远程访问遥测插件

此任务说明如何配置 Istio 以显示和访问集群外部的遥测插件。

配置远程访问

远程访问遥测插件的方式有很多种。该任务涵盖了两种基本访问方式:安全的(通过 HTTPS)和不安全的(通过 HTTP)。对于任何生产或敏感环境,强烈建议 通过安全方式访问。不安全访问易于设置,但是无法保护在集群外传输的任何凭据或数据。

方式 1:安全访问(HTTPS)

安全访问需要一个服务器证书。按照这些步骤来为您的域名安装并配置服务器证书。

您也可以使用自签名证书。访问配置使用 SDS 通过 HTTPS 访问的安全网关任务以了解使用自签名证书访问集群内服务的详情。

本方式 涵盖了传输层的安全。您还应该配置遥测插件,使其暴露在外部时需要身份验证。

要安装相应的 Istio,使用下列安装选项:

  • —set values.gateways.enabled=true
  • —set values.gateways.istio-ingressgateway.enabled=true
  • —set values.gateways.istio-ingressgateway.sds.enabled=true要额外安装遥测插件,使用下列安装选项:

  • Grafana: —set values.grafana.enabled=true

  • Kiali: —set values.kiali.enabled=true
  • Prometheus: —set values.prometheus.enabled=true
  • Tracing: —set values.tracing.enabled=true

    • 为您的域名配置 DNS 记录。
  • 获取 istio-ingressgateway 的外部 IP 地址。

  1. $ kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
  2. <IP ADDRESS OF CLUSTER INGRESS>
  • 设置环境变量保存目标域名:
  1. $ TELEMETRY_DOMAIN=<your.desired.domain>
  • 通过您的域名提供商将所需的域名指向该外部 IP 地址。

实现此步骤的机制因提供商而异。以下是一些示例文档链接:

  1. - Bluehost: [DNS 管理增改删 DNS 条目](https://my.bluehost.com/hosting/help/559)
  2. - GoDaddy: [添加 A 记录](https://www.godaddy.com/help/add-an-a-record-19238)
  3. - Google Domains: [资源记录](https://support.google.com/domains/answer/3290350?hl=en)
  4. - Name.com: [添加 A 记录](https://www.name.com/support/articles/115004893508-Adding-an-A-record)
  • 验证 DNS 记录无误。
  1. $ dig +short $TELEMETRY_DOMAIN
  2. <IP ADDRESS OF CLUSTER INGRESS>
  • 生成服务器证书
  1. $ cat <<EOF | kubectl apply -f -
  2. apiVersion: certmanager.k8s.io/v1alpha1
  3. kind: Certificate
  4. metadata:
  5. name: telemetry-gw-cert
  6. namespace: istio-system
  7. spec:
  8. secretName: telemetry-gw-cert
  9. issuerRef:
  10. name: letsencrypt
  11. kind: ClusterIssuer
  12. commonName: $TELEMETRY_DOMAIN
  13. dnsNames:
  14. - $TELEMETRY_DOMAIN
  15. acme:
  16. config:
  17. - http01:
  18. ingressClass: istio
  19. domains:
  20. - $TELEMETRY_DOMAIN
  21. ---
  22. EOF
  23. certificate.certmanager.k8s.io "telemetry-gw-cert" created
  • 等待服务器证书准备就绪。
  1. $ JSONPATH='{range .items[*]}{@.metadata.name}:{range @.status.conditions[*]}{@.type}={@.status}{end}{end}' && kubectl -n istio-system get certificates -o jsonpath="$JSONPATH"
  2. telemetry-gw-cert:Ready=True
  • 应用遥测插件的网络配置。

