mac 上学习k8s系列（33）istio part III

golangLeetcode

发布于 2022-08-02 19:37:06

8660

文章被收录于专栏：golang算法架构leetcode技术phpgolang算法架构leetcode技术php

由于istio不支持arm芯片，在m1上部分功能并不可用，所以在mac x86_64平台上运行。下载istio的安装包，解压

% tar -zxvf istio-1.12.1-osx.tar.gz
 % export PATH=$PATH:/Users/xiazemin/source/istio-1.12.1/bin

% istioctl install --set profile=demo -y
Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/v1.12/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details.
! values.global.jwtPolicy is deprecated; use Values.global.jwtPolicy=third-party-jwt. See http://istio.io/latest/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for more information instead
- Processing resources for Istio core.
✔ Istio core installed
✔ Istiod installed
✔ Egress gateways installed
- Processing resources for Ingress gateways. Waiting for Deployment/istio-system/istio-ingressgateway

✔ Ingress gateways installed
✔ Installation complete                                                                                                   Making this installation the default for injection and validation.

Thank you for installing Istio 1.12.  Please take a few minutes to tell us about your install/upgrade experience!  https://forms.gle/FegQbc9UvePd4Z9z7

demo安装成功，检查下


 % kubectl get pods -n istio-system
NAME                                    READY   STATUS    RESTARTS   AGE
istio-egressgateway-776546bdc4-vng8k    1/1     Running   0          4m41s
istio-ingressgateway-77b69b4bf8-gk5qs   1/1     Running   0          4m40s
istiod-759c9bb994-dg67v                 1/1     Running   0          5m34s

部署bookinfo的例子

 % kubectl create ns bookinfo
namespace/bookinfo created

注入istio的sidecar

 kubectl label namespace bookinfo istio-injection=enabled

部署bookinfo

%  kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml -n bookinfo
service/details created
serviceaccount/bookinfo-details created
deployment.apps/details-v1 created
service/ratings created
serviceaccount/bookinfo-ratings created
deployment.apps/ratings-v1 created
service/reviews created
serviceaccount/bookinfo-reviews created
deployment.apps/reviews-v1 created
deployment.apps/reviews-v2 created
deployment.apps/reviews-v3 created
service/productpage created
serviceaccount/bookinfo-productpage created
deployment.apps/productpage-v1 created

查看是否部署成功

% kubectl get pods -n bookinfo
NAME                              READY   STATUS            RESTARTS   AGE
details-v1-79f774bdb9-6b5hp       2/2     Running           0          59s
productpage-v1-6b746f74dc-kht57   0/2     PodInitializing   0          52s
ratings-v1-b6994bb9-l9dr8         0/2     PodInitializing   0          59s
reviews-v1-545db77b95-cxdw9       0/2     PodInitializing   0          57s
reviews-v2-7bf8c9648f-rrx9w       0/2     PodInitializing   0          56s
reviews-v3-84779c7bbc-7x4qm       0/2     PodInitializing   0          56s

等一会儿，镜像下载比较慢

 % kubectl get pods -n bookinfo
NAME                              READY   STATUS    RESTARTS   AGE
details-v1-79f774bdb9-6b5hp       2/2     Running   2          16m
productpage-v1-6b746f74dc-kht57   2/2     Running   2          15m
ratings-v1-b6994bb9-l9dr8         2/2     Running   2          16m
reviews-v1-545db77b95-cxdw9       2/2     Running   2          16m
reviews-v2-7bf8c9648f-rrx9w       2/2     Running   2          16m
reviews-v3-84779c7bbc-7x4qm       2/2     Running   2          16m

测试下，发现服务已经起来了

 kubectl  -n bookinfo exec "$(kubectl  -n bookinfo get pod -l app=ratings -o jsonpath='{.items[0].metadata.name}')" -c ratings -- curl -sS productpage:9080/productpage | grep -o "<title>.*</title>"
<title>Simple Bookstore App</title>

创建虚拟网络和gateway

 % kubectl  -n bookinfo apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
gateway.networking.istio.io/bookinfo-gateway created
virtualservice.networking.istio.io/bookinfo created

 %  istioctl analyze  -n bookinfo
✔ No validation issues found when analyzing namespace: bookinfo.

安装kiali管理界面

%  kubectl apply -f samples/addons
serviceaccount/grafana created
configmap/grafana created
service/grafana created
deployment.apps/grafana created
configmap/istio-grafana-dashboards created
configmap/istio-services-grafana-dashboards created
deployment.apps/jaeger created
service/tracing created
service/zipkin created
service/jaeger-collector created
serviceaccount/kiali created
configmap/kiali created
clusterrole.rbac.authorization.k8s.io/kiali-viewer created
clusterrole.rbac.authorization.k8s.io/kiali created
clusterrolebinding.rbac.authorization.k8s.io/kiali created
role.rbac.authorization.k8s.io/kiali-controlplane created
rolebinding.rbac.authorization.k8s.io/kiali-controlplane created
service/kiali created
deployment.apps/kiali created
serviceaccount/prometheus created
configmap/prometheus created
clusterrole.rbac.authorization.k8s.io/prometheus created
clusterrolebinding.rbac.authorization.k8s.io/prometheus created
service/prometheus created
deployment.apps/prometheus created

% kubectl rollout status deployment/kiali -n istio-system
Waiting for deployment "kiali" rollout to finish: 0 of 1 updated replicas are available...
deployment "kiali" successfully rolled out

启动

 %  istioctl dashboard kiali
http://localhost:20001/kiali

 % kubectl get svc istio-ingressgateway -n istio-system
NAME                   TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)                                                                      AGE
istio-ingressgateway   LoadBalancer   10.100.180.96   localhost     15021:31479/TCP,80:30685/TCP,443:30239/TCP,31400:30796/TCP,15443:32471/TCP   27m

尝试连接30685端口失败了，链接80端口结果404

kubectl get gateway
NAME               AGE
bookinfo-gateway   17s
$ kubectl get virtualservices.networking.istio.io
NAME       GATEWAYS               HOSTS   AGE
bookinfo   ["bookinfo-gateway"]   ["*"]   29s

 %  kubectl get virtualservices.networking.istio.io -n bookinfo
NAME       GATEWAYS               HOSTS   AGE
bookinfo   ["bookinfo-gateway"]   ["*"]   28m

http://localhost/productpage
404

研究发现，以前安装的nginx-controller占用了80端口，端口冲突了

  % kubectl delete -f ingress-nginx-controller.service.yaml
service "ingress-nginx-controller" deleted

再测试下

% curl http://localhost/productpage
upstream connect error or disconnect/reset before headers. reset reason: connection failure, transport failure reason: TLS error: 268436501:SSL routines:OPENSSL_internal:SSLV3_ALERT_CERTIFICATE_EXPIRED

查看下日志

% kubectl logs productpage-v1-78f6f4646b-fnrzn -n bookinfo
INFO:root:start at port 9080
 * Serving Flask app "productpage" (lazy loading)
 * Environment: production
   WARNING: Do not use the development server in a production environment.
   Use a production WSGI server instead.

发现服务是正常的，应该是ingress问题，重启下

 % kubectl -n istio-system delete pod istio-ingressgateway-77b69b4bf8-gk5qs
pod "istio-ingressgateway-77b69b4bf8-gk5qs" deleted
% kubectl -n istio-system delete pod istiod-759c9bb994-dg67v
pod "istiod-759c9bb994-dg67v" deleted

问题解决