美文网首页
Istio初识

Istio初识

作者: davisgao | 来源:发表于2019-12-03 17:05 被阅读0次

    1.简介

    2.整体架构

    istio

    3.组件说明

    3.1 Pilot

    属于控制面,承担着服务发现、流量管理、智能路由等,提供一系列的api的入口

    3.2 Galley

    配置的验证,管理和分发,作为istio的配置中心,通过用validatingWebhook机制对Pilot 和 Mixer 的配置进行验证

    3.3 Citadel

    负责秘钥和证书的管理,服务鉴权

    3.4 Mixer

    管理授权和审计,和连接envoy,对应镜像istio-policy,Mixer提供adapter机制
    Mixer中现有的Adapter

    • 实现Check的Adapter
      listchecker(黑白名单)
      opa(open Policy Agent)
      RBAC(连接到istioCA)

    • 实现Quota的Adapter
      Menquota(基于单机内存)
      Redisquota(基于外部Redis)

    • 实现Report的Adapter
      Circonus
      Cloudwatch
      Dogstatsd
      Fluentd
      Prometheus
      Solarwinds
      StatsD
      Stdio

    3.5 Proxy(Agent+Envoy)

    通过sidecar方式部署于pod中,负责接收控制面策略并生成配置文件,作用于pod。

    Envoy启动时的启动配置文件中包括:

    • Node信息
      包含的节点信息
    • stats_config
      Envoy的管理信息
    • admin
      Envoy的管理信息主要是指管理API地址(127.0.0.1::15000)
    • dynamic_resources
      根据Polit提供的XDS接口生成的配置信息
    • static_resources
      静态配置信息,包括prometheus,Pilot控制面和zipkin服务发现信息
    • tracing
      链路追踪Tracing的配置信息

    Envoy启动的配置文件所在位置

    [root@node4 ~]# kubectl exec productpage-v1-8554d58bff-bhlfl -c istio-proxy -- ls /etc/istio/proxy/envoy-rev0.json 
    /etc/istio/proxy/envoy-rev0.json
    

    Envoy中的接口:

    [root@node4 ~]# kubectl exec productpage-v1-8554d58bff-bhlfl  -c istio-proxy curl http://127.0.0.1:15000/help
      % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
    0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0admin commands are:
      /: Admin home page
      /certs: print certs on machine
      /clusters: upstream cluster status
      /config_dump: dump current Envoy configs (experimental)
      /contention: dump current Envoy mutex contention stats (if enabled)
      /cpuprofiler: enable/disable the CPU profiler
      /healthcheck/fail: cause the server to fail health checks
      /healthcheck/ok: cause the server to pass health checks
      /heapprofiler: enable/disable the heap profiler
      /help: print out list of admin commands
      /hot_restart_version: print the hot restart compatibility version
      /listeners: print listener info
      /logging: query/change logging levels
      /memory: print current allocation/heap usage
      /quitquitquit: exit the server
      /ready: print server state, return 200 if LIVE, otherwise return 503
      /reset_counters: reset all counters to zero
      /runtime: print runtime values
      /runtime_modify: modify runtime values
      /server_info: print server version/status information
      /stats: print server stats
      /stats/prometheus: print server stats in prometheus format
    

    clusters信息

    istio-proxy@productpage-v1-8554d58bff-tqhnk:/$ curl http://127.0.0.1:15000/clusters |grep 9080             
      % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                     Dload  Upload   Total   Spent    Left  Speed
      0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
    outbound|9080||reviews.default.svc.cluster.local::default_priority::max_connections::1024
    outbound|9080||reviews.default.svc.cluster.local::default_priority::max_pending_requests::1024
    outbound|9080||reviews.default.svc.cluster.local::default_priority::max_requests::1024
    outbound|9080||reviews.default.svc.cluster.local::default_priority::max_retries::1024
    outbound|9080||reviews.default.svc.cluster.local::high_priority::max_connections::1024
    outbound|9080||reviews.default.svc.cluster.local::high_priority::max_pending_requests::1024
    outbound|9080||reviews.default.svc.cluster.local::high_priority::max_requests::1024
    outbound|9080||reviews.default.svc.cluster.local::high_priority::max_retries::3
    outbound|9080||reviews.default.svc.cluster.local::added_via_api::true
    outbound|9080||reviews.default.svc.cluster.local::172.10.104.13:9080::cx_active::2
    outbound|9080||reviews.default.svc.cluster.local::172.10.104.13:9080::cx_connect_fail::0
    outbound|9080||reviews.default.svc.cluster.local::172.10.104.13:9080::cx_total::2
    outbound|9080||reviews.default.svc.cluster.local::172.10.104.13:9080::rq_active::0
    
