istio in kubernetes (二) -- 部署篇
在 Kubernetes 部署 Istio 【demo演示】
可参考官方文档(https://istio.io/latest/zh/docs/setup/install/) ,以部署1.7.4版本做为演示，在Mac上安装linux
基础环境
- cloud(ali)
- kubernetes(1.16.9)
- istio(1.7.4)
安装配置
# mkdir istio # cd istio # wget https://github.com/istio/istio/releases/download/1.7.4/istio-1.7.4-osx.tar.gz # ll total 94336 -rw-r--r-- 1 root wheel 45M Nov 9 09:54 istio-1.7.4-osx.tar.gz # tar xf istio-1.7.4-osx.tar.gz # cd istio-1.7.4 # ls LICENSE README.md bin manifest.yaml manifests samples tools # ls bin istioctl # export PATH=$PATH:$PWD/bin # echo $PATH /usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/go/bin:/var/root/gitlab/istio/istio/istio-1.7.4/bin # istioctl version no running Istio pods in "istio-system" 1.7.4
部署istio组件
目录结构
# ll total 48 -rw-r--r-- 1 root wheel 11K Oct 24 07:12 LICENSE -rw-r--r-- 1 root wheel 5.6K Oct 24 07:12 README.md drwxr-x--- 3 root wheel 96B Oct 24 07:12 bin -rw-r----- 1 root wheel 815B Oct 24 07:12 manifest.yaml drwxr-xr-x 6 root wheel 192B Oct 24 07:12 manifests drwxr-xr-x 21 root wheel 672B Oct 24 07:12 samples drwxr-x--- 7 root wheel 224B Oct 24 07:12 tools
能够看到有4个目录(bin、manifests、samples、tools)及3个文件(LICENSE、README.md、manifest.yaml)git
其中bin下是istioctl执行程序，manifests是istio相关的主要部署组件，manifest.yaml是当前istio版本(1.7.4)中manifests目录下各组件的配置和依赖描述，samples是一套istio应用样例，用来部署测试作功能校验的，tools是一些工具脚本github
打开README.md发现，主要说了3个点，istio的功能介绍、项目git仓库、以及问题优化管理原则，并无直接给出安装使用方法web
In this README: - [Introduction](#introduction) - [Repositories](#repositories) - [Issue management](#issue-management)
istioctl使用
# istioctl -h
Istio configuration command line utility for service operators to
debug and diagnose their Istio mesh.
Usage:
istioctl [command]
Available Commands:
analyze 分析Istio配置并打印验证消息
authz （authz是实验性的。使用“istioctl experimental authz”）
convert-ingress 将入口配置转换为Istio VirtualService配置
dashboard 访问Istio web UI
deregister 取消注册服务实例
experimental 可能被修改或弃用的实验性命令
help 关于任何命令的帮助
install 应用Istio清单，在群集上安装或从新配置Istio
kube-inject 将特使边车注入kubernetes pod资源
manifest 与Istio清单相关的命令
operator 与Istio操做员控制器相关的命令
profile 与Istio配置文件相关的命令
proxy-config 从特使处检索有关代理配置的信息[仅限kube]
proxy-status 检索网格中每一个特使的同步状态[仅限kube]
register 注册加入网格的服务实例（例如VM）
upgrade 升级Istio控制平面就位
validate 验证Istio策略和规则文件
verify-install 验证Istio安装状态
version 打印出内部版本信息
Flags:
--context string 要使用的kubeconfig上下文的名称
-h, --help istioctl帮助
-i, --istioNamespace string Istio system命名空间（默认为“Istio system”）
-c, --kubeconfig string Kubernetes配置文件
-n, --namespace string 配置命名空间
Additional help topics:
istioctl options 显示istioctl全局选项
Use "istioctl [command] --help" for more information about a command.
