Istio使用【sidecar注入】

本文使用的版本号:1.4.2

查看默认sidecar配置

kubectl get mutatingwebhookconfiguration istio-sidecar-injector -o yaml | grep "namespaceSelector:" -A5

  namespaceSelector:
    matchLabels:
      istio-injection: enabled
  objectSelector: {}
  reinvocationPolicy: Never
  rules:

可以看出,istio默认sidecar注入规则是,namespace带有标签istio-injection: enabled才会注入sidecar。

查看哪些namespace已经配置注入:

[root@k8s-master istio-1.4.2]# kubectl get namespace -L istio-injection
NAME              STATUS   AGE   ISTIO-INJECTION
default           Active   70d   
ingress-nginx     Active   69d   
istio-system      Active   19h   
kube-node-lease   Active   70d   
kube-public       Active   70d   
kube-system       Active   70d   
naftis            Active   19h   
test-deri         Active   47d 

为namespace打上注入sidecar标签:

kubectl label namespace default istio-injection=enabled --overwrite

 默认情况,是没有设置。

为namespace设置不注入sidecar

有些k8s系统组件namespace不应该注入sidecar,如kube-system等,参考如下设置

kubectl get mutatingwebhookconfiguration istio-sidecar-injector -o yaml | grep "namespaceSelector:" -A5

  namespaceSelector:
    matchExpressions:
    - key: istio-injection
      operator: NotIn
      values:
      - disabled
  rules:
  - apiGroups:
    - ""

为namespace打上不注入sidecar标签:

kubectl label namespace istio-system istio-injection=disabled --overwrite
kubectl get namespace -L istio-injection

NAME           STATUS    AGE       ISTIO-INJECTION
default        Active    18d
istio-system   Active    3d        disabled
kube-public    Active    18d       disabled
kube-system    Active    18d       disabled

查看sidecar配置策略

sidecar配置保存在configmap-istio-sidecar-injector中,更多配置可以在install/kubernetes/helm/istio/charts/sidecarInjectorWebhook/values.yaml中查看。

主要配置,默认策略:

kubectl -n istio-system get configmap istio-sidecar-injector -o jsonpath='{.data.config}' | grep policy:

允许的值为disabledenabled。仅当Webhook namespaceSelector匹配目标名称空间时,才应用默认策略。无法识别的策略导致注入被完全禁用。

注意:①策略为disabled,但是想要为POD注入sidecar,增加annotation sidecar.istio.io/inject: "true"即可

  ②策略为enabled,但是不想要为POD注入sidecar,增加annotation sidecar.istio.io/inject: "false"即可

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ignored
spec:
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      containers:
      - name: ignored
        image: tutum/curl
        command: ["/bin/sleep","infinity"]

手动注入sidecar

为一个写好的yaml文件手动注入sidecar,我们可以使用istioctl kube-inject:

istioctl kube-inject -f samples/sleep/sleep.yaml | kubectl apply -f -

默认情况下,这将使用集群内配置。或者,可以使用配置的本地副本来完成注入。下面命令可以将默认配置导出到文件:

kubectl -n istio-system get configmap istio-sidecar-injector -o=jsonpath='{.data.config}' > inject-config.yaml
kubectl -n istio-system get configmap istio-sidecar-injector -o=jsonpath='{.data.values}' > inject-values.yaml
kubectl -n istio-system get configmap istio -o=jsonpath='{.data.mesh}' > mesh-config.yaml

然后再将文件中配置注入到已建好的YAML中并运行:

istioctl kube-inject \
    --injectConfigFile inject-config.yaml \
    --meshConfigFile mesh-config.yaml \
    --valuesFile inject-values.yaml \
    --filename samples/sleep/sleep.yaml \
    | kubectl apply -f -

 这和第一条命令效果一样。验证sidecar已经注入:

kubectl get pod  -l app=sleep
NAME                     READY   STATUS    RESTARTS   AGE
sleep-64c6f57bc8-f5n4x   2/2     Running   0          24s

其它配置:neverInjectSelector/alwaysInjectSelector,参考官网

示例:

apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-sidecar-injector
data:
  config: |-
    policy: enabled
    neverInjectSelector:
      - matchExpressions:
        - {key: openshift.io/build.name, operator: Exists}
      - matchExpressions:
        - {key: openshift.io/deployer-pod-for.name, operator: Exists}
    template: |-
      initContainers:
...

配置优先级

如果POD配置了注解、neverInjectSelector/alwaysInjectSelector也都配置了,默认策略也配置了,那么他们之间的优先级参考如下:

Pod Annotations → NeverInjectSelector → AlwaysInjectSelector → Default Policy

卸载自动注入sidecar

  • 卸载istio中sidecar组件
kubectl delete mutatingwebhookconfiguration istio-sidecar-injector
kubectl -n istio-system delete service istio-sidecar-injector
kubectl -n istio-system delete deployment istio-sidecar-injector
kubectl -n istio-system delete serviceaccount istio-sidecar-injector-service-account
kubectl delete clusterrole istio-sidecar-injector-istio-system
kubectl delete clusterrolebinding istio-sidecar-injector-admin-role-binding-istio-system
  • 删除某个namespace自动注入
kubectl label namespace default istio-injection-

 sidecar注入问题

更多可以参考官网.

上一篇:服务网格和 Istio 简介


下一篇:istio使用【安装配置】