istio-流量管理-服务网格外的流量管理

istio-流量管理-服务网格外的流量管理

这个也一知半解，暂时没用到，放这吧

为了控制服务网格外的服务的流量访问，外部的服务必须首先使用一个ServiceEntry对象加入到 istio 的内部 service registry 中，服务网格才会知道如何导向这些外部服务的流量。

为了测试这个功能，我们使用 istio 样例中的 sleep 应用来验证改功能，查看 samples/sleep/sleep.yaml 文件内容：

# cat samples/sleep/sleep.yaml
# Copyright 2017 Istio Authors
#
#   Licensed under the Apache License, Version 2.0 (the "License");
#   you may not use this file except in compliance with the License.
#   You may obtain a copy of the License at
#
#       http://www.apache.org/licenses/LICENSE-2.0
#
#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an "AS IS" BASIS,
#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#   See the License for the specific language governing permissions and
#   limitations under the License.

##################################################################################################
# Sleep service
##################################################################################################
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sleep
---
apiVersion: v1
kind: Service
metadata:
  name: sleep
  labels:
    app: sleep
spec:
  ports:
  - port: 80
    name: http
  selector:
    app: sleep
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sleep
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sleep
  template:
    metadata:
      labels:
        app: sleep
    spec:
      serviceAccountName: sleep
      containers:
      - name: sleep
        image: governmentpaas/curl-ssl
        command: ["/bin/sleep", "3650d"]
        imagePullPolicy: IfNotPresent
---

 

这其实就是一个简单的应用，通过 Deployment 进行控制，通过 Service 暴露服务，现在我们来部署该应用：

[root@k8s-master istio-1.3.1]#  kubectl apply -f <(istioctl kube-inject -f samples/sleep/sleep.yaml)
serviceaccount/sleep created
service/sleep created
deployment.apps/sleep created
[root@k8s-master istio-1.3.1]#
[root@k8s-master istio-1.3.1]# kubectl get pod
NAME                                      READY   STATUS    RESTARTS   AGE
details-v1-74f858558f-qnbfx               2/2     Running   0          3d4h
dig                                       2/2     Running   0          10m
nfs-client-provisioner-74bcb5d897-nx8fb   1/1     Running   0          5d3h
productpage-v1-8554d58bff-2cng5           2/2     Running   0          3d4h
ratings-v1-7855f5bcb9-8lzb5               2/2     Running   0          3d4h
reviews-v1-59fd8b965b-fxxxn               2/2     Running   0          3d4h
reviews-v2-d6cfdb7d6-rf6nh                2/2     Running   0          3d4h
reviews-v3-75699b5cfb-qn4db               2/2     Running   0          3d4h
sleep-75c858dc6b-n7k79                    2/2     Running   0          38s

待应用部署完成后，我们进入该应用容器内部执行一些测试操作：

[root@k8s-master istio-1.3.1]# export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
[root@k8s-master istio-1.3.1]# kubectl exec -it $SLEEP_POD -c sleep -- curl -sL -o /dev/null -D - http://edition.cnn.com/politics
HTTP/1.1 503 Service Unavailable
content-length: 91
content-type: text/plain
date: Mon, 11 Nov 2019 08:24:58 GMT
server: envoy

可以看到会返回上面的404的信息(我的返回503)，因为该域名不在当前的服务网格中，默认情况下 istio 不允许访问服务网格外部的 URL，即服务网格中对未知的服务请求会被丢弃。这就需要我们来创建一个 ServiceEntry 对象，将外部的访问服务引入到服务网格中来。

例如下面的规则定义了一个访问 edition.cnn.com 的服务的 ServiceEntry:（cnn-service-entry.yaml）

例如下面的规则定义了一个访问 edition.cnn.com 的服务的 ServiceEntry:（cnn-service-entry.yaml）

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: cnn
spec:
  hosts:
  - edition.cnn.com
  ports:
  - number: 80
    name: http-port
    protocol: HTTP
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS

现在我们来部署上面的 ServiceEntry 资源：

$ istioctl create -f cnn-service-entry.yaml
Created config service-entry/default/cnn at revision 32149308
$ istioctl get serviceentry
SERVICE-ENTRY NAME   HOSTS             PORTS               NAMESPACE   AGE
cnn                  edition.cnn.com   HTTP/80,HTTPS/443   default     1m

现在我们再去上面的 sleep 容器中执行上面的测试请求：

[root@k8s-master istio-1.3.1]#  kubectl exec -it $SLEEP_POD -c sleep -- curl -sL -o /dev/null -D - http://edition.cnn.com/politics
HTTP/1.1 301 Moved Permanently
server: envoy
retry-after: 0
content-length: 0
cache-control: public, max-age=600
location: https://edition.cnn.com/politics
accept-ranges: bytes
date: Mon, 11 Nov 2019 08:27:05 GMT
via: 1.1 varnish
set-cookie: countryCode=CN; Domain=.cnn.com; Path=/
set-cookie: geoData=fengtai|BJ|100036|CN|AS|800|broadband; Domain=.cnn.com; Path=/
x-served-by: cache-hnd18723-HND
x-cache: HIT
x-cache-hits: 0
x-envoy-upstream-service-time: 250

