镜像

此任务演示了 Istio 的流量镜像功能。

流量镜像，也称为影子流量，是一个以尽可能低的风险为生产带来变化的强大的功能。镜像会将实时流量的副本发送到镜像服务。镜像流量发生在主服务的关键请求路径之外。

在此任务中，首先把流量全部路由到 v1 版本的测试服务。然后，执行规则将一部分流量镜像到 v2 版本。

开始之前

  • 按照安装指南中的说明设置 Istio。

  • 首先部署两个版本的 httpbin 服务，httpbin 服务已开启访问日志：

    httpbin-v1:

    1. $ cat <<EOF | istioctl kube-inject -f - | kubectl create -f -
    2. apiVersion: apps/v1
    3. kind: Deployment
    4. metadata:
    5.   name: httpbin-v1
    6. spec:
    7.   replicas: 1
    8.   selector:
    9.     matchLabels:
    10.       app: httpbin
    11.       version: v1
    12.   template:
    13.     metadata:
    14.       labels:
    15.         app: httpbin
    16.         version: v1
    17.     spec:
    18.       containers:
    19.       - image: docker.io/kennethreitz/httpbin
    20.         imagePullPolicy: IfNotPresent
    21.         name: httpbin
    22.         command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]
    23.         ports:
    24.         - containerPort: 80
    25. EOF

    httpbin-v2:

    1. $ cat <<EOF | istioctl kube-inject -f - | kubectl create -f -
    2. apiVersion: apps/v1
    3. kind: Deployment
    4. metadata:
    5.   name: httpbin-v2
    6. spec:
    7.   replicas: 1
    8.   selector:
    9.     matchLabels:
    10.       app: httpbin
    11.       version: v2
    12.   template:
    13.     metadata:
    14.       labels:
    15.         app: httpbin
    16.         version: v2
    17.     spec:
    18.       containers:
    19.       - image: docker.io/kennethreitz/httpbin
    20.         imagePullPolicy: IfNotPresent
    21.         name: httpbin
    22.         command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]
    23.         ports:
    24.         - containerPort: 80
    25. EOF

    httpbin Kubernetes service:

    1. $ kubectl create -f - <<EOF
    2. apiVersion: v1
    3. kind: Service
    4. metadata:
    5.   name: httpbin
    6.   labels:
    7.     app: httpbin
    8. spec:
    9.   ports:
    10.   - name: http
    11.     port: 8000
    12.     targetPort: 80
    13.   selector:
    14.     app: httpbin
    15. EOF

  • 启动 sleep 服务，这样就可以使用 curl 来提供负载了：

    sleep service:

    1. $ cat <<EOF | istioctl kube-inject -f - | kubectl create -f -
    2. apiVersion: apps/v1
    3. kind: Deployment
    4. metadata:
    5.   name: sleep
    6. spec:
    7.   replicas: 1
    8.   selector:
    9.     matchLabels:
    10.       app: sleep
    11.   template:
    12.     metadata:
    13.       labels:
    14.         app: sleep
    15.     spec:
    16.       containers:
    17.       - name: sleep
    18.         image: tutum/curl
    19.         command: ["/bin/sleep","infinity"]
    20.         imagePullPolicy: IfNotPresent
    21. EOF

创建一个默认路由策略

默认情况下，Kubernetes 在 httpbin 服务的两个版本之间进行负载均衡。在此步骤中会更改该行为，把所有流量都路由到 v1。

  1. 创建一个默认路由规则，将所有流量路由到服务的 v1：

    如果安装/配置 Istio 的时候开启了 TLS 认证，在应用 DestinationRule 之前必须将 TLS 流量策略 mode: ISTIO_MUTUAL 添加到 DestinationRule。否则，请求将发生 503 错误，如设置目标规则后出现 503 错误所述。

    1. $ kubectl apply -f - <<EOF
    2. apiVersion: networking.istio.io/v1alpha3
    3. kind: VirtualService
    4. metadata:
    5.   name: httpbin
    6. spec:
    7.   hosts:
    8.     - httpbin
    9.   http:
    10.   - route:
    11.     - destination:
    12.         host: httpbin
    13.         subset: v1
    14.       weight: 100
    15. ---
    16. apiVersion: networking.istio.io/v1alpha3
    17. kind: DestinationRule
    18. metadata:
    19.   name: httpbin
    20. spec:
    21.   host: httpbin
    22.   subsets:
    23.   - name: v1
    24.     labels:
    25.       version: v1
    26.   - name: v2
    27.     labels:
    28.       version: v2
    29. EOF

