写点什么

10 个 Istio 流量管理 最常用的例子,你知道几个?

作者:万猫学社
  • 2022 年 8 月 09 日
    北京
  • 本文字数:5510 字

    阅读完需:约 18 分钟

10个 Istio 流量管理 最常用的例子,你知道几个?

10 个 Istio 流量管理 最常用的例子,强烈建议收藏起来,以备不时之需。


为了方便理解,以 Istio 官方提供的 Bookinfo 应用示例为例,引出 Istio 流量管理的常用例子。


Bookinfo 应用的架构图如下:



其中,包含四个单独的微服务:


  • productpage:调用 detailsreviews 两个服务,用来生成页面。

  • details:包含了书籍的信息。

  • reviews:包含了书籍相关的评论。它还会调用 ratings 微服务。

  • rating:包含了由书籍评价组成的评级信息。


其中,reviews 服务有 3 个版本:


  • v1 版本不会调用 ratings 服务。

  • v2 版本会调用 ratings 服务,并使用 1 到 5 个黑色星形图标来显示评分信息。

  • v3 版本会调用 ratings 服务,并使用 1 到 5 个红色星形图标来显示评分信息。

流量转移

目标 1:把reviews 服务的所有流量都路由到 v1 版本。


apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata:  name: reviewsspec:  hosts:  - reviews  http:  - route:    - destination:        host: reviews        subset: v1---apiVersion: networking.istio.io/v1alpha3kind: DestinationRulemetadata:  name: reviewsspec:  host: reviews  subsets:    - labels:        version: v1      name: v1    - labels:        version: v2      name: v2    - labels:        version: v3      name: v3
复制代码


目标 2:把reviews 服务的 50%流量转移到 v3 版本。


apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata:  name: reviewsspec:  hosts:    - reviews  http:  - route:    - destination:        host: reviews        subset: v1      weight: 50    - destination:        host: reviews        subset: v3      weight: 50---apiVersion: networking.istio.io/v1alpha3kind: DestinationRulemetadata:  name: reviewsspec:  host: reviews  subsets:    - labels:        version: v1      name: v1    - labels:        version: v2      name: v2    - labels:        version: v3      name: v3
复制代码


目标 3:把reviews 服务的所有流量都路由到 v3 版本。


apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata:  name: reviewsspec:  hosts:  - reviews  http:  - route:    - destination:        host: reviews        subset: v3---apiVersion: networking.istio.io/v1alpha3kind: DestinationRulemetadata:  name: reviewsspec:  host: reviews  subsets:    - labels:        version: v1      name: v1    - labels:        version: v2      name: v2    - labels:        version: v3      name: v3
复制代码

基于用户身份的路由

目标:来自名为 OneMore 的用户的所有流量都路由到 v2 版本,其他流量都路由到 v1 版本。


Istio 对用户身份没有任何特殊的内置机制。在应用示例中,productpage服务在所有到 reviews 服务的 HTTP 请求中都增加了一个自定义的 end-user 请求头,其值为用户名。


apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata:  name: reviewsspec:  hosts:    - reviews  http:  - match:    - headers:        end-user:          exact: OneMore    route:    - destination:        host: reviews        subset: v2  - route:    - destination:        host: reviews        subset: v1---apiVersion: networking.istio.io/v1alpha3kind: DestinationRulemetadata:  name: reviewsspec:  host: reviews  subsets:    - labels:        version: v1      name: v1    - labels:        version: v2      name: v2    - labels:        version: v3      name: v3
复制代码

注入 HTTP 延迟故障

目标:用户 OneMore 访问时, ratings 服务注入一个 2 秒的延迟,productpage页面在大约 2 秒钟加载完成并且没有错误。


apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata:  name: ratingsspec:  hosts:  - ratings  http:  - match:    - headers:        end-user:          exact: OneMore    fault:      delay:        percentage:          value: 100.0        fixedDelay: 2s    route:    - destination:        host: ratings        subset: v1  - route:    - destination:        host: ratings        subset: v1---apiVersion: networking.istio.io/v1alpha3kind: DestinationRulemetadata:  name: ratingsspec:  host: ratings  subsets:    - labels:        version: v1      name: v1
复制代码