从istioctl帮助说明能够看出，istioctl有不少子命令，通过测试试用发现其中与部署相关的主要有3个(install、manifest、operator)：docker
install 应用Istio清单，在群集上安装或从新配置Istio manifest 与Istio清单相关的命令 operator 与Istio操做员控制器相关的命令
istio profile
下表中标记为 X 的组件就是包含在配置文件里的内容:shell
| 1.5前pod | 做用 | 1.5后pod | 说明 |
|---|---|---|---|
| egressgateway | 对外网关 | √ | 保留 |
| ingressgateway | 对内网关 | √ | 保留 |
| citadel | 证书管理和分发 | ||
| galley | 配置管理中心 | istiod | 合并后保留 |
| pilot | 流量管理中心 | ||
| sidecar-ingector | 边车代理自动注入 | ||
| polic | Mixer策略管理 | X | 做为proxy扩展 |
| telemetry | Mixer遥测管理 | X | 做为proxy扩展 |
| kiali,prometheus,grafana,tracing(jaeger) | 可视化 | √ | 保留 |
标识Istio 功能或组建
https://istio.io/latest/zh/docs/setup/install/istioctl/#customizing-the-configurationapi
istioctl install 部署
istioctl install 是默认部署，按manifests/profile/default.yaml配置部署对应的组件，以下：app
# ll
total 72
-rw-r--r-- 1 root wheel 15K Oct 24 07:12 default.yaml
-rw-r--r-- 1 root wheel 1.8K Oct 24 07:12 demo.yaml
-rw-r--r-- 1 root wheel 320B Oct 24 07:12 empty.yaml
-rw-r--r-- 1 root wheel 219B Oct 24 07:12 minimal.yaml
-rw-r--r-- 1 root wheel 405B Oct 24 07:12 preview.yaml
-rw-r--r-- 1 root wheel 119B Oct 24 07:12 remote.yaml
# istioctl profile list
Istio configuration profiles:
default
demo
empty
minimal
preview
remote
# # istioctl install
This will install the default Istio profile into the cluster. Proceed? (y/N) y
Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details.
✔ Istio core installed
✔ Istiod installed
✔ Addons installed
✔ Ingress gateways installed
✔ Installation complete
固然，也可使用-d参数指定某个目录部署，这里经过--set 指定manifests/profiles目录下的某一类配置安装，以demo为例less
# ls manifests/profiles/ default.yaml demo.yaml empty.yaml minimal.yaml preview.yaml remote.yaml # istioctl install --set profile=demo Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details. ✔ Istio core installed ✔ Istiod installed ✔ Egress gateways installed ✔ Ingress gateways installed ✔ Installation complete
istioctl manifest 部署
istioctl manifest的使用帮助以下，其安装主要是经过install子命令来落地的，其安装执行参数和效果，与直接执行istioctl install是同样的tcp
# istioctl manifest
The manifest subcommand generates, applies, diffs or migrates Istio manifests.
Usage:
istioctl manifest [command]
Available Commands:
diff Compare manifests and generate diff
generate Generates an Istio install manifest
install Applies an Istio manifest, installing or reconfiguring Istio on a cluster.
Flags:
--dry-run Console/log output only, make no changes.
-h, --help help for manifest
Global Flags:
--context string The name of the kubeconfig context to use
-c, --kubeconfig string Kubernetes configuration file
Use "istioctl manifest [command] --help" for more information about a command.
istioctl manifest install --help说明以下：
# istioctl manifest install --help
The install generates an Istio install manifest and applies it to a cluster.
Usage:
istioctl manifest install [flags]
Examples:
# Apply a default Istio installation
istioctl install
# Enable grafana dashboard
istioctl install --set values.grafana.enabled=true
# Generate the demo profile and don't wait for confirmation
istioctl install --set profile=demo --skip-confirmation
# To override a setting that includes dots, escape them with a backslash (\). Your shell may require enclosing quotes.
istioctl install --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"
Flags:
--charts string Deprecated, use --manifests instead.
-f, --filename strings Path to file containing IstioOperator custom resource
This flag can be specified multiple times to overlay multiple files. Multiple files are overlaid in left to right order.
--force Proceed even with validation errors.
-h, --help help for install
-d, --manifests string Specify a path to a directory of charts and profiles
(e.g. ~/Downloads/istio-1.7.0/manifests)
or release tar URL (e.g. https://github.com/istio/istio/releases/download/1.7.0/istio-1.7.0-linux-amd64.tar.gz).
--readiness-timeout duration Maximum time to wait for Istio resources in each component to be ready. (default 5m0s)
-r, --revision string Target control plane revision for the command.
