• 镜像
    • 开始之前
    • 创建默认路由策略
    • 镜像流量到 v2
    • 清理
    • 相关内容

    镜像

    此任务演示了 Istio 的流量镜像功能。

    流量镜像,也称为影子流量,是一个以尽可能低的风险为生产带来变化的强大的功能。镜像会将实时流量的副本发送到镜像服务。镜像流量发生在主服务的关键请求路径之外。

    在此任务中,首先把所有流量路由到 v1 测试服务。然后使用规则将一部分流量镜像到 v2

    开始之前

    • 按照安装指南中的说明设置 Istio。

    • 首先部署启用了访问日志的两个版本的 httpbin 服务:

    httpbin-v1:

    1. $ cat <<EOF | istioctl kube-inject -f - | kubectl create -f -
    2. apiVersion: extensions/v1beta1
    3. kind: Deployment
    4. metadata:
    5. name: httpbin-v1
    6. spec:
    7. replicas: 1
    8. template:
    9. metadata:
    10. labels:
    11. app: httpbin
    12. version: v1
    13. spec:
    14. containers:
    15. - image: docker.io/kennethreitz/httpbin
    16. imagePullPolicy: IfNotPresent
    17. name: httpbin
    18. command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]
    19. ports:
    20. - containerPort: 80
    21. EOF

    httpbin-v2:

    1. $ cat <<EOF | istioctl kube-inject -f - | kubectl create -f -
    2. apiVersion: extensions/v1beta1
    3. kind: Deployment
    4. metadata:
    5. name: httpbin-v2
    6. spec:
    7. replicas: 1
    8. template:
    9. metadata:
    10. labels:
    11. app: httpbin
    12. version: v2
    13. spec:
    14. containers:
    15. - image: docker.io/kennethreitz/httpbin
    16. imagePullPolicy: IfNotPresent
    17. name: httpbin
    18. command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]
    19. ports:
    20. - containerPort: 80
    21. EOF

    httpbin Kubernetes service:

    1. $ kubectl create -f - <<EOF
    2. apiVersion: v1
    3. kind: Service
    4. metadata:
    5. name: httpbin
    6. labels:
    7. app: httpbin
    8. spec:
    9. ports:
    10. - name: http
    11. port: 8000
    12. targetPort: 80
    13. selector:
    14. app: httpbin
    15. EOF
    • 启动 sleep 服务,这样就可以使用 curl 来提供负载了:

    sleep service:

    1. $ cat <<EOF | istioctl kube-inject -f - | kubectl create -f -
    2. apiVersion: extensions/v1beta1
    3. kind: Deployment
    4. metadata:
    5. name: sleep
    6. spec:
    7. replicas: 1
    8. template:
    9. metadata:
    10. labels:
    11. app: sleep
    12. spec:
    13. containers:
    14. - name: sleep
    15. image: tutum/curl
    16. command: ["/bin/sleep","infinity"]
    17. imagePullPolicy: IfNotPresent
    18. EOF

    创建默认路由策略

    默认情况下,Kubernetes 在 httpbin 服务的两个版本之间进行负载均衡。在此步骤中会更改该行为,把所有流量都路由到 v1

    • 创建一个默认路由规则,将所有流量路由到服务的 v1

    如果为 Istio 启用了双向 TLS 认证,在应用前必须将 TLS 流量策略 mode: ISTIO_MUTUAL 添加到 DestinationRule。否则,请求将发生 503 错误,如设置目标规则后出现 503 错误所述。

    1. $ kubectl apply -f - <<EOF
    2. apiVersion: networking.istio.io/v1alpha3
    3. kind: VirtualService
    4. metadata:
    5. name: httpbin
    6. spec:
    7. hosts:
    8. - httpbin
    9. http:
    10. - route:
    11. - destination:
    12. host: httpbin
    13. subset: v1
    14. weight: 100
    15. ---
    16. apiVersion: networking.istio.io/v1alpha3
    17. kind: DestinationRule
    18. metadata:
    19. name: httpbin
    20. spec:
    21. host: httpbin
    22. subsets:
    23. - name: v1
    24. labels:
    25. version: v1
    26. - name: v2
    27. labels:
    28. version: v2
    29. EOF

