1. 前言

轉(zhuǎn)載請(qǐng)說明原文出處, 尊重他人勞動(dòng)成果!

源碼位置: https://github.com/nicktming/istio
分支: tming-v1.3.6 (基于1.3.6版本)

2. 安裝 sidecar

[root@master istio.io]# pwd
/root/go/src/istio.io
[root@master istio.io]# git clone https://github.com/nicktming/istio.git
[root@master istio]# kubectl get nodes
NAME     STATUS     ROLES    AGE   VERSION
master   Ready      <none>   23d   v1.15.3
node     NotReady   <none>   23d   v1.15.3
node2    NotReady   <none>   8d    v1.15.3
[root@master istio]# 
[root@master istio]# kubectl create ns istio-system

ca.crt是api-server根證書, 放到certs目錄下.
生成secret, istio.istio-sidecar-injector-service-account, 其實(shí)該secret是由組件citadel來自動(dòng)生成秘鑰并簽名.

[root@master default]# pwd
/root/go/src/istio.io/istio/configuration/default
[root@master default]# ls
certs  cm.yaml  examples  files  istio.yaml  sidecar.yaml  webhook-create-signed-cert.sh
[root@master default]# ls certs/ca.crt 
certs/ca.crt
[root@master default]# ./webhook-create-signed-cert.sh 
root@master default]# kubectl get secret -n istio-system
NAME                                           TYPE                                  DATA   AGE
default-token-jm6jv                            kubernetes.io/service-account-token   3      75m
istio.istio-sidecar-injector-service-account   Opaque                                3      75m

部署一些配置文件

[root@master default]# kubectl apply -f cm.yaml
[root@master default]# kubectl apply -f sidecar.yaml
[root@master default]# kubectl get pods -n istio-system
NAME                                      READY   STATUS    RESTARTS   AGE
istio-sidecar-injector-84d5c488d9-6kj6s   1/1     Running   0          59m
root@master default]# kubectl get cm -n istio-system
NAME                     DATA   AGE
istio                    2      64m
istio-sidecar-injector   2      64m

測(cè)試一個(gè)例子

[root@master default]# kubectl creat ns tming
[root@master default]# kubectl label namespace ns istio-injection=enabled
[root@master default]# kubectl apply -f examples/busybox.yaml -n tming
[root@master default]# kubectl get pods -n tming
NAME           READY   STATUS    RESTARTS   AGE
test-sidecar   1/2     Running   0          47m
[root@master default]# kubectl logs test-sidecar istio-proxy -n tming
...
2020-01-19T14:40:25.392967Z     info    Envoy proxy is NOT ready: config not received from Pilot (is Pilot running?): cds updates: 0 successful, 0 rejected; lds updates: 0 successful, 0 rejected
[root@master default]# 

已經(jīng)成功, 但是envoy沒有連上pilot, 所以接下來將以二進(jìn)制形式運(yùn)行pilot.

3. pilot 和 galley

在運(yùn)行pilot之前, 將所有crd全部部署上.

3.1 部署crd

[root@master default]# pwd
/root/go/src/istio.io/istio/configuration/default
[root@master default]# kubectl apply -f files/
customresourcedefinition.apiextensions.k8s.io/virtualservices.networking.istio.io created
...
customresourcedefinition.apiextensions.k8s.io/challenges.certmanager.k8s.io created

3.2 運(yùn)行pilot

[root@master pilot-discovery]# pwd
/root/go/src/istio.io/istio/pilot/cmd/pilot-discovery
[root@master pilot-discovery]# ./run.sh
...
2020-01-20T06:38:19.808058Z     info    starting discovery service at http=[::]:9090 grpc=[::]:15010
2020-01-20T06:38:19.821669Z     info    ads     Push debounce stable[2] 15: 100.027975ms since last change, 100.089227ms since last push, full=true
2020-01-20T06:38:19.821869Z     info    ads     XDS: Pushing:2020-01-20T14:38:19+08:00/1 Services:3 ConnectedEndpoints:0
2020-01-20T06:38:19.821883Z     info    ads     Cluster init time 364ns 2020-01-20T14:38:19+08:00/1
2020-01-20T06:38:29.308073Z     info    ads     Push Status: {
    "ProxyStatus": {}
}

3.3 運(yùn)行g(shù)alley

[root@master galley]# pwd
/root/go/src/istio.io/istio/galley/cmd/galley
[root@master galley]# ./run.sh
...
2020-01-20T06:38:19.722421Z     info    mcp     Watch(): created watch 32 for istio/rbac/v1alpha1/servicerolebindings from group "default", version "0"

4. 驗(yàn)證

[root@master ~]# kubectl get pods -n tming
NAME           READY   STATUS    RESTARTS   AGE
test-sidecar   1/2     Running   0          16h

驗(yàn)證發(fā)現(xiàn)sidecar還是沒有連上pilot, 這是因?yàn)?code>pilot-agent連的是默認(rèn)配置的地址.