-s, --set stringArray Override an IstioOperator value, e.g. to choose a profile
(--set profile=demo), enable or disable components (--set components.policy.enabled=true), or override Istio
settings (--set values.grafana.enabled=true). See documentation for more info:
https://istio.io/docs/reference/config/istio.operator.v1alpha1/#IstioOperatorSpec
-y, --skip-confirmation skipConfirmation determines whether the user is prompted for confirmation.
If set to true, the user is not prompted and a Yes response is assumed in all cases.
Global Flags:
--context string The name of the kubeconfig context to use
--dry-run Console/log output only, make no changes.
-c, --kubeconfig string Kubernetes configuration file
具体执行结果以下：
# istioctl manifest install --set profile=demo Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details. ✔ Istio core installed ✔ Istiod installed ✔ Egress gateways installed ✔ Ingress gateways installed ✔ Installation complete
istioctl operator
istioctl operator安装相对简单，主要是安装istioctl的operator，经过init子命令执行，结果以下：
# istioctl operator init Operator controller is already installed in istio-operator namespace, updating. Using operator Deployment image: docker.io/istio/operator:1.6.0 ✔ Istio operator installed ✔ Installation complete
因istio operator已经经过istioctl manifest apply安装过了，因此提示installed
安装校验
istio verify-install (校验方式一)
首先，经过istioctl manifest generate 命令生成安装清单的校验文件，istioctl manifest generate使用说明以下：
# istioctl manifest generate --help
The generate subcommand generates an Istio install manifest and outputs to the console by default.
Usage:
istioctl manifest generate [flags]
Examples:
# Generate a default Istio installation
istioctl manifest generate
# Enable grafana dashboard
istioctl manifest generate --set values.grafana.enabled=true
# Generate the demo profile
istioctl manifest generate --set profile=demo
# To override a setting that includes dots, escape them with a backslash (\). Your shell may require enclosing quotes.
istioctl manifest generate --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"
Flags:
--charts string Deprecated, use --manifests instead.
-f, --filename strings Path to file containing IstioOperator custom resource
This flag can be specified multiple times to overlay multiple files. Multiple files are overlaid in left to right order.
--force Proceed even with validation errors.
-h, --help help for generate
-d, --manifests string Specify a path to a directory of charts and profiles
(e.g. ~/Downloads/istio-1.7.0/manifests)
or release tar URL (e.g. https://github.com/istio/istio/releases/download/1.7.0/istio-1.7.0-linux-amd64.tar.gz).
-o, --output string Manifest output directory path.
-r, --revision string Target control plane revision for the command.
-s, --set stringArray Override an IstioOperator value, e.g. to choose a profile
(--set profile=demo), enable or disable components (--set components.policy.enabled=true), or override Istio
settings (--set values.grafana.enabled=true). See documentation for more info:
https://istio.io/docs/reference/config/istio.operator.v1alpha1/#IstioOperatorSpec
Global Flags:
--context string The name of the kubeconfig context to use
--dry-run Console/log output only, make no changes.
