lstio

apiVersion: v1
kind: Namespace
metadata:
  name: kentxxq
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy-sidecar-configmap
  namespace: kentxxq
data:
  envoy.yaml: |
    admin:
      address:
        socket_address: { address: 0.0.0.0, port_value: 8001 }
    static_resources:
      listeners:
        name: listener
        address:
          socket_address: { address: 0.0.0.0, port_value: 8002 }
        filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: ingress_http
              codec_type: AUTO
              # 启用http代理的路由功能
              http_filters:
              - name: envoy.filters.http.router
                # 一定要设定该typed_config属性，否则提示无法找到router
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
              # 定制router配置
              route_config:
                name: tomcat_route
                virtual_hosts:
                - name: tomcat_web
                  domains: ["*"]
                  routes:
                  - match: { prefix: "/" }
                    route: { cluster: local_cluster }

      clusters:
      - name: local_cluster
        type: STATIC
        lb_policy: ROUND_ROBIN
        load_assignment:
          cluster_name: local_cluster
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address: { address: 127.0.0.1, port_value: 80 }    
---
apiVersion: v1
kind: Pod
metadata:
  name: tt-sidecar
  namespace: kentxxq
spec:
  containers:
  - image: kubernetes-register.sswang.com/mypro/envoy:v1.25.3
    name: envoysidecar
    env:
    - name: "ENVOY_UID"
      value: "0"
    - name: "ENVOY_GID"
      value: "0"
    volumeMounts:
    - name: envoyconf
      mountPath: /etc/envoy/
      readOnly: true
  - name: nginx-demo
    image: nginx:latest
  volumes:
  - name: envoyconf
    configMap:
      name: envoy-sidecar-configmap
      optional: false

1 基本环境状况
	istio构建于k8s集群之上，所有的请求都是基于k8s的apiserver组件来接收
2 接收请求
	当用户发起一个请求(通过namespace自动注入sidecar或者手工kube-inject注入sidecar)
3 流程执行
	Pilot 监听 kube-apiserver 的请求变化。
	发现k8s创建请求，并且发现namespace包含注入标签或者手工kube-inject注入sidecar
	istio通过CRD对象，经由kube-apiserver对pod进行属性修改，添加大量sidecar相关的属性信息
		- 扩充istio-init、istio-proxy等容器属性
	pod启动时候，kubelet 调用cri-服务创建容器服务
		- 首先启动istio-init初始化应用容器，设定大量的proxy代理需要的防火墙规则
		- 初始化容器使命结束后，结合大量启动参数，拉起istio-proxy容器(因为他们是同一个镜像)
		- istio-proxy容器内部的pilot-agent 进程从 Pilot中获取流量策略配置
		- pilot-agent 把获取的配置转换成Envoy识别的规则，然后通过启动参数，拉起Envoy服务
		- Envoy 作为sidecar，根据转换后的规则对pod内部的所有流量进行管控
		- 启动应用服务容器，受sidecar的流量策略监管。
4 数据聚合
	istio-proxy对多有的流量数据、日志数据、检测数据、遥测数据进行聚合
	所有的内部应用容器的检测通过istio-proxy上的15020进行检测
	pilot-agent与istio的pilot等组件实时同步相关信息

注意：
	关于istio-proxy和应用容器的启动顺序由配置文件内部的顺序决定
	但是应用容器的服务检测，必须通过istio-proxy检测后，才会向外表示正常

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: client
  name: client
  namespace: istio-traffic-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: client
  template:
    metadata:
      labels:
        app: client
    spec:
      containers:
      - image: busybox:v0.1
        name: client
        command: ["/bin/sh","-c","sleep 72000"]

apiVersion: v1
kind: Namespace
metadata:
  name: istio-traffic-test
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    server: httpd1
    app: web
  name: httpd1
  namespace: istio-traffic-test
spec:
  replicas: 1
  selector:
    matchLabels:
      server: httpd1
      app: web
  template:
    metadata:
      labels:
        server: httpd1
        app: web
    spec:
      containers:
      - image: busybox:v0.1
        name: httpd
        command: ["/bin/sh","-c","echo 'HTTP Web Page-1' > /var/www/index.html; httpd -f -p 8080 -h /var/www"]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    server: httpd2
    app: web
  name: httpd2
  namespace: istio-traffic-test
spec:
  replicas: 1
  selector:
    matchLabels:
      server: httpd2
      app: web
  template:
    metadata:
      labels:
        server: httpd2
        app: web
    spec:
      containers:
      - image: busybox:v0.1
        name: httpd
        command: ["/bin/sh","-c","echo 'HTTP Web Page-2' > /var/www/index.html; httpd -f -p 8080 -h /var/www"]
---
apiVersion: v1
kind: Service
metadata:
  name: httpd-1-svc
  namespace: istio-traffic-test
spec:
  selector:
    server: httpd1
  ports:
  - name: http
    port: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: httpd-2-svc
  namespace: istio-traffic-test
spec:
  selector:
    server: httpd2
  ports:
  - name: http
    port: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: web-svc
  namespace: istio-traffic-test
spec:
  selector:
    app: web
  ports:
  - name: http
    port: 8080

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: web-svc-vs
  namespace: istio-traffic-test
spec:
  hosts:
  - web-svc
  http:
  - route:
    - destination:
        host: httpd-1-svc
        port:
          number: 8080
      weight: 20
    - destination:
        host: httpd-2-svc
        port:
          number: 8080
      weight: 80

