宁波企业黄页公司黄页深圳seo公司助力网络营销飞跃
istio 灰度实验
使用nginx模拟2个版本的后端服务,一个nginx做代理转发服务。
先结论:istio在匹配路由时使用服务hosts(services名)做匹配,如果hosts没匹配上路由规则不生效。
2个版本的nginx服务
启动后手工进入修改index.html 为 v1,v2。方便后期验证。
echo v1 > /usr/share/nginx/html/index.html
echo v2 > /usr/share/nginx/html/index.html
---
apiVersion: apps/v1
kind: Deployment
metadata:name: nginx-v1labels:app: nginxversion: v1
spec:replicas: 1selector:matchLabels:app: nginxversion: v1template:metadata:labels:app: nginxversion: v1spec:containers:- image: nginx:1.17.8-alpinename: nginx
---
apiVersion: apps/v1
kind: Deployment
metadata:name: nginx-v2labels:app: nginxversion: v2
spec:replicas: 1selector:matchLabels:app: nginxversion: v2template:metadata:labels:app: nginxversion: v2spec:containers:- image: nginx:1.17.8-alpinename: nginx
---
apiVersion: v1
kind: Service
metadata:name: nginx
spec:ports:- name: httpport: 80targetPort: 80selector:app: nginxtype: ClusterIP
代理转发服务
---
apiVersion: v1
data:nginx.conf: |-user nginx;worker_processes auto;error_log /var/log/nginx/error.log notice;pid /var/run/nginx.pid;events {worker_connections 131072;multi_accept on;}http {include /etc/nginx/mime.types;default_type application/octet-stream;underscores_in_headers on;ignore_invalid_headers off;log_format main '$remote_addr - $remote_user [$time_local] "$host" "$request" ''$status $body_bytes_sent "$http_referer" ''"$http_user_agent" "$http_x_forwarded_for"';access_log /var/log/nginx/access.log main;server {listen 80;server_name _;# Add header# 这里重点,代理转发服务不能加上源hosts,否则转发会匹配不上istio路由规则。# proxy_set_header Host $http_host;proxy_set_header X-Real-IP $remote_addr;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Host $http_host;proxy_set_header X-Forwarded-Port $server_port;proxy_set_header X-Forwarded-Proto $scheme;proxy_set_header X-Forwarded-Scheme $scheme;proxy_set_header X-Scheme $scheme;proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;# Routelocation ^~ / {proxy_pass http://nginx:80;}}}
kind: ConfigMap
metadata:labels:app: nginx-routename: nginx-route
---
apiVersion: v1
kind: Service
metadata:labels:app: nginx-routeservice: nginx-routename: nginx-route
spec:ports:- name: httpport: 80protocol: TCPtargetPort: 80selector:app: nginx-routesessionAffinity: Nonetype: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:labels:app: nginx-routename: nginx-route
spec:replicas: 1selector:matchLabels:app: nginx-routetemplate:metadata:labels:app: nginx-routespec:containers:- image: nginx:1.22.1-alpineimagePullPolicy: IfNotPresentname: nginx-routeports:- containerPort: 80name: httpprotocol: TCPresources:limits:cpu: "2"memory: 1Girequests:cpu: 20mmemory: 256MivolumeMounts:- mountPath: /etc/nginx/nginx.confname: configssubPath: nginx.confvolumes:- configMap:name: nginx-routename: configs
配置istio gateway服务
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:name: gateway
spec:selector:istio: ingressgateway # use istio default controllerservers:- port:number: 80name: httpprotocol: HTTPhosts:- "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:name: nginx-route
spec:hosts:- "*"gateways:- gatewayhttp:- match:- uri:exact: /route:- destination:host: nginx-routeport:number: 80
# 全部请求到nginx-route转发服务,再根据路由规则转发到不同的后端。
DestinationRule
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:name: nginx
spec:host: nginxsubsets:- name: v1labels:version: v1- name: v2labels:version: v2
查看服务状态
[root@test]# kubectl get pod,svc,configmap
NAME READY STATUS RESTARTS AGE
pod/nginx-route-5458f4b5ff-jnsfm 2/2 Running 3 22h
pod/nginx-v1-7cdbb97474-nds9f 2/2 Running 2 23h
pod/nginx-v2-7f87f869c-gskqw 2/2 Running 2 23hNAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 23h
service/nginx ClusterIP 10.110.225.75 <none> 80/TCP 23h
service/nginx-route ClusterIP 10.103.42.115 <none> 80/TCP 22hNAME DATA AGE
configmap/istio-ca-root-cert 1 23h
configmap/nginx-route 1 22h
验证
配置好上面的服务使用crul请求istio-ingressgateway。
1、流量被随机分配到不同的服务。
[root@test]# IG=`kubectl get svc -A | grep ingressgateway | awk '{print $4}'`
[root@test]# for i in `seq 10`; do curl http://$IG;done
v1
v1
v1
v2
v1
v2
v2
v1
v2
v1
2、加上路由规则VirtualService
全部流量都访问v2服务
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:name: nginx
spec:hosts:- nginxhttp:- route:- destination:host: nginxsubset: v2
再请求全部流量都访问的v2
[root@test]# IG=`kubectl get svc -A | grep ingressgateway | awk '{print $4}'`
[root@test]# for i in `seq 10`; do curl http://$IG;done
v2
v2
v2
v2
v2
v2
v2
v2
v2
v2
3、修改nginx-route转发服务,带上源hosts后再请求。
configmap修改后须要重启代理服务生效。
server {listen 80;server_name _;# Add header# 这里重点,代理转发服务不能加上源hosts,否则转发会匹配不上istio路由规则。proxy_set_header Host $http_host;proxy_set_header X-Real-IP $remote_addr;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Host $http_host;proxy_set_header X-Forwarded-Port $server_port;proxy_set_header X-Forwarded-Proto $scheme;proxy_set_header X-Forwarded-Scheme $scheme;proxy_set_header X-Scheme $scheme;proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;# Routelocation ^~ / {proxy_pass http://nginx:80;}
再请求发现又随机到不同的服务而不是按vs配置的只路由到v2服务。
[root@test]# IG=`kubectl get svc -A | grep ingressgateway | awk '{print $4}'`
[root@test]# for i in `seq 10`; do curl http://$IG;done
v1
v2
v1
v2
v1
v2
v1
v1
v1
v2