欢迎关注我的公众号：
目前刚开始写一个月，一共写了18篇原创文章，文章目录如下：
istio多集群探秘，部署了50次多集群后我得出的结论
istio多集群链路追踪，附实操视频
istio防故障利器，你知道几个,istio新手不要读，太难！
istio业务权限控制，原来可以这么玩
istio实现非侵入压缩，微服务之间如何实现压缩
不懂envoyfilter也敢说精通istio系列-http-rbac-不要只会用AuthorizationPolicy配置权限
不懂envoyfilter也敢说精通istio系列-02-http-corsFilter-不要只会vs
不懂envoyfilter也敢说精通istio系列-03-http-csrf filter-再也不用再代码里写csrf逻辑了
不懂envoyfilter也敢说精通istio系列http-jwt_authn-不要只会RequestAuthorization
不懂envoyfilter也敢说精通istio系列-05-fault-filter-故障注入不止是vs
不懂envoyfilter也敢说精通istio系列-06-http-match-配置路由不只是vs
不懂envoyfilter也敢说精通istio系列-07-负载均衡配置不止是dr
不懂envoyfilter也敢说精通istio系列-08-连接池和断路器
不懂envoyfilter也敢说精通istio系列-09-http-route filter
不懂envoyfilter也敢说精通istio系列-network filter-redis proxy
不懂envoyfilter也敢说精通istio系列-network filter-HttpConnectionManager
不懂envoyfilter也敢说精通istio系列-ratelimit-istio ratelimit完全手册
学习目标
什么是sidecar
Sidecar描述了sidecar代理的配置，sidecar代理调解与其连接的工作负载的 inbound 和 outbound 通信。 默认情况下，Istio将为网格中的所有Sidecar代理服务，使其具有到达网格中每个工作负载所需的必要配置，并在与工作负载关联的所有端口上接收流量。 Sidecar资源提供了一种的方法，在向工作负载转发流量或从工作负载转发流量时，微调端口集合和代理将接收的协议。 此外，可以限制代理在从工作负载转发 outbound 流量时可以达到的服务集合。
网格中的服务和配置被组织成一个或多个名称空间（例如，Kubernetes名称空间或CF org/space）。 命名空间中的Sidecar资源将应用于同一命名空间中的一个或多个工作负载，由workloadSelector选择。 如果没有workloadSelector，它将应用于同一名称空间中的所有工作负载。 在确定要应用于工作负载的Sidecar资源时，将优先使用通过workloadSelector而选择到此工作负载的的资源，而不是没有任何workloadSelector的资源。
注意：每个命名空间只能有一个没有任何工作负载选择器的Sidecar资源。 如果给定命名空间中存在多个无选择器的Sidecar资源，则系统的行为是不确定的。 如果具有工作负载选择器的两个或多个Sidecar资源选择相同的工作负载，则系统的行为是不确定的。
资源详解
Field
| Type
| Description
| Required
|
workloadSelector | WorkloadSelector | Criteria used to select the specific set of pods/VMs on which this Sidecar configuration should be applied. If omitted, the Sidecar configuration will be applied to all workload instances in the same namespace. | No
|
ingress | IstioIngressListener[] | Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance. If omitted, Istio will automatically configure the sidecar based on the information about the workload obtained from the orchestration platform (e.g., exposed ports, services, etc.). If specified, inbound ports are configured if and only if the workload instance is associated with a service.
| No
|
egress | IstioEgressListener[] | Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh.
