首页 > 系统相关 >为Nginx服务添加ServiceEntry和workloadEntry对象，治理目标为网格外部服务的出向流量

为Nginx服务添加ServiceEntry和workloadEntry对象，治理目标为网格外部服务的出向流量

时间：2022-08-23 17:58:18浏览次数：79  
标签：ServiceEntry nginx com magedu Nginx master workloadEntry k8s root

测试在网格内部访问网格外部服务

我是开了三台云主机每台都安装下docker和docker-compose

第一台

[root@VM-0-12-centos ~]# cat Deploy-Nginx/docker-compose.yml 
version: '3.3'

services:
  nginx2001:
    image: nginx:1.20-alpine
    volumes:
      - ./html/nginx2001:/usr/share/nginx/html/
    networks:
      envoymesh:
        ipv4_address: 172.31.201.11
        aliases:
        - nginx
    expose:
      - "80"
    ports:
      - "10.0.0.12:8091:80"

networks:
  envoymesh:
    driver: bridge
    ipam:
      config:
        - subnet: 172.31.201.0/24

[root@VM-0-12-centos ~]# cat Deploy-Nginx/html/nginx2001/index.html 
<title>nginx.magedu.com</title>
Nginx 2001 ~~

第二台

[root@VM-0-6-centos ~]# cat Deploy-Nginx/docker-compose.yml 
version: '3.3'

services:
  nginx2002:
    image: nginx:1.20-alpine
    volumes:
      - ./html/nginx2002:/usr/share/nginx/html/
    networks:
      envoymesh:
        ipv4_address: 172.31.201.12
        aliases:
        - nginx
    expose:
      - "80"
    ports:
      - "10.0.0.6:8091:80"

networks:
  envoymesh:
    driver: bridge
    ipam:
      config:
        - subnet: 172.31.201.0/24
[root@VM-0-6-centos ~]# cat Deploy-Nginx/html/nginx2002/index.html 
<title>nginx.magedu.com</title>
Nginx 2002 ~~

第三台

[root@VM-0-14-centos ~]# cat Deploy-Nginx/docker-compose.yml 
version: '3.3'

services:
  nginx2101:
    image: nginx:1.21-alpine
    volumes:
      - ./html/nginx2101:/usr/share/nginx/html/
    networks:
      envoymesh:
        ipv4_address: 172.31.201.13
        aliases:
        - nginx
        - canary
    expose:
      - "80"
    ports:
      - "10.0.0.14:8091:80"

networks:
  envoymesh:
    driver: bridge
    ipam:
      config:
        - subnet: 172.31.201.0/24
[root@VM-0-14-centos ~]# cat Deploy-Nginx/html/nginx2101/index.html 
<title>nginx.magedu.com</title>
Nginx 2101 ~~

三台都执行下docker-compose up，启动之后curl访问下有没有问题

docker-compose up -d

进入sleep使用curl访问外部服务，使用while循环访问

[root@k8s-master ~]# kubectl exec -it sleep-698cfc4445-dvx5n  -- /bin/sh
/ $ curl 1.13.251.235:8091
<title>nginx.magedu.com</title>
Nginx 2101 ~~
/ $ curl 175.27.156.219:8091
<title>nginx.magedu.com</title>
Nginx 2002 ~~
/ $ curl 1.13.169.203:8091
<title>nginx.magedu.com</title>
Nginx 2001 ~~
while true; do curl curl 1.13.251.235:8091; sleep 1; done

打开kiali，可以看到流量

将外部的服务引入到网格内部

[root@k8s-master 01-Service-Entry]# kubectl apply -f 01-serviceentry-nginx.yaml 
serviceentry.networking.istio.io/nginx-external created
[root@k8s-master 01-Service-Entry]# cat 01-serviceentry-nginx.yaml 
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: nginx-external
spec:
  hosts:
  - nginx.magedu.com
  addresses:
  - "1.13.169.203"
  - "175.27.156.219"
  - "1.13.251.235"
  ports:
  - number: 8091
    name: http
    protocol: HTTP
  location: MESH_EXTERNAL
  resolution: STATIC
  endpoints:
  - address: "1.13.169.203"
    ports:
      http: 8091
  - address: "175.27.156.219"
    ports:
      http: 8091
  - address: "1.13.251.235"
    ports:
      http: 8091