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:								# 元数据部分，包括VirtualServer的名称
  name: my-virtualserver
  namespace: default
spec:									# 定义VirtualServer的规则和配置
  hosts:								# 指定VirtualServer应用的主机名，可以是一个或多个
  - example.com							# 改地址必须能够被正常访问
  gateways:								# 指定VirtualServer关联的网关，可以是一个或多个
  - my-gateway
  http:									# 定义HTTP流量的路由规则
  - match:								# 指定匹配条件，
    - uri:								# 支持使用URI前缀匹配
        prefix: /path/to/url
    rewrite:							# 定义HTTP流量的路由重写规则
      uri: /
    route:								# 定义匹配条件满足时的路由目标
    - destination:						# 指定路由的目标服务
        host: api-service				# 指定目标服务的主机名，可以是k8s的service对象
        port:							# 指定目标服务的端口号
          number: 8080

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: traffic-route-rul
  namespace: istio-traffic-test
spec:
  hosts:
  - web-svc
  http:
  - match:
    - uri:
        prefix: /app1
    rewrite:
      uri: /
    route:
    - destination:
        host: httpd-1-svc
  - match:
    - uri:
        prefix: /app2
    rewrite:
      uri: /
    route:
    - destination:
        host: httpd-2-svc
  - route:
    - destination:
        host: xxx-svc

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:									# 元数据部分，包括 DestinationRule 的名称
  name: <destinationrule-name>
spec:										# 规范部分，定义 DestinationRule 的规则和配置
  host: <service-host>						# 指定目标服务的主机名
  trafficPolicy:							# 流量策略配置部分
    loadBalancer:							# 负载均衡器配置
      simple: <load-balancer-configuration>	# 指定负载均衡策略，ROUND_ROBIN（轮询）策略。
      										# 主要是本地级别、轮询级别、http级别
    connectionPool:							# 连接池配置
      http:									# 指定 HTTP 连接池配置。
        http1MaxPendingRequests: 100		# 每个连接允许的最大挂起请求数
        maxRequestsPerConnection: 5			# 指定每个连接的最大请求数。
    outlierDetection:						# 异常检测配置
      consecutiveErrors: 5					# 指定连续错误的阈值。
      interval: 5s							# 指定检测间隔时间。
      baseEjectionTime: 30s					# 指定从负载均衡中排除主机的基本时间。
      maxEjectionPercent: 50				# 指定最大排除比例。
  subsets:									# 服务端点集合,用于路由规则中的流量拆分
  - name: xxxx
    labels:									# 使用标签对服务注册表中的服务端点进行筛选
      version: v3
    trafficPolicy:
      loadBalancer:
        simple: ROUND_ROBIN					# 支持默认的轮询调度
        consistentHash:						# 支持基于http的相关属性调度。比如httpHeaderName等
          httpCookie:
            name: user

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: traffic-rule-subset
  namespace: istio-traffic-test
spec:
  host: web-svc
  subsets:
  - name: httpd1
    labels:
      server: httpd1
  - name: httpd2
    labels:
      server: httpd2 
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: traffic-route-subset
  namespace: istio-traffic-test
spec:
  hosts:
  - web-svc
  http:
  - route:
    - destination:
        host: web-svc
        subset: httpd1
      weight: 70
    - destination:
        host: web-svc
        subset: httpd2
      weight: 30

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: traffic-route-gw
  namespace: istio-traffic-test
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: traffic-route-subset
  namespace: istio-traffic-test
spec:
  host: "*"
  subsets:
  - name: httpd-1-svc
    labels:
      server: httpd1
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: traffic-route-vs
  namespace: istio-traffic-test
spec:
  hosts:
  - "*"
  gateways:
  - traffic-route-gw
  http:
  - route:
    - destination:
        host: web-svc
        subset: httpd-1-svc

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:							# 包含了 Sidecar 对象的名称和命名空间
  name: my-sidecar
  namespace: my-namespace
spec:								# 定义了 Sidecar 对象的规范
  workloadSelector:					# 指定了与 Sidecar 关联的工作负载的标签选择器
    labels:
      app: my-app
  outboundTrafficPolicy:			# 定义了 Sidecar 的出站流量策略
    mode: REGISTRY_ONLY				# REGISTRY_ONLY，表示只允许与服务注册表中的服务进行通信
  egress:							# 定义了 Sidecar 的出口规则，即允许的外部主机和端口
    - hosts:
        - example.com				# 当前命名空间的 example.com的 service
        - "./*"						# 当前命名空间下是所有Service
    	- "istio-system/*"			# 匹配istio-system命名空间下的所有Service
      ports:
        - port: 80
          protocol: HTTP
        - port: 443
          protocol: HTTPS
    - hosts:						# 其他的访问交给istio-haha命名空间的服务
      - "istio-haha/*"
  ingress:							# 定义了 Sidecar 的入口规则，即允许的入站流量来源和目标
    - from:
        - namespaceSelector:        # 允许来自启用 Istio 注入的命名空间的流量
            matchLabels:
              istio-injection: enabled
      port:							# 将其转发到端口号为 8080 的 HTTP 目标
        number: 8080
        protocol: HTTP
      defaultEndpoint: my-service.default.svc.cluster.local    # 默认端点