| Yes
|
outboundTrafficPolicy | OutboundTrafficPolicy | This allows to configure the outbound traffic policy. If your application uses one or more external services that are not known apriori, setting the policy to ALLOW_ANY will cause the sidecars to route any unknown traffic originating from the application to its requested destination. | No
|
全局有效
sc-default-global.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: default
namespace: istio-system
spec:
ingress:
- port:
number: 9080
protocol: HTTP
name: http
defaultEndpoint: 127.0.0.1:9080
workloadSelector
没有selector
sc-default-istio-ingress.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: default
spec:
ingress:
- port:
number: 9080
protocol: HTTP
name: http
defaultEndpoint: 127.0.0.1:9080
有selector
sc-productpage-selector.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
ingress:
- port:
number: 9081
protocol: HTTP
name: http
defaultEndpoint: 127.0.0.1:9080
监听端口和目标端口不一致，可用于端口转换
此时service需要添加端口
kubectl edit svc productpage -n istio
- name: http9081
port: 9081
protocol: TCP
targetPort: 9081
修改vs端口
sidecar/vs-bookinfo-hosts-star.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: bookinfo
spec:
hosts:
- "*"
gateways:
- bookinfo-gateway
http:
- match:
- uri:
exact: /productpage
- uri:
prefix: /static
- uri:
exact: /login
- uri:
exact: /logout
- uri:
prefix: /api/v1/products
route:
- destination:
host: productpage.istio.svc.cluster.local
port:
number: 9081
egress
Field
| Type
| Description
| Required
|
port | Port | The port associated with the listener. If using Unix domain socket, use 0 as the port number, with a valid protocol. The port if specified, will be used as the default destination port associated with the imported hosts. If the port is omitted, Istio will infer the listener ports based on the imported hosts. Note that when multiple egress listeners are specified, where one or more listeners have specific ports while others have no port, the hosts exposed on a listener port will be based on the listener with the most specific port.
| No
|
bind | string | The IP or the Unix domain socket to which the listener should be bound to. Port MUST be specified if bind is not empty. Format: x.x.x.x or unix:///path/to/uds or unix://@foobar (Linux abstract namespace). If omitted, Istio will automatically configure the defaults based on imported services, the workload instances to which this configuration is applied to and the captureMode. If captureMode is NONE, bind will default to 127.0.0.1. | No
|
captureMode | CaptureMode | When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). captureMode must be DEFAULT or NONE for Unix domain socket binds. | No
|
hosts | string[] | One or more service hosts exposed by the listener in namespace/dnsName format. Services in the specified namespace matching dnsName will be exposed. The corresponding service can be a service in the service registry (e.g., a Kubernetes or cloud foundry service) or a service specified using a ServiceEntry or VirtualService configuration. Any associated DestinationRule in the same namespace will also be used.The dnsName should be specified using FQDN format, optionally including a wildcard character in the left-most component (e.g., prod/*.example.com). Set the dnsName to * to select all services from the specified namespace (e.g., prod/*).The namespace can be set to *, ., or ~, representing any, the current, or no namespace, respectively. For example, */foo.example.com selects the service from any available namespace while ./foo.example.com only selects the service from the namespace of the sidecar. If a host is set to */*, Istio will configure the sidecar to be able to reach every service in the mesh that is exported to the sidecar’s namespace. The value ~/* can be used to completely trim the configuration for sidecars that simply receive traffic and respond, but make no outbound connections of their own.NOTE: Only services and configuration artifacts exported to the sidecar’s namespace (e.g., exportTo value of *) can be referenced. Private configurations (e.g., exportTo set to .) will not be available. Refer to the exportTo setting in VirtualService, DestinationRule, and ServiceEntry configurations for details.WARNING: The list of egress hosts in a Sidecar must also include the Mixer control plane services if they are enabled. Envoy will not be able to reach them otherwise. For example, add host istio-system/istio-telemetry.istio-system.svc.cluster.local if telemetry is enabled, istio-system/istio-policy.istio-system.svc.cluster.local if policy is enabled, or add istio-system/* to allow all services in the istio-system namespace. This requirement is temporary and will be removed in a future Istio release. | Yes
|
port
sc-productpage-egress-port.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
egress:
- hosts:
- "./*"
port:
number: 9080
protocol: HTTP
name: egresshttp
bind
0.0.0.0
sc-productpage-egress-bind.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
egress:
- hosts:
- "./*"
port:
number: 9080
protocol: HTTP
name: egresshttp
bind: 0.0.0.0
目标svc ip
sc-productpage-egress-bind-svc-ip.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
egress:
- hosts:
- "./*"
port:
number: 9080
protocol: HTTP
name: egresshttp
bind: 10.68.190.94
captureMode
Name
| Description
|
DEFAULT | The default capture mode defined by the environment.