看下有没有生成listener

[root@k8s-master 01-Service-Entry]# istioctl pc listeners sleep-698cfc4445-dvx5n

[root@k8s-master 01-Service-Entry]# istioctl pc cluster sleep-698cfc4445-dvx5n

[root@k8s-master 01-Service-Entry]# istioctl pc endpoint sleep-698cfc4445-dvx5n

再次使用sleep访问外部nginx查看协议没有变成http

创建一个pod加一个解析

[root@k8s-master ~]# kubectl run client-$RANDOM --image ikubernetes/admin-box:v1.2 --restart=Never -it --command -- /bin/bash
root@client-25390 /# vi /etc/hosts
1.13.169.203 nginx.magedu.com
root@client-25390 /# while true; do curl nginx.magedu.com:8091; sleep 1 ;done

可以看到三台都可以访问到

 

这时我们就可以使用destinationrule和virtualservices

[root@k8s-master 01-Service-Entry]# cat 02-destinationrule-nginx.yaml 
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: nginx-external
spec:
  host: nginx.magedu.com
  trafficPolicy:
    loadBalancer:
      consistentHash:
        httpHeaderName: X-User
    connectionPool:
      tcp:
        maxConnections: 10000
        connectTimeout: 10ms
        tcpKeepalive:
          time: 7200s
          interval: 75s
      http:
        http2MaxRequests: 1000
        maxRequestsPerConnection: 10
    outlierDetection:
      maxEjectionPercent: 50
      consecutive5xxErrors: 5
      interval: 2m
      baseEjectionTime: 1m
      minHealthPercent: 40
[root@k8s-master 01-Service-Entry]# cat 03-virtualservice-nginx.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: nginx-external
spec:
  hosts:
  - nginx.magedu.com
  http:
  - name: falut-injection
    match:
    - headers:
        X-Testing:
          exact: "true"
    route:
    - destination:
        host: nginx.magedu.com
    fault:
      delay:
        percentage:
          value: 5
        fixedDelay: 2s
      abort:
        percentage:
          value: 5
        httpStatus: 555
  - name: nginx-external
    route:
    - destination:
        host: nginx.magedu.com
[root@k8s-master 02-Workload-Entry]# kubectl apply -f 01-workloadentry-nginx.yaml
[root@k8s-master 02-Workload-Entry]# kubectl apply -f 02-serviceentry-nginx.yaml 
[root@k8s-master 02-Workload-Entry]# cat 01-workloadentry-nginx.yaml 
apiVersion: networking.istio.io/v1beta1
kind: WorkloadEntry
metadata:
  name: workload-nginx2001
  labels:
    version: v1.20
spec:
  address: "1.13.169.203"
  ports:
    http: 8091
  labels:
    app: nginx
    version: v1.20
    instance-id: Nginx2001
---
apiVersion: networking.istio.io/v1beta1
kind: WorkloadEntry
metadata:
  name: workload-nginx2002
  labels:
    version: v1.20
spec:
  address: "175.27.156.219"
  ports:
    http: 8091
  labels:
    app: nginx
    version: v1.20
    instance-id: Nginx2002
---
[root@k8s-master 02-Workload-Entry]# cat 02-serviceentry-nginx.yaml 
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: nginx-external
spec:
  hosts:
  - nginx.magedu.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
    targetPort: 8091
  location: MESH_EXTERNAL
  resolution: STATIC
  workloadSelector:
    labels:
      app: nginx
[root@k8s-master 02-Workload-Entry]# kubectl get workloadentry
NAME                 AGE     ADDRESS
workload-nginx2001   3m31s   172.29.1.201
workload-nginx2002   3m31s   172.29.1.202
[root@k8s-master 02-Workload-Entry]# kubectl get workloadentry --show-labels
NAME                 AGE     ADDRESS        LABELS
workload-nginx2001   4m15s   172.29.1.201   version=v1.20
workload-nginx2002   4m15s   172.29.1.202   version=v1.20