    现在所有流量已经都转到 httpbin:v1 服务。

    • 向服务发送一些流量:
    1. $ export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
    2. $ kubectl exec -it $SLEEP_POD -c sleep -- sh -c 'curl http://httpbin:8000/headers' | python -m json.tool
    3. {
    4. "headers": {
    5. "Accept": "*/*",
    6. "Content-Length": "0",
    7. "Host": "httpbin:8000",
    8. "User-Agent": "curl/7.35.0",
    9. "X-B3-Sampled": "1",
    10. "X-B3-Spanid": "eca3d7ed8f2e6a0a",
    11. "X-B3-Traceid": "eca3d7ed8f2e6a0a",
    12. "X-Ot-Span-Context": "eca3d7ed8f2e6a0a;eca3d7ed8f2e6a0a;0000000000000000"
    13. }
    14. }
    • 查看 httpbin pods 的 v1v2 日志。您可以看到 v1 的访问日志和 v2<none> 的日志:
    1. $ export V1_POD=$(kubectl get pod -l app=httpbin,version=v1 -o jsonpath={.items..metadata.name})
    2. $ kubectl logs -f $V1_POD -c httpbin
    3. 127.0.0.1 - - [07/Mar/2018:19:02:43 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"
    1. $ export V2_POD=$(kubectl get pod -l app=httpbin,version=v2 -o jsonpath={.items..metadata.name})
    2. $ kubectl logs -f $V2_POD -c httpbin
    3. <none>

    镜像流量到 v2

    • 改变路由规则将流量镜像到 v2:
    1. $ kubectl apply -f - <<EOF
    2. apiVersion: networking.istio.io/v1alpha3
    3. kind: VirtualService
    4. metadata:
    5. name: httpbin
    6. spec:
    7. hosts:
    8. - httpbin
    9. http:
    10. - route:
    11. - destination:
    12. host: httpbin
    13. subset: v1
    14. weight: 100
    15. mirror:
    16. host: httpbin
    17. subset: v2
    18. EOF

    此路由规则将 100% 的流量发送到 v1 。最后一节指定镜像到 httpbin:v2 服务。当流量被镜像时,请求将通过其主机/授权报头发送到镜像服务附上 -shadow。例如,将 cluster-1 变为 cluster-1-shadow

    此外,重点注意这些被镜像的请求是“即发即弃”的,也就是说这些请求引发的响应是会被丢弃的。

    • 发送流量:
    1. $ kubectl exec -it $SLEEP_POD -c sleep -- sh -c 'curl http://httpbin:8000/headers' | python -m json.tool

