kubernetes istio的快速安裝和使用例子

安裝

[root@master ~]# wget https://github.com/istio/istio/releases/download/1.1.5/istio-1.1.5-linux.tar.gz
[root@master ~]# tar -zxvf istio-1.1.5-linux.tar.gz
[root@master ~]# cd istio-1.1.5

安裝全部Istio自定義資源定義 

[root@master istio-1.1.5]# for i in install/kubernetes/helm/istio-init/files/crd*yaml; do kubectl apply -f $i; done
[root@master istio-1.1.5]# kubectl apply -f install/kubernetes/istio-demo.yaml
[root@master istio-1.1.5]# kubectl  get svc -n istio-system
NAME                     TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                                                                                      AGE
grafana                  ClusterIP      10.105.112.216   <none>        3000/TCP                                                                                                                                     19s
istio-citadel            ClusterIP      10.104.129.126   <none>        8060/TCP,15014/TCP                                                                                                                           19s
istio-egressgateway      ClusterIP      10.96.68.169     <none>        80/TCP,443/TCP,15443/TCP                                                                                                                     19s
istio-galley             ClusterIP      10.101.195.214   <none>        443/TCP,15014/TCP,9901/TCP                                                                                                                   19s
istio-ingressgateway     LoadBalancer   10.102.30.240    <pending>     15020:31109/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:32481/TCP,15030:30697/TCP,15031:32508/TCP,15032:31496/TCP,15443:30329/TCP   19s
istio-pilot              ClusterIP      10.105.128.66    <none>        15010/TCP,15011/TCP,8080/TCP,15014/TCP                                                                                                       19s
istio-policy             ClusterIP      10.97.159.124    <none>        9091/TCP,15004/TCP,15014/TCP                                                                                                                 19s
istio-sidecar-injector   ClusterIP      10.99.226.143    <none>        443/TCP                                                                                                                                      19s
istio-telemetry          ClusterIP      10.109.97.180    <none>        9091/TCP,15004/TCP,15014/TCP,42422/TCP                                                                                                       19s
jaeger-agent             ClusterIP      None             <none>        5775/UDP,6831/UDP,6832/UDP                                                                                                                   19s
jaeger-collector         ClusterIP      10.96.209.196    <none>        14267/TCP,14268/TCP                                                                                                                          19s
jaeger-query             ClusterIP      10.110.178.26    <none>        16686/TCP                                                                                                                                    19s
kiali                    ClusterIP      10.103.103.154   <none>        20001/TCP                                                                                                                                    19s
prometheus               ClusterIP      10.102.6.211     <none>        9090/TCP                                                                                                                                     19s
tracing                  ClusterIP      10.110.154.208   <none>        80/TCP                                                                                                                                       19s
zipkin                   ClusterIP      10.98.186.181    <none>        9411/TCP 

當前 EXTERNAL-IP 處於 pending 狀態，咱們目前的環境並無可用於Istio Ingress Gateway外部的負載均衡器，爲了使得能夠從外部訪問，經過修改 istio-ingressgateway 這個Service的externalIps，覺得當前Kubernetes集羣的kube-proxy啓用了ipvs，因此這個指定一個VIP 10.0.1.111做爲externalIp。也能夠把externalIp改成clusterIP

[root@master istio-1.1.5]# kubectl edit svc istio-ingressgateway -n istio-system

......
spec:
  externalIPs:
  - 10.0.1.111

......
//再次查看
[root@master istio-1.1.5]# kubectl get svc istio-ingressgateway -n istio-system
NAME                     TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                                                                                      AGE
istio-ingressgateway     LoadBalancer   10.102.30.240    10.0.1.111    15020:31109/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:32481/TCP,15030:30697/TCP,15031:32508/TCP,15032:31496/TCP,15443:30329/TCP   7m54s
[root@master istio-1.1.5]# kubectl label namespace default istio-injection=enabled //爲須要自動注入sidecar的namespace打label
[root@master istio-1.1.5]# kubectl get namespace -L istio-system
NAME              STATUS   AGE   ISTIO-SYSTEM
default           Active   13d   enabled
istio-system      Active   22m   
kube-node-lease   Active   13d   
kube-public       Active   13d   
kube-system       Active   13d  