-c, --kubeconfig string Kubernetes configuration file
经过istioctl manifest generate把按demo配置的部署，生成对应的安装校验清单，并保存在当前目录下的test-demo.yaml文件中
# istioctl manifest generate --set profile=demo > test-demo.yaml
而后经过istio verify-install校验，校验安装成功，详细以下：
# istioctl verify-install -f test-demo.yaml CustomResourceDefinition: adapters.config.istio.io.default checked successfully CustomResourceDefinition: attributemanifests.config.istio.io.default checked successfully CustomResourceDefinition: authorizationpolicies.security.istio.io.default checked successfully CustomResourceDefinition: destinationrules.networking.istio.io.default checked successfully CustomResourceDefinition: envoyfilters.networking.istio.io.default checked successfully CustomResourceDefinition: gateways.networking.istio.io.default checked successfully CustomResourceDefinition: handlers.config.istio.io.default checked successfully CustomResourceDefinition: httpapispecbindings.config.istio.io.default checked successfully CustomResourceDefinition: httpapispecs.config.istio.io.default checked successfully CustomResourceDefinition: instances.config.istio.io.default checked successfully CustomResourceDefinition: istiooperators.install.istio.io.default checked successfully CustomResourceDefinition: peerauthentications.security.istio.io.default checked successfully CustomResourceDefinition: quotaspecbindings.config.istio.io.default checked successfully CustomResourceDefinition: quotaspecs.config.istio.io.default checked successfully CustomResourceDefinition: requestauthentications.security.istio.io.default checked successfully CustomResourceDefinition: rules.config.istio.io.default checked successfully CustomResourceDefinition: serviceentries.networking.istio.io.default checked successfully CustomResourceDefinition: sidecars.networking.istio.io.default checked successfully CustomResourceDefinition: templates.config.istio.io.default checked successfully CustomResourceDefinition: virtualservices.networking.istio.io.default checked successfully CustomResourceDefinition: workloadentries.networking.istio.io.default checked successfully ServiceAccount: istio-egressgateway-service-account.istio-system checked successfully ServiceAccount: istio-ingressgateway-service-account.istio-system checked successfully ServiceAccount: istio-reader-service-account.istio-system checked successfully ServiceAccount: istiod-service-account.istio-system checked successfully ClusterRole: istio-reader-istio-system.default checked successfully ClusterRole: istiod-istio-system.default checked successfully ClusterRoleBinding: istio-reader-istio-system.default checked successfully ClusterRoleBinding: istiod-pilot-istio-system.default checked successfully ValidatingWebhookConfiguration: istiod-istio-system.default checked successfully EnvoyFilter: metadata-exchange-1.6.istio-system checked successfully EnvoyFilter: metadata-exchange-1.7.istio-system checked successfully EnvoyFilter: stats-filter-1.6.istio-system checked successfully EnvoyFilter: stats-filter-1.7.istio-system checked successfully EnvoyFilter: tcp-metadata-exchange-1.6.istio-system checked successfully EnvoyFilter: tcp-metadata-exchange-1.7.istio-system checked successfully EnvoyFilter: tcp-stats-filter-1.6.istio-system checked successfully EnvoyFilter: tcp-stats-filter-1.7.istio-system checked successfully ConfigMap: istio.istio-system checked successfully ConfigMap: istio-sidecar-injector.istio-system checked successfully MutatingWebhookConfiguration: istio-sidecar-injector.default checked successfully Deployment: istio-egressgateway.istio-system checked successfully Deployment: istio-ingressgateway.istio-system checked successfully Deployment: istiod.istio-system checked successfully PodDisruptionBudget: istio-egressgateway.istio-system checked successfully PodDisruptionBudget: istio-ingressgateway.istio-system checked successfully PodDisruptionBudget: istiod.istio-system checked successfully Role: istio-egressgateway-sds.istio-system checked successfully Role: istio-ingressgateway-sds.istio-system checked successfully Role: istiod-istio-system.istio-system checked successfully RoleBinding: istio-egressgateway-sds.istio-system checked successfully RoleBinding: istio-ingressgateway-sds.istio-system checked successfully RoleBinding: istiod-istio-system.istio-system checked successfully Service: istio-egressgateway.istio-system checked successfully Service: istio-ingressgateway.istio-system checked successfully Service: istiod.istio-system checked successfully Checked 21 custom resource definitions Checked 2 Istio Deployments Istio is installed successfully
查看资源状态（校验方式二）
