istio-流量管理-服务网格外的流量管理
这个也一知半解，暂时没用到，放这吧
为了控制服务网格外的服务的流量访问，外部的服务必须首先使用一个ServiceEntry对象加入到 istio 的内部 service registry 中，服务网格才会知道如何导向这些外部服务的流量。
为了测试这个功能，我们使用 istio 样例中的 sleep 应用来验证改功能，查看 samples/sleep/sleep.yaml 文件内容：
# cat samples/sleep/sleep.yaml
# Copyright 2017 Istio Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
##################################################################################################
# Sleep service
##################################################################################################
apiVersion: v1
kind: ServiceAccount
metadata:
name: sleep
---
apiVersion: v1
kind: Service
metadata:
name: sleep
labels:
app: sleep
spec:
ports:
- port: 80
name: http
selector:
app: sleep
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: sleep
spec:
replicas: 1
selector:
matchLabels:
app: sleep
template:
metadata:
labels:
app: sleep
spec:
serviceAccountName: sleep
containers:
- name: sleep
image: governmentpaas/curl-ssl
command: ["/bin/sleep", "3650d"]
imagePullPolicy: IfNotPresent
---
这其实就是一个简单的应用，通过 Deployment 进行控制，通过 Service 暴露服务，现在我们来部署该应用：
[root@k8s-master istio-1.3.1]# kubectl apply -f <(istioctl kube-inject -f samples/sleep/sleep.yaml) serviceaccount/sleep created service/sleep created deployment.apps/sleep created [root@k8s-master istio-1.3.1]# [root@k8s-master istio-1.3.1]# kubectl get pod NAME READY STATUS RESTARTS AGE details-v1-74f858558f-qnbfx 2/2 Running 0 3d4h dig 2/2 Running 0 10m nfs-client-provisioner-74bcb5d897-nx8fb 1/1 Running 0 5d3h productpage-v1-8554d58bff-2cng5 2/2 Running 0 3d4h ratings-v1-7855f5bcb9-8lzb5 2/2 Running 0 3d4h reviews-v1-59fd8b965b-fxxxn 2/2 Running 0 3d4h reviews-v2-d6cfdb7d6-rf6nh 2/2 Running 0 3d4h reviews-v3-75699b5cfb-qn4db 2/2 Running 0 3d4h sleep-75c858dc6b-n7k79 2/2 Running 0 38s
待应用部署完成后，我们进入该应用容器内部执行一些测试操作：
[root@k8s-master istio-1.3.1]# export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
[root@k8s-master istio-1.3.1]# kubectl exec -it $SLEEP_POD -c sleep -- curl -sL -o /dev/null -D - http://edition.cnn.com/politics
HTTP/1.1 503 Service Unavailable
content-length: 91
content-type: text/plain
date: Mon, 11 Nov 2019 08:24:58 GMT
server: envoy
可以看到会返回上面的404的信息(我的返回503)，因为该域名不在当前的服务网格中，默认情况下 istio 不允许访问服务网格外部的 URL，即服务网格中对未知的服务请求会被丢弃。这就需要我们来创建一个 ServiceEntry 对象，将外部的访问服务引入到服务网格中来。
例如下面的规则定义了一个访问 edition.cnn.com 的服务的 ServiceEntry:（cnn-service-entry.yaml）
例如下面的规则定义了一个访问 edition.cnn.com 的服务的 ServiceEntry:（cnn-service-entry.yaml）
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: cnn
spec:
hosts:
- edition.cnn.com
ports:
- number: 80
name: http-port
protocol: HTTP
- number: 443
name: https
protocol: HTTPS
resolution: DNS
现在我们来部署上面的 ServiceEntry 资源：
$ istioctl create -f cnn-service-entry.yaml Created config service-entry/default/cnn at revision 32149308 $ istioctl get serviceentry SERVICE-ENTRY NAME HOSTS PORTS NAMESPACE AGE cnn edition.cnn.com HTTP/80,HTTPS/443 default 1m
现在我们再去上面的 sleep 容器中执行上面的测试请求：
