istio1.1（openshift） 流量路由

1、准备测试应用

准备两个nginx Pod和一个proxy

创建应用

apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
  name: www-v1
  namespace: dev
spec:
  selector:
    app: www
  replicas:
  template:
    metadata:
      labels:
        app: www
        version: v1
    spec:
      containers:
        - name: www
          image: nginx
          ports:
            - containerPort:
---
apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
  name: www-v2
  namespace: dev
spec:
  selector:
    app: www
  replicas:
  template:
    metadata:
      labels:
        app: www
        version: v2
    spec:
      containers:
        - name: www
          image: nginx
          ports:
            - containerPort:
---
apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
  name: www-proxy
  namespace: dev
spec:
  selector:
    app: www-proxy
  replicas:
  template:
    metadata:
      labels:
        app: www-proxy
    spec:
      containers:
        - name: www
          image: nginx
          ports:
            - containerPort:
---
apiVersion: v1
kind: Service
metadata:
  name: www
  namespace: dev
spec:
  selector:
    app: www
  ports:
    - name: http
      protocol: TCP
      port:
      targetPort:
---
apiVersion: v1
kind: Service
metadata:
  name: www-proxy
  namespace: dev
spec:
  selector:
    app: www-proxy
  ports:
    - name: http
      protocol: TCP
      port:
      targetPort: 

注意Service中的 - name: http一定要加上，后面要匹配流量类型

# oc create -f app.yaml

准备3个Config Maps

www-v1

#获取客户端真实IP
set_real_ip_from 10.0.0.0/;
set_real_ip_from 192.168.0.0/;
set_real_ip_from 172.16.0.0/;
set_real_ip_from 100.0.0.0/;
set_real_ip_from 127.0.0.1;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
#日志相关格式配置
log_format json '{"@timestamp":"$time_local",'
                 '"podname":"$hostname",'
                 '"clientip":"$remote_addr",'
                 '"request":"$request",'
                 '"status":"$status",'
                 '"forwarded_proto":"$http_x_forwarded_proto",'
                 '"scheme":"$scheme",'
                 '"request_method": "$request_method",'
                 '"size":"$body_bytes_sent",'
                 '"request_time":"$request_time",'
                 '"upstreamtime":"$upstream_response_time",'
                 '"upstreamhost":"$upstream_addr",'
                 '"http_host":"$host",'
                 '"url":"$uri",'
                 '"forwarded_for":"$http_x_forwarded_for",'
                 '"referer":"$http_referer",'
                 '"agent":"$http_user_agent"}';

access_log /dev/stdout json;
error_log  /dev/stderr error;
server {
    location /  {
    default_type text/html;
    return  'nginx-v1';
    }
}

www-v2

#获取客户端真实IP
set_real_ip_from 10.0.0.0/;
set_real_ip_from 192.168.0.0/;
set_real_ip_from 172.16.0.0/;
set_real_ip_from 100.0.0.0/;
set_real_ip_from 127.0.0.1;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
#日志相关格式配置
log_format json '{"@timestamp":"$time_local",'
                 '"podname":"$hostname",'
                 '"clientip":"$remote_addr",'
                 '"request":"$request",'
                 '"status":"$status",'
                 '"forwarded_proto":"$http_x_forwarded_proto",'
                 '"scheme":"$scheme",'
                 '"request_method": "$request_method",'
                 '"size":"$body_bytes_sent",'
                 '"request_time":"$request_time",'
                 '"upstreamtime":"$upstream_response_time",'
                 '"upstreamhost":"$upstream_addr",'
                 '"http_host":"$host",'
                 '"url":"$uri",'
                 '"forwarded_for":"$http_x_forwarded_for",'
                 '"referer":"$http_referer",'
                 '"agent":"$http_user_agent"}';

access_log /dev/stdout json;
error_log  /dev/stderr error;
server {
    location /  {
    default_type text/html;
    return  'nginx-v2';
    }
}

