远程访问遥测插件

此任务说明如何配置 Istio 以显示和访问集群外部的遥测插件。

配置远程访问

远程访问遥测插件的方式有很多种。 该任务涵盖了两种基本访问方式:安全的(通过 HTTPS)和不安全的(通过 HTTP)。 对于任何生产或敏感环境,强烈建议 通过安全方式访问。 不安全访问易于设置,但是无法保护在集群外传输的任何凭据或数据。

方式 1:安全访问(HTTPS)

安全访问需要一个服务器证书。按照这些步骤来为您的域名安装并配置服务器证书。

您也可以使用自签名证书。访问配置使用 SDS 通过 HTTPS 访问的安全网关任务以了解使用自签名证书访问集群内服务的详情。

本方式 涵盖了传输层的安全。您还应该配置遥测插件,使其暴露在外部时需要身份验证。

  1. 安装 cert-manager 以自动管理证书。

  2. 安装 Istio 到您的集群并启用 cert-manager 标志且配置 istio-ingressgateway 使用 Secret Discovery Service

    要安装相应的 Istio,使用下列安装选项:

    • --set values.gateways.enabled=true
    • --set values.gateways.istio-ingressgateway.enabled=true
    • --set values.gateways.istio-ingressgateway.sds.enabled=true

    要额外安装遥测插件,使用下列安装选项:

    • Grafana: --set values.grafana.enabled=true
    • Kiali: --set values.kiali.enabled=true
    • Prometheus: --set values.prometheus.enabled=true
    • Tracing: --set values.tracing.enabled=true
  3. 为您的域名配置 DNS 记录。

    1. 获取 istio-ingressgateway 的外部 IP 地址。

      1. $ kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
      2. <IP ADDRESS OF CLUSTER INGRESS>
    2. 设置环境变量保存目标域名:

      1. $ TELEMETRY_DOMAIN=<your.desired.domain>
    3. 通过您的域名提供商将所需的域名指向该外部 IP 地址。

      实现此步骤的机制因提供商而异。以下是一些示例文档链接:

    4. 验证 DNS 记录无误。

      1. $ dig +short $TELEMETRY_DOMAIN
      2. <IP ADDRESS OF CLUSTER INGRESS>
  4. 生成服务器证书

    1. $ cat <<EOF | kubectl apply -f -
    2. apiVersion: certmanager.k8s.io/v1alpha1
    3. kind: Certificate
    4. metadata:
    5. name: telemetry-gw-cert
    6. namespace: istio-system
    7. spec:
    8. secretName: telemetry-gw-cert
    9. issuerRef:
    10. name: letsencrypt
    11. kind: ClusterIssuer
    12. commonName: $TELEMETRY_DOMAIN
    13. dnsNames:
    14. - $TELEMETRY_DOMAIN
    15. acme:
    16. config:
    17. - http01:
    18. ingressClass: istio
    19. domains:
    20. - $TELEMETRY_DOMAIN
    21. ---
    22. EOF
    23. certificate.certmanager.k8s.io "telemetry-gw-cert" created
  5. 等待服务器证书准备就绪。

    1. $ JSONPATH='{range .items[*]}{@.metadata.name}:{range @.status.conditions[*]}{@.type}={@.status}{end}{end}' && kubectl -n istio-system get certificates -o jsonpath="$JSONPATH"
    2. telemetry-gw-cert:Ready=True
  6. 应用遥测插件的网络配置。

    1. 应用以下配置以暴露 Grafana:

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5. name: grafana-gateway
      6. namespace: istio-system
      7. spec:
      8. selector:
      9. istio: ingressgateway
      10. servers:
      11. - port:
      12. number: 15031
      13. name: https-grafana
      14. protocol: HTTPS
      15. tls:
      16. mode: SIMPLE
      17. serverCertificate: sds
      18. privateKey: sds
      19. credentialName: telemetry-gw-cert
      20. hosts:
      21. - "$TELEMETRY_DOMAIN"
      22. ---
      23. apiVersion: networking.istio.io/v1alpha3
      24. kind: VirtualService
      25. metadata:
      26. name: grafana-vs
      27. namespace: istio-system
      28. spec:
      29. hosts:
      30. - "$TELEMETRY_DOMAIN"
      31. gateways:
      32. - grafana-gateway
      33. http:
      34. - match:
      35. - port: 15031
      36. route:
      37. - destination:
      38. host: grafana
      39. port:
      40. number: 3000
      41. ---
      42. apiVersion: networking.istio.io/v1alpha3
      43. kind: DestinationRule
      44. metadata:
      45. name: grafana
      46. namespace: istio-system
      47. spec:
      48. host: grafana
      49. trafficPolicy:
      50. tls:
      51. mode: DISABLE
      52. ---
      53. EOF
      54. gateway.networking.istio.io "grafana-gateway" configured
      55. virtualservice.networking.istio.io "grafana-vs" configured
      56. destinationrule.networking.istio.io "grafana" configured
    2. 应用以下配置以暴露 Kiali:

