在 Kubernetes 部署 Istio 【demo演示】
可參考官方文檔(https://istio.io/latest/zh/docs/setup/install/) ,以部署1.7.4版本作為演示，在Mac上安裝
基礎環境
- cloud(ali)
- kubernetes(1.16.9)
- istio(1.7.4)
安裝配置
# mkdir istio
# cd istio
# wget https://github.com/istio/istio/releases/download/1.7.4/istio-1.7.4-osx.tar.gz
# ll
total 94336
-rw-r--r-- 1 root wheel 45M Nov 9 09:54 istio-1.7.4-osx.tar.gz
# tar xf istio-1.7.4-osx.tar.gz
# cd istio-1.7.4
# ls
LICENSE README.md bin manifest.yaml manifests samples tools
# ls bin
istioctl
# export PATH=$PATH:$PWD/bin
# echo $PATH
/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/go/bin:/var/root/gitlab/istio/istio/istio-1.7.4/bin
# istioctl version
no running Istio pods in "istio-system"
1.7.4
部署istio組件
目錄結構
# ll
total 48
-rw-r--r-- 1 root wheel 11K Oct 24 07:12 LICENSE
-rw-r--r-- 1 root wheel 5.6K Oct 24 07:12 README.md
drwxr-x--- 3 root wheel 96B Oct 24 07:12 bin
-rw-r----- 1 root wheel 815B Oct 24 07:12 manifest.yaml
drwxr-xr-x 6 root wheel 192B Oct 24 07:12 manifests
drwxr-xr-x 21 root wheel 672B Oct 24 07:12 samples
drwxr-x--- 7 root wheel 224B Oct 24 07:12 tools
可以看到有4個目錄(bin、manifests、samples、tools)及3個文件(LICENSE、README.md、manifest.yaml)
其中bin下是istioctl執行程序，manifests是istio相關的主要部署組件，manifest.yaml是當前istio版本(1.7.4)中manifests目錄下各組件的配置和依賴描述，samples是一套istio應用樣例，用來部署測試做功能校驗的，tools是一些工具腳本
打開README.md發現，主要說了3個點，istio的功能介紹、項目git倉庫、以及問題優化管理原則，並沒有直接給出安裝使用方法
In this README:
- [Introduction](#introduction)
- [Repositories](#repositories)
- [Issue management](#issue-management)
istioctl使用
# istioctl -h
Istio configuration command line utility for service operators to
debug and diagnose their Istio mesh.
Usage:
istioctl [command]
Available Commands:
analyze 分析Istio配置並打印驗證消息
authz （authz是實驗性的。使用“istioctl experimental authz”）
convert-ingress 將入口配置轉換為Istio VirtualService配置
dashboard 訪問Istio web UI
deregister 取消注冊服務實例
experimental 可能被修改或棄用的實驗性命令
help 關於任何命令的幫助
install 應用Istio清單，在群集上安裝或重新配置Istio
kube-inject 將特使邊車注入kubernetes pod資源
manifest 與Istio清單相關的命令
operator 與Istio操作員控制器相關的命令
profile 與Istio配置文件相關的命令
proxy-config 從特使處檢索有關代理配置的信息[僅限kube]
proxy-status 檢索網格中每個特使的同步狀態[僅限kube]
register 注冊加入網格的服務實例（例如VM）
upgrade 升級Istio控制平面就位
validate 驗證Istio策略和規則文件
verify-install 驗證Istio安裝狀態
version 打印出內部版本信息
Flags:
--context string 要使用的kubeconfig上下文的名稱
-h, --help istioctl幫助
-i, --istioNamespace string Istio system命名空間（默認為“Istio system”）
-c, --kubeconfig string Kubernetes配置文件
-n, --namespace string 配置命名空間
Additional help topics:
istioctl options 顯示istioctl全局選項
Use "istioctl [command] --help" for more information about a command.