将网格外部的端点引入到网格内部

也可以单独配置destinationrule和virtualservice

[root@k8s-master 02-Workload-Entry]# cat 03-destinationrule-nginx.yaml 
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: nginx-external
spec:
  host: nginx.magedu.com
  trafficPolicy:
    loadBalancer:
      simple: RANDOM
    connectionPool:
      tcp:
        maxConnections: 10000
        connectTimeout: 10ms
        tcpKeepalive:
          time: 7200s
          interval: 75s
      http:
        http2MaxRequests: 1000
        maxRequestsPerConnection: 10
    outlierDetection:
      maxEjectionPercent: 50
      consecutive5xxErrors: 5
      interval: 2m
      baseEjectionTime: 1m
      minHealthPercent: 40
[root@k8s-master 02-Workload-Entry]# cat 04-virtualservice-nginx.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: nginx-external
spec:
  hosts:
  - nginx.magedu.com
  http:
  - name: falut-injection
    route:
    - destination:
        host: nginx.magedu.com
    fault:
      delay:
        percentage:
          value: 5
        fixedDelay: 2s
      abort:
        percentage:
          value: 5
        httpStatus: 555

 

标签：ServiceEntry,nginx,com,magedu,Nginx,master,workloadEntry,k8s,root
From： https://www.cnblogs.com/zyyang1993/p/16617264.html

相关文章

  • nginx做正向代理和反向代理的区别
    虽然正向代理服务器和反向代理服务器所处的位置都是客户端和真实服务器之间，所做的事情也都是把客户端的请求转发给服务器，再把服务器的响应转发给客户端，但是二者之间还是有......
  • 【docker】nginx-rtmp搭建RTMP服务器
    1、dockerhubhttps://hub.docker.com/r/alfg/nginx-rtmp/ 2、安装dockerpullalfg/nginx-rtmpdockerrun-it-p1935:1935-p8080:80--rmnginx-rtmp测试......
  • Docker之Nginx保姆级别安装
    Docker之Nginx保姆级别安装：如果觉得样式不好：跳转即可 http://www.lifengying.site/（md文件复制过来有些样式会不一样）学英语网站项目：自己先保证Redis、Nginx、RabbitMQ、E......
  • Docker 拉取Nginx镜像 和运行
    Docker镜像拉取dockerpull[OPTIONS]NAME[:TAG|@DIGEST]镜像拉取命令OPTIONS说明：-a:拉取所有tagged镜像--disable-conten......
  • 【Nginx】Nginx常用命令
    ./nginx  #启动nginx：进入usr/local/nginx/sbin目录，执行 sudosystemctlstartnginx.service#启动nginxsudosystemctlenablenginx.service #设置开机自动运......
  • nginx: [error] invalid PID number "" in "/usr/local/nginx/logs/nginx.pid"
    第一步：查询ps-ef|grepnginx第二步：杀进程kill-QUITPID第三步:启动/usr/local/nginx/sbin/nginx-c/usr/local/nginx/conf/nginx.conf ......
  • 在Nginx或Tengine服务器上安装证书
    以下文章来源于官网文档20220822亲测我这里开始都配置好了始终无法访问,最后排查是安全组没有配置对,我的esc服务器没有加到安全组,所以443一直无法访问    ......
  • nginx 搭建下包平台
    安装依赖yum-yinstallgccgcc-c++automakezlibzlib-devel\opensslopenssl–develpcrepcre-devel下载解压部署包tar-xvfnginx-1.22.0.tar.gz-C/usr/l......
  • linux中查找nginx指定时间范围内的日志信息
    需求：在nginx中过滤出凌晨3:18-6:36的日志信息1、使用sed方式过滤注意：此方式开始和结束时间必须要在日志中真实存在，否则会匹配不到内容或匹配到末尾sed-n'/2022:03:18......
  • Nginx的反向代理（二）
    参考博客：https://www.cnblogs.com/ysocean/p/9392908.html使用 nginx反向代理 127.0.0.1:8090直接跳转到127.0.0.1:80配置nginx的配置文件nginx.conf  效果就是......

赞助商

阅读排行

网站主页关于我们联系我们网站地图

本网站内容转载自其他媒体，侵权联系[admin##ips99.com]。

Copyright © 2020-2023 IPS99 版权所有 IPS99