远程访问遥测插件

此任务说明如何配置 Istio 以暴露和访问集群外部的遥测插件。

配置远程访问

远程访问遥测插件的方式有很多种。 该任务涵盖了两种基本访问方式：安全的（通过 HTTPS）和不安全的（通过 HTTP）。 对于任何生产或敏感环境，强烈建议通过安全方式访问。 不安全访问易于设置，但是无法保护在集群外传输的任何凭据或数据。

对于这两种方式，首先请执行以下步骤：

  1. 在您的集群中安装 Istio。

    要安装额外的遥测插件，请参考集成文档。

  2. 设置域名暴露这些插件。在此示例中，您将在子域名 grafana.example.com 上暴露每个插件。

    • 如果您有一个域名（例如 example.com）指向 istio-ingressgateway 的外部 IP 地址：

      1. $ export INGRESS_DOMAIN="example.com"

    • 如果您没有域名，您可以使用 nip.io，它将自动解析为提供的 IP 地址，这种方式不建议用于生产用途。

      1. $ export INGRESS_HOST=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
      2. $ export INGRESS_DOMAIN=${INGRESS_HOST}.nip.io

方式 1：安全访问（HTTPS）

安全访问需要一个服务器证书。按照这些步骤来为您的域名安装并配置服务器证书。

本方式只涵盖了传输层的安全。您还应该配置遥测插件，使其暴露在外部时需要身份验证。

此示例使用自签名证书，这可能不适合生产用途。针对生产环境，请考虑使用 cert-manager 或其他工具来配置证书。 您还可以参阅使用 HTTPS 保护网关任务， 了解有关在网关上使用 HTTPS 的基本信息。

  1. 设置证书，此示例使用 openssl 进行自签名。

    1. $ CERT_DIR=/tmp/certs
    2. $ mkdir -p ${CERT_DIR}
    3. $ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj "/O=example Inc./CN=*.${INGRESS_DOMAIN}" -keyout ${CERT_DIR}/ca.key -out ${CERT_DIR}/ca.crt
    4. $ openssl req -out ${CERT_DIR}/cert.csr -newkey rsa:2048 -nodes -keyout ${CERT_DIR}/tls.key -subj "/CN=*.${INGRESS_DOMAIN}/O=example organization"
    5. $ openssl x509 -req -sha256 -days 365 -CA ${CERT_DIR}/ca.crt -CAkey ${CERT_DIR}/ca.key -set_serial 0 -in ${CERT_DIR}/cert.csr -out ${CERT_DIR}/tls.crt
    6. $ kubectl create -n istio-system secret tls telemetry-gw-cert --key=${CERT_DIR}/tls.key --cert=${CERT_DIR}/tls.crt

  2. 应用遥测插件的网络配置。

    1. 应用以下配置以暴露 Grafana：

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5.   name: grafana-gateway
      6.   namespace: istio-system
      7. spec:
      8.   selector:
      9.     istio: ingressgateway
      10.   servers:
      11.   - port:
      12.       number: 443
      13.       name: https-grafana
      14.       protocol: HTTPS
      15.     tls:
      16.       mode: SIMPLE
      17.       credentialName: telemetry-gw-cert
      18.     hosts:
      19.     - "grafana.${INGRESS_DOMAIN}"
      20. ---
      21. apiVersion: networking.istio.io/v1alpha3
      22. kind: VirtualService
      23. metadata:
      24.   name: grafana-vs
      25.   namespace: istio-system
      26. spec:
      27.   hosts:
      28.   - "grafana.${INGRESS_DOMAIN}"
      29.   gateways:
      30.   - grafana-gateway
      31.   http:
      32.   - route:
      33.     - destination:
      34.         host: grafana
      35.         port:
      36.           number: 3000
      37. ---
      38. apiVersion: networking.istio.io/v1alpha3
      39. kind: DestinationRule
      40. metadata:
      41.   name: grafana
      42.   namespace: istio-system
      43. spec:
      44.   host: grafana
      45.   trafficPolicy:
      46.     tls:
      47.       mode: DISABLE
      48. ---
      49. EOF
      50. gateway.networking.istio.io/grafana-gateway created
      51. virtualservice.networking.istio.io/grafana-vs created
      52. destinationrule.networking.istio.io/grafana created