部署案例

[root@master istio-1.1.5]# kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
service/details created
deployment.extensions/details-v1 created
service/ratings created
deployment.extensions/ratings-v1 created
service/reviews created
deployment.extensions/reviews-v1 created
deployment.extensions/reviews-v2 created
deployment.extensions/reviews-v3 created
service/productpage created
deployment.extensions/productpage-v1 created
[root@master istio-1.1.5]# kubectl get svc
NAME           TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE
details        ClusterIP      10.106.209.133   <none>        9080/TCP       84s
kubernetes     ClusterIP      10.96.0.1        <none>        443/TCP        13d
productpage    ClusterIP      10.96.27.39      <none>        9080/TCP       84s
ratings        ClusterIP      10.109.45.236    <none>        9080/TCP       84s
reviews        ClusterIP      10.102.249.50    <none>        9080/TCP       84s
[root@master istio-1.1.5]# kubectl get pods
NAME                             READY   STATUS    RESTARTS   AGE
details-v1-79c6548b59-d8448      1/1     Running   0          3m1s
productpage-v1-95d579cd5-62s8v   1/1     Running   0          3m1s
ratings-v1-7665579b75-jjvv7      1/1     Running   0          3m1s
reviews-v1-67446f7d9b-hrhbj      1/1     Running   0          3m1s
reviews-v2-6bc7b4f678-vhjwh      1/1     Running   0          3m1s
reviews-v3-59b5b6948-sxxhj       1/1     Running   0          3m1s
[root@master istio-1.1.5]# kubectl exec -it $(kubectl get pod -l app=ratings -o jsonpath='{.items[0].metadata.name}') -c ratings -- curl productpage:9080/productpage | grep -o "<title>.*</title>"
<title>Simple Bookstore App</title>

使用Istio Gateway接入集羣外部流量
如今Bookinfo服務已啓動並運行，您須要從Kubernetes集羣外部訪問應用程序，例如，從瀏覽器訪問。一個Istio網關 用於此目的。

1.爲應用程序定義入口網關：

[root@master istio-1.1.5]# kubectl apply -f samples/bookinfo/networking/destination-rule-all.yaml //此處不能樓，否則http://NodeIP:31380/productpage訪問不了
[root@master istio-1.1.5]# kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
gateway.networking.istio.io/bookinfo-gateway created
virtualservice.networking.istio.io/bookinfo created
[root@master istio-1.1.5]# kubectl get gateway
NAME               AGE
bookinfo-gateway   22s
[root@master istio-1.1.5]# kubectl get gateway bookinfo-gateway -o yaml
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"networking.istio.io/v1alpha3","kind":"Gateway","metadata":{"annotations":{},"name":"bookinfo-gateway","namespace":"default"},"spec":{"selector":{"istio":"ingressgateway"},"servers":[{"hosts":["istio.haipai.com"],"port":{"name":"http","number":80,"protocol":"HTTP"}}]}}
  creationTimestamp: "2019-05-24T09:03:51Z"
  generation: 1
  name: bookinfo-gateway
  namespace: default
  resourceVersion: "1649570"
  selfLink: /apis/networking.istio.io/v1alpha3/namespaces/default/gateways/bookinfo-gateway
  uid: d93469d6-7e02-11e9-9cfc-fa163ec472b0
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - istio.haipai.com
    port:
      name: http
      number: 80
      protocol: HTTP

[root@master istio-1.1.5]# kubectl get VirtualService -o wide
NAME       GATEWAYS             HOSTS   AGE
bookinfo   [bookinfo-gateway]   [*]     4m51s

瀏覽器訪問http://NodeIP:31380/productpage
而後建立v3的再去瀏覽器刷新幾回就會發現有紅有黑

[root@master istio-1.1.5]# kubectl apply -f samples/bookinfo/networking/virtual-service-reviews-v3.yaml 
virtualservice.networking.istio.io/reviews created

咱們再建一個virtual-service-reviews-jason-v2-v3.yaml此service不登錄的話默認轉發到v3(紅色)，登錄就轉發到v2(黑色)

[root@master istio-1.1.5]# ls samples/bookinfo/networking/
bookinfo-gateway.yaml            virtual-service-all-v1.yaml              virtual-service-reviews-80-20.yaml
certmanager-gateway.yaml         virtual-service-details-v2.yaml          virtual-service-reviews-90-10.yaml
destination-rule-all-mtls.yaml   virtual-service-ratings-db.yaml          virtual-service-reviews-jason-v2-v3.yaml
destination-rule-all.yaml        virtual-service-ratings-mysql-vm.yaml    virtual-service-reviews-test-v2.yaml
destination-rule-reviews.yaml    virtual-service-ratings-mysql.yaml       virtual-service-reviews-v2-v3.yaml
egress-rule-google-apis.yaml     virtual-service-ratings-test-abort.yaml  virtual-service-reviews-v3.yaml
fault-injection-details-v1.yaml  virtual-service-ratings-test-delay.yaml
ROUTING_RULE_MIGRATION.md        virtual-service-reviews-50-v3.yaml
[root@master istio-1.1.5]# kubectl apply -f samples/bookinfo/networking/virtual-service-reviews-jason-v2-v3.yaml
virtualservice.networking.istio.io/reviews configured

//此時不登錄刷新都是紅色，登錄用戶jason，密碼jason刷新都是黑色