從istioctl幫助說明可以看出，istioctl有很多子命令，經過測試試用發現其中與部署相關的主要有3個(install、manifest、operator)：
install 應用Istio清單，在群集上安裝或重新配置Istio
manifest 與Istio清單相關的命令
operator 與Istio操作員控制器相關的命令
istio profile
下表中標記為 X 的組件就是包含在配置文件里的內容:
| 1.5前pod | 作用 | 1.5后pod | 說明 |
|---|---|---|---|
| egressgateway | 對外網關 | √ | 保留 |
| ingressgateway | 對內網關 | √ | 保留 |
| citadel | 證書管理和分發 | ||
| galley | 配置管理中心 | istiod | 合並后保留 |
| pilot | 流量管理中心 | ||
| sidecar-ingector | 邊車代理自動注入 | ||
| polic | Mixer策略管理 | X | 作為proxy擴展 |
| telemetry | Mixer遙測管理 | X | 作為proxy擴展 |
| kiali,prometheus,grafana,tracing(jaeger) | 可視化 | √ | 保留 |
標識Istio 功能或組建
https://istio.io/latest/zh/docs/setup/install/istioctl/#customizing-the-configuration
istioctl install 部署
istioctl install 是默認部署，按manifests/profile/default.yaml配置部署對應的組件，如下：
# ll
total 72
-rw-r--r-- 1 root wheel 15K Oct 24 07:12 default.yaml
-rw-r--r-- 1 root wheel 1.8K Oct 24 07:12 demo.yaml
-rw-r--r-- 1 root wheel 320B Oct 24 07:12 empty.yaml
-rw-r--r-- 1 root wheel 219B Oct 24 07:12 minimal.yaml
-rw-r--r-- 1 root wheel 405B Oct 24 07:12 preview.yaml
-rw-r--r-- 1 root wheel 119B Oct 24 07:12 remote.yaml
# istioctl profile list
Istio configuration profiles:
default
demo
empty
minimal
preview
remote
# # istioctl install
This will install the default Istio profile into the cluster. Proceed? (y/N) y
Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details.
✔ Istio core installed
✔ Istiod installed
✔ Addons installed
✔ Ingress gateways installed
✔ Installation complete
當然，也可以使用-d參數指定某個目錄部署，這里通過--set 指定manifests/profiles目錄下的某一類配置安裝，以demo為例
# ls manifests/profiles/
default.yaml demo.yaml empty.yaml minimal.yaml preview.yaml remote.yaml
# istioctl install --set profile=demo
Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details.
✔ Istio core installed
✔ Istiod installed
✔ Egress gateways installed
✔ Ingress gateways installed
✔ Installation complete
istioctl manifest 部署
istioctl manifest的使用幫助如下，其安裝主要是通過install子命令來落地的，其安裝執行參數和效果，與直接執行istioctl install是一樣的
# istioctl manifest
The manifest subcommand generates, applies, diffs or migrates Istio manifests.
Usage:
istioctl manifest [command]
Available Commands:
diff Compare manifests and generate diff
generate Generates an Istio install manifest
install Applies an Istio manifest, installing or reconfiguring Istio on a cluster.
Flags:
--dry-run Console/log output only, make no changes.
-h, --help help for manifest
Global Flags:
--context string The name of the kubeconfig context to use
-c, --kubeconfig string Kubernetes configuration file
Use "istioctl manifest [command] --help" for more information about a command.
istioctl manifest install --help說明如下：
# istioctl manifest install --help
The install generates an Istio install manifest and applies it to a cluster.
Usage:
istioctl manifest install [flags]
Examples:
# Apply a default Istio installation
istioctl install
# Enable grafana dashboard
istioctl install --set values.grafana.enabled=true
# Generate the demo profile and don't wait for confirmation
istioctl install --set profile=demo --skip-confirmation
# To override a setting that includes dots, escape them with a backslash (\). Your shell may require enclosing quotes.
istioctl install --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"
Flags:
--charts string Deprecated, use --manifests instead.
-f, --filename strings Path to file containing IstioOperator custom resource
This flag can be specified multiple times to overlay multiple files. Multiple files are overlaid in left to right order.
--force Proceed even with validation errors.
-h, --help help for install
-d, --manifests string Specify a path to a directory of charts and profiles
(e.g. ~/Downloads/istio-1.7.0/manifests)
or release tar URL (e.g. https://github.com/istio/istio/releases/download/1.7.0/istio-1.7.0-linux-amd64.tar.gz).