|
IPTABLES | Capture traffic using IPtables redirection.
|
NONE | No traffic capture. When used in an egress listener, the application is expected to explicitly communicate with the listener port or Unix domain socket. When used in an ingress listener, care needs to be taken to ensure that the listener port is not in use by other processes on the host.
|
DEFAULT
sc-productpage-egress-captureMode-DEFAULT.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
egress:
- hosts:
- "./*"
port:
number: 9080
protocol: HTTP
name: egresshttp
bind: 0.0.0.0
captureMode: DEFAULT
IPTABLES
sc-productpage-egress-captureMode-IPTABLES.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
egress:
- hosts:
- "./*"
port:
number: 9080
protocol: HTTP
name: egresshttp
bind: 0.0.0.0
captureMode: IPTABLES
NONE
sc-productpage-egress-captureMode-NONE.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
egress:
- hosts:
- "./*"
port:
number: 9080
protocol: HTTP
name: egresshttp
bind: 0.0.0.0
captureMode: NONE
sc-productpage-ingress-captureMode-NONE.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
ingress:
- captureMode: NONE
defaultEndpoint: 127.0.0.1:9080
port:
number: 9080
protocol: HTTP
name: http
egress:
- hosts:
- "./*"
port:
number: 9080
protocol: HTTP
name: egresshttp
bind: 127.0.0.1
captureMode: NONE
进入和出去流量都不捕获，相当于去掉了sidecar，对这个pod的istio资源将不起作用。
注意mesh配置，允许集群外访问
outboundTrafficPolicy: mode: REGISTRY_ONLY| ALLOW_ANY
hosts
dot
sc-productpage-egress-hosts-dot.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
egress:
- hosts:
- "./*"
semi-star
sc-productpage-egress-hosts-semi-star.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
egress:
- hosts:
- "istio/*"
double-star
sc-productpage-egress-hosts-double-star.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
egress:
- hosts:
- "*/*"
specific
sc-productpage-egress-hosts-specific.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
egress:
- hosts:
- "istio/details.istio.svc.cluster.local"
ingress
Field
| Type
| Description
| Required
|
port | Port | The port associated with the listener.
| Yes
|
bind | string | The IP to which the listener should be bound. Must be in the format x.x.x.x. Unix domain socket addresses are not allowed in the bind field for ingress listeners. If omitted, Istio will automatically configure the defaults based on imported services and the workload instances to which this configuration is applied to. | No
|
captureMode | CaptureMode | The captureMode option dictates how traffic to the listener is expected to be captured (or not).
| No
|
defaultEndpoint | string | The loopback IP endpoint or Unix domain socket to which traffic should be forwarded to. This configuration can be used to redirect traffic arriving at the bind IP:Port on the sidecar to a localhost:port or Unix domain socket where the application workload instance is listening for connections. Format should be 127.0.0.1:PORT or unix:///path/to/socket | Yes
|
port
sc-productpage-ingress-port.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
ingress:
- captureMode: IPTABLES
defaultEndpoint: 127.0.0.1:9080
port:
number: 9080
protocol: HTTP
name: http
bind
sc-productpage-ingress-bind.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
ingress:
- captureMode: IPTABLES
bind: 0.0.0.0
defaultEndpoint: 127.0.0.1:9080
port:
number: 9080
protocol: HTTP
name: http
sc-productpage-ingress-bind-pod-ip.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
ingress:
- captureMode: IPTABLES
bind: 172.20.1.174
defaultEndpoint: 127.0.0.1:9080
port:
number: 9080
protocol: HTTP
name: http
bind pod ip
captureMode
Name
| Description
|
DEFAULT | The default capture mode defined by the environment.
