开发公司Istio三之VirtualService、Gateway、DestinationRule配置使用

开发公司前面介绍了Istio开发公司如何完成流量劫持，开发公司此篇博客将介绍Istio开发公司中如何配置VirtualService、Gateway、DestinationRule开发公司来完成流量管理。开发公司还是先从理论开始，先看看VirtualService、Gateway、DestinationRule的概念。
VirtualService：在Istio开发公司服务网格中定义路由规则
DestinationRule：在VirtualService开发公司路由生效后，开发公司配置应用与请求的策略集
ServiceEntry：开发公司通常用于在Istio开发公司服务网格之外启用对服务的请求
Gateway：为HTTP/TCP开发公司流量配置负载均衡器，开发公司最常见的是在网格的边缘的操作，开发公司以启用应用程序的入口流量。Istio中gateway分为IngressGateway和EgressGateway，开发公司分别管理进来的流量和开发公司出去的流量。开发公司下面是对上面3开发公司个对象配置中的各个字开发公司段含义解析。

接着通过实际例子演示如果通过配置VirtualService等完成流量管理。

案例一：部署后端服务simple，配置istio的VirtualService和Gateway，gateway网关添加在istio-ingress pod上，gateway网关expose出80端口。VirtualService将simple网关、80端口发送的，且请求的hosts是“simple.cncamp.io”的请求路由到后端务"simple.simple.svc.cluster.local"上。之前在CoreDNS章节介绍过，这个域名地址实际就是部署的后端simple服务的service地址。

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: simple
spec:
  gateways:
    - simple
  hosts:
    - simple.cncamp.io
  http:
    - match:
        - port: 80
      route:
        - destination:
            host: simple.simple.svc.cluster.local
            port:
              number: 80
---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: simple
spec:
  selector:
    istio: ingressgateway
  servers:
    - hosts:
        - simple.cncamp.io
      port:
        name: http-simple
        number: 80
        protocol: HTTP

apiVersion: apps/v1
kind: Deployment
metadata:
  name: simple
spec:
  replicas: 1
  selector:
    matchLabels:
      app: simple
  template:
    metadata:
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "80"
      labels:
        app: simple
    spec:
      containers:
        - name: simple
          imagePullPolicy: Always
          image: cncamp/httpserver:v1.0-metrics
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: simple
spec:
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
  selector:
    app: simple

上面的simple 服务的部署配置文件，通过配置文件创建相关对象。

kubectl create ns simple
kubectl create -f simple.yaml -n simple
kubectl create -f istio-specs.yaml -n simple

查看istio-ingress的service的IP地址，通过istio-ingress的IP地址发送请求。

 可以看到请求返回了响应，说明整个路由转发成功发送到了后端服务。

案例二：再部署一个服务nginx，配置VirtualService根据不同URL转发到不同的后端服务的路有规则，VirtulaService中还设置了rewrite字段。Gateway与上面相同，还是expose出80端口即可。

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: simple
spec:
  gateways:
    - simple
  hosts:
    - simple.cncamp.io
  http:
  - match:
    - uri:
        exact: "/simple/hello"
    rewrite:
      uri: "/hello"
    route:
      - destination:
          host: simple.simple.svc.cluster.local
          port:
            number: 80
  - match:
    - uri:
        prefix: "/nginx"
    rewrite:
      uri: "/"
    route:
      - destination:
          host: nginx.simple.svc.cluster.local
          port:
            number: 80

 nginx应用部署的文件内容如下所示

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx
---
apiVersion: v1
kind: Service
metadata:
  name: nginx
spec:
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
  selector:
    app: nginx

执行下面的命令启动pod以及访问应用。

kubectl apply -f nginx.yaml -n simple
kubectl apply -f istio-specs.yaml -n simple
curl -H "Host: simple.cncamp.io" $INGRESS_IP/simple/hello
curl -H "Host: simple.cncamp.io" $INGRESS_IP/nginx