[root@k8s-master istio-1.3.1]# kubectl exec -it $SLEEP_POD -c sleep -- curl -sL -o /dev/null -D - http://edition.cnn.com/politics HTTP/1.1 301 Moved Permanently server: envoy retry-after: 0 content-length: 0 cache-control: public, max-age=600 location: https://edition.cnn.com/politics accept-ranges: bytes date: Mon, 11 Nov 2019 08:27:05 GMT via: 1.1 varnish set-cookie: countryCode=CN; Domain=.cnn.com; Path=/ set-cookie: geoData=fengtai|BJ|100036|CN|AS|800|broadband; Domain=.cnn.com; Path=/ x-served-by: cache-hnd18723-HND x-cache: HIT x-cache-hits: 0 x-envoy-upstream-service-time: 250 HTTP/2 200 content-type: text/html; charset=utf-8 x-servedbyhost: ::ffff:127.0.0.1 access-control-allow-origin: * cache-control: max-age=60 content-security-policy: default-src 'self' blob: https://*.cnn.com:* http://*.cnn.com:* *.cnn.io:* *.cnn.net:* *.turner.com:* *.turner.io:* *.ugdturner.com:* courageousstudio.com *.vgtf.net:*; script-src 'unsafe-eval' 'unsafe-inline' 'self' *; style-src 'unsafe-inline' 'self' blob: *; child-src 'self' blob: *; frame-src 'self' *; object-src 'self' *; img-src 'self' data:blob: *; media-src 'self' data: blob: *; font-src 'self' data: *; connect-src 'self' *; frame-ancestors 'self' https://*.cnn.com:* http://*.cnn.com https://*.cnn.io:* http://*.cnn.io:* *.turner.com:* courageousstudio.com; x-content-type-options: nosniff x-xss-protection: 1; mode=block via: 1.1 varnish accept-ranges: bytes date: Mon, 11 Nov 2019 08:27:07 GMT via: 1.1 varnish age: 45 set-cookie: countryCode=CN; Domain=.cnn.com; Path=/ set-cookie: geoData=beijing|BJ|100000|CN|AS|800|broadband; Domain=.cnn.com; Path=/ set-cookie: FastAB=0=1029,1=7669,2=2963,3=3546,4=7780,5=6467,6=4575,7=2654,8=4365,9=7238; Domain=.cnn.com; Path=/; Expires=Thu Jul 01 2021 00:00:00 GMT set-cookie: tryThing00=0488; Domain=.cnn.com; Path=/; Expires=Mon Jul 01 2019 00:00:00 GMT set-cookie: tryThing01=4810; Domain=.cnn.com; Path=/; Expires=Sun Mar 01 2020 00:00:00 GMT set-cookie: tryThing02=3753; Domain=.cnn.com; Path=/; Expires=Wed Jan 01 2020 00:00:00 GMT x-served-by: cache-iad2148-IAD, cache-tyo19934-TYO x-cache: HIT, MISS x-cache-hits: 1, 0 x-timer: S1573460826.227224,VS0,VE913 vary: Accept-Encoding content-length: 1298588
现在我们发现可以正常返回内容了，返回200，证明请求成功了。
说明：-L让 curl 跟随连接进行重定向。这里服务器直接返回的 301 重定向响应，要求客户端再使用HTTPS的方式对 https://edition.cnn.com/politics 地址进行访问，第二次访问才返回了200的成功码。
除此之外，我们还可以进一步配置egress gateway，使这些对外部的流量访问经由egress去到外部。
现在我们在 istio 中定义一个egress gateway对象来注册允许从服务网格出去的服务，创建一个用于edition.cnn.com 的 egress gateway 对象:(cnn-egress-gateway.yaml)
[root@k8s-master istio-1.3.1]# vim cnn-egress-gateway.yaml
[root@k8s-master istio-1.3.1]# cat cnn-egress-gateway.yaml
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: istio-egressgateway
spec:
selector:
istio: egressgateway
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- edition.cnn.com
[root@k8s-master istio-1.3.1]# kubectl apply -f cnn-egress-gateway.yaml
gateway.networking.istio.io/istio-egressgateway created
[root@k8s-master istio-1.3.1]#
除了上面的 engress gateway 对象之外，我们还需要创建 VirtualService 和 DestinationRule 这两个资源对象:（cnn-virtual-rule.yaml）
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: direct-cnn-through-egress-gateway
spec:
hosts:
- edition.cnn.com
gateways:
- istio-egressgateway
- mesh
http:
- match:
- gateways:
- mesh
port: 80
route:
- destination:
host: istio-egressgateway.istio-system.svc.cluster.local
subset: cnn
port:
number: 80
weight: 100
- match:
- gateways:
- istio-egressgateway
port: 80
route:
- destination:
host: edition.cnn.com
port:
number: 80
weight: 100
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: egressgateway-for-cnn
spec:
host: istio-egressgateway.istio-system.svc.cluster.local
subsets:
- name: cnn
下面是一知半解了 代码一直通不过 放这吧