用istioctl看istio生成的envoy xds配置（一）

首先理解envoy配置需要理解listener，router，cluster，endpoint这些概念，对应lds，rds，cds，eds统称xds。
本文使用istio自带的bookinfo sample来展示底层envoy具体的配置情况

第一部分文章展示两种情况：

1. namespace启用默认注入sidecar的istio配置情况
2. 仅部署一个gateway指向内部原生kube服务的情况

默认注入sidecar，没有配置istio规则的情况

启用默认注入，部署bookinfo

kubectl label namespace default istio-injection=enabled
kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml

此时没应用任何istio规则，但是所有被注入的pod已经都处于istio管理下

# istioctl proxy-status
NAME                                                  CLUSTER        CDS        LDS        EDS        RDS          ECDS         ISTIOD                      VERSION
details-v1-7d88846999-6t7f5.default                   Kubernetes     SYNCED     SYNCED     SYNCED     SYNCED       NOT SENT     istiod-7cd55d9dc4-pw4x4     1.15.0
istio-egressgateway-775cf5d9b5-h24dz.istio-system     Kubernetes     SYNCED     SYNCED     SYNCED     NOT SENT     NOT SENT     istiod-7cd55d9dc4-pw4x4     1.15.0
istio-ingressgateway-ffbcc4c7f-9rw9j.istio-system     Kubernetes     SYNCED     SYNCED     SYNCED     NOT SENT     NOT SENT     istiod-7cd55d9dc4-pw4x4     1.15.0
productpage-v1-5f578dd9b7-kxbq2.default               Kubernetes     SYNCED     SYNCED     SYNCED     SYNCED       NOT SENT     istiod-7cd55d9dc4-pw4x4     1.15.0
ratings-v1-754f9c4975-gbzrn.default                   Kubernetes     SYNCED     SYNCED     SYNCED     SYNCED       NOT SENT     istiod-7cd55d9dc4-pw4x4     1.15.0
reviews-v1-69865ff55-vw54r.default                    Kubernetes     SYNCED     SYNCED     SYNCED     SYNCED       NOT SENT     istiod-7cd55d9dc4-pw4x4     1.15.0
reviews-v2-789d584fbf-jd6rp.default                   Kubernetes     SYNCED     SYNCED     SYNCED     SYNCED       NOT SENT     istiod-7cd55d9dc4-pw4x4     1.15.0
reviews-v3-64f8b69f99-9rhhm.default                   Kubernetes     SYNCED     SYNCED     SYNCED     SYNCED       NOT SENT     istiod-7cd55d9dc4-pw4x4     1.15.0

查看gateway，没有任何gateway规则存在

# istioctl proxy-config listeners istio-ingressgateway-ffbcc4c7f-9rw9j.istio-system
ADDRESS PORT  MATCH DESTINATION
0.0.0.0 15021 ALL   Inline Route: /healthz/ready*
0.0.0.0 15090 ALL   Inline Route: /stats/prometheus*

查看其中一个服务，都是kube svc的对应产生的规则

# istioctl proxy-config listeners productpage-v1-5f578dd9b7-kxbq2.default
ADDRESS        PORT  MATCH                                                                                           DESTINATION
172.16.255.227 53    ALL                                                                                             Cluster: outbound|53||kube-dns.kube-system.svc.cluster.local
0.0.0.0        80    Trans: raw_buffer; App: http/1.1,h2c                                                            Route: 80
0.0.0.0        80    ALL                                                                                             PassthroughCluster
172.16.255.89  80    Trans: raw_buffer; App: http/1.1,h2c                                                            Route: gateway.istio-ingress.svc.cluster.local:80
172.16.255.89  80    ALL                                                                                             Cluster: outbound|80||gateway.istio-ingress.svc.cluster.local
172.16.252.1   443   ALL                                                                                             Cluster: outbound|443||kubernetes.default.svc.cluster.local
172.16.252.27  443   ALL                                                                                             Cluster: outbound|443||istiod.istio-system.svc.cluster.local
172.16.252.94  443   Trans: raw_buffer; App: http/1.1,h2c                                                            Route: hpa-metrics-service.kube-system.svc.cluster.local:443
部分省略…………