    2. 应用以下配置以暴露 Kiali：

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5.   name: kiali-gateway
      6.   namespace: istio-system
      7. spec:
      8.   selector:
      9.     istio: ingressgateway
      10.   servers:
      11.   - port:
      12.       number: 443
      13.       name: https-kiali
      14.       protocol: HTTPS
      15.     tls:
      16.       mode: SIMPLE
      17.       credentialName: telemetry-gw-cert
      18.     hosts:
      19.     - "kiali.${INGRESS_DOMAIN}"
      20. ---
      21. apiVersion: networking.istio.io/v1alpha3
      22. kind: VirtualService
      23. metadata:
      24.   name: kiali-vs
      25.   namespace: istio-system
      26. spec:
      27.   hosts:
      28.   - "kiali.${INGRESS_DOMAIN}"
      29.   gateways:
      30.   - kiali-gateway
      31.   http:
      32.   - route:
      33.     - destination:
      34.         host: kiali
      35.         port:
      36.           number: 20001
      37. ---
      38. apiVersion: networking.istio.io/v1alpha3
      39. kind: DestinationRule
      40. metadata:
      41.   name: kiali
      42.   namespace: istio-system
      43. spec:
      44.   host: kiali
      45.   trafficPolicy:
      46.     tls:
      47.       mode: DISABLE
      48. ---
      49. EOF
      50. gateway.networking.istio.io/kiali-gateway created
      51. virtualservice.networking.istio.io/kiali-vs created
      52. destinationrule.networking.istio.io/kiali created

    3. 应用以下配置以暴露 Prometheus：

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5.   name: prometheus-gateway
      6.   namespace: istio-system
      7. spec:
      8.   selector:
      9.     istio: ingressgateway
      10.   servers:
      11.   - port:
      12.       number: 443
      13.       name: https-prom
      14.       protocol: HTTPS
      15.     tls:
      16.       mode: SIMPLE
      17.       credentialName: telemetry-gw-cert
      18.     hosts:
      19.     - "prometheus.${INGRESS_DOMAIN}"
      20. ---
      21. apiVersion: networking.istio.io/v1alpha3
      22. kind: VirtualService
      23. metadata:
      24.   name: prometheus-vs
      25.   namespace: istio-system
      26. spec:
      27.   hosts:
      28.   - "prometheus.${INGRESS_DOMAIN}"
      29.   gateways:
      30.   - prometheus-gateway
      31.   http:
      32.   - route:
      33.     - destination:
      34.         host: prometheus
      35.         port:
      36.           number: 9090
      37. ---
      38. apiVersion: networking.istio.io/v1alpha3
      39. kind: DestinationRule
      40. metadata:
      41.   name: prometheus
      42.   namespace: istio-system
      43. spec:
      44.   host: prometheus
      45.   trafficPolicy:
      46.     tls:
      47.       mode: DISABLE
      48. ---
      49. EOF
      50. gateway.networking.istio.io/prometheus-gateway created
      51. virtualservice.networking.istio.io/prometheus-vs created
      52. destinationrule.networking.istio.io/prometheus created

    4. 应用以下配置以暴露跟踪服务：

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5.   name: tracing-gateway
      6.   namespace: istio-system
      7. spec:
      8.   selector:
      9.     istio: ingressgateway
      10.   servers:
      11.   - port:
      12.       number: 443
      13.       name: https-tracing
      14.       protocol: HTTPS
      15.     tls:
      16.       mode: SIMPLE
      17.       credentialName: telemetry-gw-cert
      18.     hosts:
      19.     - "tracing.${INGRESS_DOMAIN}"
      20. ---
      21. apiVersion: networking.istio.io/v1alpha3
      22. kind: VirtualService
      23. metadata:
      24.   name: tracing-vs
      25.   namespace: istio-system
      26. spec:
      27.   hosts:
      28.   - "tracing.${INGRESS_DOMAIN}"
      29.   gateways:
      30.   - tracing-gateway
      31.   http:
      32.   - route:
      33.     - destination:
      34.         host: tracing
      35.         port:
      36.           number: 80
      37. ---
      38. apiVersion: networking.istio.io/v1alpha3
      39. kind: DestinationRule
      40. metadata:
      41.   name: tracing
      42.   namespace: istio-system
      43. spec:
      44.   host: tracing
      45.   trafficPolicy:
      46.     tls:
      47.       mode: DISABLE
      48. ---
      49. EOF
      50. gateway.networking.istio.io/tracing-gateway created
      51. virtualservice.networking.istio.io/tracing-vs created
      52. destinationrule.networking.istio.io/tracing created