--readiness-timeout duration Maximum time to wait for Istio resources in each component to be ready. (default 5m0s)
-r, --revision string Target control plane revision for the command.
-s, --set stringArray Override an IstioOperator value, e.g. to choose a profile
(--set profile=demo), enable or disable components (--set components.policy.enabled=true), or override Istio
settings (--set values.grafana.enabled=true). See documentation for more info:
https://istio.io/docs/reference/config/istio.operator.v1alpha1/#IstioOperatorSpec
-y, --skip-confirmation skipConfirmation determines whether the user is prompted for confirmation.
If set to true, the user is not prompted and a Yes response is assumed in all cases.
Global Flags:
--context string The name of the kubeconfig context to use
--dry-run Console/log output only, make no changes.
-c, --kubeconfig string Kubernetes configuration file
具體執行結果如下：
# istioctl manifest install --set profile=demo
Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details.
✔ Istio core installed
✔ Istiod installed
✔ Egress gateways installed
✔ Ingress gateways installed
✔ Installation complete
istioctl operator
istioctl operator安裝相對簡單，主要是安裝istioctl的operator，通過init子命令執行，結果如下：
# istioctl operator init
Operator controller is already installed in istio-operator namespace, updating.
Using operator Deployment image: docker.io/istio/operator:1.6.0
✔ Istio operator installed
✔ Installation complete
因istio operator已經通過istioctl manifest apply安裝過了，所以提示installed
安裝校驗
istio verify-install (校驗方式一)
首先，通過istioctl manifest generate 命令生成安裝清單的校驗文件，istioctl manifest generate使用說明如下：
# istioctl manifest generate --help
The generate subcommand generates an Istio install manifest and outputs to the console by default.
Usage:
istioctl manifest generate [flags]
Examples:
# Generate a default Istio installation
istioctl manifest generate
# Enable grafana dashboard
istioctl manifest generate --set values.grafana.enabled=true
# Generate the demo profile
istioctl manifest generate --set profile=demo
# To override a setting that includes dots, escape them with a backslash (\). Your shell may require enclosing quotes.
istioctl manifest generate --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"
Flags:
--charts string Deprecated, use --manifests instead.
-f, --filename strings Path to file containing IstioOperator custom resource
This flag can be specified multiple times to overlay multiple files. Multiple files are overlaid in left to right order.
--force Proceed even with validation errors.
-h, --help help for generate
-d, --manifests string Specify a path to a directory of charts and profiles
(e.g. ~/Downloads/istio-1.7.0/manifests)
or release tar URL (e.g. https://github.com/istio/istio/releases/download/1.7.0/istio-1.7.0-linux-amd64.tar.gz).
-o, --output string Manifest output directory path.
-r, --revision string Target control plane revision for the command.
-s, --set stringArray Override an IstioOperator value, e.g. to choose a profile
(--set profile=demo), enable or disable components (--set components.policy.enabled=true), or override Istio
settings (--set values.grafana.enabled=true). See documentation for more info:
https://istio.io/docs/reference/config/istio.operator.v1alpha1/#IstioOperatorSpec
Global Flags:
--context string The name of the kubeconfig context to use
--dry-run Console/log output only, make no changes.