    

    Envoy的运行时配置信息

    [root@node4 ~]# kubectl exec -it productpage-v1-8554d58bff-bhlfl -c istio-proxy curl http://127.0.0.1:15000/config_dump
    

    包含的内容

    • BootstrapConfigDump
      bootstrap包含启动Envoy时的配置西悉尼

    • ClustersConfigDump
      static_clusters:
      主要包括istio平台本省的组件信息,如zipkin、prometheus、STRICT_DNS(Polit控制面)
      dynamic_active_clusters:根据POD产生的cluster,根据类型分为STATIC(如BlackHoleCluster,类似404无匹配时到达)、ORIGINAL_DST和EDS(表示通过API产生的配置)

    • ListenersConfigDump
      static_listeners:在15090端口上开启的listeners
      dynamic_active_listeners:动态在POD和service上创建的listeners
    • ScopedRoutesConfigDump
    • RoutesConfigDump对应VirtualService
      static_route_configs : 平台产生的路由配置信息
      dynamic_route_configs : 根据业务产的路由配置
    • SecretsConfigDump

    4.istio中资源类型

    • attributemanifest
      定义属性清单

    • instance rule handler
      instance 表示一系列的数据
      handler 对应着数据处理的适配器
      rule 包含一系列的action,每个action是一个handler 和一组instance 的对应关系

      三个关系
    • DestinationRule
      描述即将流量转发到服务时应用的策略集,包括负载均衡配置,sidecar中的连接池大小和异常值检测设置(主要用于从负载平衡池中逐出不正常的主机)
      其中负载均衡策略包括:ROUND_ROBIN、LEAST_CONN、RANDOM、PASSTHROUGH

