Kubernetes

Traefik Ingress

第一次用Traefik是在2019年，

它的结构图差不多是这样

直接上helm

helm repo add traefik https://helm.traefik.io/traefik
helm repo update
helm install traefik traefik/traefik

kubectl port-forward $(kubectl get pods --selector "app.kubernetes.io/name=traefik" --output=name) 9000:9000

可以用 hostport

nodeport

Ingressgateway添加多证书

先做一个清理

kubectl delete secret istio-ingressgateway-certs -n istio-system

准备 两套 证书

这里我用的两个域名是

• golang.press
• diynocap.com

kubectl create secret generic istio-ingressgateway-certs -n istio-system --from-file=diy-cert.pem --from-file=diy-key.pem --from-file=go-cert.pem --from-file=go-key.pem

修改 gateway

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: nginx-gateway
  namespace: lizhe
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 443
      name: https-diy
      protocol: HTTPS
    hosts:
    - "diynocap.com"
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/diy-cert.pem
      privateKey: /etc/istio/ingressgateway-certs/diy-key.pem
  - port:
      number: 443
      name: https-go
      protocol: HTTPS
    hosts:
    - "golang.press"
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/go-cert.pem
      privateKey: /etc/istio/ingressgateway-certs/go-key.pem

Ingressgateway添加证书

这里我用的域名是 diynocap.com 准备好证书

kubectl create -n istio-system secret tls istio-ingressgateway-certs --key private.key --cert cert.pem

然后修改 gateway

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: nginx-gateway
  namespace: lizhe
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "diynocap.com"
    - "diynocap2.com"
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key

需要设置对应的 hostport端口或者使用nodeport

对Ingress gateway的补充

Ingressgateway 人如其名，毕竟还是 ingress，那ingress是按照 URL 地址来匹配资源的，而且受 namespace 影响

如果把 Gateway 的 hosts 从 * 改成 地址，那么就只能用地址来访问了

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: nginx-gateway
  namespace: lizhe
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "diynocap.com"

当然要把 diynocap.com 指向对应的 IP地址

但是因为 服务是通过 nodeport 暴露的，所以提供的是 高位端口

如何使ingressgateway使用 80 端口呢？

当然可以使用 hostport

设置dns

故障重试

配置如下

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-default-v2
  namespace: lizhe
spec: 
  hosts:
  - nginx-service
  http:
  - match:
    - headers:
        ver: 
          exact: v2
    timeout: 3s
    retries:
      attempts: 3
    route: 
    - destination:
        host: nginx-service
        subset: v2
  - match:
    - headers:
        ver: 
          exact: v3
    redirect:
      uri: /index.html
  - route: 
    - destination: 
        host: nginx-service
        subset: v1
    timeout: 3s
    retries:
      attempts: 3

Timeout控制

为了避免按照程序本身的默认超时时间等待，可以加入 timeout

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-default-v2
  namespace: lizhe
spec: 
  hosts:
  - nginx-service
  http:
  - match:
    - headers:
        ver: 
          exact: v2
    timeout: 3s
    route: 
    - destination:
        host: nginx-service
        subset: v2
  - match:
    - headers:
        ver: 
          exact: v3
    redirect:
      uri: /index.html
  - route: 
    - destination: 
        host: nginx-service
        subset: v1
    timeout: 3s

URI重定向

还有另一种对目标路由的分流方式，根据URL进行重定向

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-default-v2
  namespace: lizhe
spec: 
  hosts:
  - nginx-service
  http:
  - match:
    - headers:
        ver: 
          exact: v2
    route: 
    - destination:
        host: nginx-service
        subset: v2
  - match:
    - headers:
        ver: 
          exact: v3
    redirect:
      uri: /index.html
  - route: 
    - destination: 
        host: nginx-service
        subset: v1

按来源服务分流

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-default-v2
  namespace: lizhe
spec: 
  hosts:
  - nginx-service
  http:
  - match:
    - sourceLabels:
        app: v2
    route: 
    - destination:
        host: nginx-service
        subset: v2
  - match:
    - sourceLabels:
        app: v3
    route: 
    - destination:
        host: nginx-service
        subset: v3
  - route: 
    - destination: 
        host: nginx-service
        subset: v1

然后我们给 nginx 打个label

然后去把label改成 v3

按Header分流

按照 HTTP Header 分流的一个重要好处就是可以固定某些用户在某些特定的版本上

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-default-v2
  namespace: lizhe
spec: 
  hosts:
  - nginx-service
  http:
  - match:
    - headers:
        ver: 
          exact: v2
    route: 
    - destination:
        host: nginx-service
        subset: v2
  - match:
    - headers:
        ver: 
          exact: v3
    route: 
    - destination:
        host: nginx-service
        subset: v3
  - route: 
    - destination: 
        host: nginx-service
        subset: v1

上面规则的 默认会将流量导入到 v1 ，如果 request header 中指定了版本，那么会导入到指定的版本

curl http://nginx-service/helloworld.html
curl http://nginx-service/helloworld.html -H 'ver:v2'
curl http://nginx-service/helloworld.html -H 'ver:v3'

按权重分流

我们修改之前的 VirtualService ， 添加一些权重

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-default-v2
  namespace: lizhe
spec: 
  hosts:
  - nginx-service
  http:
  - route: 
    - destination: 
        host: nginx-service
        subset: v1
      weight: 10
    - destination: 
        host: nginx-service
        subset: v2
      weight: 10
    - destination: 
        host: nginx-service
        subset: v3
      weight: 80

然后进行一下测试

for i in `seq 20`; do curl http://nginx-service/helloworld.html;echo "" ;done