一、Istio / 入门 - 部署示例应用
部署yml文件，位于istio目录的samples目录下。如
C:\Program Install\istio-1.10.3\samples。
1. 部署Booking
kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
#kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
service/details created
serviceaccount/bookinfo-details created
deployment.apps/details-v1 created
service/ratings created
serviceaccount/bookinfo-ratings created
deployment.apps/ratings-v1 created
service/reviews created
serviceaccount/bookinfo-reviews created
deployment.apps/reviews-v1 created
deployment.apps/reviews-v2 created
deployment.apps/reviews-v3 created
service/productpage created
serviceaccount/bookinfo-productpage created
deployment.apps/productpage-v1 created
2. 查看创建的资源
#kubectl get pods
NAME READY STATUS RESTARTS AGE
details-v1-79f774bdb9-5wft6 2/2 Running 0 4m6s
productpage-v1-6b746f74dc-9xx25 2/2 Running 0 4m6s
ratings-v1-b6994bb9-jn58f 1/2 Running 0 4m6s
reviews-v1-545db77b95-dm4bz 2/2 Running 0 4m6s
reviews-v2-7bf8c9648f-hsgwr 2/2 Running 0 4m6s
reviews-v3-84779c7bbc-bhq66 2/2 Running 0 4m6s
#kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
details ClusterIP 10.101.66.249 <none> 9080/TCP 4m10s
kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 6h4m
productpage ClusterIP 10.111.50.235 <none> 9080/TCP 4m9s
ratings ClusterIP 10.110.48.219 <none> 9080/TCP 4m10s
reviews ClusterIP 10.100.11.29 <none> 9080/TCP 4m10s
#kubectl get ingress
No resources found in default namespace.
#kubectl get sidecars
No resources found in default namespace.
验证
kubectl exec ratings-v1-b6994bb9-jn58f -c ratings -- curl -s productpage:9080/productpage
二、Istio / 入门 对外发布
此时，BookInfo 应用已经部署，但还不能被外界访问。 要开放访问，需要创建 Istio 入站网关（Ingress Gateway）, 它会在网格边缘把一个路径映射到路由。
- 关联应用到Ingress Gateway
#kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
gateway.networking.istio.io/bookinfo-gateway created
virtualservice.networking.istio.io/bookinfo created
#kubectl get gateway -n default
NAME AGE
bookinfo-gateway 2m46s
#kubectl get vs -n default
NAME GATEWAYS HOSTS AGE
bookinfo ["bookinfo-gateway"] ["*"] 2m55s
- 确保配置文件正确
#istioctl analyze
✔ No validation issues found when analyzing namespace: default.
三、Istio / 入门 配置ingress地址和端口
- 对于运行于本地环境的Kubernetes，如minikube:
| 环境变量 | 值 | 说明 |
|---|---|---|
| INGRESS_HOST | 本地IP |
|
| INGRESS_PORT | kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].nodePort}' |
windows用单引号，linux用双引号 |
| SECURE_INGRESS_PORT | kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=='https')].nodePort}' |
windows用单引号，linux用双引号 |
| GATEWAY_URL | $INGRESS_HOST:$INGRESS_PORT |
#kubectl -n istio-system get service istio-ingressgateway
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
istio-ingressgateway LoadBalancer 10.110.185.80 localhost 15021:30776/TCP,80:32338/TCP,443:32623/TCP,31400:31980/TCP,15443:31490/TCP 88m
#kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=='http2')]}'
'{"name":"http2","nodePort":32338,"port":80,"protocol":"TCP","targetPort":8080}'
#kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=='http2')].nodePort}'
'32338'
#kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=='https')]}'
'{"name":"https","nodePort":32623,"port":443,"protocol":"TCP","targetPort":8443}'
#kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=='https')].nodePort}'
'32623'
- 对于正经Kubernetes集群
执行如下，看是否支持外部负载均衡。范例：
kubectl get svc istio-ingressgateway -n istio-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
istio-ingressgateway LoadBalancer 172.21.109.129 130.211.10.121 80:31380/TCP,443:31390/TCP,31400:31400/TCP 17h
如果 EXTERNAL-IP 存在值，那么就存在外部负载均衡可用于ingress gateway。 EXTERNAL-IP 值为 <none> (or <pending>)，那就不存在外部负载均衡。这时，可以通过 node port访问gateway（如上例）。
| 环境变量 | 值 | 说明 |
|---|---|---|
| INGRESS_HOST | kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}' |
|
| INGRESS_PORT | kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].port}' |
nodePort改port |
| SECURE_INGRESS_PORT | kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=='https')].port}' |
nodePort改port |
| GATEWAY_URL | $INGRESS_HOST:$INGRESS_PORT |
- 外部访问测试
Istio Bookinfo 示例包含四个独立的微服务，每个微服务都有多个版本。其中一个微服务reviews的三个不同版本已经部署并同时运行。在浏览器中访问 Bookinfo 应用程序的/productpage并刷新几次。您会注意到，有时书评的输出包含星级评分，有时则不包含。
图片.png
图片.png
图片.png
四、Istio / 入门 Dashboard
部署 Kiali 仪表板、 以及 Prometheus、 Grafana、 还有 Jaeger
部署
#kubectl apply -f samples/addons
#kubectl get svc -n istio-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
grafana ClusterIP 10.109.68.9 <none> 3000/TCP 2m58s
istio-egressgateway ClusterIP 10.100.39.94 <none> 80/TCP,443/TCP 116m
istio-ingressgateway LoadBalancer 10.110.185.80 localhost 15021:30776/TCP,80:32338/TCP,443:32623/TCP,31400:31980/TCP,15443:31490/TCP 116m
istiod ClusterIP 10.103.228.126 <none> 15010/TCP,15012/TCP,443/TCP,15014/TCP 116m
jaeger-collector ClusterIP 10.109.202.41 <none> 14268/TCP,14250/TCP 2m56s
kiali ClusterIP 10.107.0.209 <none> 20001/TCP,9090/TCP 2m55s
prometheus ClusterIP 10.109.39.193 <none> 9090/TCP 2m54s
tracing ClusterIP 10.108.251.51 <none> 80/TCP 2m57s
zipkin ClusterIP 10.103.210.61 <none> 9411/TCP 2m56s
#kubectl get pods -n istio-system
NAME READY STATUS RESTARTS AGE
grafana-56d978ff77-24znt 1/1 Running 0 3m9s
istio-egressgateway-5547fcc8fc-dkfk2 1/1 Running 0 116m
istio-ingressgateway-8f568d595-ttbfg 1/1 Running 0 116m
istiod-5c79cf75bf-d67vk 1/1 Running 0 76m
jaeger-5c7c5c8d87-lh8vn 1/1 Running 0 3m9s
kiali-5bb9c9cf49-5xjxf 1/1 Running 0 3m7s
prometheus-5546cc5d8f-txz4x 3/3 Running 0 3m5s
kubectl rollout status deployment/kiali -n istio-system
deployment "kiali" successfully rolled out
查看dashboard，会自动打开一个页面
C:\Program Install\istio-1.10.3>istioctl dashboard kiali
http://localhost:20001/kiali
图片.png