|
IPTABLES | Capture traffic using IPtables redirection.
|
NONE | No traffic capture. When used in an egress listener, the application is expected to explicitly communicate with the listener port or Unix domain socket. When used in an ingress listener, care needs to be taken to ensure that the listener port is not in use by other processes on the host.
|
DEFAULT
sc-productpage-ingress-capture-mode-DEFAULT.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
ingress:
- captureMode: DEFAULT
bind: 0.0.0.0
defaultEndpoint: 127.0.0.1:9080
port:
number: 9080
protocol: HTTP
name: http
IPTABLES
sc-productpage-ingress-capture-mode-IPTABLES.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
ingress:
- captureMode: IPTABLES
bind: 0.0.0.0
defaultEndpoint: 127.0.0.1:9080
port:
number: 9080
protocol: HTTP
name: http
NONE
sc-productpage-ingress-capture-mode-NONE.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
ingress:
- captureMode: NONE
defaultEndpoint: 127.0.0.1:9080
port:
number: 9080
protocol: HTTP
name: http
defaultEndpoint
unix socket
1部署mysqlgateway
kubectl apply -f gateway/gateway-mysql.yaml -n istio
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
name: mysql
spec:
selector:
istio: ingressgateway
servers:
- port:
number: 3306
name: mysql
protocol: MYSQL
hosts:
- "*"
2部署mysql vs
kubectl apply -f gateway/protocol/vs-mysql.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: mysql
spec:
hosts:
- "*"
gateways:
- mysql
tcp:
- match:
- port: 3306
route:
- destination:
host: mysqldb.istio.svc.cluster.local
port:
number: 3306
3添加svc 端口
kubectl edit svc istio-ingressgateway -n istio-system
3306端口
4部署sidecar
sc-mysql-defaultEndpoint-unix.yaml
当绑定地址是IP时，captureMode选项指示如何劫持（或不劫持）到监听器的流量。 对于Unix domain socket，captureMode必须为DEFAULT或NONE。
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: mysql
spec:
workloadSelector:
labels:
app: mysqldb
ingress:
- bind: 0.0.0.0
port:
number: 3306
protocol: MYSQL
name: mysql
defaultEndpoint: unix:///var/run/mysqld/mysqld.sock
captureMode: NONE
ip -port
sc-productpage-ingerss-defaultEndpoint-ip.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
ingress:
- captureMode: NONE
defaultEndpoint: 127.0.0.1:9080
port:
number: 9080
protocol: HTTP
name: http
outboundTrafficPolicy
egressProxy
egressProxy
| Destination
| | Specifies the details of the egress proxy to which unknown traffic should be forwarded to from the sidecar. Valid only if the mode is set to ALLOW_ANY. If not specified when the mode is ALLOW_ANY, the sidecar will send the unknown traffic directly to the IP requested by the application. ** NOTE 1: The specified egress host must be imported in the egress section for the traffic forwarding to work. NOTE 2**: An Envoy based egress gateway is unlikely to be able to handle plain text TCP connections forwarded from the sidecar. Envoy's dynamic forward proxy can handle only HTTP and TLS connections. $hide_from_docs |
| | | |
FIELD
| TYPE
| LABEL
| DESCRIPTION
|
host
| string
| | The name of a service from the service registry. Service names are looked up from the platform's service registry (e.g., Kubernetes services, Consul services, etc.) and from the hosts declared by ServiceEntry. Traffic forwarded to destinations that are not found in either of the two, will be dropped. Note for Kubernetes users: When short names are used (e.g. “reviews” instead of “reviews.default.svc.cluster.local”), Istio will interpret the short name based on the namespace of the rule, not the service. A rule in the “default” namespace containing a host “reviews will be interpreted as “reviews.default.svc.cluster.local”, irrespective of the actual namespace associated with the reviews service. To avoid potential misconfiguration, it is recommended to always use fully qualified domain names over short names. |
subset
| string
| | The name of a subset within the service. Applicable only to services within the mesh. The subset must be defined in a corresponding DestinationRule.
