Kubernetes Archives - Page 17 of 25

12 May 2021 Wednesday

Istio http流量管理

在Kubernetes中 service 和 Deployment 或者其他负载的关系通常是一对一的，
而在Istio中，Service经常会对应不同的 Deployment。

Istio 主要通过 DestinationRule 和 VirtualService 来实现该功能，可以简单理解成将原始的 Kubernetes service 拆成了两个单独的部分

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-default-v2
  namespace: lizhe
spec: 
  hosts:
  - nginx-service //（Kubernetes service name）
  http:
  - route: 
    - destination: 
        host: nginx-service
        subset: v2

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: nginx-desrule 
  namespace: lizhe
spec: 
  host: nginx-service //（Kubernetes service name）
  subsets:
  - name: v1 
    labels: 
      version: v1
  - name: v2
    labels: 
      version: v2
  - name: v3
    labels: 
      version: v3

多个 host 的例子

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
  - reviews
  gateways:
  - bookinfo-gateway
  - mesh
  http:
  - match:
    - headers:
        end-user:
          exact: jason
    route:
    - destination:
        host: reviews
        subset: v2
  - route:
    - destination:
        host: reviews
        subset: v3

By studyk8s 0 Comments

12 May 2021 Wednesday

Kubectl port-forward

先创建一个测试用的nginx

以往的情况，如果要测试的话，可能需要一个 nodeport ，但是这里要介绍的是 kubectl port-forward

kubectl get pod -n test
kubectl -n test port-forward nginxtest-567f8d7d65-5snfq 82:80

当然也可以通过label来获取 pod id

kubectl -n test get pod -l workload.user.cattle.io/workloadselector -o jsonpath='{.items[0].metadata.name}'

这样命令可以改为

kubectl -n test port-forward $(kubectl -n test get pod -l workload.user.cattle.io/workloadselector -o jsonpath='{.items[0].metadata.name}') 82:80

By studyk8s 0 Comments

11 May 2021 Tuesday

Kiali配置

要手动安装 Kiali 请参考Kiali helm安装

同时你还需要安装 prometheus、grafana 和 jaeger

最终目标是让 Kiali 能正确查询流量

完整的配置

auth:
  openid: {}
  openshift:
    client_id_prefix: kiali
  strategy: anonymous
deployment:
  accessible_namespaces:
  - '**'
  additional_service_yaml: {}
  affinity:
    node: {}
    pod: {}
    pod_anti: {}
  custom_dashboards:
    excludes:
    - ""
    includes:
    - '*'
  hpa:
    api_version: autoscaling/v2beta2
    spec: {}
  image_pull_policy: Always
  image_pull_secrets: []
  ingress_enabled: false
  logger:
    log_format: text
    log_level: info
    sampler_rate: "1"
    time_field_format: 2006-01-02T15:04:05Z07:00
  namespace: istio-system
  node_selector: {}
  override_ingress_yaml:
    metadata: {}
  pod_annotations: {}
  pod_labels: {}
  priority_class_name: ""
  replicas: 1
  repository: rancher/mirrored-kiali-kiali
  resources: {}
  secret_name: kiali
  service_annotations: {}
  service_type: ""
  tag: v1.32.0
  tolerations: []
  version_label: v1.32.0
  view_only_mode: false
enabled: true
external_services:
  custom_dashboards:
    enabled: true
  grafana:
    in_cluster_url: http://grafana.grafana.svc:80
    url: http://grafana.grafana.svc:80
  prometheus:
    custom_metrics_url: http://pro.prometheus.svc:9090
    url: http://pro.prometheus.svc:9090
  tracing:
    in_cluster_url: http://tracing.istio-system.svc:16686/jaeger
global:
  cattle:
    clusterId: local
    clusterName: local
    rkePathPrefix: ""
    rkeWindowsPathPrefix: ""
    systemDefaultRegistry: ""
    url: https://krancher.com
  defaultPodDisruptionBudget:
    enabled: true
  proxy:
    repository: rancher/mirrored-istio-proxyv2
    tag: 1.9.3
  proxy_init:
    repository: rancher/mirrored-istio-proxyv2
    tag: 1.9.3
  rbac:
    pspEnabled: false
  systemDefaultRegistry: ""
identity:
  cert_file: ""
  private_key_file: ""
istio_namespace: istio-system
login_token:
  signing_key: sc5QF1IE4Q3X1zF6
server:
  metrics_enabled: true
  metrics_port: 9090
  port: 20001
  web_root: /kiali
web_root_override: true