    • Gateway
      网关,描述应用在边缘设备(整个mesh对外的入口和出口)上的开放的端口和协议等

    • VirtualService
      定义路由规则,包括headers匹配等

    • ServiceEntry
      ServiceEntry用于将附加条目添加到Istio内部维护的服务注册表中。

    4.istio的安装

    istio的安装

    //下载istio-1.3.4-linux.tar.gz
    [root@node4 istio]# wget https://github.com/istio/istio/releases/download/1.3.4/istio-1.3.4-linux.tar.gz
    [root@node4 istio]# tar -zxvf istio-1.3.4-linux.tar.gz
    [root@node4 istio]# cd istio-1.3.4/
    [root@node4 istio-1.3.4]# kubectl apply -f install/kubernetes/istio-demo.yaml
    [root@node4 istio-1.3.4]# kubectl -n istio-system get pod 
    NAME                                      READY   STATUS      RESTARTS   AGE
    grafana-59d57c5c56-sj95t                  1/1     Running     0          21d
    istio-citadel-555bff45bf-rtcv6            1/1     Running     0          21d
    istio-egressgateway-7fd45cc845-2lzzh      1/1     Running     0          21d
    istio-galley-7f8b6db7d7-v992r             1/1     Running     0          21d
    istio-grafana-post-install-1.3.4-7bgxj    0/1     Completed   0          21d
    istio-ingressgateway-64456bb8b-nqc89      1/1     Running     0          21d
    istio-pilot-85894cd4f5-859kp              2/2     Running     0          21d
    istio-policy-7d8f44db64-4zggd             2/2     Running     2          21d
    istio-security-post-install-1.3.4-2vxhk   0/1     Completed   0          21d
    istio-sidecar-injector-65d5f8db56-2x8l5   1/1     Running     0          21d
    istio-telemetry-85c7c59b86-wxxsx          2/2     Running     2          21d
    istio-tracing-795c9c64c4-8r6p5            1/1     Running     0          21d
    kiali-8c9d6fbf6-rblp5                     1/1     Running     0          21d
    prometheus-7d7b9f7844-kfpk4               1/1     Running     0          21d
    [root@node4 istio-1.3.4]# kubectl -n istio-system get svc
    NAME                     TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                                                                                      AGE
    grafana                  ClusterIP   172.20.185.180   <none>        3000/TCP                                                                                                                                     21d
    istio-citadel            ClusterIP   172.20.170.209   <none>        8060/TCP,15014/TCP                                                                                                                           21d
    istio-egressgateway      ClusterIP   172.20.17.218    <none>        80/TCP,443/TCP,15443/TCP                                                                                                                     21d
    istio-galley             ClusterIP   172.20.53.63     <none>        443/TCP,15014/TCP,9901/TCP                                                                                                                   21d
    istio-ingressgateway     NodePort    172.20.68.121    <none>        15020:30962/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:30391/TCP,15030:32742/TCP,15031:31213/TCP,15032:31411/TCP,15443:32673/TCP   21d
    istio-pilot              ClusterIP   172.20.42.191    <none>        15010/TCP,15011/TCP,8080/TCP,15014/TCP                                                                                                       21d
    istio-policy             ClusterIP   172.20.168.15    <none>        9091/TCP,15004/TCP,15014/TCP                                                                                                                 21d
    istio-sidecar-injector   ClusterIP   172.20.149.157   <none>        443/TCP,15014/TCP                                                                                                                            21d
    istio-telemetry          ClusterIP   172.20.42.203    <none>        9091/TCP,15004/TCP,15014/TCP,42422/TCP                                                                                                       21d
    jaeger-agent             ClusterIP   None             <none>        5775/UDP,6831/UDP,6832/UDP                                                                                                                   21d
    jaeger-collector         ClusterIP   172.20.50.220    <none>        14267/TCP,14268/TCP,14250/TCP                                                                                                                21d
    jaeger-query             ClusterIP   172.20.49.122    <none>        16686/TCP                                                                                                                                    21d
    kiali                    ClusterIP   172.20.238.205   <none>        20001/TCP                                                                                                                                    21d
    prometheus               ClusterIP   172.20.97.112    <none>        9090/TCP                                                                                                                                     21d
    tracing                  ClusterIP   172.20.203.114   <none>        80/TCP                                                                                                                                       21d
    zipkin                   ClusterIP   172.20.133.126   <none>        9411/TCP                                                                                                                                     21d
    
    

    bookinfo实例

    //设置default的注入标识
    [root@node4 istio-1.3.4]# kubectl label namespace default istio-injection=enabled
    [root@node4 istio-1.3.4]# kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
    [root@node4 istio-1.3.4]# kubectl get pod
    NAME                                                  READY   STATUS              RESTARTS   AGE
    details-v1-74f858558f-cqwdk                           2/2     Running             0          21d
    productpage-v1-8554d58bff-bhlfl                       2/2     Running             0          21d
    ratings-v1-7855f5bcb9-c6d7w                           2/2     Running             0          21d
    reviews-v1-59fd8b965b-h759b                           2/2     Running             0          21d
    reviews-v2-d6cfdb7d6-v4fjt                            2/2     Running             0          21d
    reviews-v3-75699b5cfb-kf8tb                           2/2     Running             0          21d
    

    检查Proxy注入

    image.png
    访问测试
    export INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].nodePort}')
    export INGRESS_HOST=$(kubectl get po -l istio=ingressgateway -n istio-system -o jsonpath='{.items[0].status.hostIP}')
    
    image.png
    image.png
    image.png

    5.访问流程分析

    image.png

    相关文章

      网友评论

          本文标题:Istio初识

          本文链接:https://www.haomeiwen.com/subject/bnlfictx.html