美文网首页
istio helm安装

istio helm安装

作者: 潘猛_9f76 | 来源:发表于2019-07-11 17:55 被阅读0次

helm是istio官方推荐的正式安装方式

安装helm

项目首页:
https://github.com/helm/helm

先安装helm client,使用helm client安装tiller,通过tiller下载chart,使用chart部署应用
helm client ---> helm tiller (chart) ---> apiserver

下载helm client安装脚本

$ wget https://raw.githubusercontent.com/helm/helm/master/scripts/get 

运行helm client安装脚本

$ sh get
Downloading https://kubernetes-helm.storage.googleapis.com/helm-v2.14.0-linux-amd64.tar.gz
Preparing to install helm and tiller into /usr/local/bin
helm installed into /usr/local/bin/helm
tiller installed into /usr/local/bin/tiller
Run 'helm init' to configure helm.

设置环境变量,将/usr/local/bin加入到.bash_profile中PATH环境变量的配置中,并增加helm的命令的补全

$ cat >> /root/.bash_profile << EOF
source <(helm completion bash)
EOF

Helm init 安装tiller服务器

$ helm init
$HELM_HOME has been configured at /root/.helm.
Tiller (the Helm server-side component) has been installed into your Kubernetes Cluster.
Please note: by default, Tiller is deployed with an insecure 'allow unauthenticated users' policy.
To prevent this, run `helm init` with the --tiller-tls-verify flag.
For more information on securing your installation see: https://docs.helm.sh/using_helm/#securing-your-helm-installation

Tiller也是容器化安装,会在kubenetes的kube-system namespace中增加service、deployment、pod等资源

$ kubectl get pods --all-namespaces | grep till
kube-system     tiller-deploy-765dcb8745-4q4hm             1/1     Running             0          8m48s

验证安装成功
当pod变为Running状态后,可以使用helm version确认服务器正常

验证search功能
Helm是k8s的包管理器,类似yum、apt等,chart是一个应用的信息集合(相当于rpm包),而release是chart的运行实例。Helm search可以查看当前可以安装的chart
Helm与yum类似,也有仓库,上面看到的包属于默认的仓库,可以使用helm repo list查看

权限设置
此时tiller还没有集群权限,需要给tiller服务器添加权限
创建serviceaccount资源tiller,属于kube-system命名空间

$ kubectl create serviceaccount -n kube-system tiller

创建 clusterrolebinding资源tiller-cluster-rule,集群角色为cluster-admin,用户为kube-system:tiller

$ kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller

修改deployment tiller-deploy的配置,增加字段spec.template.spec.serviceAccount

$ kubectl patch deploy -n kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'
安装istio

添加istio repo到helm中

$ helm repo add istio.io https://storage.googleapis.com/istio-release/releases/1.2.2/charts/
"istio.io" has been added to your repositories
$ helm repo list
NAME            URL                                                                
stable          https://kubernetes-charts.storage.googleapis.com                   
local           http://127.0.0.1:8879/charts                                       
istio.io        https://storage.googleapis.com/istio-release/releases/1.2.2/charts/
$ helm search istio
NAME                    CHART VERSION   APP VERSION     DESCRIPTION                        
istio.io/istio          1.2.2           1.2.2           Helm chart for all istio components
istio.io/istio-cni      0.1.0           0.1.0           Helm chart for istio-cni components
istio.io/istio-init     1.2.2           1.2.2           Helm chart to initialize Istio CRDs

安装istio-init

$ kubectl create ns istio-system
$ helm install istio.io/istio-init --name istio-init --namespace istio-system
NAME:   istio-init
LAST DEPLOYED: Thu Jul 11 15:55:04 2019
NAMESPACE: istio-system
STATUS: DEPLOYED
RESOURCES:
==> v1/ClusterRole
NAME                     AGE
istio-init-istio-system  0s
==> v1/ClusterRoleBinding
NAME                                        AGE
istio-init-admin-role-binding-istio-system  0s
==> v1/ConfigMap
NAME          DATA  AGE
istio-crd-10  1     0s
istio-crd-11  1     0s
istio-crd-12  1     0s
==> v1/Job
NAME               COMPLETIONS  DURATION  AGE
istio-init-crd-10  0/1          0s        0s
istio-init-crd-11  0/1          0s        0s
istio-init-crd-12  0/1          0s        0s
==> v1/Pod(related)
NAME                     READY  STATUS             RESTARTS  AGE
istio-init-crd-10-7l9p4  0/1    ContainerCreating  0         0s
istio-init-crd-11-vwb6h  0/1    ContainerCreating  0         0s
istio-init-crd-12-g2dbc  0/1    ContainerCreating  0         0s
==> v1/ServiceAccount
NAME                        SECRETS  AGE
istio-init-service-account  1        0s