    现在所有流量都转到httpbin:v1服务。

  2. 向服务发送一下流量：

    1. $ export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
    2. $ kubectl exec -it $SLEEP_POD -c sleep -- sh -c 'curl  http://httpbin:8000/headers' | python -m json.tool
    3. {
    4.   "headers": {
    5.     "Accept": "*/*",
    6.     "Content-Length": "0",
    7.     "Host": "httpbin:8000",
    8.     "User-Agent": "curl/7.35.0",
    9.     "X-B3-Sampled": "1",
    10.     "X-B3-Spanid": "eca3d7ed8f2e6a0a",
    11.     "X-B3-Traceid": "eca3d7ed8f2e6a0a",
    12.     "X-Ot-Span-Context": "eca3d7ed8f2e6a0a;eca3d7ed8f2e6a0a;0000000000000000"
    13.   }
    14. }

  3. 分别查看 httpbin 服务 v1 和 v2 两个 pods 的日志，您可以看到访问日志进入 v1，而 v2 中没有日志，显示为 <none>：

    1. $ export V1_POD=$(kubectl get pod -l app=httpbin,version=v1 -o jsonpath={.items..metadata.name})
    2. $ kubectl logs -f $V1_POD -c httpbin
    3. 127.0.0.1 - - [07/Mar/2018:19:02:43 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"
    1. $ export V2_POD=$(kubectl get pod -l app=httpbin,version=v2 -o jsonpath={.items..metadata.name})
    2. $ kubectl logs -f $V2_POD -c httpbin
    3. <none>

镜像流量到 v2

  1. 改变流量规则将流量镜像到 v2：

    1. $ kubectl apply -f - <<EOF
    2. apiVersion: networking.istio.io/v1alpha3
    3. kind: VirtualService
    4. metadata:
    5.   name: httpbin
    6. spec:
    7.   hosts:
    8.     - httpbin
    9.   http:
    10.   - route:
    11.     - destination:
    12.         host: httpbin
    13.         subset: v1
    14.       weight: 100
    15.     mirror:
    16.       host: httpbin
    17.       subset: v2
    18.     mirror_percent: 100
    19. EOF

    这个路由规则发送 100% 流量到 v1。最后一段表示你将镜像流量到 httpbin:v2 服务。当流量被镜像时，请求将发送到镜像服务中，并在 headers 中的 Host/Authority 属性值上追加 -shadow。例如 cluster-1 变为 cluster-1-shadow。

    此外，重点注意这些被镜像的流量是『 即发即弃』 的，就是说镜像请求的响应会被丢弃。

    您可以使用 mirror_percent 属性来设置镜像流量的百分比，而不是镜像全部请求。为了兼容老版本，如果这个属性不存在，将镜像所有流量。

  2. 发送流量：

    1. $ kubectl exec -it $SLEEP_POD -c sleep -- sh -c 'curl  http://httpbin:8000/headers' | python -m json.tool

    现在就可以看到 v1 和 v2 中都有了访问日志。v2 中的访问日志就是由镜像流量产生的，这些请求的实际目标是 v1。

    1. $ kubectl logs -f $V1_POD -c httpbin
    2. 127.0.0.1 - - [07/Mar/2018:19:02:43 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"
    3. 127.0.0.1 - - [07/Mar/2018:19:26:44 +0000] "GET /headers HTTP/1.1" 200 321 "-" "curl/7.35.0"
    1. $ kubectl logs -f $V2_POD -c httpbin
    2. 127.0.0.1 - - [07/Mar/2018:19:26:44 +0000] "GET /headers HTTP/1.1" 200 361 "-" "curl/7.35.0"

