This commit is contained in:
104
网关/Istio/Istio重定向HTTP为HTTPS.md
Normal file
104
网关/Istio/Istio重定向HTTP为HTTPS.md
Normal file
@@ -0,0 +1,104 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# Istio重定向HTTP为HTTPS
|
||||
|
||||
## 部署基础服务
|
||||
|
||||
1. 部署 Nginx 资源
|
||||
|
||||
```yaml
|
||||
kubectl apply -f https://gitee.com/offends/Kubernetes/raw/main/File/Yaml/nginx-deployment.yaml
|
||||
kubectl apply -f https://gitee.com/offends/Kubernetes/raw/main/File/Yaml/nginx-deployment-svc.yaml
|
||||
```
|
||||
|
||||
2. 查看部署情况
|
||||
|
||||
```bash
|
||||
kubectl get deploy,svc
|
||||
```
|
||||
|
||||
## 配置 Istio 对外访问
|
||||
|
||||
1. 部署 Nginx Gateway 资源
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: networking.istio.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: nginx-gateway
|
||||
namespace: default
|
||||
spec:
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
servers:
|
||||
- port:
|
||||
number: 443
|
||||
name: https
|
||||
protocol: HTTPS
|
||||
hosts:
|
||||
- example.com # 替换为你的域名
|
||||
tls:
|
||||
mode: SIMPLE
|
||||
credentialName: example-tls # 替换为你的证书,这个 secret 必须在 istio-system 命名空间
|
||||
- port:
|
||||
number: 80
|
||||
name: http
|
||||
protocol: HTTP
|
||||
hosts:
|
||||
- example.com # 替换为你的域名
|
||||
EOF
|
||||
```
|
||||
|
||||
2. 部署 Nginx VirtualService 资源
|
||||
|
||||
```yaml
|
||||
http:
|
||||
- name: http-redirect
|
||||
match:
|
||||
- port: 80
|
||||
redirect:
|
||||
port: 443
|
||||
scheme: https
|
||||
- name: https-route
|
||||
match:
|
||||
- port: 443
|
||||
route:
|
||||
- destination:
|
||||
host: nginx-service.default.svc.cluster.local # 完整的服务 FQDN
|
||||
port:
|
||||
number: 80
|
||||
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: networking.istio.io/v1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: nginx-virtualservice
|
||||
namespace: default
|
||||
spec:
|
||||
hosts:
|
||||
- example.com # 替换为你的域名
|
||||
gateways:
|
||||
- nginx-gateway
|
||||
http:
|
||||
- name: https-route
|
||||
match:
|
||||
- uri:
|
||||
prefix: /
|
||||
port: 443
|
||||
route:
|
||||
- destination:
|
||||
host: nginx-service.default.svc.cluster.local
|
||||
port:
|
||||
number: 80
|
||||
- name: http-redirect
|
||||
match:
|
||||
- port: 80
|
||||
redirect:
|
||||
port: 443
|
||||
scheme: https
|
||||
EOF
|
||||
```
|
||||
|
||||
3. 访问 HTTP 实现自动跳转到 HTTPS
|
||||
|
||||
144
网关/Istio/使用Istio开启对外访问.md
Normal file
144
网关/Istio/使用Istio开启对外访问.md
Normal file
@@ -0,0 +1,144 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# 使用Istio开启对外访问
|
||||
|
||||
## Istio开启对外访问
|
||||
|
||||
### 部署基础服务
|
||||
|
||||
1. 部署 Nginx 资源
|
||||
|
||||
```yaml
|
||||
kubectl apply -f https://gitee.com/offends/Kubernetes/raw/main/File/Yaml/nginx-deployment.yaml
|
||||
kubectl apply -f https://gitee.com/offends/Kubernetes/raw/main/File/Yaml/nginx-deployment-svc.yaml
|
||||
```
|
||||
|
||||
2. 查看部署情况
|
||||
|
||||
```bash
|
||||
kubectl get deploy,svc
|
||||
```
|
||||
|
||||
### 配置 Istio 对外访问
|
||||
|
||||
1. 部署 Nginx Gateway 资源
|
||||
|
||||
- HTTP
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: networking.istio.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: nginx-gateway
|
||||
namespace: default
|
||||
spec:
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
servers:
|
||||
- port:
|
||||
number: 80
|
||||
name: http
|
||||
protocol: HTTP
|
||||
hosts:
|
||||
- '*'
|
||||
EOF
|
