1. 前言
轉(zhuǎn)載請說明原文出處, 尊重他人勞動成果!
源碼位置: https://github.com/nicktming/istio
分支: tming-v1.3.6 (基于1.3.6版本)
2. 安裝 sidecar
[root@master istio.io]# pwd
/root/go/src/istio.io
[root@master istio.io]# git clone https://github.com/nicktming/istio.git
[root@master istio]# kubectl get nodes
NAME STATUS ROLES AGE VERSION
master Ready <none> 23d v1.15.3
node NotReady <none> 23d v1.15.3
node2 NotReady <none> 8d v1.15.3
[root@master istio]#
[root@master istio]# kubectl create ns istio-system
ca.crt是api-server根證書, 放到certs目錄下.
生成secret,istio.istio-sidecar-injector-service-account, 其實該secret是由組件citadel來自動生成秘鑰并簽名.
[root@master default]# pwd
/root/go/src/istio.io/istio/configuration/default
[root@master default]# ls
certs cm.yaml examples files istio.yaml sidecar.yaml webhook-create-signed-cert.sh
[root@master default]# ls certs/ca.crt
certs/ca.crt
[root@master default]# ./webhook-create-signed-cert.sh
root@master default]# kubectl get secret -n istio-system
NAME TYPE DATA AGE
default-token-jm6jv kubernetes.io/service-account-token 3 75m
istio.istio-sidecar-injector-service-account Opaque 3 75m
部署一些配置文件
[root@master default]# kubectl apply -f cm.yaml
[root@master default]# kubectl apply -f sidecar.yaml
[root@master default]# kubectl get pods -n istio-system
NAME READY STATUS RESTARTS AGE
istio-sidecar-injector-84d5c488d9-6kj6s 1/1 Running 0 59m
root@master default]# kubectl get cm -n istio-system
NAME DATA AGE
istio 2 64m
istio-sidecar-injector 2 64m
測試一個例子
[root@master default]# kubectl creat ns tming
[root@master default]# kubectl label namespace ns istio-injection=enabled
[root@master default]# kubectl apply -f examples/busybox.yaml -n tming
[root@master default]# kubectl get pods -n tming
NAME READY STATUS RESTARTS AGE
test-sidecar 1/2 Running 0 47m
[root@master default]# kubectl logs test-sidecar istio-proxy -n tming
...
2020-01-19T14:40:25.392967Z info Envoy proxy is NOT ready: config not received from Pilot (is Pilot running?): cds updates: 0 successful, 0 rejected; lds updates: 0 successful, 0 rejected
[root@master default]#
已經(jīng)成功, 但是
envoy沒有連上pilot, 所以接下來將以二進制形式運行pilot.
3. pilot 和 galley
在運行
pilot之前, 將所有crd全部部署上.
3.1 部署crd
[root@master default]# pwd
/root/go/src/istio.io/istio/configuration/default
[root@master default]# kubectl apply -f files/
customresourcedefinition.apiextensions.k8s.io/virtualservices.networking.istio.io created
...
customresourcedefinition.apiextensions.k8s.io/challenges.certmanager.k8s.io created
3.2 運行pilot
[root@master pilot-discovery]# pwd
/root/go/src/istio.io/istio/pilot/cmd/pilot-discovery
[root@master pilot-discovery]# ./run.sh
...
2020-01-20T06:38:19.808058Z info starting discovery service at http=[::]:9090 grpc=[::]:15010
2020-01-20T06:38:19.821669Z info ads Push debounce stable[2] 15: 100.027975ms since last change, 100.089227ms since last push, full=true
2020-01-20T06:38:19.821869Z info ads XDS: Pushing:2020-01-20T14:38:19+08:00/1 Services:3 ConnectedEndpoints:0
2020-01-20T06:38:19.821883Z info ads Cluster init time 364ns 2020-01-20T14:38:19+08:00/1
2020-01-20T06:38:29.308073Z info ads Push Status: {
"ProxyStatus": {}
}
3.3 運行g(shù)alley
[root@master galley]# pwd
/root/go/src/istio.io/istio/galley/cmd/galley
[root@master galley]# ./run.sh
...