-c, --kubeconfig string Kubernetes configuration file
通過istioctl manifest generate把按demo配置的部署，生成對應的安裝校驗清單，並保存在當前目錄下的test-demo.yaml文件中
# istioctl manifest generate --set profile=demo > test-demo.yaml
然后通過istio verify-install校驗，校驗安裝成功，詳細如下：
# istioctl verify-install -f test-demo.yaml
CustomResourceDefinition: adapters.config.istio.io.default checked successfully
CustomResourceDefinition: attributemanifests.config.istio.io.default checked successfully
CustomResourceDefinition: authorizationpolicies.security.istio.io.default checked successfully
CustomResourceDefinition: destinationrules.networking.istio.io.default checked successfully
CustomResourceDefinition: envoyfilters.networking.istio.io.default checked successfully
CustomResourceDefinition: gateways.networking.istio.io.default checked successfully
CustomResourceDefinition: handlers.config.istio.io.default checked successfully
CustomResourceDefinition: httpapispecbindings.config.istio.io.default checked successfully
CustomResourceDefinition: httpapispecs.config.istio.io.default checked successfully
CustomResourceDefinition: instances.config.istio.io.default checked successfully
CustomResourceDefinition: istiooperators.install.istio.io.default checked successfully
CustomResourceDefinition: peerauthentications.security.istio.io.default checked successfully
CustomResourceDefinition: quotaspecbindings.config.istio.io.default checked successfully
CustomResourceDefinition: quotaspecs.config.istio.io.default checked successfully
CustomResourceDefinition: requestauthentications.security.istio.io.default checked successfully
CustomResourceDefinition: rules.config.istio.io.default checked successfully
CustomResourceDefinition: serviceentries.networking.istio.io.default checked successfully
CustomResourceDefinition: sidecars.networking.istio.io.default checked successfully
CustomResourceDefinition: templates.config.istio.io.default checked successfully
CustomResourceDefinition: virtualservices.networking.istio.io.default checked successfully
CustomResourceDefinition: workloadentries.networking.istio.io.default checked successfully
ServiceAccount: istio-egressgateway-service-account.istio-system checked successfully
ServiceAccount: istio-ingressgateway-service-account.istio-system checked successfully
ServiceAccount: istio-reader-service-account.istio-system checked successfully
ServiceAccount: istiod-service-account.istio-system checked successfully
ClusterRole: istio-reader-istio-system.default checked successfully
ClusterRole: istiod-istio-system.default checked successfully
ClusterRoleBinding: istio-reader-istio-system.default checked successfully
ClusterRoleBinding: istiod-pilot-istio-system.default checked successfully
ValidatingWebhookConfiguration: istiod-istio-system.default checked successfully
EnvoyFilter: metadata-exchange-1.6.istio-system checked successfully
EnvoyFilter: metadata-exchange-1.7.istio-system checked successfully
EnvoyFilter: stats-filter-1.6.istio-system checked successfully
EnvoyFilter: stats-filter-1.7.istio-system checked successfully
EnvoyFilter: tcp-metadata-exchange-1.6.istio-system checked successfully
EnvoyFilter: tcp-metadata-exchange-1.7.istio-system checked successfully
EnvoyFilter: tcp-stats-filter-1.6.istio-system checked successfully
EnvoyFilter: tcp-stats-filter-1.7.istio-system checked successfully
ConfigMap: istio.istio-system checked successfully
ConfigMap: istio-sidecar-injector.istio-system checked successfully
MutatingWebhookConfiguration: istio-sidecar-injector.default checked successfully
Deployment: istio-egressgateway.istio-system checked successfully
Deployment: istio-ingressgateway.istio-system checked successfully
Deployment: istiod.istio-system checked successfully
PodDisruptionBudget: istio-egressgateway.istio-system checked successfully
PodDisruptionBudget: istio-ingressgateway.istio-system checked successfully
PodDisruptionBudget: istiod.istio-system checked successfully
Role: istio-egressgateway-sds.istio-system checked successfully
Role: istio-ingressgateway-sds.istio-system checked successfully
Role: istiod-istio-system.istio-system checked successfully
RoleBinding: istio-egressgateway-sds.istio-system checked successfully