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5. name: kiali-gateway
      6. namespace: istio-system
      7. spec:
      8. selector:
      9. istio: ingressgateway
      10. servers:
      11. - port:
      12. number: 15029
      13. name: https-kiali
      14. protocol: HTTPS
      15. tls:
      16. mode: SIMPLE
      17. serverCertificate: sds
      18. privateKey: sds
      19. credentialName: telemetry-gw-cert
      20. hosts:
      21. - "$TELEMETRY_DOMAIN"
      22. ---
      23. apiVersion: networking.istio.io/v1alpha3
      24. kind: VirtualService
      25. metadata:
      26. name: kiali-vs
      27. namespace: istio-system
      28. spec:
      29. hosts:
      30. - "$TELEMETRY_DOMAIN"
      31. gateways:
      32. - kiali-gateway
      33. http:
      34. - match:
      35. - port: 15029
      36. route:
      37. - destination:
      38. host: kiali
      39. port:
      40. number: 20001
      41. ---
      42. apiVersion: networking.istio.io/v1alpha3
      43. kind: DestinationRule
      44. metadata:
      45. name: kiali
      46. namespace: istio-system
      47. spec:
      48. host: kiali
      49. trafficPolicy:
      50. tls:
      51. mode: DISABLE
      52. ---
      53. EOF
      54. gateway.networking.istio.io "kiali-gateway" configured
      55. virtualservice.networking.istio.io "kiali-vs" configured
      56. destinationrule.networking.istio.io "kiali" configured
    3. 应用以下配置以暴露 Prometheus:

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5. name: prometheus-gateway
      6. namespace: istio-system
      7. spec:
      8. selector:
      9. istio: ingressgateway
      10. servers:
      11. - port:
      12. number: 15030
      13. name: https-prom
      14. protocol: HTTPS
      15. tls:
      16. mode: SIMPLE
      17. serverCertificate: sds
      18. privateKey: sds
      19. credentialName: telemetry-gw-cert
      20. hosts:
      21. - "$TELEMETRY_DOMAIN"
      22. ---
      23. apiVersion: networking.istio.io/v1alpha3
      24. kind: VirtualService
      25. metadata:
      26. name: prometheus-vs
      27. namespace: istio-system
      28. spec:
      29. hosts:
      30. - "$TELEMETRY_DOMAIN"
      31. gateways:
      32. - prometheus-gateway
      33. http:
      34. - match:
      35. - port: 15030
      36. route:
      37. - destination:
      38. host: prometheus
      39. port:
      40. number: 9090
      41. ---
      42. apiVersion: networking.istio.io/v1alpha3
      43. kind: DestinationRule
      44. metadata:
      45. name: prometheus
      46. namespace: istio-system
      47. spec:
      48. host: prometheus
      49. trafficPolicy:
      50. tls:
      51. mode: DISABLE
      52. ---
      53. EOF
      54. gateway.networking.istio.io "prometheus-gateway" configured
      55. virtualservice.networking.istio.io "prometheus-vs" configured
      56. destinationrule.networking.istio.io "prometheus" configured
    4. 应用以下配置以暴露跟踪服务:

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5. name: tracing-gateway
      6. namespace: istio-system
      7. spec:
      8. selector:
      9. istio: ingressgateway
      10. servers:
      11. - port:
      12. number: 15032
      13. name: https-tracing
      14. protocol: HTTPS
      15. tls:
      16. mode: SIMPLE
      17. serverCertificate: sds
      18. privateKey: sds
      19. credentialName: telemetry-gw-cert
      20. hosts:
      21. - "$TELEMETRY_DOMAIN"
      22. ---
      23. apiVersion: networking.istio.io/v1alpha3
      24. kind: VirtualService
      25. metadata:
      26. name: tracing-vs
      27. namespace: istio-system
      28. spec:
      29. hosts:
      30. - "$TELEMETRY_DOMAIN"
      31. gateways:
      32. - tracing-gateway
      33. http:
      34. - match:
      35. - port: 15032
      36. route:
      37. - destination:
      38. host: tracing
      39. port:
      40. number: 80
      41. ---
      42. apiVersion: networking.istio.io/v1alpha3
      43. kind: DestinationRule
      44. metadata:
      45. name: tracing
      46. namespace: istio-system
      47. spec:
      48. host: tracing
      49. trafficPolicy:
      50. tls:
      51. mode: DISABLE
      52. ---
      53. EOF
      54. gateway.networking.istio.io "tracing-gateway" configured
      55. virtualservice.networking.istio.io "tracing-vs" configured
      56. destinationrule.networking.istio.io "tracing" configured
  7. 通过浏览器访问这些遥测插件。

    • Kiali: https://$TELEMETRY_DOMAIN:15029/
    • Prometheus: https://$TELEMETRY_DOMAIN:15030/
    • Grafana: https://$TELEMETRY_DOMAIN:15031/
    • Tracing: https://$TELEMETRY_DOMAIN:15032/

方式 2:不安全访问(HTTP)

  1. 安装 Istio 到您的集群并启用您所需要的遥测插件。

    要额外安装这些遥测插件,使用下列安装选项:

    • Grafana: --set values.grafana.enabled=true
    • Kiali: --set values.kiali.enabled=true
    • Prometheus: --set values.prometheus.enabled=true
    • Tracing: --set values.tracing.enabled=true
  2. 应用遥测插件的网络配置。

    1. 应用以下配置以暴露 Grafana:

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5. name: grafana-gateway
      6. namespace: istio-system
      7. spec:
      8. selector:
      9. istio: ingressgateway
      10. servers:
      11. - port:
      12. number: 15031
      13. name: http-grafana
      14. protocol: HTTP
      15. hosts:
      16. - "*"
      17. ---
      18. apiVersion: networking.istio.io/v1alpha3
      19. kind: VirtualService
      20. metadata:
      21. name: grafana-vs
      22. namespace: istio-system
      23. spec:
      24. hosts:
      25. - "*"
      26. gateways:
      27. - grafana-gateway
      28. http:
      29. - match:
      30. - port: 15031
      31. route:
      32. - destination:
      33. host: grafana
      34. port:
      35. number: 3000
      36. ---
      37. apiVersion: networking.istio.io/v1alpha3
      38. kind: DestinationRule
      39. metadata:
      40. name: grafana
      41. namespace: istio-system
      42. spec:
      43. host: grafana
      44. trafficPolicy:
      45. tls:
      46. mode: DISABLE
      47. ---
      48. EOF
      49. gateway.networking.istio.io "grafana-gateway" configured
      50. virtualservice.networking.istio.io "grafana-vs" configured
      51. destinationrule.networking.istio.io "grafana" configured
    2. 应用以下配置以暴露 Kiali:

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5. name: kiali-gateway
      6. namespace: istio-system
      7. spec:
      8. selector:
      9. istio: ingressgateway
      10. servers:
      11. - port:
      12. number: 15029
      13. name: http-kiali
      14. protocol: HTTP
      15. hosts:
      16. - "*"
      17. ---
      18. apiVersion: networking.istio.io/v1alpha3
      19. kind: VirtualService
      20. metadata:
      21. name: kiali-vs
      22. namespace: istio-system
      23. spec:
      24. hosts:
      25. - "*"
      26. gateways:
      27. - kiali-gateway
      28. http:
      29. - match:
      30. - port: 15029
      31. route:
      32. - destination:
      33. host: kiali
      34. port:
      35. number: 20001
      36. ---
      37. apiVersion: networking.istio.io/v1alpha3
      38. kind: DestinationRule
      39. metadata:
      40. name: kiali
      41. namespace: istio-system
      42. spec:
      43. host: kiali
      44. trafficPolicy:
      45. tls:
      46. mode: DISABLE
      47. ---
      48. EOF
      49. gateway.networking.istio.io "kiali-gateway" configured
      50. virtualservice.networking.istio.io "kiali-vs" configured
      51. destinationrule.networking.istio.io "kiali" configured
    3. 应用以下配置以暴露 Prometheus:

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5. name: prometheus-gateway
      6. namespace: istio-system
      7. spec:
      8. selector:
      9. istio: ingressgateway
      10. servers:
      11. - port:
      12. number: 15030
      13. name: http-prom
      14. protocol: HTTP
      15. hosts:
      16. - "*"
      17. ---
      18. apiVersion: networking.istio.io/v1alpha3
      19. kind: VirtualService
      20. metadata:
      21. name: prometheus-vs
      22. namespace: istio-system
      23. spec:
      24. hosts:
      25. - "*"
      26. gateways:
      27. - prometheus-gateway
      28. http:
      29. - match:
      30. - port: 15030
      31. route:
      32. - destination:
      33. host: prometheus
      34. port:
      35. number: 9090
      36. ---
      37. apiVersion: networking.istio.io/v1alpha3
      38. kind: DestinationRule
      39. metadata:
      40. name: prometheus
      41. namespace: istio-system
      42. spec:
      43. host: prometheus
      44. trafficPolicy:
      45. tls:
      46. mode: DISABLE
      47. ---
      48. EOF
      49. gateway.networking.istio.io "prometheus-gateway" configured
      50. virtualservice.networking.istio.io "prometheus-vs" configured
      51. destinationrule.networking.istio.io "prometheus" configured
    4. 应用以下配置以暴露跟踪服务:

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5. name: tracing-gateway
      6. namespace: istio-system
      7. spec:
      8. selector:
      9. istio: ingressgateway
      10. servers:
      11. - port:
      12. number: 15032
      13. name: http-tracing
      14. protocol: HTTP
      15. hosts:
      16. - "*"
      17. ---
      18. apiVersion: networking.istio.io/v1alpha3
      19. kind: VirtualService
      20. metadata:
      21. name: tracing-vs
      22. namespace: istio-system
      23. spec:
      24. hosts:
      25. - "*"
      26. gateways:
      27. - tracing-gateway
      28. http:
      29. - match:
      30. - port: 15032
      31. route:
      32. - destination:
      33. host: tracing
      34. port:
      35. number: 80
      36. ---
      37. apiVersion: networking.istio.io/v1alpha3
      38. kind: DestinationRule
      39. metadata:
      40. name: tracing
      41. namespace: istio-system
      42. spec:
      43. host: tracing
      44. trafficPolicy:
      45. tls:
      46. mode: DISABLE
      47. ---
      48. EOF
      49. gateway.networking.istio.io "tracing-gateway" configured
      50. virtualservice.networking.istio.io "tracing-vs" configured
      51. destinationrule.networking.istio.io "tracing" configured
  3. 通过浏览器访问这些遥测插件。

    • Kiali: http://<IP ADDRESS OF CLUSTER INGRESS>:15029/
    • Prometheus: http://<IP ADDRESS OF CLUSTER INGRESS>:15030/
    • Grafana: http://<IP ADDRESS OF CLUSTER INGRESS>:15031/
    • Tracing: http://<IP ADDRESS OF CLUSTER INGRESS>:15032/

清除

  • 移除所有相关的网关:

    1. $ kubectl -n istio-system delete gateway grafana-gateway kiali-gateway prometheus-gateway tracing-gateway
    2. gateway.networking.istio.io "grafana-gateway" deleted
    3. gateway.networking.istio.io "kiali-gateway" deleted
    4. gateway.networking.istio.io "prometheus-gateway" deleted
    5. gateway.networking.istio.io "tracing-gateway" deleted
  • 移除所有相关的 Virtual Services:

    1. $ kubectl -n istio-system delete virtualservice grafana-vs kiali-vs prometheus-vs tracing-vs
    2. virtualservice.networking.istio.io "grafana-vs" deleted
    3. virtualservice.networking.istio.io "kiali-vs" deleted
    4. virtualservice.networking.istio.io "prometheus-vs" deleted
    5. virtualservice.networking.istio.io "tracing-vs" deleted
  • 如果安装了网关证书,移除它:

    1. $ kubectl -n istio-system delete certificate telemetry-gw-cert
    2. certificate.certmanager.k8s.io "telemetry-gw-cert" deleted