2020-01-20T06:38:19.722421Z info mcp Watch(): created watch 32 for istio/rbac/v1alpha1/servicerolebindings from group "default", version "0"
4. 驗證
[root@master ~]# kubectl get pods -n tming
NAME READY STATUS RESTARTS AGE
test-sidecar 1/2 Running 0 16h
驗證發(fā)現(xiàn)sidecar還是沒有連上
pilot, 這是因為pilot-agent連的是默認配置的地址.
[root@master ~]# kubectl -n tming get pod test-sidecar -o yaml
...
- --discoveryAddress
- istio-pilot.istio-system:15010
...
因此需要修改配置才可以, 在
istio-sidecar-injector(configMap)中找到discoveryAddress屬性將原先的配置"{{ annotation .ObjectMeta `sidecar.istio.io/discoveryAddress` .ProxyConfig.DiscoveryAddress }}"改成172.31.71.181:15010(換成自己的ip即可)
[root@master istio]# kubectl apply -f configuration/default/cm.yaml
[root@master istio]# kubectl get pods -n tming
NAME READY STATUS RESTARTS AGE
test-sidecar 2/2 Running 0 35s
如果有問題, 可以重啟
sidecar這個pod.
可以看到已經(jīng)正常運行了, 接下來部署一個ingress-gateway來統(tǒng)一入口.
5. 部署ingress-gateway
[root@master istio]# pwd
/root/go/src/istio.io/istio
[root@master istio]# kubectl apply -f configuration/default/ingress-gateway.yaml
deployment.apps/istio-ingressgateway created
service/istio-policy created
service/istio-telemetry created
[root@master istio]# kubectl get pods,svc,MutatingWebhookConfiguration -n istio-system
NAME READY STATUS RESTARTS AGE
pod/istio-ingressgateway-768778694-sz9kw 1/1 Running 0 30m
pod/istio-sidecar-injector-84d5c488d9-jqnx9 1/1 Running 0 41m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/istio-ingressgateway LoadBalancer 169.169.242.173 <pending> 15020:15143/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:2880/TCP,15030:42855/TCP,15031:33520/TCP,15032:10091/TCP,15443:42831/TCP 41s
service/istio-sidecar-injector ClusterIP 169.169.226.113 <none> 443/TCP,15014/TCP 19h
NAME CREATED AT
mutatingwebhookconfiguration.admissionregistration.k8s.io/istio-sidecar-injector 2020-01-19T13:28:17Z
[root@master istio]#
6. 驗證bookinfo
[root@master istio]# kubectl label ns default instio-injection=enabled
namespace/default labeled
[root@master istio]# kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
service/details created
...
deployment.apps/productpage-v1 created
[root@master istio]#
[root@master istio]# kubectl get pods
NAME READY STATUS RESTARTS AGE
details-v1-74f858558f-tb2pl 2/2 Running 0 69s
productpage-v1-8554d58bff-twxnc 2/2 Running 0 67s
ratings-v1-7855f5bcb9-76dwb 2/2 Running 0 67s
reviews-v1-59fd8b965b-cf8v9 2/2 Running 0 68s
reviews-v2-d6cfdb7d6-n74tg 2/2 Running 0 68s
reviews-v3-75699b5cfb-txmpt 2/2 Running 0 68s
[root@master istio]# kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
[root@master istio]# kubectl get gw,vs
NAME AGE
gateway.networking.istio.io/bookinfo-gateway 10m
NAME GATEWAYS HOSTS AGE
virtualservice.networking.istio.io/bookinfo [bookinfo-gateway] [*] 10m
查看
ingress-gateway的80端口對應(yīng)的nodeport.
[root@master istio]# kubectl get svc istio-ingressgateway -n istio-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
istio-ingressgateway LoadBalancer 169.169.242.173 <pending> 15020:15143/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:2880/TCP,15030:42855/TCP,15031:33520/TCP,15032:10091/TCP,15443:42831/TCP 57m
[root@master istio]#
訪問
節(jié)點ip:31380效果如下:
pic.png
7. 總結(jié)
把各個組件拆分開用二進制運行可以方便研究源碼的時候進行調(diào)試, 接下來將對各組件源碼進行分析.
8. 參考
- istio 1.3.6源碼