  3. 如果要检查流量内部，请在另一个控制台上运行以下命令：

    ``` $ export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) $ export V1_POD_IP=$(kubectl get pod -l app=httpbin,version=v1 -o jsonpath={.items..status.podIP}) $ export V2_POD_IP=$(kubectl get pod -l app=httpbin,version=v2 -o jsonpath={.items..status.podIP}) $ kubectl exec -it $SLEEP_POD -c istio-proxy — sudo tcpdump -A -s 0 host $V1_POD_IP or host $V2_POD_IP tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 05:47:50.159513 IP sleep-7b9f8bfcd-2djx5.38836 > 10-233-75-11.httpbin.default.svc.cluster.local.80: Flags [P.], seq 4039989036:4039989832, ack 3139734980, win 254, options [nop,nop,TS val 77427918 ecr 76730809], length 796: HTTP: GET /headers HTTP/1.1 E..P2.X.X.X. .K. .K….P..W,.$…….+….. ..t…..GET /headers HTTP/1.1 host: httpbin:8000 user-agent: curl/7.35.0 accept: / x-forwarded-proto: http x-request-id: 571c0fd6-98d4-4c93-af79-6a2fe2945847 x-envoy-decorator-operation: httpbin.default.svc.cluster.local:8000/* x-b3-traceid: 82f3e0a76dcebca2 x-b3-spanid: 82f3e0a76dcebca2 x-b3-sampled: 0 x-istio-attributes: Cj8KGGRlc3RpbmF0aW9uLnNlcnZpY2UuaG9zdBIjEiFodHRwYmluLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwKPQoXZGVzdGluYXRpb24uc2VydmljZS51aWQSIhIgaXN0aW86Ly9kZWZhdWx0L3NlcnZpY2VzL2h0dHBiaW4KKgodZGVzdGluYXRpb24uc2VydmljZS5uYW1lc3BhY2USCRIHZGVmYXVsdAolChhkZXN0aW5hdGlvbi5zZXJ2aWNlLm5hbWUSCRIHaHR0cGJpbgo6Cgpzb3VyY2UudWlkEiwSKmt1YmVybmV0ZXM6Ly9zbGVlcC03YjlmOGJmY2QtMmRqeDUuZGVmYXVsdAo6ChNkZXN0aW5hdGlvbi5zZXJ2aWNlEiMSIWh0dHBiaW4uZGVmYXVsdC5zdmMuY2x1c3Rlci5sb2NhbA== content-length: 0