|
port
| PortSelector
| | Specifies the port on the host that is being addressed. If a service exposes only a single port it is not required to explicitly select the port
|
host
sc-productpage-outboundTrafficPolicy-egressProxy-host.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
outboundTrafficPolicy:
egressProxy:
host: "details.istio.svc.cluster.local"
port:
number: 9080
mode: ALLOW_ANY
port
sc-productpage-outboundTrafficPolicy-egressProxy-port.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
outboundTrafficPolicy:
egressProxy:
host: "details.istio.svc.cluster.local"
port:
number: 9080
mode: ALLOW_ANY
subset
sc-productpage-outboundTrafficPolicy-egressProxy-subset.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
outboundTrafficPolicy:
egressProxy:
host: "details.istio.svc.cluster.local"
port:
number: 9080
subset: v1
mode: ALLOW_ANY
mode
Name
| Description
|
REGISTRY_ONLY | Outbound traffic will be restricted to services defined in the service registry as well as those defined through ServiceEntry configurations. |
ALLOW_ANY | Outbound traffic to unknown destinations will be allowed, in case there are no services or ServiceEntry configurations for the destination port. |
REGISTRY_ONLY
sc-productpage-outboundTrafficPolicy-mode-REGISTRY_ONLY.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
outboundTrafficPolicy:
mode: REGISTRY_ONLY
ALLOW_ANY
sc-productpage-outboundTrafficPolicy-mode-ALLOW_ANY.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
outboundTrafficPolicy:
mode: ALLOW_ANY
组合应用
sc-productpage-complex.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
ingress:
- captureMode: NONE
defaultEndpoint: 127.0.0.1:9080
port:
number: 9080
protocol: HTTP
name: http
egress:
- hosts:
- "./*"
port:
number: 9080
protocol: HTTP
name: egresshttp
bind: 127.0.0.1
captureMode: NONE
outboundTrafficPolicy:
mode: REGISTRY_ONLY
outbound将不能访问
sc-productpage-complex-02.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
ingress:
- captureMode: NONE
defaultEndpoint: 127.0.0.1:9080
port:
number: 9080
protocol: HTTP
name: http
egress:
- hosts:
- "./*"
port:
number: 9080
protocol: HTTP
name: egresshttp
bind: 127.0.0.1
captureMode: NONE
outboundTrafficPolicy:
mode: ALLOW_ANY
可以访问outbound
sc-productpage-complex-03.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: productpage
spec:
workloadSelector:
labels:
app: productpage
ingress:
- captureMode: NONE
defaultEndpoint: 127.0.0.1:9080
port:
number: 9080
protocol: HTTP
name: http
egress:
- hosts:
- "./*"
port:
number: 9080
protocol: HTTP
name: egresshttp
bind: 127.0.0.1
captureMode: NONE
outboundTrafficPolicy:
mode: ALLOW_ANY
egressProxy:
host: "details.istio.svc.cluster.local"
port:
number: 9080
subset: v1
只有detail outbound能访问
egress_proxy must be set only with ALLOW_ANY outbound_traffic_policy mode
使用ServiceEntry
1进入pod访问www.baidu.com
kubectl exec -it sleep-557747455f-ft9bs -n istio -- /bin/sh
curl www.baidu.com
可以访问
2部署sidecar
sc-sleep-REGISTRY_ONLY.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: sleep
spec:
workloadSelector:
labels:
app: sleep
outboundTrafficPolicy:
mode: REGISTRY_ONLY
3在访问www.baidu.com
不能访问
4部署serviceentry
serviceentries/se-baidu.yaml
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
name: baidu
spec:
hosts:
- "www.baidu.com"
ports:
- number: 80
name: http
protocol: HTTP
location: MESH_EXTERNAL
resolution: DNS
5再访问www.baidu.com
可以访问