确认istio-init安装成功,检查3个pod是否完成,检查是不是新建了23个GRD

$ kubectl get pods -n istio-system
NAME                      READY   STATUS      RESTARTS   AGE
istio-init-crd-10-7l9p4   0/1     Completed   0          6m40s
istio-init-crd-11-vwb6h   0/1     Completed   0          6m40s
istio-init-crd-12-g2dbc   0/1     Completed   0          6m40s
$ kubectl get crds | grep 'istio.io\|certmanager.k8s.io' | wc -l
23
#如果使用了cert-manager,应该是28个GRD

采用default方式安装istio,并查看相关svc和pod,注意type为Nodeport

$ helm install istio.io/istio --name istio --namespace istio-system --set gateways.istio-ingressgateway.type=NodePort
#缺省gateways.istio-ingressgateway使用的是LoadBalance
NAME:   istio
LAST DEPLOYED: Thu Jul 11 17:00:01 2019
NAMESPACE: istio-system
STATUS: DEPLOYED

RESOURCES:
==> v1/ClusterRole
NAME                                 AGE
istio-citadel-istio-system           13s
istio-galley-istio-system            14s
istio-mixer-istio-system             14s
istio-pilot-istio-system             13s
istio-reader                         13s
istio-sidecar-injector-istio-system  13s
prometheus-istio-system              13s

==> v1/ClusterRoleBinding
NAME                                                    AGE
istio-citadel-istio-system                              13s
istio-galley-admin-role-binding-istio-system            13s
istio-mixer-admin-role-binding-istio-system             13s
istio-multi                                             13s
istio-pilot-istio-system                                13s
istio-sidecar-injector-admin-role-binding-istio-system  13s
prometheus-istio-system                                 13s

==> v1/ConfigMap
NAME                             DATA  AGE
istio                            2     14s
istio-galley-configuration       1     14s
istio-security-custom-resources  2     14s
istio-sidecar-injector           2     14s
prometheus                       1     14s

==> v1/Deployment
NAME                    READY  UP-TO-DATE  AVAILABLE  AGE
istio-citadel           1/1    1           1          12s
istio-galley            0/1    1           0          13s
istio-ingressgateway    0/1    1           0          13s
istio-pilot             0/1    1           0          13s
istio-policy            0/1    1           0          13s
istio-sidecar-injector  0/1    1           0          12s
istio-telemetry         0/1    1           0          13s
prometheus              0/1    1           0          12s

==> v1/Pod(related)
NAME                                     READY  STATUS             RESTARTS  AGE
istio-citadel-68c85b6684-9kl6n           1/1    Running            0         12s
istio-galley-77d697957f-jxlgz            0/1    ContainerCreating  0         13s
istio-ingressgateway-8b858ff84-6j7n7     0/1    ContainerCreating  0         13s
istio-pilot-5544b58bb6-78p7g             1/2    Running            0         12s
istio-policy-5f9cf6df57-v6l5c            0/2    ContainerCreating  0         13s
istio-sidecar-injector-66549495d8-4rfhs  0/1    ContainerCreating  0         12s
istio-telemetry-7749c6d54f-zs8qd         0/2    ContainerCreating  0         13s
prometheus-776fdf7479-54m5k              0/1    ContainerCreating  0         12s

==> v1/Role
NAME                      AGE
istio-ingressgateway-sds  13s

==> v1/RoleBinding
NAME                      AGE
istio-ingressgateway-sds  13s

==> v1/Service
NAME                    TYPE       CLUSTER-IP      EXTERNAL-IP  PORT(S)                                                                                                                                     AGE
istio-citadel           ClusterIP  10.97.67.100    <none>       8060/TCP,15014/TCP                                                                                                                          13s
istio-galley            ClusterIP  10.106.30.202   <none>       443/TCP,15014/TCP,9901/TCP                                                                                                                  13s
istio-ingressgateway    NodePort   10.111.118.204  <none>       15020:31683/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:31381/TCP,15030:31215/TCP,15031:31601/TCP,15032:32032/TCP,15443:30133/TCP  13s
istio-pilot             ClusterIP  10.100.206.217  <none>       15010/TCP,15011/TCP,8080/TCP,15014/TCP                                                                                                      13s
istio-policy            ClusterIP  10.105.215.18   <none>       9091/TCP,15004/TCP,15014/TCP                                                                                                                13s
istio-sidecar-injector  ClusterIP  10.108.0.169    <none>       443/TCP                                                                                                                                     13s
istio-telemetry         ClusterIP  10.107.242.174  <none>       9091/TCP,15004/TCP,15014/TCP,42422/TCP                                                                                                      13s
prometheus              ClusterIP  10.105.154.7    <none>       9090/TCP                                                                                                                                    13s