  1. 05:47:50.159609 IP sleep-7b9f8bfcd-2djx5.49560 > 10-233-71-7.httpbin.default.svc.cluster.local.80: Flags [P.], seq 296287713:296288571, ack 4029574162, win 254, options [nop,nop,TS val 77427918 ecr 76732809], length 858: HTTP: GET /headers HTTP/1.1
  2. E.....X.X...
  3. .K.
  4. .G....P......l......e.....
  5. ..t.....GET /headers HTTP/1.1
  6. host: httpbin-shadow:8000
  7. user-agent: curl/7.35.0
  8. accept: */*
  9. x-forwarded-proto: http
  10. x-request-id: 571c0fd6-98d4-4c93-af79-6a2fe2945847
  11. x-envoy-decorator-operation: httpbin.default.svc.cluster.local:8000/*
  12. x-b3-traceid: 82f3e0a76dcebca2
  13. x-b3-spanid: 82f3e0a76dcebca2
  14. x-b3-sampled: 0
  15. x-istio-attributes: Cj8KGGRlc3RpbmF0aW9uLnNlcnZpY2UuaG9zdBIjEiFodHRwYmluLmRlZmF1bHQuc3ZjLmNsdXN0ZXIubG9jYWwKPQoXZGVzdGluYXRpb24uc2VydmljZS51aWQSIhIgaXN0aW86Ly9kZWZhdWx0L3NlcnZpY2VzL2h0dHBiaW4KKgodZGVzdGluYXRpb24uc2VydmljZS5uYW1lc3BhY2USCRIHZGVmYXVsdAolChhkZXN0aW5hdGlvbi5zZXJ2aWNlLm5hbWUSCRIHaHR0cGJpbgo6Cgpzb3VyY2UudWlkEiwSKmt1YmVybmV0ZXM6Ly9zbGVlcC03YjlmOGJmY2QtMmRqeDUuZGVmYXVsdAo6ChNkZXN0aW5hdGlvbi5zZXJ2aWNlEiMSIWh0dHBiaW4uZGVmYXVsdC5zdmMuY2x1c3Rlci5sb2NhbA==
  16. x-envoy-internal: true
  17. x-forwarded-for: 10.233.75.12
  18. content-length: 0
  21. 05:47:50.166734 IP 10-233-75-11.httpbin.default.svc.cluster.local.80 > sleep-7b9f8bfcd-2djx5.38836: Flags [P.], seq 1:472, ack 796, win 276, options [nop,nop,TS val 77427925 ecr 77427918], length 471: HTTP: HTTP/1.1 200 OK
  22. E....3X.?...
  23. .K.
  24. .K..P...$....ZH...........
  25. ..t...t.HTTP/1.1 200 OK
  26. server: envoy
  27. date: Fri, 15 Feb 2019 05:47:50 GMT
  28. content-type: application/json
  29. content-length: 241
  30. access-control-allow-origin: *
  31. access-control-allow-credentials: true
  32. x-envoy-upstream-service-time: 3
  34. {
  35.   "headers": {
  36.     "Accept": "*/*",
  37.     "Content-Length": "0",
  38.     "Host": "httpbin:8000",
  39.     "User-Agent": "curl/7.35.0",
  40.     "X-B3-Sampled": "0",
  41.     "X-B3-Spanid": "82f3e0a76dcebca2",
  42.     "X-B3-Traceid": "82f3e0a76dcebca2"
  43.   }
  44. }
  46. 05:47:50.166789 IP sleep-7b9f8bfcd-2djx5.38836 > 10-233-75-11.httpbin.default.svc.cluster.local.80: Flags [.], ack 472, win 262, options [nop,nop,TS val 77427925 ecr 77427925], length 0
  47. E..42.X.X.\.
  48. .K.
  49. .K....P..ZH.$.............
  50. ..t...t.
  51. 05:47:50.167234 IP 10-233-71-7.httpbin.default.svc.cluster.local.80 > sleep-7b9f8bfcd-2djx5.49560: Flags [P.], seq 1:512, ack 858, win 280, options [nop,nop,TS val 77429926 ecr 77427918], length 511: HTTP: HTTP/1.1 200 OK
  52. E..3..X.>...
  53. .G.
  54. .K..P....l....;...........
  55. ..|...t.HTTP/1.1 200 OK
  56. server: envoy
  57. date: Fri, 15 Feb 2019 05:47:49 GMT
  58. content-type: application/json
  59. content-length: 281
  60. access-control-allow-origin: *
  61. access-control-allow-credentials: true
  62. x-envoy-upstream-service-time: 3
  64. {
  65.   "headers": {
  66.     "Accept": "*/*",
  67.     "Content-Length": "0",
  68.     "Host": "httpbin-shadow:8000",
  69.     "User-Agent": "curl/7.35.0",
  70.     "X-B3-Sampled": "0",
  71.     "X-B3-Spanid": "82f3e0a76dcebca2",
  72.     "X-B3-Traceid": "82f3e0a76dcebca2",
  73.     "X-Envoy-Internal": "true"
  74.   }
  75. }
  77. 05:47:50.167253 IP sleep-7b9f8bfcd-2djx5.49560 > 10-233-71-7.httpbin.default.svc.cluster.local.80: Flags [.], ack 512, win 262, options [nop,nop,TS val 77427926 ecr 77429926], length 0
  78. E..4..X.X...
  79. .K.
  80. .G....P...;..n............
  81. ..t...|.
  82. ```
  84. 您可以看到流量​​ 的请求和响应内容。

清理

  1. 删除规则：

    1. $ kubectl delete virtualservice httpbin
    2. $ kubectl delete destinationrule httpbin

  2. 关闭 httpbin 服务和客户端：

    1. $ kubectl delete deploy httpbin-v1 httpbin-v2 sleep
    2. $ kubectl delete svc httpbin

相关内容

用于在生产环境进行测试的 Istio 流量镜像功能

介绍更安全，低风险的部署和发布到生产。

使用 Admiral 管理 Istio 多集群的配置和服务发现

为 Istio deployment（cluster）提供自动化 Istio 配置，并让其像单个网格一样工作。

把 Istio 作为外部服务的代理

把 Istio 入口网关配置为外部服务的代理。

用于隔离和边界保护的多网格部署

将需要隔离的环境部署到单独的网格中，并通过网格联邦启用网格间通信。

Istio 中安全管控出口流量，第三部分

管控出口流量的备选方案比较，包括性能因素。

Istio 中的安全管控出口流量，第二部分

使用 Istio 的出口流量管控来阻止相关出口流量攻击。