Installation and configuration of Istio
# Delete the old ingresskubectl delete-f nginx-ingress.yaml and create the gateway service vi nginx-web-gateway.yamlapiVersion: networking.istio.io/v1alpha3kind: Gatewaymetadata: name: nginx-web-gateway namespace: defaultspec: selector: istio: ingressgateway # use Istio default gateway implementation servers:-port: number: 80 name: web protocol: HTTP hosts:-"nginx.xxxx.com"-apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata: name: nginx -web namespace: defaultspec: hosts:-"nginx.xxxx.com" gateways:-nginx-web-gateway http:-match:-port: 80 route:-destination: host: nginx weight: 100Murray # backend forwarding load balancer # refer to https://istio.io/zh/docs/reference/config/istio.networking.v1alpha3/apiVersion: networking.istio.io/v1alpha3kind: DestinationRulemetadata: name: nginx-ratings Namespace: defaultspec: host: nginx trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s# execute kubectl apply-f nginx-web-gateway.yaml# to see if you can access [root@] ~] # kubectl get pod-o wide-n istio-system | grep istio-ingressgatewayistio-ingressgateway-54cf955579-227qt 1max 1 Running 0 21h 10.65. 5.52 node03 # host bind IP10.65.5.52 nginx.xxxx.com# to check whether the browser is open
# it can be opened normally # the service cannot be accessed yet. Modify the nginx Ingress to enable the service to provide services # modify the namespace annotations: kubernetes.io/ingress.class: traefik traefik.frontend.rule.type: PathPrefixStripspec: rules:-host: nginx.xxxx.com http: paths: where the istio gateway is located: Ingressvi nginx-ingress.yamlapiVersion: extensions/v1beta1kind: Ingressmetadata: name: istio-system #: -path: / backend: serviceName: istio-ingressgateway # now the service becomes the istio gateway service servicePort: 8 delete just bound host direct dns resolution access
Normal Ingressnginx log 192.168.20.94-[10/Sep/2019:16:02:20 + 0800] nginx.xxxx.com "GET / HTTP/1.1" 3040 "" Mozilla/5.0 (Windows NT 10.0; Win64; x64) Rv:69.0) Gecko/20100101 Firefox/69.0 "" 192.168.20.94192.168.30.35 "127.0.0.1 ups_add: ups_resp_time: request_time: 0.000 ups_status: request_body: upstream_response_length [] # istio-ingressgateway Service Log [2019-09-11T09:30:30.820Z]" GET / HTTP/1.1 "304 -" 000 0 "192.168.20.94192.168.30.35" Mozilla/5.0 (Windows NT 10.0 Win64 X64) AppleWebKit/537.36 (KHTML Like Gecko) Chrome/76.0.3809.132 Safari/537.36 "" 34555d82-f202-4ae0-8896-f87105c562e1 "nginx.xxxx.com"10.65.5.30 Gatewaymetadata 80" outbound | 80 | | nginx.default.svc.xxxx.local-10.65.5.52 4ae0 80 192.168.30.35 4ae0 46178-istio-ingressgateway can be configured with multiple domain names apiVersion: networking.istio.io/v1alpha3kind: Gatewaymetadata: name: zentao-web-gateway namespace: zentaospec: selector: istio : ingressgateway # use Istio default gateway implementation servers:-port: number: 80 name: http protocol: HTTP hosts:-"zentao.xxxx.com"-apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata: name: zentao-web namespace: zentaospec: hosts:-"zentao.xxxx.com" gateways:-zentao-web-gateway http:-match:-port: 80 route:-destination: host: zentao Weight: 100---apiVersion: networking.istio.io/v1alpha3kind: DestinationRulemetadata: name: zentao-ratings namespace: zentaospec: host: zentao trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s# Ingress apiVersion: extensions/v1beta1kind: Ingressmetadata: name: zentao namespace: istio-system annotations: kubernetes.io/ingress.class: traefik traefik.frontend.rule.type: PathPrefixStripspec: rules:-host: zentao .xxxx.com http: paths:-path: / backend: serviceName: istio-ingressgateway servicePort: 8 Port non-80 services # proxy nginx metrics Monitoring apiVersion: networking.istio.io/v1alpha3kind: Gatewaymetadata: name: metrics-gateway namespace: defaultspec: selector: istio: ingressgateway # use Istio default gateway implementation servers:-port: number: 30080 name: http-metrics Protocol: HTTP hosts:-"*"-- apiVersion: networking.istio.io/v1alpha3kind: VirtualServicemetadata: name: defaultspec: hosts:-"*" gateways:-metrics-gateway http:-match:-port: 30080 route:-destination: host: nginx port: number: 9913 weight: 10 check whether gateway pod 30080 port is listening [root@] ~] # kubectl get pod-o wide-n istio-system | grep istio-ingressgatewayistio-ingressgateway-54cf955579-227qt 1 Running 0 21h 10.65.5.52 node03 # enter kubectl exec [root @] ~] # kubectl exec-ti istio-ingressgateway-54cf955579-227qt / bin/bash-n istio-systemroot@istio-ingressgateway-54cf955579-227qt:/# netstat-tnlpActive Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program nametcp 00 127.0.0.1 LISTEN 98/envoytcp 15000 0.0.0.0 LISTEN 98/envoytcp 00 0.0.0.0 LISTEN 98/envoytcp 00 0.0.0.0 0.0.0.0LISTEN 1/pilot-agent#30080 * LISTEN 98/envoytcp 00 0.0.0.0LISTEN 1/pilot-agent#30080 15090 0.0.0.0LISTEN 1/pilot-agent#30080 port has been listening Ip: Port access http://10.65.5.52:30080/metrics
Ability to access istio-ingressgateway print log [2019-09-11T09:43:42.947Z] "GET / favicon.ico HTTP/1.1" 200-"0152 11" 192.168.20.94 "" Mozilla/5.0 (Windows NT 10.0; Win64 X64) AppleWebKit/537.36 (KHTML Like Gecko) Chrome/76.0.3809.132 Safari/537.36 "" 1c2b2699-6167-4b9f-ba7a-4071216dc742 "10.65.5.52 4b9f-ba7a-4071216dc742 30080"10.65.6.216 istio-ingressgateway service 9913" outbound | 9913 | | nginx.default.svc.xxxx.local-10.65.5.52 1c2b2699 30080 192.168.20.94 IP 63024-so that you can use haproxy + dns to provide tcp services if you use ClusterIP, you must modify istio-ingressgateway service to expose IP. For daemonset deployment, it is best to use hostNetwork: true so that TCP agents can directly hostip access proxy ports instead of Ingress direct external access # istio-1.2.5/samples as an example can be tested to do canary release cleanup istiohelm uninstall istio--namespace istio-systemhelm uninstall istio-init-namespace istio-systemhelm uninstall istio-cni-namespace istio-systemkubectl delete ns istio-system
