首页 > 其他分享 >Istio egress gateway

Istio egress gateway

时间：2022-11-01 16:59:24浏览次数：54  
标签：networking istio 192.168 Istio nginx egress TCP io gateway

Egress Gateway逻辑示意图

Egress Gateway 配置要点

  • 各Sidecar Envoy上访问特定外部主机的流量，要路由至Egress Gateway

  • Egress Gateway要将相应的流量路由至相应的外部目标

服务说明

  • 在网格外部运行有nginx服务，有两个实例

    • Nginx2001：监听地址为 172.29.1.201:8091，Nginx版本为1.20

    • Nginx2002：监听地址为 172.29.1.202:8091，Nginx版本为1.20

    • Nginx2101：监听地址为 172.29.1.203:8091，Nginx版本为1.21

  • 网格内部default名称空间中的pods/client作为客户端访问该服务

主机设置

添加IP地址

~# ip addr add 192.168.174.130/16 dev ens33
~# ip addr add 192.168.174.131/16 dev ens33
~# ip addr add 192.168.174.132/16 dev ens33

查看IP地址

~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq state UP group default qlen 1000
    link/ether 00:0c:29:35:d9:64 brd ff:ff:ff:ff:ff:ff
    inet 192.168.174.121/24 brd 192.168.174.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet 192.168.174.130/16 scope global ens33
       valid_lft forever preferred_lft forever
    inet 192.168.174.131/16 scope global secondary ens33
       valid_lft forever preferred_lft forever
    inet 192.168.174.132/16 scope global secondary ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe35:d964/64 scope link 
       valid_lft forever preferred_lft forever

部署nginx

docker-compose.yml

version: '3.3'

services:
  nginx2001:
    image: nginx:1.20-alpine
    volumes:
      - ./html/nginx2001:/usr/share/nginx/html/
    networks:
      envoymesh:
        ipv4_address: 172.31.201.11
        aliases:
        - nginx
    expose:
      - "80"
    ports:
      - "192.168.174.130:8091:80"

  nginx2002:
    image: nginx:1.20-alpine
    volumes:
      - ./html/nginx2002:/usr/share/nginx/html/
    networks:
      envoymesh:
        ipv4_address: 172.31.201.12
        aliases:
        - nginx
    expose:
      - "80"
    ports:
      - "192.168.174.131:8091:80"

  nginx2101:
    image: nginx:1.21-alpine
    volumes:
      - ./html/nginx2101:/usr/share/nginx/html/
    networks:
      envoymesh:
        ipv4_address: 172.31.201.13
        aliases:
        - nginx
        - canary
    expose:
      - "80"
    ports:
      - "192.168.174.132:8091:80"

networks:
  envoymesh:
    driver: bridge
    ipam:
      config:
        - subnet: 172.31.201.0/24

运行nginx

# docker-compose up -d
[+] Running 4/4
 ⠿ Network wgs_envoymesh      Created                                                                                                                 0.1s
 ⠿ Container wgs-nginx2101-1  Started                                                                                                                 1.5s
 ⠿ Container wgs-nginx2001-1  Started                                                                                                                 1.6s
 ⠿ Container wgs-nginx2002-1  Started

访问nginx

~# curl 192.168.174.130:8091
nginx 2001
~# curl 192.168.174.131:8091
nginx 2002
~# curl 192.168.174.132:8091
nginx 2101

部署client

创建client

~# kubectl run client --image=ikubernetes/admin-box -it --rm --restart=Never --command -- /bin/sh
If you don't see a command prompt, try pressing enter.
root@client #