||||
```
|
||||
|
||||
- HTTPS
|
||||
|
||||
1. 创建证书 Secret 资源
|
||||
|
||||
```bash
|
||||
kubectl create secret tls demo-tls --cert=server.crt --key=server.key -n istio-system
|
||||
```
|
||||
|
||||
2. 创建 Gateway 资源
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: networking.istio.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: nginx-gateway
|
||||
namespace: default
|
||||
spec:
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
servers:
|
||||
- port:
|
||||
number: 443
|
||||
name: https
|
||||
protocol: HTTPS
|
||||
hosts:
|
||||
- example.com # 替换为你的域名
|
||||
tls:
|
||||
mode: SIMPLE
|
||||
credentialName: example-tls # 替换为你的证书,这个 secret 必须在 istio-system 命名空间
|
||||
EOF
|
||||
```
|
||||
|
||||
2. 部署 Nginx VirtualService 资源
|
||||
|
||||
- HTTP
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: networking.istio.io/v1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: nginx-virtualservice
|
||||
namespace: default
|
||||
spec:
|
||||
hosts:
|
||||
- '*'
|
||||
gateways:
|
||||
- nginx-gateway
|
||||
http:
|
||||
- match:
|
||||
- uri:
|
||||
prefix: /
|
||||
port: 80
|
||||
route:
|
||||
- destination:
|
||||
host: nginx-service.default.svc.cluster.local
|
||||
port:
|
||||
number: 80
|
||||
EOF
|
||||
```
|
||||
|
||||
- HTTPS
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: networking.istio.io/v1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: nginx-virtualservice
|
||||
namespace: default
|
||||
spec:
|
||||
hosts:
|
||||
- example.com # 替换为你的域名
|
||||
gateways:
|
||||
- nginx-gateway
|
||||
http:
|
||||
- match:
|
||||
- uri:
|
||||
prefix: /
|
||||
port: 443
|
||||
route:
|
||||
- destination:
|
||||
host: nginx-service.default.svc.cluster.local
|
||||
port:
|
||||
number: 80
|
||||
EOF
|
||||
```
|
||||
|
||||
3. 访问测试
|
||||
|
||||
```bash
|
||||
kubectl get svc istio-ingressgateway -n istio-system
|
||||
```
|
||||
|
||||
通过 `域名` 或 `IP:80` 访问
|
||||
|
||||
145
网关/Istio/官方Istio使用示例.md
Normal file
145
网关/Istio/官方Istio使用示例.md
Normal file
@@ -0,0 +1,145 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# 官方Istio使用示例
|
||||
|
||||
[Bookinfo 应用](https://istio.io/latest/zh/docs/examples/bookinfo/)
|
||||
|
||||
## 前提条件
|
||||
|
||||
如果您还没有开始，请遵循 [Istio安装和使用](https://gitee.com/offends/Kubernetes/blob/main/%E7%BD%91%E5%85%B3/Istio/Istio%E5%AE%89%E8%A3%85%E5%92%8C%E4%BD%BF%E7%94%A8.md) 完成 Istio 的部署工作。
|
||||
|
||||
本文使用 Istio 官方推荐的 Gateway API 部署举例。
|
||||
|
||||
## 部署 Bookinfo
|
||||
|
||||
<img src="https://istio.io/latest/zh/docs/examples/bookinfo/withistio.svg" style="zoom:100%;" />
|
||||
|
||||
1. 进入示例目录
|
||||
|
||||
```bash
|
||||
cd istio-1.28.1
|
||||
```
|
||||
|
||||
2. 部署应用
|
||||
|
||||
```bash
|
||||
kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
|
||||
```
|
||||
|
||||
3. 要确认 Bookinfo 应用正在运行，请从某个 Pod 中（例如从 `ratings` 中）用 `curl` 命令对此应用发送一条请求
|
||||
|
||||
```bash
|
||||
kubectl exec "$(kubectl get pod -l app=ratings -o jsonpath='{.items[0].metadata.name}')" -c ratings -- curl -sS productpage:9080/productpage | grep -o "<title>.*</title>"
|
||||
```
|
||||
|
||||
结果输出 `<title>Simple Bookstore App</title>` 即代表运行成功。
|
||||
|
||||
4. 对外开放应用
|
||||
|
||||
```bash
|
||||
kubectl apply -f samples/bookinfo/gateway-api/bookinfo-gateway.yaml
|
||||
```
|
||||
|
||||
5. 通过注解网关将服务类型更改为 `NodePort`
|
||||
|
||||
```bash
|
||||