HTTP/2 200
content-type: text/html; charset=utf-8
x-servedbyhost: ::ffff:127.0.0.1
access-control-allow-origin: *
cache-control: max-age=60
content-security-policy: default-src 'self' blob: https://*.cnn.com:* http://*.cnn.com:* *.cnn.io:* *.cnn.net:* *.turner.com:* *.turner.io:* *.ugdturner.com:* courageousstudio.com *.vgtf.net:*; script-src 'unsafe-eval' 'unsafe-inline' 'self' *; style-src 'unsafe-inline' 'self' blob: *; child-src 'self' blob: *; frame-src 'self' *; object-src 'self' *; img-src 'self' data:blob: *; media-src 'self' data: blob: *; font-src 'self' data: *; connect-src 'self' *; frame-ancestors 'self' https://*.cnn.com:* http://*.cnn.com https://*.cnn.io:* http://*.cnn.io:* *.turner.com:* courageousstudio.com;
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
via: 1.1 varnish
accept-ranges: bytes
date: Mon, 11 Nov 2019 08:27:07 GMT
via: 1.1 varnish
age: 45
set-cookie: countryCode=CN; Domain=.cnn.com; Path=/
set-cookie: geoData=beijing|BJ|100000|CN|AS|800|broadband; Domain=.cnn.com; Path=/
set-cookie: FastAB=0=1029,1=7669,2=2963,3=3546,4=7780,5=6467,6=4575,7=2654,8=4365,9=7238; Domain=.cnn.com; Path=/; Expires=Thu Jul 01 2021 00:00:00 GMT
set-cookie: tryThing00=0488; Domain=.cnn.com; Path=/; Expires=Mon Jul 01 2019 00:00:00 GMT
set-cookie: tryThing01=4810; Domain=.cnn.com; Path=/; Expires=Sun Mar 01 2020 00:00:00 GMT
set-cookie: tryThing02=3753; Domain=.cnn.com; Path=/; Expires=Wed Jan 01 2020 00:00:00 GMT
x-served-by: cache-iad2148-IAD, cache-tyo19934-TYO
x-cache: HIT, MISS
x-cache-hits: 1, 0
x-timer: S1573460826.227224,VS0,VE913
vary: Accept-Encoding
content-length: 1298588

现在我们发现可以正常返回内容了，返回200，证明请求成功了。

说明：-L让 curl 跟随连接进行重定向。这里服务器直接返回的 301 重定向响应，要求客户端再使用HTTPS的方式对 https://edition.cnn.com/politics 地址进行访问，第二次访问才返回了200的成功码。

除此之外，我们还可以进一步配置egress gateway，使这些对外部的流量访问经由egress去到外部。

现在我们在 istio 中定义一个egress gateway对象来注册允许从服务网格出去的服务，创建一个用于edition.cnn.com 的 egress gateway 对象:(cnn-egress-gateway.yaml)

[root@k8s-master istio-1.3.1]# vim cnn-egress-gateway.yaml
[root@k8s-master istio-1.3.1]# cat cnn-egress-gateway.yaml
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-egressgateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - edition.cnn.com
[root@k8s-master istio-1.3.1]# kubectl apply -f cnn-egress-gateway.yaml
gateway.networking.istio.io/istio-egressgateway created
[root@k8s-master istio-1.3.1]#

除了上面的 engress gateway 对象之外，我们还需要创建 VirtualService 和 DestinationRule 这两个资源对象:（cnn-virtual-rule.yaml）

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: direct-cnn-through-egress-gateway
spec:
  hosts:
  - edition.cnn.com
  gateways:
  - istio-egressgateway
  - mesh
  http:
  - match:
    - gateways:
      - mesh
      port: 80
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
        subset: cnn
        port:
          number: 80
      weight: 100
  - match:
    - gateways:
      - istio-egressgateway
      port: 80
    route:
    - destination:
        host: edition.cnn.com
        port:
          number: 80
      weight: 100

---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: egressgateway-for-cnn
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  subsets:
  - name: cnn

https://www.qikqiak.com/istio-book/traffic-control/3.%E5%9F%BA%E4%BA%8EBookinfo%E7%9A%84%E6%B5%81%E9%87%8F%E6%8E%A7%E5%88%B6%E9%85%8D%E7%BD%AE.html

下面是一知半解了  代码一直通不过  放这吧