RoleBinding: istio-ingressgateway-sds.istio-system checked successfully
RoleBinding: istiod-istio-system.istio-system checked successfully
Service: istio-egressgateway.istio-system checked successfully
Service: istio-ingressgateway.istio-system checked successfully
Service: istiod.istio-system checked successfully
Checked 21 custom resource definitions
Checked 2 Istio Deployments
Istio is installed successfully
查看資源狀態（校驗方式二）
查看istio 的CRD
查看istio相關的CRD是否正常創建，通過命令可以查看到與istio相關的crd非常多，在demo模式下共有21個，詳細如下：
# kubectl get crd|grep istio
adapters.config.istio.io 2020-11-09T11:03:47Z
attributemanifests.config.istio.io 2020-11-09T11:03:47Z
authorizationpolicies.security.istio.io 2020-11-09T11:03:47Z
destinationrules.networking.istio.io 2020-11-09T11:03:47Z
envoyfilters.networking.istio.io 2020-11-09T11:03:47Z
gateways.networking.istio.io 2020-11-09T11:03:47Z
handlers.config.istio.io 2020-11-09T11:03:47Z
httpapispecbindings.config.istio.io 2020-11-09T11:03:47Z
httpapispecs.config.istio.io 2020-11-09T11:03:47Z
instances.config.istio.io 2020-11-09T11:03:47Z
istiooperators.install.istio.io 2020-11-09T11:03:47Z
peerauthentications.security.istio.io 2020-11-09T11:03:47Z
quotaspecbindings.config.istio.io 2020-11-09T11:03:47Z
quotaspecs.config.istio.io 2020-11-09T11:03:47Z
requestauthentications.security.istio.io 2020-11-09T11:03:47Z
rules.config.istio.io 2020-11-09T11:03:47Z
serviceentries.networking.istio.io 2020-11-09T11:03:47Z
sidecars.networking.istio.io 2020-11-09T11:03:47Z
templates.config.istio.io 2020-11-09T11:03:47Z
virtualservices.networking.istio.io 2020-11-09T11:03:47Z
workloadentries.networking.istio.io 2020-11-09T11:03:47Z
# kubectl get crd|grep istio|wc -l
21
查看operator狀態
查看istio operator是否正常運行，istio operator是運行在另外一個命名空間(istio-operator )下的，具體如下：
# kubectl get all -n istio-operator
NAME READY STATUS RESTARTS AGE
pod/istio-operator-76f79b96dd-hbfcx 1/1 Running 0 30m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/istio-operator ClusterIP 10.0.80.13 <none> 8383/TCP 30m
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/istio-operator 1/1 1 1 30m
NAME DESIRED CURRENT READY AGE
replicaset.apps/istio-operator-76f79b96dd 1 1 1 30m
其中pod和service都正常
查看istio operator維護配置情況
通過執行kubectl get IstioOperator -n istio-system -o yaml，查看對應status，可以看到istio-operator維護的各個組件運行情況，均為HEALTHY狀態
status:
componentStatus:
Base:
status: HEALTHY
EgressGateways:
status: HEALTHY
IngressGateways:
status: HEALTHY
Pilot:
status: HEALTHY
status: HEALTHY
查看命名空間istio-system的所有資源狀態
可以看到3個pod（istio-egressgateway、istio-ingressgateway、istiod即pilot），以及對應的3個service，均是正常，如下：
# kubectl get all -n istio-system
NAME READY STATUS RESTARTS AGE
pod/istio-egressgateway-695f5944d8-jjbmn 1/1 Running 0 20m
pod/istio-ingressgateway-5c697d4cd7-2qvlf 1/1 Running 0 20m
pod/istiod-77544cd464-mkhhz 1/1 Running 0 9m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/istio-egressgateway ClusterIP 10.0.80.2 <none> 80/TCP,443/TCP,15443/TCP 20m
service/istio-ingressgateway LoadBalancer 4x.xxx.xxx.xx <pending> 15021:31437/TCP,80:31135/TCP,443:31445/TCP,31400:30539/TCP,15443:31470/TCP 20m
service/istiod ClusterIP 10.0.80.201 <none> 15010/TCP,15012/TCP,443/TCP,15014/TCP,853/TCP 9m
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/istio-egressgateway 1/1 1 1 20m
deployment.apps/istio-ingressgateway 1/1 1 1 20m
deployment.apps/istiod 1/1 1 1 9m
這是根據.../manifests/profiles/demo.yaml配置下指定的component部署的deployment（istio-egressgateway、istio-ingressgateway、istiod即pilot），部分內容截取如下：
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
meshConfig:
accessLogFile: /dev/stdout
components:
egressGateways:
- name: istio-egressgateway
enabled: true
k8s:
resources:
requests:
cpu: 10m
memory: 40Mi
ingressGateways:
- name: istio-ingressgateway
enabled: true
k8s:
resources:
requests:
cpu: 10m
memory: 40Mi
service:
ports:
## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
# Note that AWS ELB will by default perform health checks on the first port
# on this list. Setting this to the health check port will ensure that health
# checks always work. https://github.com/istio/istio/issues/12503
- port: 15021
targetPort: 15021
name: status-port
- port: 80
targetPort: 8080
name: http2
- port: 443
targetPort: 8443
name: https
- port: 31400
targetPort: 31400
