istio-code

客户端 sleep.yaml

apiVersion: v1
kind: Service
metadata:
  name: sleep
  labels:
    app: sleep
    version: v1
spec:
  selector:
    app: sleep
    version: v1
  ports:
    - name: ssh
      port: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sleep
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sleep
      version: v1
  template:
    metadata:
      labels:
        app: sleep
        version: v1
    spec:
      containers:
      - name: sleep
        image: dustise/sleep
        imagePullPolicy: IfNotPresent

服务端 flaskapp.yaml

apiVersion: v1
kind: Service
metadata:
  name: flaskapp
  labels:
    app: flaskapp
spec:
  selector:
    app: flaskapp
  ports:
    - name: http
      port: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: flaskapp-v1
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: flaskapp
      version: v1
  template:
    metadata:
      labels:
        app: flaskapp
        version: v1
    spec:
      containers:
      - name: flaskapp
        image: dustise/flaskapp
        imagePullPolicy: IfNotPresent
        env:
        - name: version
          value: v1
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: flaskapp-v2
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: flaskapp
      version: v2
  template:
    metadata:
      labels:
        app: flaskapp
        version: v2
    spec:
      containers:
      - name: flaskapp
        image: dustise/flaskapp
        imagePullPolicy: IfNotPresent
        env:
        - name: version
          value: v2

目标规则

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: flaskapp
spec:
  host: flaskapp
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

路由规则

只有v2

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: flaskapp-default-v2
spec:
  hosts:
  - flaskapp
  http:
  - route:
    - destination:
        host: flaskapp
        subset: v2

路由拆分按权重

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: flaskapp
spec:
  hosts:
  - flaskapp.default.svc.cluster.local
  http:
  - route:
    - destination:
        host: flaskapp.default.svc.cluster.local
        subset: v2
      weight: 50
    - destination:
        host: flaskapp.default.svc.cluster.local
        subset: v1
      weight: 50

金丝雀部署

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: flaskapp
spec:
  hosts:
  - flaskapp.default.svc.cluster.local
  http:
  - match:
    - headers:
        lab:
          exact: canary
    route:
    - destination:
        host: flaskapp.default.svc.cluster.local
        subset: v2
  - route:
    - destination:
        host: flaskapp.default.svc.cluster.local
        subset: v1

根据服务来源路由

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: flaskapp
spec:
  hosts:
  - flaskapp.default.svc.cluster.local
  http:
  - match:
    - sourceLabels:
        app: sleep
        version: v1
    route:
    - destination:
        host: flaskapp.default.svc.cluster.local
        subset: v1
  - route:
    - destination:
        host: flaskapp.default.svc.cluster.local
        subset: v2

超时重试

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.default.svc.cluster.local
  http:
  - timeout: 3s
    route:
    - destination:
        host: httpbin.default.svc.cluster.local

故障重试

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.default.svc.cluster.local
  http:
  - route:
    - destination:
        host: httpbin.default.svc.cluster.local
    retries:
      attempts: 3

黑白名单

根据label进行区分

apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
  name: code-7
spec:
  compiledAdapter: denier
  params:
    status:
      code: 7
      message: Not allowed
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: palce-holder
spec:
  compiledTemplate: checknothing
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: deny-sleep-v1-to-httpbin
spec:
  match: destination.labels["app"] == "httpbin" && source.labels["app"]== "sleep" && source.labels["version"] == "v1"
  actions:
  - handler: code-7
    instances: [ palce-holder ]

根据名单列表进行区分

apiVersion: config.istio.io/v1alpha2
kind: handler
metadata:
  name: whitelist
spec:
  compiledAdapter: listchecker
  params:
    overrides: [ "v2"]  # overrides provide a static list
    blacklist: false
---
apiVersion: config.istio.io/v1alpha2
kind: instance
metadata:
  name: appversion
spec:
  compiledTemplate: listentry
  params:
    value: source.labels["version"]
---
apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: checkversion
spec:
  match: destination.labels["app"] == "httpbin"
  actions:
  - handler: whitelist
    instances: [ appversion ]

memQuota限流

apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
  name: quotahandler
spec:
  compiledAdapter: memquota
  params:
    quotas:
    - name: requestcountquota.instance.default
      maxAmount: 20
      validDuration: 1s
      overrides:
      - dimensions:
          destination: httpbin
        maxAmount: 1
        validDuration: 5s


---

apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: requestcountquota
spec:
  compiledTemplate: quota
  params:
    dimensions:
      destination: destination.labels["app"] | destination.service.name | "unknown"
---


apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: quota
spec:
  actions:
  - handler: quotahandler
    instances:
    - requestcountquota

---

apiVersion: config.istio.io/v1alpha2
kind: QuotaSpec
metadata:
  name: request-count
spec:
  rules:
  - quotas:
    - charge: 500
      quota: requestcountquota

---

apiVersion: config.istio.io/v1alpha2
kind: QuotaSpecBinding
metadata:
  name: spec-sleep
spec:
  quotaSpecs:
  - name: request-count
  namespace: default
  services:
  - name: httpbin
  namespace: default

redis 限流

apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
  name: quotahandler
spec:
  compiledAdapter: memquota
  params:
    quotas:
    - name: requestcountquota.instance.default
      maxAmount: 20
      validDuration: 1s
      overrides:
      - dimensions:
          destination: httpbin
        maxAmount: 1
        validDuration: 5s
---

apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
  name: redishandler
spec:
  compiledAdapter: redisquota
  params:
    redisServerUrl: redis:6379
    connectionPoolSize: 10
    quotas:
    - name: requestcountquota.instance.default
      maxAmount: 20
      validDuration: 10s
      bucketDuration: 1s
      rateLimitAlgorithm: ROLLING_WINDOW
      overrides:
      - dimensions:
          destination: httpbin
        maxAmount: 1
---

apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
  name: requestcountquota
spec:
  compiledTemplate: quota
  params:
    dimensions:
      destination: destination.labels["app"] | destination.service.name | "unknown"
---


apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: quota
spec:
  actions:
  - handler: quotahandler
    instances:
    - requestcountquota

---

apiVersion: config.istio.io/v1alpha2
kind: QuotaSpec
metadata:
  name: request-count
spec:
  rules:
  - quotas:
    - charge: 500
      quota: requestcountquota

---

apiVersion: config.istio.io/v1alpha2
kind: QuotaSpecBinding
metadata:
  name: spec-sleep
spec:
  quotaSpecs:
  - name: request-count
  namespace: default
  services:
  - name: httpbin
  namespace: default
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis
spec:
  replicas: 1
  selector:
    matchLabels:
      name: redis
  template:
    metadata:
      labels:
        name: redis
    spec:
      containers:
      - name: redis
        image: redis
        ports:
        - containerPort: 6379
---
apiVersion: v1
kind: Service
metadata:
  name: redis
  labels:
    name: redis
spec:
  ports:
  - port: 6379
    targetPort: 6379
  selector:
    name: redis