本文内容基于 流量的熔断。
流量镜像
流量镜像,也称为影子流量,是一个以尽可能低的风险为生产带来变化的强大的功能。镜像会将实时流量的副本发送到镜像服务。镜像流量发生在主服务的关键请求路径之外。
- 恢复环境:
kubectl delete -f samples/httpbin/httpbin.yaml
kubectl delete -f samples/httpbin/networking/destination-rule-httpbin.yaml
kubectl delete -f samples/httpbin/sample-client/fortio-deploy.yaml
- 部署两个版本的
httpbin
服务,httpbin
服务已开启访问日志:
vim samples/httpbin/httpbin-deploy-v1.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: httpbin-v1
spec:
replicas: 1
selector:
matchLabels:
app: httpbin
version: v1
template:
metadata:
labels:
app: httpbin
version: v1
spec:
containers:
- image: docker.io/kennethreitz/httpbin
imagePullPolicy: IfNotPresent
name: httpbin
command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]
ports:
- containerPort: 80
vim samples/httpbin/httpbin-deploy-v2.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: httpbin-v2
spec:
replicas: 1
selector:
matchLabels:
app: httpbin
version: v2
template:
metadata:
labels:
app: httpbin
version: v2
spec:
containers:
- image: docker.io/kennethreitz/httpbin
imagePullPolicy: IfNotPresent
name: httpbin
command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]
ports:
- containerPort: 80
vim samples/httpbin/httpbin-svc.yaml
apiVersion: v1
kind: Service
metadata:
name: httpbin
labels:
app: httpbin
spec:
ports:
- name: http
port: 8000
targetPort: 80
selector:
app: httpbin
kubectl apply -f samples/httpbin/httpbin-deploy-v1.yaml
kubectl apply -f samples/httpbin/httpbin-deploy-v2.yaml
kubectl apply -f samples/httpbin/httpbin-svc.yaml
- 启动
sleep
服务,使用 curl 来提供负载:
vim samples/httpbin/sleep-deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: sleep
spec:
replicas: 1
selector:
matchLabels:
app: sleep
template:
metadata:
labels:
app: sleep
spec:
containers:
- name: sleep
image: tutum/curl
command: ["/bin/sleep","infinity"]
imagePullPolicy: IfNotPresent
kubectl apply -f samples/httpbin/sleep-deploy.yaml
- 创建默认路由策略:
默认情况下,Kubernetes 在 httpbin
服务的两个版本之间进行负载均衡。在此,把所有流量都路由到 v1。
如果 Istio 开启了 TLS 认证,在应用 DestinationRule 之前必须将 TLS 流量策略
mode: ISTIO_MUTUAL
添加到 DestinationRule。否则,请求将发生 503 错误。
- 创建一个默认路由规则,将所有流量路由到服务的 v1:
vim samples/httpbin/networking/destination-rule.yaml
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: httpbin
spec:
host: httpbin
subsets:
- name: v1
labels:
version: v1
- name: v2
labels:
version: v2
vim samples/httpbin/networking/virtual-service-v1.yaml
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: httpbin
spec:
hosts:
- httpbin
http:
- route:
- destination:
host: httpbin
subset: v1
weight: 100
kubectl apply -f samples/httpbin/networking/destination-rule.yaml
kubectl apply -f samples/httpbin/networking/virtual-service-v1.yaml
- 向服务发送一下流量:
export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
kubectl exec -it $SLEEP_POD -c sleep -- sh -c 'curl http://httpbin:8000/headers' | python -m json.tool
{
"headers": {
"Accept": "*/*",
"Content-Length": "0",
"Host": "httpbin:8000",
"User-Agent": "curl/7.35.0",
"X-B3-Parentspanid": "372facbd5b406888",
"X-B3-Sampled": "0",
"X-B3-Spanid": "e60d58ce6b12ec8d",
"X-B3-Traceid": "94127e32a64208bd372facbd5b406888",
"X-Envoy-Attempt-Count": "1",
"X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/default;Hash=4604a9f50d9b2ecbb94f71e00a73294408a0597af96f77ffba09c53377f4a925;Subject=\"\";URI=spiffe://cluster.local/ns/default/sa/default"
}
}
- 分别查看
httpbin
服务 v1 和 v2 两个Pod
的日志:
export V1_POD=$(kubectl get pod -l app=httpbin,version=v1 -o jsonpath={.items..metadata.name})
kubectl logs -f $V1_POD -c httpbin
127.0.0.1 - - [01/Mar/2021:06:29:37 +0000] "GET /headers HTTP/1.1" 200 553 "-" "curl/7.35.0"
export V2_POD=$(kubectl get pod -l app=httpbin,version=v2 -o jsonpath={.items..metadata.name})
kubectl logs -f $V2_POD -c httpbin
可以看到访问日志进入 v1,而 v2 中没有日志产生。
- 镜像流量到 v2:
- 改变流量规则将流量镜像到 v2:
vim samples/httpbin/networking/virtual-service-v1-mirror-v2.yaml
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: httpbin
spec:
hosts:
- httpbin
http:
- route:
- destination:
host: httpbin
subset: v1
weight: 100
mirror:
host: httpbin
subset: v2
mirror_percent: 100
kubectl apply -f samples/httpbin/networking/virtual-service-v1-mirror-v2.yaml
这个路由规则发送 100% 流量到 v1。最后一段表示将镜像流量到 httpbin:v2
服务。当流量被镜像时,请求将发送到镜像服务中,并在 headers
中的 Host/Authority
属性值上追加 -shadow
。例如 cluster-1
变为 cluster-1-shadow
。
需要重点注意的是,这些被镜像的流量是 即发即弃 的,就是说镜像请求的响应会被丢弃。
可以使用 mirror_percent
属性来设置镜像流量的百分比,而不是镜像全部请求。如果这个属性不存在,将镜像所有流量。
- 发送流量:
kubectl exec -it $SLEEP_POD -c sleep -- sh -c 'curl http://httpbin:8000/headers' | python -m json.tool
{
"headers": {
"Accept": "*/*",
"Content-Length": "0",
"Host": "httpbin:8000",
"User-Agent": "curl/7.35.0",
"X-B3-Parentspanid": "e1e80c46db19f77d",
"X-B3-Sampled": "0",
"X-B3-Spanid": "f978596e99f13e2b",
"X-B3-Traceid": "dc285fef04fa4e1ce1e80c46db19f77d",
"X-Envoy-Attempt-Count": "1",
"X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/default;Hash=4604a9f50d9b2ecbb94f71e00a73294408a0597af96f77ffba09c53377f4a925;Subject=\"\";URI=spiffe://cluster.local/ns/default/sa/default"
}
}
kubectl logs -f $V1_POD -c httpbin
127.0.0.1 - - [01/Mar/2021:06:29:37 +0000] "GET /headers HTTP/1.1" 200 553 "-" "curl/7.35.0"
127.0.0.1 - - [01/Mar/2021:06:53:49 +0000] "GET /headers HTTP/1.1" 200 553 "-" "curl/7.35.0"
kubectl logs -f $V2_POD -c httpbin
127.0.0.1 - - [01/Mar/2021:06:53:49 +0000] "GET /headers HTTP/1.1" 200 560 "-" "curl/7.35.0"
可以看到 v1 和 v2 中都有了访问日志。v2 中的访问日志就是由镜像流量产生的,这些请求的实际目标是 v1。