添加域名解析

root@client # echo "192.168.174.130 nginx.wgs.com" >> /etc/hosts

访问nginx

root@client # while true;do curl nginx.wgs.com:8091; sleep 0.$RANDOM;done
nginx 2001
nginx 2001
nginx 2001

workloadentry

workloadentry-nginx.yaml

apiVersion: networking.istio.io/v1beta1
kind: WorkloadEntry
metadata:
  name: workload-nginx2001
spec:
  address: "192.168.174.130"
  ports:
    http: 8091
  labels:
    app: nginx
    version: "v1.20"
    instance-id: Nginx2001
---
apiVersion: networking.istio.io/v1beta1
kind: WorkloadEntry
metadata:
  name: workload-nginx2002
spec:
  address: "192.168.174.131"
  ports:
    http: 8091
  labels:
    app: nginx
    version: "v1.20"
    instance-id: Nginx2002
---
apiVersion: networking.istio.io/v1beta1
kind: WorkloadEntry
metadata:
  name: workload-nginx2101
spec:
  address: "192.168.174.132"
  ports:
    http: 8091
  labels:
    app: nginx
    version: "v1.21"
    instance-id: Nginx2101
---

创建workloadentry资源

# kubectl apply -f workloadentry-nginx.yaml 
workloadentry.networking.istio.io/workload-nginx2001 created
workloadentry.networking.istio.io/workload-nginx2002 created
workloadentry.networking.istio.io/workload-nginx2101 created

查看workloadentry资源

# kubectl get we
NAME                 AGE   ADDRESS
workload-nginx2001   47s   192.168.174.130
workload-nginx2002   47s   192.168.174.131
workload-nginx2101   47s   192.168.174.132

serviceentry

serviceentry-nginx.yaml

---
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: nginx
spec:
  hosts:
  - nginx.wgs.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  location: MESH_EXTERNAL
  resolution: STATIC
  workloadSelector:
    labels:
      app: nginx
---

创建ServiceEntry资源

# kubectl apply -f serviceentry-nginx.yaml 
serviceentry.networking.istio.io/nginx-external created

查看ServiceEntry资源

# kubectl get se
NAME             HOSTS               LOCATION        RESOLUTION   AGE
nginx-external   ["nginx.wgs.com"]   MESH_EXTERNAL   STATIC       34s

egress gateway

查看egress gateway svc

# kubectl get svc -n istio-system 
NAME                   TYPE           CLUSTER-IP       EXTERNAL-IP       PORT(S)                                                                      AGE
grafana                ClusterIP      10.100.162.68    <none>            3000/TCP                                                                     6d5h
istio-egressgateway    ClusterIP      10.100.121.95    <none>            80/TCP,443/TCP # egress gateway                                                              11d
istio-ingressgateway   LoadBalancer   10.100.145.112   192.168.174.109   15021:32417/TCP,80:46683/TCP,443:37652/TCP,31400:59146/TCP,15443:30622/TCP   11d
istiod                 ClusterIP      10.100.149.76    <none>            15010/TCP,15012/TCP,443/TCP,15014/TCP                                        11d
jaeger-collector       ClusterIP      10.100.126.122   <none>            14268/TCP,14250/TCP,9411/TCP                                                 6d5h
kiali                  ClusterIP      10.100.238.145   <none>            20001/TCP,9090/TCP                                                           6d5h
prometheus             ClusterIP      10.100.250.207   <none>            9090/TCP                                                                     6d5h
tracing                ClusterIP      10.100.178.135   <none>            80/TCP,16685/TCP                                                             6d5h
zipkin                 ClusterIP      10.100.119.139   <none>            9411/TCP                                                                     6d5h

gateway-egress.yaml

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: egress
  namespace: istio-system
spec:
  selector:
    app: istio-egressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"

创建egress gateway资源

# kubectl apply -f gateway-egress.yaml 
gateway.networking.istio.io/egress created

查看egress gateway资源

# kubectl get gw -n istio-system 
NAME            AGE
egress          91s

高级流量治理-子集

destinationrule-nginx.yaml

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: nginx-external
spec:
  host: nginx.wgs.com
  trafficPolicy:
    loadBalancer:
      simple: RANDOM
    connectionPool:
      tcp:
        maxConnections: 10000
        connectTimeout: 10ms
        tcpKeepalive:
          time: 7200s
          interval: 75s
      http:
        http2MaxRequests: 1000
        maxRequestsPerConnection: 10
    outlierDetection:
      maxEjectionPercent: 50
      consecutive5xxErrors: 5
      interval: 2m
      baseEjectionTime: 1m
      minHealthPercent: 40
  subsets:
  - name: v20
    labels:
      version: "v1.20"
  - name: v21
    labels:
      version: "v1.21"
---

virtualservice-wegit-based-routing.yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: nginx-external
spec:
  hosts:
  - nginx.wgs.com
  gateways:
  - istio-system/egress
  - mesh
  http:
  - match:
    - gateways:
      - mesh
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
  - match:
    - gateways:
      - istio-system/egress
    route:
    - destination:
        host: nginx.wgs.com
        subset: v21
      weight: 5
    - destination:
        host: nginx.wgs.com
        subset: v20
      weight: 95