    • 应用以下配置以暴露 Grafana:
  1. $ cat <<EOF | kubectl apply -f -
  2. apiVersion: networking.istio.io/v1alpha3
  3. kind: Gateway
  4. metadata:
  5. name: grafana-gateway
  6. namespace: istio-system
  7. spec:
  8. selector:
  9. istio: ingressgateway
  10. servers:
  11. - port:
  12. number: 15031
  13. name: https-grafana
  14. protocol: HTTPS
  15. tls:
  16. mode: SIMPLE
  17. serverCertificate: sds
  18. privateKey: sds
  19. credentialName: telemetry-gw-cert
  20. hosts:
  21. - "$TELEMETRY_DOMAIN"
  22. ---
  23. apiVersion: networking.istio.io/v1alpha3
  24. kind: VirtualService
  25. metadata:
  26. name: grafana-vs
  27. namespace: istio-system
  28. spec:
  29. hosts:
  30. - "$TELEMETRY_DOMAIN"
  31. gateways:
  32. - grafana-gateway
  33. http:
  34. - match:
  35. - port: 15031
  36. route:
  37. - destination:
  38. host: grafana
  39. port:
  40. number: 3000
  41. ---
  42. apiVersion: networking.istio.io/v1alpha3
  43. kind: DestinationRule
  44. metadata:
  45. name: grafana
  46. namespace: istio-system
  47. spec:
  48. host: grafana
  49. trafficPolicy:
  50. tls:
  51. mode: DISABLE
  52. ---
  53. EOF
  54. gateway.networking.istio.io "grafana-gateway" configured
  55. virtualservice.networking.istio.io "grafana-vs" configured
  56. destinationrule.networking.istio.io "grafana" configured
  • 应用以下配置以暴露 Kiali:
  1. $ cat <<EOF | kubectl apply -f -
  2. apiVersion: networking.istio.io/v1alpha3
  3. kind: Gateway
  4. metadata:
  5. name: kiali-gateway
  6. namespace: istio-system
  7. spec:
  8. selector:
  9. istio: ingressgateway
  10. servers:
  11. - port:
  12. number: 15029
  13. name: https-kiali
  14. protocol: HTTPS
  15. tls:
  16. mode: SIMPLE
  17. serverCertificate: sds
  18. privateKey: sds
  19. credentialName: telemetry-gw-cert
  20. hosts:
  21. - "$TELEMETRY_DOMAIN"
  22. ---
  23. apiVersion: networking.istio.io/v1alpha3
  24. kind: VirtualService
  25. metadata:
  26. name: kiali-vs
  27. namespace: istio-system
  28. spec:
  29. hosts:
  30. - "$TELEMETRY_DOMAIN"
  31. gateways:
  32. - kiali-gateway
  33. http:
  34. - match:
  35. - port: 15029
  36. route:
  37. - destination:
  38. host: kiali
  39. port:
  40. number: 20001
  41. ---
  42. apiVersion: networking.istio.io/v1alpha3
  43. kind: DestinationRule
  44. metadata:
  45. name: kiali
  46. namespace: istio-system
  47. spec:
  48. host: kiali
  49. trafficPolicy:
  50. tls:
  51. mode: DISABLE
  52. ---
  53. EOF
  54. gateway.networking.istio.io "kiali-gateway" configured
  55. virtualservice.networking.istio.io "kiali-vs" configured
  56. destinationrule.networking.istio.io "kiali" configured
  • 应用以下配置以暴露 Prometheus:
  1. $ cat <<EOF | kubectl apply -f -
  2. apiVersion: networking.istio.io/v1alpha3
  3. kind: Gateway
  4. metadata:
  5. name: prometheus-gateway
  6. namespace: istio-system
  7. spec:
  8. selector:
  9. istio: ingressgateway
  10. servers:
  11. - port:
  12. number: 15030
  13. name: https-prom
  14. protocol: HTTPS
  15. tls:
  16. mode: SIMPLE
  17. serverCertificate: sds
  18. privateKey: sds
  19. credentialName: telemetry-gw-cert
  20. hosts:
  21. - "$TELEMETRY_DOMAIN"
  22. ---
  23. apiVersion: networking.istio.io/v1alpha3
  24. kind: VirtualService
  25. metadata:
  26. name: prometheus-vs
  27. namespace: istio-system
  28. spec:
  29. hosts:
  30. - "$TELEMETRY_DOMAIN"
  31. gateways:
  32. - prometheus-gateway
  33. http:
  34. - match:
  35. - port: 15030
  36. route:
  37. - destination:
  38. host: prometheus
  39. port:
  40. number: 9090
  41. ---
  42. apiVersion: networking.istio.io/v1alpha3
  43. kind: DestinationRule
  44. metadata:
  45. name: prometheus
  46. namespace: istio-system
  47. spec:
  48. host: prometheus
  49. trafficPolicy:
  50. tls:
  51. mode: DISABLE
  52. ---
  53. EOF
  54. gateway.networking.istio.io "prometheus-gateway" configured
  55. virtualservice.networking.istio.io "prometheus-vs" configured
  56. destinationrule.networking.istio.io "prometheus" configured
  • 应用以下配置以暴露跟踪服务:
  1. $ cat <<EOF | kubectl apply -f -
  2. apiVersion: networking.istio.io/v1alpha3
  3. kind: Gateway
  4. metadata:
  5. name: tracing-gateway
  6. namespace: istio-system
  7. spec:
  8. selector:
  9. istio: ingressgateway
  10. servers:
  11. - port:
  12. number: 15032
  13. name: https-tracing
  14. protocol: HTTPS
  15. tls:
  16. mode: SIMPLE
  17. serverCertificate: sds
  18. privateKey: sds
  19. credentialName: telemetry-gw-cert
  20. hosts:
  21. - "$TELEMETRY_DOMAIN"
  22. ---
  23. apiVersion: networking.istio.io/v1alpha3
  24. kind: VirtualService
  25. metadata:
  26. name: tracing-vs
  27. namespace: istio-system
  28. spec:
  29. hosts:
  30. - "$TELEMETRY_DOMAIN"
  31. gateways:
  32. - tracing-gateway
  33. http:
  34. - match:
  35. - port: 15032
  36. route:
  37. - destination:
  38. host: tracing
  39. port:
  40. number: 80
  41. ---
  42. apiVersion: networking.istio.io/v1alpha3
  43. kind: DestinationRule
  44. metadata:
  45. name: tracing
  46. namespace: istio-system
  47. spec:
  48. host: tracing
  49. trafficPolicy:
  50. tls:
  51. mode: DISABLE
  52. ---
  53. EOF
  54. gateway.networking.istio.io "tracing-gateway" configured
  55. virtualservice.networking.istio.io "tracing-vs" configured
  56. destinationrule.networking.istio.io "tracing" configured