[root@master ~]# kubectl -n tming get pod test-sidecar -o yaml
...
- --discoveryAddress
    - istio-pilot.istio-system:15010
...

因此需要修改配置才可以, 在istio-sidecar-injector(configMap)中找到discoveryAddress屬性將原先的配置"{{ annotation .ObjectMeta `sidecar.istio.io/discoveryAddress` .ProxyConfig.DiscoveryAddress }}"改成172.31.71.181:15010 (換成自己的ip即可)

[root@master istio]# kubectl apply -f configuration/default/cm.yaml
[root@master istio]# kubectl get pods -n tming
NAME           READY   STATUS    RESTARTS   AGE
test-sidecar   2/2     Running   0          35s

如果有問題, 可以重啟sidecar這個(gè)pod.
可以看到已經(jīng)正常運(yùn)行了, 接下來部署一個(gè)ingress-gateway來統(tǒng)一入口.

5. 部署ingress-gateway

[root@master istio]# pwd
/root/go/src/istio.io/istio
[root@master istio]# kubectl apply -f configuration/default/ingress-gateway.yaml 
deployment.apps/istio-ingressgateway created
service/istio-policy created
service/istio-telemetry created
[root@master istio]# kubectl get pods,svc,MutatingWebhookConfiguration -n istio-system
NAME                                          READY   STATUS    RESTARTS   AGE
pod/istio-ingressgateway-768778694-sz9kw      1/1     Running   0          30m
pod/istio-sidecar-injector-84d5c488d9-jqnx9   1/1     Running   0          41m

NAME                             TYPE           CLUSTER-IP        EXTERNAL-IP   PORT(S)                                                                                                                                     AGE
service/istio-ingressgateway     LoadBalancer   169.169.242.173   <pending>     15020:15143/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:2880/TCP,15030:42855/TCP,15031:33520/TCP,15032:10091/TCP,15443:42831/TCP   41s
service/istio-sidecar-injector   ClusterIP      169.169.226.113   <none>        443/TCP,15014/TCP                                                                                                                           19h

NAME                                                                               CREATED AT
mutatingwebhookconfiguration.admissionregistration.k8s.io/istio-sidecar-injector   2020-01-19T13:28:17Z
[root@master istio]# 

6. 驗(yàn)證bookinfo

[root@master istio]# kubectl label ns default instio-injection=enabled
namespace/default labeled
[root@master istio]# kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml 
service/details created
...
deployment.apps/productpage-v1 created
[root@master istio]# 
[root@master istio]# kubectl get pods
NAME                              READY   STATUS    RESTARTS   AGE
details-v1-74f858558f-tb2pl       2/2     Running   0          69s
productpage-v1-8554d58bff-twxnc   2/2     Running   0          67s
ratings-v1-7855f5bcb9-76dwb       2/2     Running   0          67s
reviews-v1-59fd8b965b-cf8v9       2/2     Running   0          68s
reviews-v2-d6cfdb7d6-n74tg        2/2     Running   0          68s
reviews-v3-75699b5cfb-txmpt       2/2     Running   0          68s
[root@master istio]# kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
[root@master istio]# kubectl get gw,vs 
NAME                                           AGE
gateway.networking.istio.io/bookinfo-gateway   10m

NAME                                          GATEWAYS             HOSTS   AGE
virtualservice.networking.istio.io/bookinfo   [bookinfo-gateway]   [*]     10m

查看ingress-gateway的80端口對(duì)應(yīng)的nodeport.

[root@master istio]# kubectl get svc istio-ingressgateway -n istio-system
NAME                   TYPE           CLUSTER-IP        EXTERNAL-IP   PORT(S)                                                                                                                                     AGE
istio-ingressgateway   LoadBalancer   169.169.242.173   <pending>     15020:15143/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:2880/TCP,15030:42855/TCP,15031:33520/TCP,15032:10091/TCP,15443:42831/TCP   57m
[root@master istio]# 

訪問節(jié)點(diǎn)ip:31380效果如下:

pic.png

7. 總結(jié)

把各個(gè)組件拆分開用二進(jìn)制運(yùn)行可以方便研究源碼的時(shí)候進(jìn)行調(diào)試, 接下來將對(duì)各組件源碼進(jìn)行分析.

8. 參考

1. istio 1.3.6源碼