    这样就可以看到 v1v2 中都有了访问日志。v2 中的访问日志就是由镜像流量产生的,这些请求的实际目标是 v1

    1. $ kubectl logs -f $V1_POD -c httpbin
    2. 127.0.0.1 - - [07/Mar/2018:19:02:43 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"
    3. 127.0.0.1 - - [07/Mar/2018:19:26:44 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"
    1. $ kubectl logs -f $V2_POD -c httpbin
    2. 127.0.0.1 - - [07/Mar/2018:19:26:44 +0000] "GET /headers HTTP/1.1" 200 361 "-" "curl/7.35.0"
    • 如果要检查流量内部,请在另一个控制台上运行以下命令:
    1. $ export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
    2. $ export V1_POD_IP=$(kubectl get pod -l app=httpbin -l version=v1 -o jsonpath={.items..status.podIP})
    3. $ export V2_POD_IP=$(kubectl get pod -l app=httpbin -l version=v2 -o jsonpath={.items..status.podIP})
    4. $ kubectl exec -it $SLEEP_POD -c istio-proxy -- sudo tcpdump -A -s 0 host $V1_POD_IP or host $V2_POD_IP
    5. tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    6. listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
    7. 05:47:50.159513 IP sleep-7b9f8bfcd-2djx5.38836 > 10-233-75-11.httpbin.default.svc.cluster.local.80: Flags [P.], seq 4039989036:4039989832, ack 3139734980, win 254, options [nop,nop,TS val 77427918 ecr 76730809], length 796: HTTP: GET /headers HTTP/1.1
    8. E..P2.X.X.X.
    9. .K.
    10. .K....P..W,.$.......+.....
    11. ..t.....GET /headers HTTP/1.1
    12. host: httpbin:8000
    13. user-agent: curl/7.35.0
    14. accept: */*
    15. x-forwarded-proto: http
    16. x-request-id: 571c0fd6-98d4-4c93-af79-6a2fe2945847
    17. x-envoy-decorator-operation: httpbin.default.svc.cluster.local:8000/*
    18. x-b3-traceid: 82f3e0a76dcebca2
    19. x-b3-spanid: 82f3e0a76dcebca2
    20. x-b3-sampled: 0
    21. x-istio-attributes: Cj8KGGRlc3RpbmF0aW9uLnNlcnZpY2UuaG9zdBIjEiFodHRwYmluLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwKPQoXZGVzdGluYXRpb24uc2VydmljZS51aWQSIhIgaXN0aW86Ly9kZWZhdWx0L3NlcnZpY2VzL2h0dHBiaW4KKgodZGVzdGluYXRpb24uc2VydmljZS5uYW1lc3BhY2USCRIHZGVmYXVsdAolChhkZXN0aW5hdGlvbi5zZXJ2aWNlLm5hbWUSCRIHaHR0cGJpbgo6Cgpzb3VyY2UudWlkEiwSKmt1YmVybmV0ZXM6Ly9zbGVlcC03YjlmOGJmY2QtMmRqeDUuZGVmYXVsdAo6ChNkZXN0aW5hdGlvbi5zZXJ2aWNlEiMSIWh0dHBiaW4uZGVmYXVsdC5zdmMuY2x1c3Rlci5sb2NhbA==
    22. content-length: 0
    23. 05:47:50.159609 IP sleep-7b9f8bfcd-2djx5.49560 > 10-233-71-7.httpbin.default.svc.cluster.local.80: Flags [P.], seq 296287713:296288571, ack 4029574162, win 254, options [nop,nop,TS val 77427918 ecr 76732809], length 858: HTTP: GET /headers HTTP/1.1
    24. E.....X.X...
    25. .K.
    26. .G....P......l......e.....
    27. ..t.....GET /headers HTTP/1.1
    28. host: httpbin-shadow:8000
    29. user-agent: curl/7.35.0
    30. accept: */*
    31. x-forwarded-proto: http
    32. x-request-id: 571c0fd6-98d4-4c93-af79-6a2fe2945847
    33. x-envoy-decorator-operation: httpbin.default.svc.cluster.local:8000/*
    34. x-b3-traceid: 82f3e0a76dcebca2
    35. x-b3-spanid: 82f3e0a76dcebca2
    36. x-b3-sampled: 0
    37. x-istio-attributes: Cj8KGGRlc3RpbmF0aW9uLnNlcnZpY2UuaG9zdBIjEiFodHRwYmluLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwKPQoXZGVzdGluYXRpb24uc2VydmljZS51aWQSIhIgaXN0aW86Ly9kZWZhdWx0L3NlcnZpY2VzL2h0dHBiaW4KKgodZGVzdGluYXRpb24uc2VydmljZS5uYW1lc3BhY2USCRIHZGVmYXVsdAolChhkZXN0aW5hdGlvbi5zZXJ2aWNlLm5hbWUSCRIHaHR0cGJpbgo6Cgpzb3VyY2UudWlkEiwSKmt1YmVybmV0ZXM6Ly9zbGVlcC03YjlmOGJmY2QtMmRqeDUuZGVmYXVsdAo6ChNkZXN0aW5hdGlvbi5zZXJ2aWNlEiMSIWh0dHBiaW4uZGVmYXVsdC5zdmMuY2x1c3Rlci5sb2NhbA==