方式 2:不安全访问(HTTP)

  • 安装 Istio 到您的集群并启用您所需要的遥测插件。

要额外安装这些遥测插件,使用下列安装选项:

  • Grafana: —set values.grafana.enabled=true
  • Kiali: —set values.kiali.enabled=true
  • Prometheus: —set values.prometheus.enabled=true
  • Tracing: —set values.tracing.enabled=true

    • 应用遥测插件的网络配置。
  • 应用以下配置以暴露 Grafana:

  1. $ cat <<EOF | kubectl apply -f -
  2. apiVersion: networking.istio.io/v1alpha3
  3. kind: Gateway
  4. metadata:
  5. name: grafana-gateway
  6. namespace: istio-system
  7. spec:
  8. selector:
  9. istio: ingressgateway
  10. servers:
  11. - port:
  12. number: 15031
  13. name: http-grafana
  14. protocol: HTTP
  15. hosts:
  16. - "*"
  17. ---
  18. apiVersion: networking.istio.io/v1alpha3
  19. kind: VirtualService
  20. metadata:
  21. name: grafana-vs
  22. namespace: istio-system
  23. spec:
  24. hosts:
  25. - "*"
  26. gateways:
  27. - grafana-gateway
  28. http:
  29. - match:
  30. - port: 15031
  31. route:
  32. - destination:
  33. host: grafana
  34. port:
  35. number: 3000
  36. ---
  37. apiVersion: networking.istio.io/v1alpha3
  38. kind: DestinationRule
  39. metadata:
  40. name: grafana
  41. namespace: istio-system
  42. spec:
  43. host: grafana
  44. trafficPolicy:
  45. tls:
  46. mode: DISABLE
  47. ---
  48. EOF
  49. gateway.networking.istio.io "grafana-gateway" configured
  50. virtualservice.networking.istio.io "grafana-vs" configured
  51. destinationrule.networking.istio.io "grafana" configured
  • 应用以下配置以暴露 Kiali:
  1. $ cat <<EOF | kubectl apply -f -
  2. apiVersion: networking.istio.io/v1alpha3
  3. kind: Gateway
  4. metadata:
  5. name: kiali-gateway
  6. namespace: istio-system
  7. spec:
  8. selector:
  9. istio: ingressgateway
  10. servers:
  11. - port:
  12. number: 15029
  13. name: http-kiali
  14. protocol: HTTP
  15. hosts:
  16. - "*"
  17. ---
  18. apiVersion: networking.istio.io/v1alpha3
  19. kind: VirtualService
  20. metadata:
  21. name: kiali-vs
  22. namespace: istio-system
  23. spec:
  24. hosts:
  25. - "*"
  26. gateways:
  27. - kiali-gateway
  28. http:
  29. - match:
  30. - port: 15029
  31. route:
  32. - destination:
  33. host: kiali
  34. port:
  35. number: 20001
  36. ---
  37. apiVersion: networking.istio.io/v1alpha3
  38. kind: DestinationRule
  39. metadata:
  40. name: kiali
  41. namespace: istio-system
  42. spec:
  43. host: kiali
  44. trafficPolicy:
  45. tls:
  46. mode: DISABLE
  47. ---
  48. EOF
  49. gateway.networking.istio.io "kiali-gateway" configured
  50. virtualservice.networking.istio.io "kiali-vs" configured
  51. destinationrule.networking.istio.io "kiali" configured
  • 应用以下配置以暴露 Prometheus:
  1. $ cat <<EOF | kubectl apply -f -
  2. apiVersion: networking.istio.io/v1alpha3
  3. kind: Gateway
  4. metadata:
  5. name: prometheus-gateway
  6. namespace: istio-system
  7. spec:
  8. selector:
  9. istio: ingressgateway
  10. servers:
  11. - port:
  12. number: 15030
  13. name: http-prom
  14. protocol: HTTP
  15. hosts:
  16. - "*"
  17. ---
  18. apiVersion: networking.istio.io/v1alpha3
  19. kind: VirtualService
  20. metadata:
  21. name: prometheus-vs
  22. namespace: istio-system
  23. spec:
  24. hosts:
  25. - "*"
  26. gateways:
  27. - prometheus-gateway
  28. http:
  29. - match:
  30. - port: 15030
  31. route:
  32. - destination:
  33. host: prometheus
  34. port:
  35. number: 9090
  36. ---
  37. apiVersion: networking.istio.io/v1alpha3
  38. kind: DestinationRule
  39. metadata:
  40. name: prometheus
  41. namespace: istio-system
  42. spec:
  43. host: prometheus
  44. trafficPolicy:
  45. tls:
  46. mode: DISABLE
  47. ---
  48. EOF
  49. gateway.networking.istio.io "prometheus-gateway" configured
  50. virtualservice.networking.istio.io "prometheus-vs" configured
  51. destinationrule.networking.istio.io "prometheus" configured
  • 应用以下配置以暴露跟踪服务:
  1. $ cat <<EOF | kubectl apply -f -
  2. apiVersion: networking.istio.io/v1alpha3
  3. kind: Gateway
  4. metadata:
  5. name: tracing-gateway
  6. namespace: istio-system
  7. spec:
  8. selector:
  9. istio: ingressgateway
  10. servers:
  11. - port:
  12. number: 15032
  13. name: http-tracing
  14. protocol: HTTP
  15. hosts:
  16. - "*"
  17. ---
  18. apiVersion: networking.istio.io/v1alpha3
  19. kind: VirtualService
  20. metadata:
  21. name: tracing-vs
  22. namespace: istio-system
  23. spec:
  24. hosts:
  25. - "*"
  26. gateways:
  27. - tracing-gateway
  28. http:
  29. - match:
  30. - port: 15032
  31. route:
  32. - destination:
  33. host: tracing
  34. port:
  35. number: 80
  36. ---
  37. apiVersion: networking.istio.io/v1alpha3
  38. kind: DestinationRule
  39. metadata:
  40. name: tracing
  41. namespace: istio-system
  42. spec:
  43. host: tracing
  44. trafficPolicy:
  45. tls:
  46. mode: DISABLE
  47. ---
  48. EOF
  49. gateway.networking.istio.io "tracing-gateway" configured
  50. virtualservice.networking.istio.io "tracing-vs" configured
  51. destinationrule.networking.istio.io "tracing" configured
  • 通过浏览器访问这些遥测插件。