查看istio 的CRD
查看istio相关的CRD是否正常建立，经过命令能够查看到与istio相关的crd很是多，在demo模式下共有21个，详细以下：
# kubectl get crd|grep istio adapters.config.istio.io 2020-11-09T11:03:47Z attributemanifests.config.istio.io 2020-11-09T11:03:47Z authorizationpolicies.security.istio.io 2020-11-09T11:03:47Z destinationrules.networking.istio.io 2020-11-09T11:03:47Z envoyfilters.networking.istio.io 2020-11-09T11:03:47Z gateways.networking.istio.io 2020-11-09T11:03:47Z handlers.config.istio.io 2020-11-09T11:03:47Z httpapispecbindings.config.istio.io 2020-11-09T11:03:47Z httpapispecs.config.istio.io 2020-11-09T11:03:47Z instances.config.istio.io 2020-11-09T11:03:47Z istiooperators.install.istio.io 2020-11-09T11:03:47Z peerauthentications.security.istio.io 2020-11-09T11:03:47Z quotaspecbindings.config.istio.io 2020-11-09T11:03:47Z quotaspecs.config.istio.io 2020-11-09T11:03:47Z requestauthentications.security.istio.io 2020-11-09T11:03:47Z rules.config.istio.io 2020-11-09T11:03:47Z serviceentries.networking.istio.io 2020-11-09T11:03:47Z sidecars.networking.istio.io 2020-11-09T11:03:47Z templates.config.istio.io 2020-11-09T11:03:47Z virtualservices.networking.istio.io 2020-11-09T11:03:47Z workloadentries.networking.istio.io 2020-11-09T11:03:47Z # kubectl get crd|grep istio|wc -l 21
查看operator状态
查看istio operator是否正常运行，istio operator是运行在另一个命名空间(istio-operator )下的，具体以下：
# kubectl get all -n istio-operator NAME READY STATUS RESTARTS AGE pod/istio-operator-76f79b96dd-hbfcx 1/1 Running 0 30m NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/istio-operator ClusterIP 10.0.80.13 <none> 8383/TCP 30m NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/istio-operator 1/1 1 1 30m NAME DESIRED CURRENT READY AGE replicaset.apps/istio-operator-76f79b96dd 1 1 1 30m
其中pod和service都正常
查看istio operator维护配置状况
经过执行kubectl get IstioOperator -n istio-system -o yaml，查看对应status，能够看到istio-operator维护的各个组件运行状况，均为HEALTHY状态
status:
componentStatus:
Base:
status: HEALTHY
EgressGateways:
status: HEALTHY
IngressGateways:
status: HEALTHY
Pilot:
status: HEALTHY
status: HEALTHY
查看命名空间istio-system的全部资源状态
能够看到3个pod（istio-egressgateway、istio-ingressgateway、istiod即pilot），以及对应的3个service，均是正常，以下：
# kubectl get all -n istio-system NAME READY STATUS RESTARTS AGE pod/istio-egressgateway-695f5944d8-jjbmn 1/1 Running 0 20m pod/istio-ingressgateway-5c697d4cd7-2qvlf 1/1 Running 0 20m pod/istiod-77544cd464-mkhhz 1/1 Running 0 9m NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/istio-egressgateway ClusterIP 10.0.80.2 <none> 80/TCP,443/TCP,15443/TCP 20m service/istio-ingressgateway LoadBalancer 4x.xxx.xxx.xx <pending> 15021:31437/TCP,80:31135/TCP,443:31445/TCP,31400:30539/TCP,15443:31470/TCP 20m service/istiod ClusterIP 10.0.80.201 <none> 15010/TCP,15012/TCP,443/TCP,15014/TCP,853/TCP 9m NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/istio-egressgateway 1/1 1 1 20m deployment.apps/istio-ingressgateway 1/1 1 1 20m deployment.apps/istiod 1/1 1 1 9m
这是根据.../manifests/profiles/demo.yaml配置下指定的component部署的deployment（istio-egressgateway、istio-ingressgateway、istiod即pilot），部份内容截取以下：
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
meshConfig:
accessLogFile: /dev/stdout
components:
egressGateways:
- name: istio-egressgateway
enabled: true
k8s:
resources:
requests:
cpu: 10m
memory: 40Mi
ingressGateways:
- name: istio-ingressgateway
enabled: true
k8s:
resources:
requests:
cpu: 10m
memory: 40Mi
service:
ports:
## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
# Note that AWS ELB will by default perform health checks on the first port
# on this list. Setting this to the health check port will ensure that health
# checks always work. https://github.com/istio/istio/issues/12503
- port: 15021
targetPort: 15021
name: status-port
- port: 80
targetPort: 8080
name: http2
- port: 443
targetPort: 8443
name: https
- port: 31400
targetPort: 31400
name: tcp
# This is the port where sni routing happens
- port: 15443
targetPort: 15443
name: tls
pilot:
k8s:
env:
- name: PILOT_TRACE_SAMPLING
value: "100"
resources:
requests:
cpu: 10m
memory: 100Mi
如果按默认安装，则使用.../manifests/profiles/default.yaml，会经过component指定部署更多deployment（istio-egressgateway、istiod即pilot），固然你也能够经过istioctl install --set component.telemetry.enabled=true来配置/manifests/profiles/default.yaml，而后经过istioctl install安装telemetry