==> v1/ServiceAccount
NAME                                    SECRETS  AGE
istio-citadel-service-account           1        14s
istio-galley-service-account            1        14s
istio-ingressgateway-service-account    1        14s
istio-mixer-service-account             1        14s
istio-multi                             1        14s
istio-pilot-service-account             1        14s
istio-security-post-install-account     1        14s
istio-sidecar-injector-service-account  1        14s
prometheus                              1        14s

==> v1alpha2/attributemanifest
NAME        AGE
istioproxy  12s
kubernetes  12s

==> v1alpha2/handler
NAME           AGE
kubernetesenv  12s
prometheus     12s

==> v1alpha2/instance
NAME                  AGE
attributes            12s
requestcount          12s
requestduration       12s
requestsize           12s
responsesize          12s
tcpbytereceived       12s
tcpbytesent           12s
tcpconnectionsclosed  12s
tcpconnectionsopened  12s

==> v1alpha2/rule
NAME                     AGE
kubeattrgenrulerule      11s
promhttp                 11s
promtcp                  12s
promtcpconnectionclosed  11s
promtcpconnectionopen    12s
tcpkubeattrgenrulerule   11s

==> v1alpha3/DestinationRule
NAME             AGE
istio-policy     12s
istio-telemetry  12s

==> v1beta1/ClusterRole
NAME                                      AGE
istio-security-post-install-istio-system  13s

==> v1beta1/ClusterRoleBinding
NAME                                                   AGE
istio-security-post-install-role-binding-istio-system  13s

==> v1beta1/MutatingWebhookConfiguration
NAME                    AGE
istio-sidecar-injector  12s

==> v1beta1/PodDisruptionBudget
NAME                    MIN AVAILABLE  MAX UNAVAILABLE  ALLOWED DISRUPTIONS  AGE
istio-galley            1              N/A              0                    14s
istio-ingressgateway    1              N/A              0                    14s
istio-pilot             1              N/A              0                    14s
istio-policy            1              N/A              0                    14s
istio-sidecar-injector  1              N/A              0                    14s
istio-telemetry         1              N/A              0                    14s

==> v2beta1/HorizontalPodAutoscaler
NAME                  REFERENCE                        TARGETS        MINPODS  MAXPODS  REPLICAS  AGE
istio-ingressgateway  Deployment/istio-ingressgateway  <unknown>/80%  1        5        0         12s
istio-pilot           Deployment/istio-pilot           <unknown>/80%  1        5        0         12s
istio-policy          Deployment/istio-policy          <unknown>/80%  1        5        0         12s
istio-telemetry       Deployment/istio-telemetry       <unknown>/80%  1        5        0         12s


NOTES:
Thank you for installing istio.

Your release is named istio.

To get started running application with Istio, execute the following steps:
1. Label namespace that application object will be deployed to by the following command (take default namespace as an example)

$ kubectl label namespace default istio-injection=enabled
$ kubectl get namespace -L istio-injection