随机查看其中一个服务productpage，已经有了根据kube Service生成的默认routes

# istioctl proxy-config routes productpage-v1-5f578dd9b7-kxbq2.default -o json
            {
                "name": "reviews.default.svc.cluster.local:9080",
                "domains": [
                    "reviews.default.svc.cluster.local",
                    "reviews.default.svc.cluster.local:9080",
                    "reviews",
                    "reviews:9080",
                    "reviews.default.svc",
                    "reviews.default.svc:9080",
                    "reviews.default",
                    "reviews.default:9080",
                    "172.16.255.33",
                    "172.16.255.33:9080"
                ],
                "routes": [
                    {
                        "name": "default",
                        "match": {
                            "prefix": "/"
                        },
                        "route": {
                            "cluster": "outbound|9080||reviews.default.svc.cluster.local",
部分省略…………
                        "decorator": {
                            "operation": "reviews.default.svc.cluster.local:9080/*"

应用一个Gateway和VirtualService的情况

首先创建一个bookinfo对应的Gateway暴露80端口，然后创建一个VirtualService指向productpage

注意此时没有创建DestinationRule，productpage指向的是原理就有的kube service

# kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "*"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage
        port:
          number: 9080

这时可以看到VirtualService规则都转化成了envoy routes

# istioctl proxy-config routes istio-ingressgateway-ffbcc4c7f-9rw9j.istio-system --name  http.8080
NAME          DOMAINS     MATCH                 VIRTUAL SERVICE
http.8080     *           /productpage          bookinfo.default
http.8080     *           /static*              bookinfo.default
http.8080     *           /login                bookinfo.default
http.8080     *           /logout               bookinfo.default
http.8080     *           /api/v1/products*     bookinfo.default

继续查看详细信息，这里只截取其中/productpage部分，

可以看到metadata.filterMetadata.istio里有对应的istio配置项

“config”: “/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/bookinfo”

这样方便核查某条规则对应生产的配置是否正确

# istioctl proxy-config routes istio-ingressgateway-ffbcc4c7f-9rw9j.istio-system --name  http.8080 -o yaml
      match:
        caseSensitive: true
        path: /productpage
      metadata:
        filterMetadata:
          istio:
            config: /apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/bookinfo
      route:
        cluster: outbound|9080||productpage.default.svc.cluster.local
        maxStreamDuration:
          grpcTimeoutHeaderMax: 0s
          maxStreamDuration: 0s
        retryPolicy:
          hostSelectionRetryMaxAttempts: "5"
          numRetries: 2
          retriableStatusCodes:
          - 503
          retryHostPredicate:
          - name: envoy.retry_host_predicates.previous_hosts
            typedConfig:
              '@type': type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate
          retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes
        timeout: 0s
    - decorator:
        operation: productpage.default.svc.cluster.local:9080/static*
部分省略…………

继续查看route对应的cluster

# istioctl proxy-config clusters istio-ingressgateway-ffbcc4c7f-9rw9j.istio-system --fqdn productpage.default.svc.cluster.local  
SERVICE FQDN                              PORT     SUBSET     DIRECTION     TYPE     DESTINATION RULE
productpage.default.svc.cluster.local     9080     -          outbound      EDS  

详细版本

# istioctl proxy-config clusters istio-ingressgateway-ffbcc4c7f-9rw9j.istio-system --fqdn productpage.default.svc.cluster.local  -o json
部分省略…………
        "name": "outbound|9080||productpage.default.svc.cluster.local",
        "type": "EDS",
        "edsClusterConfig": {
            "edsConfig": {
                "ads": {},
                "initialFetchTimeout": "0s",
                "resourceApiVersion": "V3"
            },
            "serviceName": "outbound|9080||productpage.default.svc.cluster.local"
        },
部分省略…………

最后是对应的endpoints

# istioctl proxy-config endpoints istio-ingressgateway-ffbcc4c7f-9rw9j.istio-system --cluster "outbound|9080||productpage.default.svc.cluster.local"
ENDPOINT             STATUS      OUTLIER CHECK     CLUSTER
172.16.0.15:9080     HEALTHY     OK                outbound|9080||productpage.default.svc.cluster.local

详细版本可以用一下命令

# istioctl proxy-config endpoints istio-ingressgateway-ffbcc4c7f-9rw9j.istio-system --cluster "outbound|9080||productpage.default.svc.cluster.local" -o yaml
全部省略…………

小结

从上面的例子可以看出，istio提取了所有相关的kube Service并转化成自己的envoy规则