  3. 通过浏览器访问这些遥测插件。

    如果您使用了自签名的证书，您的浏览器可能将其标记为不安全的。

    • Kiali：https://kiali.${INGRESS_DOMAIN}
    • Prometheus：https://prometheus.${INGRESS_DOMAIN}
    • Grafana：https://grafana.${INGRESS_DOMAIN}
    • Tracing：https://tracing.${INGRESS_DOMAIN}

方式 2：不安全访问（HTTP）

  1. 应用遥测插件的网络配置。

    1. 应用以下配置以暴露 Grafana：

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5.   name: grafana-gateway
      6.   namespace: istio-system
      7. spec:
      8.   selector:
      9.     istio: ingressgateway
      10.   servers:
      11.   - port:
      12.       number: 80
      13.       name: http-grafana
      14.       protocol: HTTP
      15.     hosts:
      16.     - "grafana.${INGRESS_DOMAIN}"
      17. ---
      18. apiVersion: networking.istio.io/v1alpha3
      19. kind: VirtualService
      20. metadata:
      21.   name: grafana-vs
      22.   namespace: istio-system
      23. spec:
      24.   hosts:
      25.   - "grafana.${INGRESS_DOMAIN}"
      26.   gateways:
      27.   - grafana-gateway
      28.   http:
      29.   - route:
      30.     - destination:
      31.         host: grafana
      32.         port:
      33.           number: 3000
      34. ---
      35. apiVersion: networking.istio.io/v1alpha3
      36. kind: DestinationRule
      37. metadata:
      38.   name: grafana
      39.   namespace: istio-system
      40. spec:
      41.   host: grafana
      42.   trafficPolicy:
      43.     tls:
      44.       mode: DISABLE
      45. ---
      46. EOF
      47. gateway.networking.istio.io/grafana-gateway created
      48. virtualservice.networking.istio.io/grafana-vs created
      49. destinationrule.networking.istio.io/grafana created

    2. 应用以下配置以暴露 Kiali：

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5.   name: kiali-gateway
      6.   namespace: istio-system
      7. spec:
      8.   selector:
      9.     istio: ingressgateway
      10.   servers:
      11.   - port:
      12.       number: 80
      13.       name: http-kiali
      14.       protocol: HTTP
      15.     hosts:
      16.     - "kiali.${INGRESS_DOMAIN}"
      17. ---
      18. apiVersion: networking.istio.io/v1alpha3
      19. kind: VirtualService
      20. metadata:
      21.   name: kiali-vs
      22.   namespace: istio-system
      23. spec:
      24.   hosts:
      25.   - "kiali.${INGRESS_DOMAIN}"
      26.   gateways:
      27.   - kiali-gateway
      28.   http:
      29.   - route:
      30.     - destination:
      31.         host: kiali
      32.         port:
      33.           number: 20001
      34. ---
      35. apiVersion: networking.istio.io/v1alpha3
      36. kind: DestinationRule
      37. metadata:
      38.   name: kiali
      39.   namespace: istio-system
      40. spec:
      41.   host: kiali
      42.   trafficPolicy:
      43.     tls:
      44.       mode: DISABLE
      45. ---
      46. EOF
      47. gateway.networking.istio.io/kiali-gateway created
      48. virtualservice.networking.istio.io/kiali-vs created
      49. destinationrule.networking.istio.io/kiali created