2. Deploy your applications

$ kubectl apply -f <your-application>.yaml

For more information on running Istio, visit:
https://istio.io/

查看部署情况

$ kubectl get svc -n istio-system
NAME                     TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                                                                                      AGE
istio-citadel            ClusterIP   10.105.168.54    <none>        8060/TCP,15014/TCP                                                                                                                           2m3s
istio-galley             ClusterIP   10.96.206.169    <none>        443/TCP,15014/TCP,9901/TCP                                                                                                                   2m4s
istio-ingressgateway     NodePort    10.100.122.195   <none>        15020:32279/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:31090/TCP,15030:31719/TCP,15031:32634/TCP,15032:31885/TCP,15443:30493/TCP   2m4s
istio-pilot              ClusterIP   10.97.214.19     <none>        15010/TCP,15011/TCP,8080/TCP,15014/TCP                                                                                                       2m3s
istio-policy             ClusterIP   10.101.16.60     <none>        9091/TCP,15004/TCP,15014/TCP                                                                                                                 2m3s
istio-sidecar-injector   ClusterIP   10.110.143.225   <none>        443/TCP                                                                                                                                      2m3s
istio-telemetry          ClusterIP   10.102.132.254   <none>        9091/TCP,15004/TCP,15014/TCP,42422/TCP                                                                                                       2m3s
prometheus               ClusterIP   10.100.112.16    <none>        9090/TCP                                                                                                                                     2m3s
$ kubectl get pods -n istio-system 
NAME                                      READY   STATUS              RESTARTS   AGE
istio-citadel-68c85b6684-4gbdg            1/1     Running             0          3m21s
istio-galley-77d697957f-ls798             0/1     ContainerCreating   0          3m21s
istio-ingressgateway-8b858ff84-qndv9      0/1     Running             0          3m21s
istio-init-crd-10-7l9p4                   0/1     Completed           0          19m
istio-init-crd-11-vwb6h                   0/1     Completed           0          19m
istio-init-crd-12-g2dbc                   0/1     Completed           0          19m
istio-pilot-5544b58bb6-tvkqg              0/2     ContainerCreating   0          3m21s
istio-policy-5f9cf6df57-jqnbh             2/2     Running             1          3m21s
istio-security-post-install-1.2.2-dqtz5   0/1     ContainerCreating   0          5m19s
istio-sidecar-injector-66549495d8-klp5z   0/1     ContainerCreating   0          3m21s
istio-telemetry-7749c6d54f-867p5          0/2     ContainerCreating   0          3m21s
prometheus-776fdf7479-t4txt               0/1     ContainerCreating   0          3m21s
#需要等待pod都运行成功
$ kubectl get pods -n istio-system 
NAME                                      READY   STATUS      RESTARTS   AGE
istio-citadel-68c85b6684-9kl6n            1/1     Running     0          6m45s
istio-galley-77d697957f-jxlgz             1/1     Running     0          6m46s
istio-ingressgateway-8b858ff84-6j7n7      1/1     Running     0          6m46s
istio-init-crd-10-7l9p4                   0/1     Completed   0          71m
istio-init-crd-11-vwb6h                   0/1     Completed   0          71m
istio-init-crd-12-g2dbc                   0/1     Completed   0          71m
istio-pilot-5544b58bb6-78p7g              2/2     Running     0          6m45s
istio-policy-5f9cf6df57-v6l5c             2/2     Running     5          6m46s
istio-sidecar-injector-66549495d8-4rfhs   1/1     Running     0          6m45s
istio-telemetry-7749c6d54f-zs8qd          2/2     Running     1          6m46s
prometheus-776fdf7479-54m5k               1/1     Running     0          6m45s

如何卸载istio

#删除release
$ helm delete --purge istio
$ helm delete --purge istio-init
#删除release后,并不会删除相关的crds资源,需要单独删除
$ tar -zxvf .helm/cache/archive/istio-init-1.2.2.tgz 
$ kubectl delete  -f istio-init/files/
#确认crds清理完成
$ kubectl get crds | grep 'istio.io\|certmanager.k8s.io' | wc -l

可以通过helm upgrade修改release中的配置

$ helm upgrade  --set gateways.istio-ingressgateway.type=LoadBalance istio  istio.io/istio

istio所有端口

Port Protocol Used by Description
8060 HTTP Citadel GRPC server
9090 HTTP Prometheus Prometheus
9091 HTTP Mixer Policy/Telemetry
9093 HTTP Citadel
15000 TCP Envoy Envoy admin port (commands/diagnostics)
15001 TCP Envoy Envoy
15004 HTTP Mixer, Pilot Policy/Telemetry - mTLS
15010 HTTP Pilot Pilot service - XDS pilot - discovery
15011 TCP Pilot Pilot service - mTLS - Proxy - discovery
15014 HTTP Citadel,Mixer, Pilot Control plane monitoring
15030 TCP Prometheus Prometheus
15090 HTTP Mixer Proxy
42422 TCP Mixer Telemetry - Prometheus

配置namespace default为自动注入

$ kubectl label namespace default istio-injection=enabled
$ kubectl get namespace -L istio-injection

相关文章

网友评论

      本文标题:istio helm安装

      本文链接:https://www.haomeiwen.com/subject/uzzdkctx.html