    38. x-envoy-internal: true
    39. x-forwarded-for: 10.233.75.12
    40. content-length: 0
    41. 05:47:50.166734 IP 10-233-75-11.httpbin.default.svc.cluster.local.80 > sleep-7b9f8bfcd-2djx5.38836: Flags [P.], seq 1:472, ack 796, win 276, options [nop,nop,TS val 77427925 ecr 77427918], length 471: HTTP: HTTP/1.1 200 OK
    42. E....3X.?...
    43. .K.
    44. .K..P...$....ZH...........
    45. ..t...t.HTTP/1.1 200 OK
    46. server: envoy
    47. date: Fri, 15 Feb 2019 05:47:50 GMT
    48. content-type: application/json
    49. content-length: 241
    50. access-control-allow-origin: *
    51. access-control-allow-credentials: true
    52. x-envoy-upstream-service-time: 3
    53. {
    54. "headers": {
    55. "Accept": "*/*",
    56. "Content-Length": "0",
    57. "Host": "httpbin:8000",
    58. "User-Agent": "curl/7.35.0",
    59. "X-B3-Sampled": "0",
    60. "X-B3-Spanid": "82f3e0a76dcebca2",
    61. "X-B3-Traceid": "82f3e0a76dcebca2"
    62. }
    63. }
    64. 05:47:50.166789 IP sleep-7b9f8bfcd-2djx5.38836 > 10-233-75-11.httpbin.default.svc.cluster.local.80: Flags [.], ack 472, win 262, options [nop,nop,TS val 77427925 ecr 77427925], length 0
    65. E..42.X.X.\.
    66. .K.
    67. .K....P..ZH.$.............
    68. ..t...t.
    69. 05:47:50.167234 IP 10-233-71-7.httpbin.default.svc.cluster.local.80 > sleep-7b9f8bfcd-2djx5.49560: Flags [P.], seq 1:512, ack 858, win 280, options [nop,nop,TS val 77429926 ecr 77427918], length 511: HTTP: HTTP/1.1 200 OK
    70. E..3..X.>...
    71. .G.
    72. .K..P....l....;...........
    73. ..|...t.HTTP/1.1 200 OK
    74. server: envoy
    75. date: Fri, 15 Feb 2019 05:47:49 GMT
    76. content-type: application/json
    77. content-length: 281
    78. access-control-allow-origin: *
    79. access-control-allow-credentials: true
    80. x-envoy-upstream-service-time: 3
    81. {
    82. "headers": {
    83. "Accept": "*/*",
    84. "Content-Length": "0",
    85. "Host": "httpbin-shadow:8000",
    86. "User-Agent": "curl/7.35.0",
    87. "X-B3-Sampled": "0",
    88. "X-B3-Spanid": "82f3e0a76dcebca2",
    89. "X-B3-Traceid": "82f3e0a76dcebca2",
    90. "X-Envoy-Internal": "true"
    91. }
    92. }
    93. 05:47:50.167253 IP sleep-7b9f8bfcd-2djx5.49560 > 10-233-71-7.httpbin.default.svc.cluster.local.80: Flags [.], ack 512, win 262, options [nop,nop,TS val 77427926 ecr 77429926], length 0
    94. E..4..X.X...
    95. .K.
    96. .G....P...;..n............
    97. ..t...|.

    您可以查看流量​​的请求和响应内容。

    清理

    • 删除规则:
    1. $ kubectl delete virtualservice httpbin
    2. $ kubectl delete destinationrule httpbin
    • 关闭 httpbin 服务和客户端:
    1. $ kubectl delete deploy httpbin-v1 httpbin-v2 sleep
    2. $ kubectl delete svc httpbin

    相关内容

    用于在生产环境进行测试的 Istio 流量镜像功能

    介绍更安全,低风险的部署和发布到生产。

    多集群服务网格中的分版本路由

    在多集群服务网格环境中配置 Istio 的路由规则。

    Egress gateway 性能测试

    评估加入 Egress gateway 对性能造成的影响。

    Istio Sidecar 注入过程解密

    Istio 将数据面组件注入到现存部署之中的过程。

    使用 Cert-Manager 部署一个自定义 Ingress 网关

    如何使用 cert-manager 手工部署一个自定义 Ingress 网关。

    增量式应用 Istio 第一部分,流量管理

    如何在不部署 Sidecar 代理的情况下使用 Istio 进行流量管理。