卸载：
经过istioctl manifest generate生成对应的安装清单，而后删除，命令：istioctl manifest generate | kubectl delete -f -
详细demo以下：
# istioctl manifest generate --set profile=demo |kubectl delete -f - customresourcedefinition.apiextensions.k8s.io "adapters.config.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "attributemanifests.config.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "authorizationpolicies.security.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "destinationrules.networking.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "envoyfilters.networking.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "gateways.networking.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "handlers.config.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "httpapispecbindings.config.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "httpapispecs.config.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "instances.config.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "istiooperators.install.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "peerauthentications.security.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "quotaspecbindings.config.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "quotaspecs.config.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "requestauthentications.security.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "rules.config.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "serviceentries.networking.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "sidecars.networking.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "templates.config.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "virtualservices.networking.istio.io" deleted customresourcedefinition.apiextensions.k8s.io "workloadentries.networking.istio.io" deleted serviceaccount "istio-egressgateway-service-account" deleted serviceaccount "istio-ingressgateway-service-account" deleted serviceaccount "istio-reader-service-account" deleted serviceaccount "istiod-service-account" deleted clusterrole.rbac.authorization.k8s.io "istio-reader-istio-system" deleted clusterrole.rbac.authorization.k8s.io "istiod-istio-system" deleted clusterrolebinding.rbac.authorization.k8s.io "istio-reader-istio-system" deleted clusterrolebinding.rbac.authorization.k8s.io "istiod-pilot-istio-system" deleted validatingwebhookconfiguration.admissionregistration.k8s.io "istiod-istio-system" deleted configmap "istio" deleted configmap "istio-sidecar-injector" deleted mutatingwebhookconfiguration.admissionregistration.k8s.io "istio-sidecar-injector" deleted deployment.apps "istio-egressgateway" deleted deployment.apps "istio-ingressgateway" deleted deployment.apps "istiod" deleted poddisruptionbudget.policy "istio-egressgateway" deleted poddisruptionbudget.policy "istio-ingressgateway" deleted poddisruptionbudget.policy "istiod" deleted role.rbac.authorization.k8s.io "istio-egressgateway-sds" deleted role.rbac.authorization.k8s.io "istio-ingressgateway-sds" deleted role.rbac.authorization.k8s.io "istiod-istio-system" deleted rolebinding.rbac.authorization.k8s.io "istio-egressgateway-sds" deleted rolebinding.rbac.authorization.k8s.io "istio-ingressgateway-sds" deleted rolebinding.rbac.authorization.k8s.io "istiod-istio-system" deleted service "istio-egressgateway" deleted service "istio-ingressgateway" deleted service "istiod" deleted
把资源清理干净后，删除命名空间istio-system
# kubectl get all -n istio-system No resources found in istio-system namespace. # kubectl delete ns istio-system namespace "istio-system" deleted
API Gateway VS Service Mesh
istio/kong和istio交互.md
如何为服务网格选择入口网关
istio/如何为服务网格选择入口网关.md
安装istio【自定义组件】
# istioctl profile --help # 与Istio配置文件相关的命令
...
Available Commands:
diff 区分两个Istio配置文件
dump 转储Istio配置文件
list 列出可用的Istio配置文件
...
查看内置的demo profile
# istioctl profile dump demo
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
addonComponents:
istiocoredns:
enabled: false
components:
base:
enabled: true
cni:
enabled: false
...
- 说明：
- addonComponents:表示要安装的第三方组件，这里显示：istiocoredns不默认安装，grafana\kiali\prometheus\tracing默认安装；
- components:表示istio内部组件，这里显示，cni不默认安装。
- istioctl manifest apply --set profile=demo --set addonComponents.istiocoredns.enabled=true --set components.citadel.enabled=true --set components.cni.enabled=true
# istioctl manifest --help ... Available Commands: diff 比较清单并生成差别 generate 生成Istio安装清单 install 应用Istio清单，在群集上安装或从新配置Istio ...