name: tcp
# This is the port where sni routing happens
- port: 15443
targetPort: 15443
name: tls
pilot:
k8s:
env:
- name: PILOT_TRACE_SAMPLING
value: "100"
resources:
requests:
cpu: 10m
memory: 100Mi
若是按默認安裝，則使用.../manifests/profiles/default.yaml，會通過component指定部署更多deployment（istio-egressgateway、istiod即pilot），當然你也可以通過istioctl install --set component.telemetry.enabled=true來配置/manifests/profiles/default.yaml，然后通過istioctl install安裝telemetry
卸載：
通過istioctl manifest generate生成對應的安裝清單，然后刪除，命令：istioctl manifest generate | kubectl delete -f -
詳細demo如下：
# istioctl manifest generate --set profile=demo |kubectl delete -f -
customresourcedefinition.apiextensions.k8s.io "adapters.config.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "attributemanifests.config.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "authorizationpolicies.security.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "destinationrules.networking.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "envoyfilters.networking.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "gateways.networking.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "handlers.config.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "httpapispecbindings.config.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "httpapispecs.config.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "instances.config.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "istiooperators.install.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "peerauthentications.security.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "quotaspecbindings.config.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "quotaspecs.config.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "requestauthentications.security.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "rules.config.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "serviceentries.networking.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "sidecars.networking.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "templates.config.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "virtualservices.networking.istio.io" deleted
customresourcedefinition.apiextensions.k8s.io "workloadentries.networking.istio.io" deleted
serviceaccount "istio-egressgateway-service-account" deleted
serviceaccount "istio-ingressgateway-service-account" deleted
serviceaccount "istio-reader-service-account" deleted
serviceaccount "istiod-service-account" deleted
clusterrole.rbac.authorization.k8s.io "istio-reader-istio-system" deleted
clusterrole.rbac.authorization.k8s.io "istiod-istio-system" deleted
clusterrolebinding.rbac.authorization.k8s.io "istio-reader-istio-system" deleted
clusterrolebinding.rbac.authorization.k8s.io "istiod-pilot-istio-system" deleted
validatingwebhookconfiguration.admissionregistration.k8s.io "istiod-istio-system" deleted
configmap "istio" deleted
configmap "istio-sidecar-injector" deleted
mutatingwebhookconfiguration.admissionregistration.k8s.io "istio-sidecar-injector" deleted
deployment.apps "istio-egressgateway" deleted
deployment.apps "istio-ingressgateway" deleted
deployment.apps "istiod" deleted
poddisruptionbudget.policy "istio-egressgateway" deleted
poddisruptionbudget.policy "istio-ingressgateway" deleted
poddisruptionbudget.policy "istiod" deleted
role.rbac.authorization.k8s.io "istio-egressgateway-sds" deleted
role.rbac.authorization.k8s.io "istio-ingressgateway-sds" deleted
role.rbac.authorization.k8s.io "istiod-istio-system" deleted
rolebinding.rbac.authorization.k8s.io "istio-egressgateway-sds" deleted
rolebinding.rbac.authorization.k8s.io "istio-ingressgateway-sds" deleted
rolebinding.rbac.authorization.k8s.io "istiod-istio-system" deleted
service "istio-egressgateway" deleted
service "istio-ingressgateway" deleted
service "istiod" deleted
把資源清理干凈后，刪除命名空間istio-system
# kubectl get all -n istio-system
No resources found in istio-system namespace.
# kubectl delete ns istio-system
namespace "istio-system" deleted
API Gateway VS Service Mesh
istio/kong和istio交互.md
如何為服務網格選擇入口網關
istio/如何為服務網格選擇入口網關.md
安裝istio【自定義組件】
# istioctl profile --help # 與Istio配置文件相關的命令
...
Available Commands:
diff 區分兩個Istio配置文件
dump 轉儲Istio配置文件
list 列出可用的Istio配置文件
...
