Istio安装

一、安装

1.1.istioctl安装

https://istio.io/latest/zh/docs/setup/install/istioctl/

#curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.20.1 TARGET_ARCH=x86_64 sh -
wget https://github.com/istio/istio/releases/download/1.20.1/istio-1.20.1-linux-amd64.tar.gz

tar -zxvf istio-1.20.1-linux-amd64.tar.gz
mv istio-1.20.1 /usr/local/
ln -sf /usr/local/istio-1.20.1/ /usr/local/istio

grep -q istio /etc/profile || echo 'export PATH=/usr/local/istio/bin/:$PATH' >> /etc/profile
source /etc/profile

1.2.istiod安装

cat << "EOF" >  istio-install.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    pilot:
      k8s:
        env:
        - name: PILOT_TRACE_SAMPLING
          value: "100"
        replicaCount: 2
        resources:
          requests:
            cpu: 10m
            memory: 100Mi
  meshConfig:
    accessLogFile: /dev/stdout
  profile: minimal
  values:
    global:
      proxy:
        readinessFailureThreshold: 30
        readinessInitialDelaySeconds: 10
        readinessPeriodSeconds: 2
    pilot:
      replicaCount: 2
      enableProtocolSniffingForInbound: true
      enableProtocolSniffingForOutbound: true
      env:
        ENABLE_LEGACY_FSGROUP_INJECTION: false
EOF
 
NODE_SELECTOR="pool=istio"
# kubectl label nodes xxxx pool=istio

istioctl install -f istio-install.yaml \
--set profile=minimal -y \
--set hub=${HUB} \
--set values.global.hub=${HUB} \
--set values.pilot.nodeSelector.${NODE_SELECTOR} \
--set revision="1-20-1"

# 注：以上命令会生成 IstioOperator配置

# 修改MINPODS,建议最少为双副本
kubectl -n istio-system edit hpa

配置备份

• 备份

kubectl -n istio-system get IstioOperator installed-state-1-20-1 -o yaml

• 备份安装

istioctl install -f installed-state-1-20-1.yaml

参数说明:

1. profile=demo，制定demo模式，适用于生产环境
2. values.global.hub 参数指定镜像仓库地址，避免从公网下载镜像（先将公网镜像push到ecr仓库）
3. values.gateways.istio-ingressgateway.type 指定 ingressgateway的service类型为ClusterIP，默认为 LoadBalancer, 没有修改的话安装时会新建SLB/ALB
4. values.pilot.replicaCount 参数指定istiod的pod数量
5. values.global.proxy.readinessInitialDelaySeconds 参数指定注入到业务的istio容器的启动冷却时间
6. values.global.proxy.readinessInitialDelaySeconds参数指定istio proxy 注入ready后再启动业务的容器
   

二、接入

注：采用hostNetwork模式的容器默认不注入istio-proxy

标签

标签	规则
istio-injection	DoesNotExist
sidecar.istio.io/inject	NotIn “false”
istio.io/rev	In “1-20-1”

MutatingWebhookConfiguration

kubectl get MutatingWebhookConfiguration istio-sidecar-injector-1-20-1-ops -o yaml

2.1.Workload接入

deployment

kubectl -n default patch deployment nginx-default -p '{"spec":{"template":{"metadata":{"labels":{"istio.io/rev":"1-20-1"}}}}}'
或
kubectl -n default patch deployment nginx-default -p '{"spec":{"template":{"metadata":{"labels":{"sidecar.istio.io/inject":"true"}}}}}'

2.2.Namespace接入

kubectl label ns default istio.io/rev=1-20-1

2.3.Envoy AccessLog

注：参考【1.2.istiod安装】

cat << "EOF" >  istio-install.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    accessLogFile: /dev/stdout
EOF
#accessLogFile 配置

2.4.可视化

https://istio.io/latest/zh/docs/tasks/observability/kiali/

kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.20/samples/addons/kiali.yaml

三、卸载

istioctl uninstall -y --purge

kubectl delete namespace istio-system
kubectl label namespace default istio-injection-

kubectl delete -f https://raw.githubusercontent.com/istio/istio/release-1.20/samples/addons/kiali.yaml