -H "x-user: user2" demoapp:8080;sleep 0.5;done
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
root@client7 # while true;do curl -H "x-user: user3" demoapp:8080;sleep 0.5;done
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-zc258, ServerIP: 10.200.122.219!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-zc258, ServerIP: 10.200.122.219!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-zc258, ServerIP: 10.200.122.219!

12-connection-pool

root@slave002:~/istio-in-practise/Basics/ms-demo/12-connection-pool# cat virutalservice-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demoapp
spec:
  hosts:
  - demoapp
  http:
  - name: canary
    match:
    - uri:
        prefix: /canary
    rewrite:
      uri: /
    route:
    - destination:
        host: demoapp
        subset: v11
  - name: default
    route:
    - destination:
        host: demoapp
        subset: v10
root@slave002:~/istio-in-practise/Basics/ms-demo/12-connection-pool# cat destinationrule-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: demoapp
spec:
  host: demoapp
  trafficPolicy:
    loadBalancer:
      simple: LEAST_CONN
    connectionPool:
      tcp:
        maxConnections: 100
        connectTimeout: 30ms
        tcpKeepalive:
          time: 7200s
          interval: 75s
      http:
        http2MaxRequests: 1000
        maxRequestsPerConnection: 10
  subsets:
  - name: v10
    labels:
      version: v1.0
    trafficPolicy:
      loadBalancer:
        consistentHash:
          httpHeaderName: X-User
  - name: v11
    labels:
      version: v1.1

 

root@client7 # while true;do curl  demoapp:8080;sleep 0.000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005;done
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-jzkls, ServerIP: 10.200.111.30!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-zc258, ServerIP: 10.200.122.219!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-c6vx5, ServerIP: 10.200.111.29!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-zc258, ServerIP: 10.200.122.219

13-outlier-detection

root@slave002:~/istio-in-practise/Basics/ms-demo/13-outlier-detection# cat destinationrule-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: demoapp
spec:
  host: demoapp
  trafficPolicy:
    loadBalancer:
      simple: RANDOM
    connectionPool:
      tcp:
        maxConnections: 100
        connectTimeout: 30ms
        tcpKeepalive:
          time: 7200s
          interval: 75s
      http:
        http2MaxRequests: 1000
        maxRequestsPerConnection: 10
    outlierDetection:
      maxEjectionPercent: 50   #移除阈值
      consecutive5xxErrors: 5  #连续5次5XX弹出主机
      interval: 10s            #检测时长
      baseEjectionTime: 1m     #弹出时长1分钟加回来
      minHealthPercent: 40
  subsets:
  - name: v10
    labels:
      version: v1.0
  - name: v11
    labels:
      version: v1.1

 

OKroot@master001:~# curl -XPOST -d 'livez=FAIL' 10.200.111.29:8080/livez
root@master001:~# curl 10.200.111.29:8080/livez
FAILroot@master001:~# curl -I 10.200.111.29:8080/livez
HTTP/1.1 506 Variant Also Negotiates
content-type: text/html; charset=utf-8
content-length: 4
server: istio-envoy
date: Wed, 05 Jan 2022 15:19:21 GMT
x-envoy-upstream-service-time: 1
x-envoy-decorator-operation: demoappv10.default.svc.cluster.local:8080/*
demoappv10-6ff964cbff-c6vx5   2/2     Running   0          151m   10.200.111.29    192.168.192.153   <none>           <none>
demoappv10-6ff964cbff-jzkls   2/2     Running   0          151m   10.200.111.30    192.168.192.153   <none>           <none>
demoappv10-6ff964cbff-zc258   2/2     Running   0          151m   10.200.122.219   192.168.192.152   <none>           <none>

 

while true;do curl  proxy/livez;sleep 0.5;done
Proxying value: FAIL - Took 4 milliseconds.
Proxying value: FAIL - Took 12 milliseconds.
Proxying value: OK - Took 4 milliseconds.
Proxying value: OK - Took 4 milliseconds.
Proxying value: OK - Took 6 milliseconds.
Proxying value: OK - Took 3 milliseconds.
Proxying value: FAIL - Took 4 milliseconds.
Proxying value: OK - Took 4 milliseconds.
Proxying value: OK - Took 4 milliseconds.
Proxying value: OK - Took 4 milliseconds.
Proxying value: FAIL - Took 4 milliseconds.
root@client7 # while true;do curl  proxy/livez;sleep 0.5;done
Proxying value: OK - Took 4 milliseconds.
Proxying value: OK - Took 3 milliseconds.
Proxying value: OK - Took 4 milliseconds.
Proxying value: OK - Took 3 milliseconds.
Proxying value: OK - Took 5 milliseconds.
Proxying value: FAIL - Took 4 milliseconds.
Proxying value: OK - Took 3 milliseconds.
Proxying value: OK - Took 3 milliseconds.
Proxying value: OK - Took 3 milliseconds.
Proxying value: FAIL - Took 4 milliseconds.
Proxying value: FAIL - Took 5 milliseconds.
Proxying value: FAIL - Took 3 milliseconds.
Proxying value: FAIL - Took 3 milliseconds.

每一分钟连续5个5XX

上一篇:通过Unity3d创建二维码(利用zxing2.2)


下一篇:云原生服务网格Istio:原理、实践、架构与源码解析