kubectl annotate gateway bookinfo-gateway networking.istio.io/service-type=NodePort --namespace=default
|
||||
```
|
||||
|
||||
6. 检查网关的状态
|
||||
|
||||
```bash
|
||||
kubectl get gateway
|
||||
```
|
||||
|
||||
7. 查看 NodePort 对外端口
|
||||
|
||||
```bash
|
||||
kubectl get svc bookinfo-gateway-istio
|
||||
```
|
||||
|
||||
8. 浏览器访问
|
||||
|
||||
```bash
|
||||
http://$ip:30000/productpage
|
||||
```
|
||||
|
||||
刷新页面，应该会看到书评和评分发生变化， 因为请求分布在 `reviews` 服务的不同版本上
|
||||
|
||||
## 使用 Kiali 仪表板
|
||||
|
||||
1. 安装 Kiali 仪表板
|
||||
|
||||
```bash
|
||||
kubectl apply -f samples/addons/prometheus.yaml
|
||||
kubectl apply -f samples/addons/kiali.yaml
|
||||
```
|
||||
|
||||
2. 修改对外访问模式为 NodePort
|
||||
|
||||
```bash
|
||||
kubectl patch svc kiali -n istio-system -p '{"spec":{"type":"NodePort"}}'
|
||||
```
|
||||
|
||||
3. 查看 NodePort 对外端口
|
||||
|
||||
```bash
|
||||
kubectl get svc kiali -n istio-system
|
||||
```
|
||||
|
||||
4. 浏览器访问
|
||||
|
||||
```bash
|
||||
http://$ip:30001/kiali
|
||||
```
|
||||
|
||||
5. 刷新页面并查看拓扑图
|
||||
|
||||
## 使用 Istio 实现灰度发布
|
||||
|
||||
[官方文档](https://istio.io/latest/zh/docs/tasks/traffic-management/traffic-shifting/#apply-weight-based-routing)
|
||||
|
||||
1. 定义服务可用版本
|
||||
|
||||
```bash
|
||||
kubectl apply -f samples/bookinfo/platform/kube/bookinfo-versions.yaml
|
||||
```
|
||||
|
||||
2. 首先，运行此命令将所有流量路由到各个微服务的 `v1` 版本
|
||||
|
||||
```bash
|
||||
kubectl apply -f samples/bookinfo/gateway-api/route-reviews-v1.yaml
|
||||
```
|
||||
|
||||
3. 在浏览器中打开 Bookinfo 站点。网址为 `http://$GATEWAY_URL/productpage`， 其中 `$GATEWAY_URL` 是 Ingress 的外部 IP 地址，其描述参见 [Bookinfo](https://istio.io/latest/zh/docs/examples/bookinfo/#determine-the-ingress-IP-and-port) 文档。
|
||||
|
||||
请注意，不管刷新多少次，页面的评论部分都不会显示评价星级的内容。 这是因为 Istio 被配置为将星级评价的服务的所有流量都路由到了 `reviews:v1` 版本，而该版本的服务不访问带评价星级的服务。
|
||||
|
||||
4. 使用下面的命令把 50% 的流量从 `reviews:v1` 转移到 `reviews:v3`
|
||||
|
||||
```bash
|
||||
kubectl apply -f samples/bookinfo/gateway-api/route-reviews-50-v3.yaml
|
||||
```
|
||||
|
||||
5. 等待几秒钟，等待新的规则传播到代理中生效，确认规则已被替换。刷新浏览器中的 `/productpage` 页面，大约有 50% 的几率会看到页面中带**红色**星级的评价内容。 这是因为 `reviews` 的 `v3` 版本可以访问带星级评价，但 `v1` 版本不能
|
||||
|
||||
6. 如果您认为 `reviews:v3` 微服务已经稳定，您可以通过应用 Virtual Service 规则将 100% 的流量路由 `reviews:v3`
|
||||
|
||||
```bash
|
||||
kubectl apply -f samples/bookinfo/gateway-api/route-reviews-v3.yaml
|
||||
```
|
||||
|
||||
7. 现在，当您刷新 `/productpage` 时，您将始终看到带有**红色**星级评分的书评
|
||||
|
||||
8. 清理路由规则
|
||||
|
||||
```bash
|
||||
kubectl delete httproute reviews
|
||||
```
|
||||
|
||||
## 清理示例环境
|
||||
|
||||
```bash
|
||||
samples/bookinfo/platform/kube/cleanup.sh
|
||||
```
|
||||
|
||||
176
网关/Istio/通过Istio实现灰度发布.md
Normal file
176
网关/Istio/通过Istio实现灰度发布.md
Normal file
@@ -0,0 +1,176 @@
|
||||
> 本文作者：丁辉
|
||||
|
||||
# 通过Istio实现灰度发布
|
||||
|
||||
部署测试示例 Nginx Deployment v1和v2
|
||||
|
||||
1. 部署 v1 版本
|
||||
|
||||
```bash
|
||||
kubectl apply -f https://gitee.com/offends/Kubernetes/raw/main/File/Yaml/nginx-deployment-v1.yaml
|
||||
```
|
||||
|
||||
2. 部署 v2 版本
|
||||
|
||||
```bash
|
||||
kubectl apply -f https://gitee.com/offends/Kubernetes/raw/main/File/Yaml/nginx-deployment-v2.yaml
|
||||
```
|
||||
|
||||
## 配合 Istio APIs 实现灰度发布
|
||||
|
||||
1. 创建 Nginx Service
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nginx-deployment-service
|
||||
namespace: default
|
||||
spec:
|
||||
selector:
|
||||
app: nginx
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