可以看到nginx和simple服务都访问成功。

案例三：上面都是http方式访问，如果要通过https访问，配置tls即可，Gateway中expose 443端口，并配置了tls，tls是一个secret，后面会通过命令生成这个secret。

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: httpsserver
spec:
  gateways:
    - httpsserver
  hosts:
    - httpsserver.cncamp.io
  http:
    - match:
        - port: 443
      route:
        - destination:
            host: httpserver.securesvc.svc.cluster.local
            port:
              number: 80
---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: httpsserver
spec:
  selector:
    istio: ingressgateway
  servers:
    - hosts:
        - httpsserver.cncamp.io
      port:
        name: https-default
        number: 443
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: cncamp-credential

后端服务httpserver的部署yaml文件内容如下所示。

apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpserver
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpserver
  template:
    metadata:
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "80"
      labels:
        app: httpserver
    spec:
      containers:
        - name: httpserver
          imagePullPolicy: Always
          image: cncamp/httpserver:v1.0-metrics
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: httpserver
spec:
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
  selector:
    app: httpserver

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=cncamp Inc./CN=*.cncamp.io' -keyout cncamp.io.key -out cncamp.io.crt
kubectl create -n istio-system secret tls cncamp-credential --key=cncamp.io.key --cert=cncamp.io.crt
kubectl apply -f istio-specs.yaml -n securesvc

通过openssl命令生成key和cert，通过kubectl create secret tls命令生成secret对象，通过https访问访问服务。

curl --resolve httpsserver.cncamp.io:443:$INGRESS_IP https://httpsserver.cncamp.io/healthz -v -k

可以看到访问成功，因为是https方式访问，故可以看到有TLS握手的过程。

 案例四：模拟金丝雀部署，将应用的两个版本同时部署上，配置路由到V1和V2的规则。 如果请求的header中包含jesse，则路有到V2版本，否则路有到V1版本。Destination中定义V1和V2.

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: canary
spec:
  hosts:
    - canary
  http:
    - match:
        - headers:
            user:
              exact: jesse
      route:
        - destination:
            host: canary
            subset: v2
    - route:
      - destination:
          host: canary
          subset: v1
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: canary
spec:
  host: canary
  trafficPolicy:
    loadBalancer:
      simple: RANDOM
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2
      trafficPolicy:
        loadBalancer:
          simple: ROUND_ROBIN

模拟的后端服务V1和V2版本，区分V1和V2应用主要是通过lables version进行区分的。

apiVersion: apps/v1
kind: Deployment
metadata:
  name: canary
spec:
  replicas: 1
  selector:
    matchLabels:
      app: canary
  template:
    metadata:
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "80"
      labels:
        app: canary
        version: v1
    spec:
      containers:
        - name: canary
          imagePullPolicy: Always
          image: cncamp/httpserver:v1.0-metrics
          ports:
            - containerPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: canary-v2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: canary
  template:
    metadata:
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "80"
      labels:
        app: canary
        version: v2
    spec:
      containers:
        - name: canary
          imagePullPolicy: Always
          image: cncamp/httpserver:v2.0-metrics
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: canary
spec:
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
  selector:
    app: canary

启动后端服务和生产VirtualService和DestinationRule。

kubectl apply -f canary.yaml -n canary
kubectl apply -f istio-specs.yaml -n canary

为了访问canary，这里再启动一个能执行linux命令的pod，toolbox。

apiVersion: apps/v1
kind: Deployment
metadata:
  name: toolbox
spec:
  replicas: 1
  selector:
    matchLabels:
      app: toolbox
  template:
    metadata:
      labels:
        app: toolbox
        access: "true"
    spec:
      containers:
        - name: toolbox
          image: centos
          command:
            - tail
            - -f
            - /dev/null

登录到toolbox中，通过curl命令(curl canary/hello -H "user: jesse")访问后端服务，如果header中有jesse字段值，那么就会访问到V2版本的服务，否则会访问V1版本的服务。执行结果如下所示

以上就是通过例子演示Istio中VirtualService、Gateway、DestinationRule的配置，从而完成流量管理。