kuma 学习四 策略

通过策略我们可以构建灵活的service mesh

应用策略

我们可以通过kumactl 以及kubectl 应用策略

• kumactl 格式

echo "

  type: ..

  spec: ..

" | kumactl -f -

• kubectl 格式

echo "

  apiVersion: kuma.io/v1alpha1

  kind: ..

  spec: ..

" | kubectl -f -

mesh 类型的策略

允许在同一个kuma 集群中创建多service mesh
通用格式：

 

type: Mesh

name: default

 

k8s 格式：

apiVersion: kuma.io/v1alpha1

kind: Mesh

metadata:

  namespace: kuma-system

  name: default

双向 tls

• 通用格式

type: Mesh

name: default

mtls:

  enabled: true 

  ca:

    builtin: {}

• k8s 格式：

apiVersion: kuma.io/v1alpha1

kind: Mesh

metadata:

  namespace: kuma-system

  name: default

spec:

  mtls:

    enabled: true

    ca:

      builtin: {}

流量许可

• 通用格式

type: TrafficPermission

name: permission-1

mesh: default

rules:

  - sources:

    - match:

        service: backend

    destinations:

    - match:

        service: redis

        version: "5.0"

• k8s 格式

apiVersion: kuma.io/v1alpha1

kind: TrafficPermission

mesh: default

metadata:

  namespace: default

  name: permission-1

spec:

  rules:

    - sources:

      - match:

          service: backend

      destinations:

      - match:

          service: redis

          version: "5.0"

流量路由

• 通用格式

type: TrafficRoute

name: route-1

mesh: default

rules:

  - sources:

      - match:

          service: backend

    destinations:

      - match:

          service: redis

    conf:

      - weight: 90

        destination:

          - service: backend

            version: "1.0"

      - weight: 10

        destination:

          - service: backend

            version: "2.0"

• k8s 格式

apiVersion: kuma.io/v1alpha1

kind: TrafficRoute

mesh: default

metadata:

  namespace: default

  name: route-1

spec:

  rules:

    - sources:

      - match:

          service: backend

    destinations:

      - match:

          service: redis

    conf:

      - weight: 90

        destination:

          - service: backend

            version: "1.0"

      - weight: 10

        destination:

          - service: backend

            version: "2.0"

流量追踪

• 通用格式

type: Mesh

name: default

tracing:

  enabled: true

  type: zipkin

  address: zipkin.srv:9000

• k8s 格式

apiVersion: kuma.io/v1alpha1

kind: Mesh

metadata:

  namespace: kuma-system

  name: default

spec:

  tracing:

    enabled: true

    type: zipkin

    address: zipkin.srv:9000

流量日志

• 通用格式

type: Mesh

name: default

logging:

  accessLogs:

    enabled: true

    filePath: "/tmp/access.log"

• k8s 格式

apiVersion: kuma.io/v1alpha1

kind: Mesh

metadata:

  namespace: kuma-system

  name: default

spec:

  logging:

    accessLogs:

      enabled: true

      filePath: "/tmp/access.log"

proxy template

proxy template 很强大 ，通过此我们可以配置低级的envoy

• 格式

type: ProxyTemplate

mesh: default

name: template-1

selectors:

  - match:

      service: backend

conf:

  imports:

    - default-proxy

  resources:

    - ..

    - ..

当前对于import的支持稍简单，以下是一个复杂的例子：

imports:

    - default-proxy

  resources:

    - name: localhost:9901

      version: v1

      resource: |

        '@type': type.googleapis.com/envoy.api.v2.Cluster

        connectTimeout: 5s

        name: localhost:9901

        loadAssignment:

          clusterName: localhost:9901

          endpoints:

          - lbEndpoints:

            - endpoint:

                address:

                  socketAddress:

                    address: 127.0.0.1

                    portValue: 9901

        type: STATIC

    - name: inbound:0.0.0.0:4040

      version: v1

      resource: |

        '@type': type.googleapis.com/envoy.api.v2.Listener

        name: inbound:0.0.0.0:4040

        address:

          socket_address:

            address: 0.0.0.0

            port_value: 4040

        filter_chains:

        - filters:

          - name: envoy.http_connection_manager

            config:

              route_config:

                virtual_hosts:

                - routes:

                  - match:

                      prefix: "/stats/prometheus"

                    route:

                      cluster: localhost:9901

                  domains:

                  - "*"

                  name: envoy_admin

              codec_type: AUTO

              http_filters:

                name: envoy.router

              stat_prefix: stats

参考资料

https://kuma.io/docs/0.1.1/policies/#applying-policies