镜像

此任务演示了 Istio 的流量镜像功能。

流量镜像,也称为影子流量,是一个以尽可能低的风险为生产带来变化的强大的功能。镜像会将实时流量的副本发送到镜像服务。镜像流量发生在主服务的关键请求路径之外。

在此任务中,首先把流量全部路由到测试服务的 v1 版本。然后,执行规则将一部分流量镜像到 v2 版本。

开始之前

  • 按照安装指南中的说明设置 Istio。

  • 首先部署两个版本的 Httpbin 服务,并开启访问日志功能:

    httpbin-v1:

    1. $ cat <<EOF | istioctl kube-inject -f - | kubectl create -f -
    2. apiVersion: apps/v1
    3. kind: Deployment
    4. metadata:
    5. name: httpbin-v1
    6. spec:
    7. replicas: 1
    8. selector:
    9. matchLabels:
    10. app: httpbin
    11. version: v1
    12. template:
    13. metadata:
    14. labels:
    15. app: httpbin
    16. version: v1
    17. spec:
    18. containers:
    19. - image: docker.io/kennethreitz/httpbin
    20. imagePullPolicy: IfNotPresent
    21. name: httpbin
    22. command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]
    23. ports:
    24. - containerPort: 80
    25. EOF

    httpbin-v2:

    1. $ cat <<EOF | istioctl kube-inject -f - | kubectl create -f -
    2. apiVersion: apps/v1
    3. kind: Deployment
    4. metadata:
    5. name: httpbin-v2
    6. spec:
    7. replicas: 1
    8. selector:
    9. matchLabels:
    10. app: httpbin
    11. version: v2
    12. template:
    13. metadata:
    14. labels:
    15. app: httpbin
    16. version: v2
    17. spec:
    18. containers:
    19. - image: docker.io/kennethreitz/httpbin
    20. imagePullPolicy: IfNotPresent
    21. name: httpbin
    22. command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]
    23. ports:
    24. - containerPort: 80
    25. EOF

    httpbin Kubernetes service:

    1. $ kubectl create -f - <<EOF
    2. apiVersion: v1
    3. kind: Service
    4. metadata:
    5. name: httpbin
    6. labels:
    7. app: httpbin
    8. spec:
    9. ports:
    10. - name: http
    11. port: 8000
    12. targetPort: 80
    13. selector:
    14. app: httpbin
    15. EOF
  • 启动 sleep 服务,这样就可以使用 curl 来提供负载:

    sleep service:

    1. $ cat <<EOF | istioctl kube-inject -f - | kubectl create -f -
    2. apiVersion: apps/v1
    3. kind: Deployment
    4. metadata:
    5. name: sleep
    6. spec:
    7. replicas: 1
    8. selector:
    9. matchLabels:
    10. app: sleep
    11. template:
    12. metadata:
    13. labels:
    14. app: sleep
    15. spec:
    16. containers:
    17. - name: sleep
    18. image: curlimages/curl
    19. command: ["/bin/sleep","3650d"]
    20. imagePullPolicy: IfNotPresent
    21. EOF

创建一个默认路由策略

默认情况下,Kubernetes 在 httpbin 服务的两个版本之间进行负载均衡。在此步骤中会更改该行为,把所有流量都路由到 v1 版本。

  1. 创建一个默认路由规则,将所有流量路由到服务的 v1 版本:

    1. $ kubectl apply -f - <<EOF
    2. apiVersion: networking.istio.io/v1alpha3
    3. kind: VirtualService
    4. metadata:
    5. name: httpbin
    6. spec:
    7. hosts:
    8. - httpbin
    9. http:
    10. - route:
    11. - destination:
    12. host: httpbin
    13. subset: v1
    14. weight: 100
    15. ---
    16. apiVersion: networking.istio.io/v1alpha3
    17. kind: DestinationRule
    18. metadata:
    19. name: httpbin
    20. spec:
    21. host: httpbin
    22. subsets:
    23. - name: v1
    24. labels:
    25. version: v1
    26. - name: v2
    27. labels:
    28. version: v2
    29. EOF