    3. 应用以下配置以暴露 Prometheus：

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5.   name: prometheus-gateway
      6.   namespace: istio-system
      7. spec:
      8.   selector:
      9.     istio: ingressgateway
      10.   servers:
      11.   - port:
      12.       number: 80
      13.       name: http-prom
      14.       protocol: HTTP
      15.     hosts:
      16.     - "prometheus.${INGRESS_DOMAIN}"
      17. ---
      18. apiVersion: networking.istio.io/v1alpha3
      19. kind: VirtualService
      20. metadata:
      21.   name: prometheus-vs
      22.   namespace: istio-system
      23. spec:
      24.   hosts:
      25.   - "prometheus.${INGRESS_DOMAIN}"
      26.   gateways:
      27.   - prometheus-gateway
      28.   http:
      29.   - route:
      30.     - destination:
      31.         host: prometheus
      32.         port:
      33.           number: 9090
      34. ---
      35. apiVersion: networking.istio.io/v1alpha3
      36. kind: DestinationRule
      37. metadata:
      38.   name: prometheus
      39.   namespace: istio-system
      40. spec:
      41.   host: prometheus
      42.   trafficPolicy:
      43.     tls:
      44.       mode: DISABLE
      45. ---
      46. EOF
      47. gateway.networking.istio.io/prometheus-gateway created
      48. virtualservice.networking.istio.io/prometheus-vs created
      49. destinationrule.networking.istio.io/prometheus created

    4. 应用以下配置以暴露跟踪服务：

      1. $ cat <<EOF | kubectl apply -f -
      2. apiVersion: networking.istio.io/v1alpha3
      3. kind: Gateway
      4. metadata:
      5.   name: tracing-gateway
      6.   namespace: istio-system
      7. spec:
      8.   selector:
      9.     istio: ingressgateway
      10.   servers:
      11.   - port:
      12.       number: 80
      13.       name: http-tracing
      14.       protocol: HTTP
      15.     hosts:
      16.     - "tracing.${INGRESS_DOMAIN}"
      17. ---
      18. apiVersion: networking.istio.io/v1alpha3
      19. kind: VirtualService
      20. metadata:
      21.   name: tracing-vs
      22.   namespace: istio-system
      23. spec:
      24.   hosts:
      25.   - "tracing.${INGRESS_DOMAIN}"
      26.   gateways:
      27.   - tracing-gateway
      28.   http:
      29.   - route:
      30.     - destination:
      31.         host: tracing
      32.         port:
      33.           number: 80
      34. ---
      35. apiVersion: networking.istio.io/v1alpha3
      36. kind: DestinationRule
      37. metadata:
      38.   name: tracing
      39.   namespace: istio-system
      40. spec:
      41.   host: tracing
      42.   trafficPolicy:
      43.     tls:
      44.       mode: DISABLE
      45. ---
      46. EOF
      47. gateway.networking.istio.io/tracing-gateway created
      48. virtualservice.networking.istio.io/tracing-vs created
      49. destinationrule.networking.istio.io/tracing created

  2. 通过浏览器访问这些遥测插件。

    • Kiali：http://kiali.${INGRESS_DOMAIN}
    • Prometheus：http://prometheus.${INGRESS_DOMAIN}
    • Grafana：http://grafana.${INGRESS_DOMAIN}
    • Tracing：http://tracing.${INGRESS_DOMAIN}

清理

  • 移除所有相关的 Gateway：

    1. $ kubectl -n istio-system delete gateway grafana-gateway kiali-gateway prometheus-gateway tracing-gateway
    2. gateway.networking.istio.io "grafana-gateway" deleted
    3. gateway.networking.istio.io "kiali-gateway" deleted
    4. gateway.networking.istio.io "prometheus-gateway" deleted
    5. gateway.networking.istio.io "tracing-gateway" deleted

  • 移除所有相关的 Virtual Service：

    1. $ kubectl -n istio-system delete virtualservice grafana-vs kiali-vs prometheus-vs tracing-vs
    2. virtualservice.networking.istio.io "grafana-vs" deleted
    3. virtualservice.networking.istio.io "kiali-vs" deleted
    4. virtualservice.networking.istio.io "prometheus-vs" deleted
    5. virtualservice.networking.istio.io "tracing-vs" deleted

  • 移除所有相关的 Destination Rule：

    1. $ kubectl -n istio-system delete destinationrule grafana kiali prometheus tracing
    2. destinationrule.networking.istio.io "grafana" deleted
    3. destinationrule.networking.istio.io "kiali" deleted
    4. destinationrule.networking.istio.io "prometheus" deleted
    5. destinationrule.networking.istio.io "tracing" deleted