EOF
|
||||
```
|
||||
|
||||
2. 创建 Nginx Gateway 资源
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: networking.istio.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: nginx-gateway
|
||||
namespace: default
|
||||
spec:
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
servers:
|
||||
- port:
|
||||
number: 443
|
||||
name: https
|
||||
protocol: HTTPS
|
||||
hosts:
|
||||
- example.com # 替换为你的域名
|
||||
tls:
|
||||
mode: SIMPLE
|
||||
credentialName: example-tls # 替换为你的证书,这个 secret 必须在 istio-system 命名空间
|
||||
EOF
|
||||
```
|
||||
|
||||
3. 创建 DestinationRule 资源
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: networking.istio.io/v1
|
||||
kind: DestinationRule
|
||||
metadata:
|
||||
name: nginx-destination
|
||||
spec:
|
||||
host: nginx-deployment-service #对应 service 名称
|
||||
subsets:
|
||||
- name: v1
|
||||
labels:
|
||||
version: v1 # Pod标签
|
||||
- name: v2
|
||||
labels:
|
||||
version: v2 # Pod标签
|
||||
EOF
|
||||
```
|
||||
|
||||
4. 创建 VirtualService 资源(限制流量全部开放给 v1)
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: networking.istio.io/v1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: nginx-virtualservice
|
||||
namespace: default
|
||||
spec:
|
||||
hosts:
|
||||
- example.com # 替换为你的域名
|
||||
gateways:
|
||||
- nginx-gateway
|
||||
http:
|
||||
- route:
|
||||
- destination:
|
||||
host: nginx-deployment-service.default.svc.cluster.local # 指对应的 service 名称
|
||||
port:
|
||||
number: 80
|
||||
subset: v1 # 对应 DestinationRule 中的 v1
|
||||
weight: 100 # 100%流量分发到 v1
|
||||
- destination:
|
||||
host: nginx-deployment-service.default.svc.cluster.local # 指对应的 service 名称
|
||||
port:
|
||||
number: 80
|
||||
subset: v2 # 对应 DestinationRule 中的 v2
|
||||
EOF
|
||||
```
|
||||
|
||||
5. 更新 VirtualService 资源(将 20% 流量分给 v2)
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: networking.istio.io/v1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: nginx-virtualservice
|
||||
namespace: default
|
||||
spec:
|
||||
hosts:
|
||||
- example.com # 替换为你的域名
|
||||
gateways:
|
||||
- nginx-gateway
|
||||
http:
|
||||
- route:
|
||||
- destination:
|
||||
host: nginx-deployment-service.default.svc.cluster.local # 指对应的 service 名称
|
||||
port:
|
||||
number: 80
|
||||
subset: v1 # 对应 DestinationRule 中的 v1
|
||||
weight: 80 # 80%流量分发到 v1
|
||||
- destination:
|
||||
host: nginx-deployment-service.default.svc.cluster.local # 指对应的 service 名称
|
||||
port:
|
||||
number: 80
|
||||
subset: v2 # 对应 DestinationRule 中的 v2
|
||||
weight: 20 # 20%流量分发到 v2
|
||||
EOF
|
||||
```
|
||||
|
||||
6. 最后将全部流量开放给 v2
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: networking.istio.io/v1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: nginx-virtualservice
|
||||
namespace: default
|
||||
spec:
|
||||
hosts:
|
||||
- example.com # 替换为你的域名
|
||||
gateways:
|
||||
- nginx-gateway
|
||||
http:
|
||||
- route:
|
||||
- destination:
|
||||
host: nginx-deployment-service.default.svc.cluster.local # 指对应的 service 名称
|
||||
port:
|
||||
number: 80
|
||||
subset: v1 # 对应 DestinationRule 中的 v1
|
||||
- destination:
|
||||
host: nginx-deployment-service.default.svc.cluster.local # 指对应的 service 名称
|
||||
port:
|
||||
number: 80
|
||||
subset: v2 # 对应 DestinationRule 中的 v2
|
||||
weight: 100 # 100%流量分发到 v2
|
||||
EOF
|
||||
```
|
||||
|
||||
7. 完成灰度发布(HTTPS同理)。
|
||||
Reference in New Issue
Block a user