    • Kiali: http://<IP ADDRESS OF CLUSTER INGRESS>:15029/
    • Prometheus: http://<IP ADDRESS OF CLUSTER INGRESS>:15030/
    • Grafana: http://<IP ADDRESS OF CLUSTER INGRESS>:15031/
    • Tracing: http://<IP ADDRESS OF CLUSTER INGRESS>:15032/

清除

  • 移除所有相关的网关:
  1. $ kubectl -n istio-system delete gateway grafana-gateway kiali-gateway prometheus-gateway tracing-gateway
  2. gateway.networking.istio.io "grafana-gateway" deleted
  3. gateway.networking.istio.io "kiali-gateway" deleted
  4. gateway.networking.istio.io "prometheus-gateway" deleted
  5. gateway.networking.istio.io "tracing-gateway" deleted
  • 移除所有相关的 Virtual Services:
  1. $ kubectl -n istio-system delete virtualservice grafana-vs kiali-vs prometheus-vs tracing-vs
  2. virtualservice.networking.istio.io "grafana-vs" deleted
  3. virtualservice.networking.istio.io "kiali-vs" deleted
  4. virtualservice.networking.istio.io "prometheus-vs" deleted
  5. virtualservice.networking.istio.io "tracing-vs" deleted
  • 如果安装了网关证书,移除它:
  1. $ kubectl -n istio-system delete certificate telemetry-gw-cert
  2. certificate.certmanager.k8s.io "telemetry-gw-cert" deleted

相关内容

Jaeger

了解如何配置代理以向 Jaeger 发送追踪请求。

Zipkin

了解如何通过配置代理以将追踪请求发送到 Zipkin。

LightStep

怎样配置代理才能把追踪请求发送到 LightStep。

概述

Istio 分布式追踪的概述。

用于隔离和边界保护的多网格部署

将需要隔离的环境部署到单独的网格中,并通过网格联邦启用网格间通信。

Istio 中安全管控出口流量,第三部分

管控出口流量的备选方案比较,包括性能因素。