注入 HTTP 中止故障

目标:用户 OneMore 访问时, ratings 服务注入一个 503 的中止故障,productpage 页面能够立即被加载,同时显示 “Ratings service is currently unavailable” 这样的消息。


apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata:  name: ratingsspec:  hosts:    - ratings  http:    - fault:        abort:          httpStatus: 503          percentage:            value: 100      match:        - headers:            end-user:              exact: OneMore      route:        - destination:            host: ratings            subset: v1    - route:        - destination:            host: ratings            subset: v1---apiVersion: networking.istio.io/v1alpha3kind: DestinationRulemetadata:  name: ratingsspec:  host: ratings  subsets:    - labels:        version: v1      name: v1
复制代码

设置请求超时

首先,用户 OneMore 访问时, ratings 服务注入一个 2 秒的延迟,productpage页面在大约 2 秒钟加载完成并且没有错误。


按照上文注入 HTTP 延迟故障进行操作,不再赘述。


目标:用户 OneMore 访问时, reviews 服务的请求超时设置为 1 秒,同时显示 “Sorry, product reviews are currently unavailable for this book.” 这样的消息。


kind: VirtualServiceapiVersion: networking.istio.io/v1alpha3metadata:  name: reviewsspec:  hosts:    - reviews  http:    - match:        - headers:            end-user:              exact: OneMore      route:        - destination:            host: reviews            subset: v2      timeout: 1s    - route:        - destination:            host: reviews            subset: v1---apiVersion: networking.istio.io/v1alpha3kind: DestinationRulemetadata:  name: reviewsspec:  host: reviews  subsets:    - labels:        version: v1      name: v1    - labels:        version: v2      name: v2    - labels:        version: v3      name: v3
复制代码


在 Jaeger 可以看到具体的调用链如下:


设置请求重试

首先,用户 OneMore 访问时, ratings 服务注入一个 2 秒的延迟,productpage页面在大约 2 秒钟加载完成并且没有错误。


按照上文注入 HTTP 延迟故障进行操作,不再赘述。


目标:用户 OneMore 访问时, reviews 服务的请求重试次数为 2 次,重试超时时间为 0.5 秒,同时显示 “Sorry, product reviews are currently unavailable for this book.” 这样的错误消息。


kind: VirtualServiceapiVersion: networking.istio.io/v1alpha3metadata:  name: reviewsspec:  hosts:    - reviews  http:    - match:        - headers:            end-user:              exact: OneMore      route:        - destination:            host: reviews            subset: v2      retries:        attempts: 2        perTryTimeout: 0.5s    - route:        - destination:            host: reviews            subset: v1---apiVersion: networking.istio.io/v1alpha3kind: DestinationRulemetadata:  name: reviewsspec:  host: reviews  subsets:    - labels:        version: v1      name: v1    - labels:        version: v2      name: v2    - labels:        version: v3      name: v3
复制代码

拒绝目标 IP 的请求

目标:除了 IP 为10.201.240.131的客户端可以访问/api/v1/products/1,其他客户端拒绝请求。


apiVersion: security.istio.io/v1beta1kind: AuthorizationPolicymetadata:  name: deny-by-ipspec:  selector:    matchLabels:      app: productpage  action: DENY  rules:  - to:    - operation:        paths: ["/api/v1/products/1"]    when:    - key: remote.ip      notValues: ["10.201.240.131"]
复制代码

熔断

目标:设置details服务的并发上限为 1。


apiVersion: networking.istio.io/v1alpha3kind: DestinationRulemetadata:  name: detailsspec:  host: details  trafficPolicy:    connectionPool:      tcp:        maxConnections: 1      http:        http1MaxPendingRequests: 1        maxRequestsPerConnection: 1
复制代码


可以使用 Fortio 进行负载测试,发送并发数为 2 的连接(-c 2),请求 20 次(-n 20):


kubectl exec fortio-deploy-684b6b47f8-tzsg8 -c fortio -- /usr/bin/fortio load -c 3 -qps 0 -n 20 -loglevel Warning http://details:9080/details/0
复制代码