www-proxy

#获取客户端真实IP
set_real_ip_from 10.0.0.0/;
set_real_ip_from 192.168.0.0/;
set_real_ip_from 172.16.0.0/;
set_real_ip_from 100.0.0.0/;
set_real_ip_from 127.0.0.1;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
#日志相关格式配置
log_format json '{"@timestamp":"$time_local",'
                 '"podname":"$hostname",'
                 '"clientip":"$remote_addr",'
                 '"request":"$request",'
                 '"status":"$status",'
                 '"forwarded_proto":"$http_x_forwarded_proto",'
                 '"scheme":"$scheme",'
                 '"request_method": "$request_method",'
                 '"size":"$body_bytes_sent",'
                 '"request_time":"$request_time",'
                 '"upstreamtime":"$upstream_response_time",'
                 '"upstreamhost":"$upstream_addr",'
                 '"http_host":"$host",'
                 '"url":"$uri",'
                 '"forwarded_for":"$http_x_forwarded_for",'
                 '"referer":"$http_referer",'
                 '"agent":"$http_user_agent"}';

access_log /dev/stdout json;
error_log  /dev/stderr error;
server {
    location /  {
    proxy_http_version 1.1;
    proxy_pass http://www;
    }
}

挂载

# oc set volume  dc/www-v1 --add --overwrite --name=config-volume --mount-path=/etc/nginx/conf.d --source='{"configMap": { "name": "www-v1"}}'
# oc set volume  dc/www-v2 --add --overwrite --name=config-volume --mount-path=/etc/nginx/conf.d --source='{"configMap": { "name": "www-v2"}}'
# oc set volume  dc/www-proxy --add --overwrite --name=config-volume --mount-path=/etc/nginx/conf.d --source='{"configMap": { "name": "www-proxy"}}'

为了方便测试www-proxy 需要绑定外部Ingress 比如openshif route

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: www-proxy
  namespace: dev
spec:
  host: www-proxy.ingress.com
  to:
    kind: Service
    name: www-proxy
  port:
    targetPort: 

2、路由流量

默认情况下在内网网络访问www应用，可以看出来流量是轮询的

# curl www-proxy.ingress.com
nginx-v2
nginx-v2
nginx-v1
nginx-v2
nginx-v1
nginx-v1

创建istio VirtualService、DestinationRule 路由流量

kind: VirtualService
metadata:
  name: www-intranet
  namespace: dev
spec:
  hosts:
  - www
  http:
  - route:
    - destination:
        host: www
        subset: v2
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: www
  namespace: dev
spec:
  host: www
  subsets:
  - labels:
      version: v1
    name: v1
  - labels:
      version: v2
    name: v2
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN

这里的http要对应Service -name 的值

测试一下，此时应该只会返回"nginx-v2"

# curl www-prxoy.ingress.com
nginx-v2
nginx-v2
nginx-v2
nginx-v2
nginx-v2

根据权重路由流量

spec:
  hosts:
  - www
  http:
  - route:
    - destination:
        host: www
        subset: v1
      weight:
    - destination:
        host: www
        subset: v2
      weight: 

测试一下

# curl www-proxy.ingress.com
nginx-v1
nginx-v2
nginx-v2
nginx-v2
nginx-v2
nginx-v1
nginx-v2
nginx-v2

下面介绍不通过www-proxy直接路由外部流量，需要额外创建istio Gateway并和VirtualService绑定

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: default-gateway
  namespace: dev
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - '*'
    port:
      name: http
      number:
      protocol: HTTP
---
kind: VirtualService
metadata:
  name: www
  namespace: dev
spec:
  gateways:
  - default-gateway
  hosts:
  - www.ingress.com
  http:
  - route:
    - destination:
        host: www
        subset: v1
---
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  labels:
    app: istio-ingressgateway
    chart: gateways
    heritage: Tiller
    istio: ingressgateway
    release: istio
  name: www
  namespace: istio-system
spec:
  host: www.ingress.com
  port:
    targetPort: http2
  to:
    kind: Service
    name: istio-ingressgateway

注意如果没有外部ingress 使用NodePort的方式引入流量，并且Gateway和VirtualService任意一个hosts没有*，这时候Gateway无法识别具体的host域名

那么可以修改istio-ingressgateway的Deployment用hostPort直接暴露80和443端口，在把istio-ingressgateway的Pod绑定到固定的节点上运行

...
- containerPort:
hostPort:
protocol: TCP
- containerPort:
hostPort:
protocol: TCP
....

下面测试一下

# curl www.ingress.com
nginx-v1
nginx-v1
nginx-v1
nginx-v1
nginx-v1