查看內置的demo profile
# istioctl profile dump demo
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
addonComponents:
istiocoredns:
enabled: false
components:
base:
enabled: true
cni:
enabled: false
...
- 說明：
- addonComponents:表示要安裝的第三方組件，這里顯示：istiocoredns不默認安裝，grafana\kiali\prometheus\tracing默認安裝；
- components:表示istio內部組件，這里顯示，cni不默認安裝。
- istioctl manifest apply --set profile=demo --set addonComponents.istiocoredns.enabled=true --set components.citadel.enabled=true --set components.cni.enabled=true
# istioctl manifest --help
...
Available Commands:
diff 比較清單並生成差異
generate 生成Istio安裝清單
install 應用Istio清單，在群集上安裝或重新配置Istio
...
生成kubernetes manifests yaml 文件
# istioctl manifest generate --help
generate子命令生成一個Istio安裝清單，並在默認情況下輸出到控制台。
Usage:
istioctl manifest generate [flags]
Examples:
# 生成默認的Istio安裝
istioctl manifest generate
# 啟用跟蹤
istioctl install --set meshConfig.enableTracing=true
# 生成演示配置文件
istioctl manifest generate --set profile=demo
# 要覆蓋包含點的設置，請使用反斜杠（\）對其進行轉義。您的shell可能需要加引號
istioctl manifest generate --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"
...
輸出到generate-manifest-istio-yaml目錄
# mkdir generate-manifest-istio-yaml
# istioctl manifest generate -o generate-manifest-istio-yaml
也可以將manifest輸出到一個文件
# istioctl manifest generate > generate-manifest-istio.yaml
# istioctl manifest install -f addonComponents.yaml
# kubectl get deployment -n istio-system
# istioctl manifest install -f addonComponents.yaml
# kubectl get all -n istio-system
NAME READY STATUS RESTARTS AGE
pod/grafana-8fdf895f6-tt2x7 1/1 Running 0 16h
pod/istio-tracing-85fddf979f-fj76v 1/1 Running 0 16h
pod/istiod-6869899d55-lrw9q 1/1 Running 0 16h
pod/kiali-777987866-xrz78 1/1 Running 0 16h
pod/prometheus-5dc7ccbd8c-58nxf 1/1 Running 0 16h
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/grafana ClusterIP 10.0.145.54 <none> 3000/TCP 16h
service/istiod ClusterIP 10.0.228.155 <none> 15010/TCP,15012/TCP,443/TCP,15014/TCP,853/TCP 18h
service/jaeger-agent ClusterIP None <none> 5775/UDP,6831/UDP,6832/UDP 16h
service/jaeger-collector ClusterIP 10.0.125.5 <none> 14267/TCP,14268/TCP,14250/TCP 16h
service/jaeger-collector-headless ClusterIP None <none> 14250/TCP 16h
service/jaeger-query ClusterIP 10.0.133.43 <none> 16686/TCP 16h
service/kiali ClusterIP 10.0.194.167 <none> 20001/TCP 16h
service/prometheus ClusterIP 10.0.124.3 <none> 9090/TCP 16h
service/tracing ClusterIP 10.0.245.10 <none> 80/TCP 16h
service/zipkin ClusterIP 10.0.45.150 <none> 9411/TCP 16h
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/grafana 1/1 1 1 16h
deployment.apps/istio-tracing 1/1 1 1 16h
deployment.apps/istiod 1/1 1 1 18h
deployment.apps/kiali 1/1 1 1 16h
deployment.apps/prometheus 1/1 1 1 16h
NAME DESIRED CURRENT READY AGE
replicaset.apps/grafana-8fdf895f6 1 1 1 16h
replicaset.apps/istio-tracing-85fddf979f 1 1 1 16h
replicaset.apps/istiod-6869899d55 1 1 1 18h
replicaset.apps/kiali-777987866 1 1 1 16h
replicaset.apps/prometheus-5dc7ccbd8c 1 1 1 16h
NAME REFERENCE TARGETS MINPODS MAXPODS REPLICAS AGE
horizontalpodautoscaler.autoscaling/istiod Deployment/istiod 5%/80% 1 5 1 16h