其中,fortio-deploy-684b6b47f8-tzsg8 是 Fortio 的 Pod 名称,效果如下:


流量镜像

目标:把流量全部路由到 reviews 服务的 v2 版本,再把流量全部镜像到 v3 版本。


apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata:  name: reviewsspec:  hosts:  - reviews  http:  - route:    - destination:        host: reviews        subset: v2    mirror:      host: reviews      subset: v3    mirrorPercentage:      value: 100.0---apiVersion: networking.istio.io/v1alpha3kind: DestinationRulemetadata:  name: reviewsspec:  host: reviews  subsets:    - labels:        version: v1      name: v1    - labels:        version: v2      name: v2    - labels:        version: v3      name: v3
复制代码


执行如下命令查看reviews服务 v3 版本的 Envoy 访问日志:


kubectl logs -l app=reviews,version=v3 -c istio-proxy
复制代码


可以看到reviews服务 v3 版本被调用的日志:


{     "authority": "reviews-shadow:9080",     "bytes_received": 0,     "bytes_sent": 375,     "connection_termination_details": null,     "downstream_local_address": "10.1.1.64:9080",     "downstream_remote_address": "10.1.1.59:0",     "duration": 1914,     "method": "GET",     "path": "/reviews/0",     "protocol": "HTTP/1.1",     "request_id": "b79cefe6-1277-9c39-b398-f94a704840cc",     "requested_server_name": "outbound_.9080_.v3_.reviews.default.svc.cluster.local",     "response_code": 200,     "response_code_details": "via_upstream",     "response_flags": "-",     "route_name": "default",     "start_time": "2022-06-27T07:34:19.129Z",     "upstream_cluster": "inbound|9080||",     "upstream_host": "10.1.1.64:9080",     "upstream_local_address": "127.0.0.6:59837",     "upstream_service_time": "1913",     "upstream_transport_failure_reason": null,     "user_agent": "curl/7.79.1",     "x_forwarded_for": "10.1.1.59"}
复制代码

Ingress 的路由

目标:请求头app-iddetails的所有流量都路由到details服务中。


apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata:  name: bookinfospec:  hosts:    - '*'  gateways:    - bookinfo-gateway  http:    - match:        - uri:            exact: /productpage        - uri:            prefix: /static        - uri:            exact: /login        - uri:            exact: /logout        - uri:            prefix: /api/v1/products      route:        - destination:            host: productpage            port:              number: 9080    - match:        - headers:            app-id:              exact: details      route:        - destination:            host: details            port:              number: 9080
复制代码


使用 curl 命令验证一下:


curl -H "app-id: details" -v http://127.0.0.1/details/2
复制代码


返回结果如下:


* Trying 127.0.0.1:80...* Connected to 127.0.0.1 (127.0.0.1) port 80 (#0)> GET /details/2 HTTP/1.1> Host: 127.0.0.1> User-Agent: curl/7.79.1> Accept: */*> app-id: details>* Mark bundle as not supporting multiuse< HTTP/1.1 200 OK< content-type: application/json< server: istio-envoy< date: Tue, 28 Jun 2022 07:14:40 GMT< content-length: 178< x-envoy-upstream-service-time: 4<
{"id":2,"author":"William Shakespeare","year":1595,"type":"paperback","pages":200,"publisher":"PublisherA","language":"English","ISBN-10":"1234567890","ISBN-13":"123-1234567890"}
* Connection #0 to host 127.0.0.1 left intact
复制代码


返回结果可以看出,访问的是details服务。


最后,感谢你这么帅,还给我点赞

发布于: 刚刚阅读数: 4
用户头像

万猫学社

关注

资深研发工程师 2018.04.15 加入

微信搜索「万猫学社」,关注并回复「电子书」,免费获取12本必读技术书籍。

评论

发布
暂无评论
10个 Istio 流量管理 最常用的例子,你知道几个?_云原生_万猫学社_InfoQ写作社区