其中重点是

  grafana:
    in_cluster_url: http://grafana.grafana.svc:80
    url: http://grafana.grafana.svc:80
  prometheus:
    custom_metrics_url: http://pro.prometheus.svc:9090
    url: http://pro.prometheus.svc:9090
  tracing:
    in_cluster_url: http://tracing.istio-system.svc:16686/jaeger

grafana 地址实际上就是控制台地址

prometheus 地址也是控制台地址

jaeger 地址也是控制台地址

By studyk8s 0 Comments

10 May 2021 Monday

Istio ingressgateway

参考主页 https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/

Ingress Gateway在逻辑上相当于边缘网络的一个负载均衡器，用于接收和处理网络边缘出栈和入栈的网络连接，其中包含开放端口和 TLS的配置内容

Kubernetes 使用Ingress来处理外部进入集群的流量（南北流量）
使用Istio网关时，使用的是 Gateway 和 VirtualServices 资源来控制入口流量。在网格内部不需要Gateways，可以使用内部dns来相互访问。

vsgateway.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-default-v2-gw
  namespace: lizhe
spec:
  hosts:
  - "*"
  gateways:
  - nginx-gateway
  http:
  - match:
    - uri:
        prefix: /helloworld.html
    route:
    - destination:
        port:
          number: 80
        host: nginx-service
        subset: v2

gw.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: nginx-gateway
  namespace: lizhe
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"

http://192.168.194.173:31380/helloworld.html

By studyk8s 0 Comments

10 May 2021 Monday

Istio helloworld

创建3个dep

depv1.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: versionv1
  namespace: lizhe
spec: 
  replicas: 1
  selector:
    matchLabels:
      app: nginx
      version: v1
  template:
    metadata:
      labels:
        app: nginx
        version: v1
    spec: 
      containers:
      - name: versionv1
        image: libaibai/version:v1
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80
          name: http
          protocol: TCP

depv2.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: versionv2
  namespace: lizhe
spec: 
  replicas: 1
  selector:
    matchLabels:
      app: nginx
      version: v2
  template:
    metadata:
      labels:
        app: nginx
        version: v2
    spec: 
      containers:
      - name: versionv2
        image: libaibai/version:v2
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80
          name: http
          protocol: TCP

depv3.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: versionv3
  namespace: lizhe
spec: 
  replicas: 1
  selector:
    matchLabels:
      app: nginx
      version: v3
  template:
    metadata:
      labels:
        app: nginx
        version: v3
    spec: 
      containers:
      - name: versionv3
        image: libaibai/version:v3
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80
          name: http
          protocol: TCP

svc.yaml

apiVersion: v1
kind: Service
metadata:
  name: nginx-service
  namespace: lizhe
  labels:
    app: nginx
spec:
  ports:
  - port: 80
    name: http
  selector:
    app: nginx

为了测试我会在这里再启动一个 nginx

需要特别注意的是，这个nginx也需要注入istio，否则无法以 nginx-service 做为路径, 你可能已经注意到了，这里不是使用的标准 Kubernetes DNS格式

然后我们试着把流量单独导向 v2

dr.yaml

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: nginx-desrule 
  namespace: lizhe
spec: 
  host: nginx-service
  subsets:
  - name: v1 
    labels: 
      version: v1
  - name: v2
    labels: 
      version: v2
  - name: v3
    labels: 
      version: v3

vs.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-default-v2
  namespace: lizhe
spec: 
  hosts:
  - nginx-service
  http:
  - route: 
    - destination: 
        host: nginx-service
        subset: v2

Istio已用新的Gateway和VirtualServices资源替换了熟悉的Ingress资源。它们协同工作，将流量路由到网格中。在网格内部，不需要Gateway，因为服务可以通过集群本地服务名称相互访问。

By studyk8s 0 Comments

09 May 2021 Sunday

Istioctl dashboard kiali

./istioctl dashboard kiali

http://localhost:20001/kiali

By studyk8s 0 Comments

09 May 2021 Sunday

Istioctl 安装

下载

curl -L https://istio.io/downloadIstio | sh -

By studyk8s 0 Comments

09 May 2021 Sunday

Kiali helm安装

helm install \
  --namespace istio-system \
  --set auth.strategy="anonymous" \
  --repo https://kiali.org/helm-charts \
  kiali-server \
  kiali-server

By studyk8s 0 Comments

09 May 2021 Sunday

Istio rancher app 安装

直接截图了，这种是最简单的了

  prometheus:
    custom_metrics_url: http://rancher-monitoring-prometheus.cattle-monitoring-system.svc:9090
    url: http://rancher-monitoring-prometheus.cattle-monitoring-system.svc:9090

上面的默认连接和我用app安装的prometheus位置不一样，所以需要替换上面两个连接

用nodeport

http://192.168.194.173:31194/

用clusterip

http://10.43.140.39:9090

  prometheus:
    custom_metrics_url: http://pro.prometheus.svc:9090
    url: http://pro.prometheus.svc:9090

By studyk8s 0 Comments

08 May 2021 Saturday

Longhorn on RKE2/K3s

使用rke1的情况，不需要特殊的配置，不过rke2和k3s比较容易出现诡异的问题

首先是 longhorn-driver-deployer 不能正确启动，会不断的重启

参考 https://longhorn.io/docs/1.0.0/advanced-resources/os-distro-specific/csi-on-k3s/

发现似乎是 –kubelet-root-dir 的问题

检查 kubelet 启动参数

发现 RKE2 下使用的 kubelet root 路径是 /var/lib/kubelet

然后正常启动，不过在初始化 mysql 之类的应用时，即使可以正确创建并加载了PV，也会出现无法mount的错误，提示 csi 有问题，这里需要确保正确初始化了 csi，参考以下截图

By studyk8s 0 Comments

Kubernetes

Send a Message