生成kubernetes manifests yaml 文件
# istioctl manifest generate --help generate子命令生成一个Istio安装清单，并在默认状况下输出到控制台。 Usage: istioctl manifest generate [flags] Examples: # 生成默认的Istio安装 istioctl manifest generate # 启用跟踪 istioctl install --set meshConfig.enableTracing=true # 生成演示配置文件 istioctl manifest generate --set profile=demo # 要覆盖包含点的设置，请使用反斜杠（\）对其进行转义。您的shell可能须要加引号 istioctl manifest generate --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default" ...
输出到generate-manifest-istio-yaml目录
# mkdir generate-manifest-istio-yaml # istioctl manifest generate -o generate-manifest-istio-yaml
也能够将manifest输出到一个文件
# istioctl manifest generate > generate-manifest-istio.yaml
# istioctl manifest install -f addonComponents.yaml # kubectl get deployment -n istio-system # istioctl manifest install -f addonComponents.yaml # kubectl get all -n istio-system NAME READY STATUS RESTARTS AGE pod/grafana-8fdf895f6-tt2x7 1/1 Running 0 16h pod/istio-tracing-85fddf979f-fj76v 1/1 Running 0 16h pod/istiod-6869899d55-lrw9q 1/1 Running 0 16h pod/kiali-777987866-xrz78 1/1 Running 0 16h pod/prometheus-5dc7ccbd8c-58nxf 1/1 Running 0 16h NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/grafana ClusterIP 10.0.145.54 <none> 3000/TCP 16h service/istiod ClusterIP 10.0.228.155 <none> 15010/TCP,15012/TCP,443/TCP,15014/TCP,853/TCP 18h service/jaeger-agent ClusterIP None <none> 5775/UDP,6831/UDP,6832/UDP 16h service/jaeger-collector ClusterIP 10.0.125.5 <none> 14267/TCP,14268/TCP,14250/TCP 16h service/jaeger-collector-headless ClusterIP None <none> 14250/TCP 16h service/jaeger-query ClusterIP 10.0.133.43 <none> 16686/TCP 16h service/kiali ClusterIP 10.0.194.167 <none> 20001/TCP 16h service/prometheus ClusterIP 10.0.124.3 <none> 9090/TCP 16h service/tracing ClusterIP 10.0.245.10 <none> 80/TCP 16h service/zipkin ClusterIP 10.0.45.150 <none> 9411/TCP 16h NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/grafana 1/1 1 1 16h deployment.apps/istio-tracing 1/1 1 1 16h deployment.apps/istiod 1/1 1 1 18h deployment.apps/kiali 1/1 1 1 16h deployment.apps/prometheus 1/1 1 1 16h NAME DESIRED CURRENT READY AGE replicaset.apps/grafana-8fdf895f6 1 1 1 16h replicaset.apps/istio-tracing-85fddf979f 1 1 1 16h replicaset.apps/istiod-6869899d55 1 1 1 18h replicaset.apps/kiali-777987866 1 1 1 16h replicaset.apps/prometheus-5dc7ccbd8c 1 1 1 16h NAME REFERENCE TARGETS MINPODS MAXPODS REPLICAS AGE horizontalpodautoscaler.autoscaling/istiod Deployment/istiod 5%/80% 1 5 1 16h
相关文章
- 1. istio in kubernetes (一) --原理篇
- 2. Kubernetes-1.16部署之四 Istio
- 3. istio部署-istio prometheus
- 4. istio部署-istio jaeger & kiali
- 5. istio 1.2.5及istio-cni 部署
- 6. Istio 1.0 部署
- 7. istio部署
- 8. istio-部署
- 9. Istio 服务部署
- 10. 二进制部署kubernetes集群（上篇）
- 更多相关文章...
- • Maven 自动化部署 - Maven教程
- • ionic 头部与底部 - ionic 教程
- • 使用阿里云OSS+CDN部署前端页面与加速静态资源
- • Docker容器实战(八) - 漫谈 Kubernetes 的本质
相关标签/搜索
每日一句
-
每一个你不满意的现在，都有一个你没有努力的曾经。
欢迎关注本站公众号,获取更多信息