    现在所有流量都转到 httpbin:v1 服务。

  2. 向服务发送一部分流量:

    1. $ export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
    2. $ kubectl exec "${SLEEP_POD}" -c sleep -- curl -sS http://httpbin:8000/headers
    3. {
    4. "headers": {
    5. "Accept": "*/*",
    6. "Content-Length": "0",
    7. "Host": "httpbin:8000",
    8. "User-Agent": "curl/7.35.0",
    9. "X-B3-Parentspanid": "57784f8bff90ae0b",
    10. "X-B3-Sampled": "1",
    11. "X-B3-Spanid": "3289ae7257c3f159",
    12. "X-B3-Traceid": "b56eebd279a76f0b57784f8bff90ae0b",
    13. "X-Envoy-Attempt-Count": "1",
    14. "X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/default;Hash=20afebed6da091c850264cc751b8c9306abac02993f80bdb76282237422bd098;Subject=\"\";URI=spiffe://cluster.local/ns/default/sa/default"
    15. }
    16. }
  3. 分别查看 httpbin Pod的 v1v2 两个版本的日志。您可以看到 v1 版本的访问日志条目,而 v2 版本没有日志:

    1. $ export V1_POD=$(kubectl get pod -l app=httpbin,version=v1 -o jsonpath={.items..metadata.name})
    2. $ kubectl logs "$V1_POD" -c httpbin
    3. 127.0.0.1 - - [07/Mar/2018:19:02:43 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"
    1. $ export V2_POD=$(kubectl get pod -l app=httpbin,version=v2 -o jsonpath={.items..metadata.name})
    2. $ kubectl logs "$V2_POD" -c httpbin
    3. <none>

镜像流量到 v2

  1. 改变流量规则将流量镜像到 v2:

    1. $ kubectl apply -f - <<EOF
    2. apiVersion: networking.istio.io/v1alpha3
    3. kind: VirtualService
    4. metadata:
    5. name: httpbin
    6. spec:
    7. hosts:
    8. - httpbin
    9. http:
    10. - route:
    11. - destination:
    12. host: httpbin
    13. subset: v1
    14. weight: 100
    15. mirror:
    16. host: httpbin
    17. subset: v2
    18. mirrorPercent: 100
    19. EOF

    这个路由规则发送 100% 流量到 v1 版本。最后一节表示您将 100% 的相同流量镜像(即发送)到 httpbin:v2 服务。当流量被镜像时,请求将发送到镜像服务中,并在 headers 中的 Host/Authority 属性值上追加 -shadow。例如 cluster-1 变为 cluster-1-shadow

    此外,重点注意这些被镜像的流量是『 即发即弃』的,就是说镜像请求的响应会被丢弃。

    您可以使用 mirror_percent 属性来设置镜像流量的百分比,而不是镜像全部请求。为了兼容老版本,如果这个属性不存在,将镜像所有流量。

  2. 发送流量:

    1. $ kubectl exec "${SLEEP_POD}" -c sleep -- curl -sS http://httpbin:8000/headers

    现在就可以看到 v1v2 版本中都有了访问日志。v2 版本中的访问日志就是由镜像流量产生的,这些请求的实际目标是 v1 版本。

    1. $ kubectl logs "$V1_POD" -c httpbin
    2. 127.0.0.1 - - [07/Mar/2018:19:02:43 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"
    3. 127.0.0.1 - - [07/Mar/2018:19:26:44 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"
    1. $ kubectl logs "$V2_POD" -c httpbin
    2. 127.0.0.1 - - [07/Mar/2018:19:26:44 +0000] "GET /headers HTTP/1.1" 200 361 "-" "curl/7.35.0"

清理

  1. 删除规则:

    1. $ kubectl delete virtualservice httpbin
    2. $ kubectl delete destinationrule httpbin
  2. 关闭 Httpbin 服务和客户端:

    1. $ kubectl delete deploy httpbin-v1 httpbin-v2 sleep
    2. $ kubectl delete svc httpbin