镜像

此任务演示了Istio的流量镜像功能。

流量镜像,也称为阴影,是一个强大的概念,它使要素团队可以以最小的风险将更改引入生产。镜像会将实时流量的副本发送到镜像服务。镜像流量发生在主要服务的关键请求路径的带外。

在此任务中,您将首先强制所有流量流向v1测试服务。然后,您将应用规则将部分流量镜像到v2。

在你开始之前 按照安装指南中的说明设置Istio 。

首先,部署启用访问日志记录的两个版本的httpbin服务:

httpbin-v1:

$ cat <<EOF | istioctl kube-inject -f - | kubectl create -f - apiVersion: apps/v1 kind: Deployment metadata: name: httpbin-v1 spec: replicas: 1 selector: matchLabels: app: httpbin version: v1 template: metadata: labels: app: httpbin version: v1 spec: containers:

  • image: docker.io/kennethreitz/httpbin

    imagePullPolicy: IfNotPresent

    name: httpbin

    command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]

    ports:

    • containerPort: 80

      EOF

httpbin-v2:

$ cat <<EOF | istioctl kube-inject -f - | kubectl create -f - apiVersion: apps/v1 kind: Deployment metadata: name: httpbin-v2 spec: replicas: 1 selector: matchLabels: app: httpbin version: v2 template: metadata: labels: app: httpbin version: v2 spec: containers:

  • image: docker.io/kennethreitz/httpbin

    imagePullPolicy: IfNotPresent

    name: httpbin

    command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]

    ports:

    • containerPort: 80

      EOF

httpbin Kubernetes服务:

$ kubectl create -f - <<EOF apiVersion: v1 kind: Service metadata: name: httpbin labels: app: httpbin spec: ports:

  • name: http

    port: 8000

    targetPort: 80

    selector:

    app: httpbin

    EOF

启动sleep服务,以便您可以curl用来提供负载:

睡眠服务:

$ cat <<EOF | istioctl kube-inject -f - | kubectl create -f - apiVersion: apps/v1 kind: Deployment metadata: name: sleep spec: replicas: 1 selector: matchLabels: app: sleep template: metadata: labels: app: sleep spec: containers:

  • name: sleep

    image: tutum/curl

    command: ["/bin/sleep","infinity"]

    imagePullPolicy: IfNotPresent

    EOF

创建默认路由策略 默认情况下,两个httpbin服务版本之间的Kubernetes负载均衡。在此步骤中,您将更改该行为,以便所有流量都转到v1。

创建默认路由规则以将所有流量路由到v1服务:

$ kubectl apply -f - <<EOF apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: httpbin spec: hosts:

  • httpbin

    http:

    • route:

  • destination:

    host: httpbin

    subset: v1

    weight: 100

apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: httpbin spec: host: httpbin subsets:

  • name: v1

    labels:

    version: v1

  • name: v2

    labels:

    version: v2

    EOF

现在,所有流量都流向该httpbin:v1服务。

向服务发送一些流量:

$ export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) $ kubectl exec "${SLEEP_POD}" -c sleep -- curl -s http://httpbin:8000/headers { "headers": { "Accept": "/", "Content-Length": "0", "Host": "httpbin:8000", "User-Agent": "curl/7.35.0", "X-B3-Parentspanid": "57784f8bff90ae0b", "X-B3-Sampled": "1", "X-B3-Spanid": "3289ae7257c3f159", "X-B3-Traceid": "b56eebd279a76f0b57784f8bff90ae0b", "X-Envoy-Attempt-Count": "1", "X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/default;Hash=20afebed6da091c850264cc751b8c9306abac02993f80bdb76282237422bd098;Subject=\"\";URI=spiffe://cluster.local/ns/default/sa/default" } }

检查日志v1和v2对的httpbin pod。您应该看到访问日志条目,v1而没有v2:

$ export V1_POD=$(kubectl get pod -l app=httpbin,version=v1 -o jsonpath={.items..metadata.name}) $ kubectl logs "$V1_POD" -c httpbin 127.0.0.1 - - [07/Mar/2018:19:02:43 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"

$ export V2_POD=$(kubectl get pod -l app=httpbin,version=v2 -o jsonpath={.items..metadata.name}) $ kubectl logs "$V2_POD" -c httpbin

将流量镜像到v2 更改路由规则以将流量镜像到v2:

$ kubectl apply -f - <<EOF apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: httpbin spec: hosts:

  • httpbin

    http:

    • route:

  • destination:

    host: httpbin

    subset: v1

    weight: 100

    mirror:

    host: httpbin

    subset: v2

    mirror_percent: 100

    EOF

此路由规则将100％的流量发送到v1。最后一个节指定您要镜像到httpbin:v2服务。当流量被镜像时,请求将通过其Host/Authority标头附加到来发送到镜像服务-shadow。例如,cluster-1变为cluster-1-shadow。

同样,重要的是要注意,这些请求被镜像为"即发即弃",这意味着响应被丢弃了。

您可以使用该mirror_percent字段来镜像一部分流量,而不是镜像所有请求。如果不存在此字段,则为了与旧版本兼容,将对所有流量进行镜像。

发送流量:

$ kubectl exec "${SLEEP_POD}" -c sleep -- curl -s http://httpbin:8000/headers

现在,你应该看到两者的访问日志记录v1和v2。在其中创建的访问日志v2是实际要发送的镜像请求v1。

$ kubectl logs "$V1_POD" -c httpbin 127.0.0.1 - - [07/Mar/2018:19:02:43 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0" 127.0.0.1 - - [07/Mar/2018:19:26:44 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"

$ kubectl logs "$V2_POD" -c httpbin 127.0.0.1 - - [07/Mar/2018:19:26:44 +0000] "GET /headers HTTP/1.1" 200 361 "-" "curl/7.35.0"

打扫干净 删除规则:

$ kubectl delete virtualservice httpbin $ kubectl delete destinationrule httpbin

关闭httpbin服务和客户端:

$ kubectl delete deploy httpbin-v1 httpbin-v2 sleep $ kubectl delete svc httpbin

Previous熔断Nextingress

Last updated