> For the complete documentation index, see [llms.txt](https://rocdu.gitbook.io/deep-understanding-of-istio/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rocdu.gitbook.io/deep-understanding-of-istio/4/5/5-7.md).

# 镜像

此任务演示了Istio的流量镜像功能。

流量镜像,也称为阴影,是一个强大的概念,它使要素团队可以以最小的风险将更改引入生产。镜像会将实时流量的副本发送到镜像服务。镜像流量发生在主要服务的关键请求路径的带外。

在此任务中,您将首先强制所有流量流向v1测试服务。然后,您将应用规则将部分流量镜像到v2。

在你开始之前 按照安装指南中的说明设置Istio 。

首先,部署启用访问日志记录的两个版本的httpbin服务:

httpbin-v1:

$ cat <\<EOF | istioctl kube-inject -f - | kubectl create -f - apiVersion: apps/v1 kind: Deployment metadata: name: httpbin-v1 spec: replicas: 1 selector: matchLabels: app: httpbin version: v1 template: metadata: labels: app: httpbin version: v1 spec: containers:

* image: docker.io/kennethreitz/httpbin

  imagePullPolicy: IfNotPresent

  name: httpbin

  command: \["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]

  ports:

  * containerPort: 80

    EOF

httpbin-v2:

$ cat <\<EOF | istioctl kube-inject -f - | kubectl create -f - apiVersion: apps/v1 kind: Deployment metadata: name: httpbin-v2 spec: replicas: 1 selector: matchLabels: app: httpbin version: v2 template: metadata: labels: app: httpbin version: v2 spec: containers:

* image: docker.io/kennethreitz/httpbin

  imagePullPolicy: IfNotPresent

  name: httpbin

  command: \["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]

  ports:

  * containerPort: 80

    EOF

httpbin Kubernetes服务:

$ kubectl create -f - <\<EOF apiVersion: v1 kind: Service metadata: name: httpbin labels: app: httpbin spec: ports:

* name: http

  port: 8000

  targetPort: 80

  selector:

  app: httpbin

  EOF

启动sleep服务,以便您可以curl用来提供负载:

睡眠服务:

$ cat <\<EOF | istioctl kube-inject -f - | kubectl create -f - apiVersion: apps/v1 kind: Deployment metadata: name: sleep spec: replicas: 1 selector: matchLabels: app: sleep template: metadata: labels: app: sleep spec: containers:

* name: sleep

  image: tutum/curl

  command: \["/bin/sleep","infinity"]

  imagePullPolicy: IfNotPresent

  EOF

创建默认路由策略 默认情况下,两个httpbin服务版本之间的Kubernetes负载均衡。在此步骤中,您将更改该行为,以便所有流量都转到v1。

创建默认路由规则以将所有流量路由到v1服务:

$ kubectl apply -f - <\<EOF apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: httpbin spec: hosts:

* httpbin

  http:

  * route:
* destination:

  &#x20; host: httpbin

  &#x20; subset: v1

  weight: 100

apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: httpbin spec: host: httpbin subsets:

* name: v1

  labels:

  &#x20; version: v1
* name: v2

  labels:

  &#x20; version: v2

  EOF

现在,所有流量都流向该httpbin:v1服务。

向服务发送一些流量:

$ export SLEEP\_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) $ kubectl exec "${SLEEP\_POD}" -c sleep -- curl -s <http://httpbin:8000/headers> { "headers": { "Accept": "*/*", "Content-Length": "0", "Host": "httpbin:8000", "User-Agent": "curl/7.35.0", "X-B3-Parentspanid": "57784f8bff90ae0b", "X-B3-Sampled": "1", "X-B3-Spanid": "3289ae7257c3f159", "X-B3-Traceid": "b56eebd279a76f0b57784f8bff90ae0b", "X-Envoy-Attempt-Count": "1", "X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/default;Hash=20afebed6da091c850264cc751b8c9306abac02993f80bdb76282237422bd098;Subject=\\"\\";URI=spiffe://cluster.local/ns/default/sa/default" } }

检查日志v1和v2对的httpbin pod。您应该看到访问日志条目,v1而没有v2:

$ export V1\_POD=$(kubectl get pod -l app=httpbin,version=v1 -o jsonpath={.items..metadata.name}) $ kubectl logs "$V1\_POD" -c httpbin 127.0.0.1 - - \[07/Mar/2018:19:02:43 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"

$ export V2\_POD=$(kubectl get pod -l app=httpbin,version=v2 -o jsonpath={.items..metadata.name}) $ kubectl logs "$V2\_POD" -c httpbin

将流量镜像到v2 更改路由规则以将流量镜像到v2:

$ kubectl apply -f - <\<EOF apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: httpbin spec: hosts:

* httpbin

  http:

  * route:
* destination:

  &#x20; host: httpbin

  &#x20; subset: v1

  weight: 100

  mirror:

  host: httpbin

  subset: v2

  mirror\_percent: 100

  EOF

此路由规则将100％的流量发送到v1。最后一个节指定您要镜像到httpbin:v2服务。当流量被镜像时,请求将通过其Host/Authority标头附加到来发送到镜像服务-shadow。例如,cluster-1变为cluster-1-shadow。

同样,重要的是要注意,这些请求被镜像为"即发即弃",这意味着响应被丢弃了。

您可以使用该mirror\_percent字段来镜像一部分流量,而不是镜像所有请求。如果不存在此字段,则为了与旧版本兼容,将对所有流量进行镜像。

发送流量:

$ kubectl exec "${SLEEP\_POD}" -c sleep -- curl -s <http://httpbin:8000/headers>

现在,你应该看到两者的访问日志记录v1和v2。在其中创建的访问日志v2是实际要发送的镜像请求v1。

$ kubectl logs "$V1\_POD" -c httpbin 127.0.0.1 - - \[07/Mar/2018:19:02:43 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0" 127.0.0.1 - - \[07/Mar/2018:19:26:44 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"

$ kubectl logs "$V2\_POD" -c httpbin 127.0.0.1 - - \[07/Mar/2018:19:26:44 +0000] "GET /headers HTTP/1.1" 200 361 "-" "curl/7.35.0"

打扫干净 删除规则:

$ kubectl delete virtualservice httpbin $ kubectl delete destinationrule httpbin

关闭httpbin服务和客户端:

$ kubectl delete deploy httpbin-v1 httpbin-v2 sleep $ kubectl delete svc httpbin