创建资源

# kubectl apply -f destinationrule-subsets.yaml -f virtualservice-wegit-based-routing.yaml 
destinationrule.networking.istio.io/nginx-external created
virtualservice.networking.istio.io/nginx-external created

访问nginx

root@client # while true;do curl  nginx.wgs.com; sleep 0.$RANDOM;done
nginx 2002
nginx 2002
nginx 2001
nginx 2002
nginx 2002
nginx 2001
nginx 2001
nginx 2101
nginx 2001
nginx 2001
nginx 2001
nginx 2101
nginx 2001

查看kiali

参考文档

https://istio.io/latest/docs/reference/config/networking/gateway/

标签：networking,istio,192.168,Istio,nginx,egress,TCP,io,gateway
From： https://www.cnblogs.com/wangguishe/p/16848062.html

相关文章

  • Istio workloadEntry实例
    服务说明在网格外部运行有nginx服务，有两个实例Nginx2001：监听地址为172.29.1.201:8091，Nginx版本为1.20Nginx2002：监听地址为172.29.1.202:8091，Nginx版本为1.20N......
  • Istio ServiceEntry实例
    服务说明在网格外部运行有nginx服务，有两个实例Nginx2001：监听地址为172.29.1.201:8091，Nginx版本为1.20Nginx2002：监听地址为172.29.1.202:8091，Nginx版本为1.20N......
  • Istio 流量拦截
    Sidecar代理方式简介Kubernetes平台上，EnvoySidecar容器与application容器于同一个Pod中共存，它们共享NETWORK、UTS和IPC等名称空间，因此也共用同一个网络协议栈；EnvoySideca......
  • NetworkPolicy Ingress及Egress简介及案例
    一、NetworkPolicy简介官方介绍：https://kubernetes.io/zh/docs/concepts/services-networking/network-policies/基于NetworkPolicy在三层(网络层)或四层(传输层)控制拒......
  • Gateway
    一、GateWay1.作用对用户请求做身份认证、权限校验将用户请求路由到微服务，并实现负载均衡对用户请求做限流2.使用1.创建模块，引入GateWay网关依赖和nacos依赖<!--......
  • 机器学习 之 逻辑回归（LogisticRegression）文本算法的精确率
    目录​​0、推荐​​​​1、背景​​​​2、效果图​​​​3、本次实验整体流程​​​​4、这里用词向量，而不是TF-IDF预处理后的向量​​​​5、源代码​​​​6、知识点普......
  • istio部署demoapp应用 (十四）sidecar
    创建client~#kubectlrunclient--image=ikubernetes/admin-box-it--rm--restart=Never--command--/bin/shIfyoudon'tseeacommandprompt,trypressingen......
  • asyncapi event-gateway
    支持的功能消息验证消息操作消息聚合消息过滤验证节流路由监控（包括追踪）参考架构说明目前来说官方的似乎还只支持基于kafka的处理，当前基于事件消息模式玩法......
  • Istio Policies and Telemetry
    要理解策略和遥测，首先要理解Mixer的架构；[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-sUuojjzC-1664190859192)(https://istio.io/docs/conc......
  • Istio(十三)：Istio项目实际案例——Online Boutique
    目录一.模块概览二.系统环境三.创建Kubernetes(k8s)集群3.1创建Kubernetes(k8s)集群3.2Kubernetes集群环境四.安装istio4.1安装Istio五.部署onlineBoutique应用5.1部......

赞助商

阅读排行

网站主页关于我们联系我们网站地图

本网站内容转载自其他媒体，侵权联系[admin##ips99.com]。

Copyright © 2020-2023 IPS99 版权所有 IPS99