istio中的grafana等内部组件服务开放给集群外用户访问

1、前言

在安装完成istio后,默认状态下,集群外用户不能直接访问istio集群内的grafana等管理、监控服务。

有两种方法可以将集群内服务开放出来。一种是使用port-forward方式将本地端口流量转发到pod端口,实现集群内服务的访问;另一种方式是采用istio gateway方式,将集群内服务暴露到外网。

第二种方式需要将集群的默认网关服务ingressgateway的网络模式设置为nodeport模式,作为代理实现对外服务。

2、启用ingressgateway的NodePort模式

(1)设置ingress gateway的工作模式

istio安装时,可以通过参数 --set
gateways.istio-ingressgateway.type=NodePort设置ingress gateway组件的工作模式。

--创建istio并安装grafana、kiali、tracing等组件,并设置ingress gateway模式为NodePort

helm install istio.io/istio --name istio --namespace=istio-system --set gateways.istio-ingressgateway.type=NodePort --set grafana.enabled=true --set kiali.enabled=true --set tracing.enabled=true 

如果Istio安装时没有指定该参数,可以通过以下方式更改

helm upgrade istio istio.io/istio --set gateways.istio-ingressgateway.type=NodePort --set grafana.enabled=true --set kiali.enabled=true --set tracing.enabled=true 

kubectl patch service istio-ingressgateway -n istio-system -p '{"spec":{"type":"NodePort"}}'

(2)验证ingress gateway的网络模式

kubectl get svc -n istio-system
NAME                     TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                                                                                      AGE
grafana                  ClusterIP   172.18.87.213            3000/TCP                                                                                                                                     3m45s
istio-citadel            ClusterIP   172.18.62.138            8060/TCP,15014/TCP                                                                                                                           4h56m
istio-galley             ClusterIP   172.18.108.232           443/TCP,15014/TCP,9901/TCP                                                                                                                   4h56m

-----------
istio-ingressgateway     NodePort    172.18.24.214            15020:31970/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:32365/TCP,15030:30818/TCP,15031:30828/TCP,15032:31036/TCP,15443:30309/TCP   4h56m 
-----------可以看到istio-ingressgateway当前是NodePort模式

istio-pilot              ClusterIP   172.18.249.193           15010/TCP,15011/TCP,8080/TCP,15014/TCP                                                                                                       4h56m
istio-policy             ClusterIP   172.18.236.243           9091/TCP,15004/TCP,15014/TCP                                                                                                                 4h56m
istio-sidecar-injector   ClusterIP   172.18.41.244            443/TCP,15014/TCP                                                                                                                            4h56m
istio-telemetry          ClusterIP   172.18.199.225           9091/TCP,15004/TCP,15014/TCP,42422/TCP                                                                                                       4h56m
jaeger-agent             ClusterIP   None                     5775/UDP,6831/UDP,6832/UDP                                                                                                                   3m45s
jaeger-collector         ClusterIP   172.18.252.169           14267/TCP,14268/TCP                                                                                                                          3m45s
jaeger-query             ClusterIP   172.18.112.84            16686/TCP                                                                                                                                    3m45s
kiali                    ClusterIP   172.18.27.228            20001/TCP                                                                                                                                    3m45s
prometheus               ClusterIP   172.18.67.104            9090/TCP                                                                                                                                     4h56m
tracing                  ClusterIP   172.18.118.65            80/TCP                                                                                                                                       3m45s
zipkin                   ClusterIP   172.18.105.196           9411/TCP                                                                                                                                     3m45s
[root@centos75 istio-ui]#

(3)查看作为边界代理的ingress-gateway的端口映射情况

[root@centos75 istio-ui]# kubectl describe svc istio-ingressgateway -n istio-system
Name:                     istio-ingressgateway
Namespace:                istio-system
Labels:                   app=istio-ingressgateway
                          chart=gateways
                          heritage=Tiller
                          istio=ingressgateway
                          release=istio
Annotations:              
Selector:                 app=istio-ingressgateway,istio=ingressgateway,release=istio
Type:                     NodePort
IP:                       172.18.24.214
Port:                     status-port  15020/TCP
TargetPort:               15020/TCP
NodePort:                 status-port  31970/TCP
Endpoints:                192.168.148.92:15020
Port:                     http2  80/TCP
TargetPort:               80/TCP
NodePort:                 http2  31380/TCP
Endpoints:                192.168.148.92:80
Port:                     https  443/TCP
TargetPort:               443/TCP
NodePort:                 https  31390/TCP
Endpoints:                192.168.148.92:443
Port:                     tcp  31400/TCP
TargetPort:               31400/TCP
NodePort:                 tcp  31400/TCP
Endpoints:                192.168.148.92:31400
Port:                     https-kiali  15029/TCP
TargetPort:               15029/TCP
NodePort:                 https-kiali  32365/TCP
Endpoints:                192.168.148.92:15029
Port:                     https-prometheus  15030/TCP
TargetPort:               15030/TCP
NodePort:                 https-prometheus  30818/TCP
Endpoints:                192.168.148.92:15030
--------- https-grafana的15301端口映射到node的30828端口,我们需要将15031端口关联到grafana上
Port:                     https-grafana  15031/TCP
TargetPort:               15031/TCP
NodePort:                 https-grafana  30828/TCP
Endpoints:                192.168.148.92:15031
--------- 集群外用户通过访问网关所在机器的30828端口就可以访问到grafana服务
Port:                     https-tracing  15032/TCP
TargetPort:               15032/TCP
NodePort:                 https-tracing  31036/TCP
Endpoints:                192.168.148.92:15032
Port:                     tls  15443/TCP
TargetPort:               15443/TCP
NodePort:                 tls  30309/TCP
Endpoints:                192.168.148.92:15443
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   
[root@centos75 istio-ui]#

上图所示,ingressgateway创建时,自动预设了一些端口映射,其中https-grafana的15301端口映射到node的30828端口,我们将15031端口关联到grafana上,集群外就用户通过访问网关所在机器的30828端口访问到grafana服务

4、gateway方式暴露集群内服务

需要创建服务的gateway和virtual service资源如下

(1)创建grafana的gateway

gateway的服务端口是15031,正好对应ingressgateway的nodetype端口30828。

[root@centos75 istio-ui]# cat grafana-gateway.yaml
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: grafana-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 15031
      name: http
      protocol: HTTP
    hosts:
    - "*"
[root@centos75 istio-ui]# kubectl apply -f grafana-gateway.yaml -n istio-system
gateway.networking.istio.io/grafana-gateway created
[root@centos75 istio-ui]#

(2)创建grafana的virtual service

设置virtual service与grafana-gateway绑定,将来自gateway的流量路由到内部grafana服务3000端口

[root@centos75 istio-ui]# cat grafana-vs.yaml
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana-vs
spec:
  hosts:
  - "*"
  gateways:
  - grafana-gateway
  http:
  - route:
    - destination:
        host: grafana
        port:
          number: 3000
[root@centos75 istio-ui]# kubectl apply -f grafana-vs.yaml -n istio-system
virtualservice.networking.istio.io/grafana-vs unchanged
[root@centos75 istio-ui]#

(3)测试grafana的连通性

[root@centos75 istio-ui]# curl -I http://10.0.135.30:30828
HTTP/1.1 200 OK
content-type: text/html; charset=UTF-8
date: Sat, 14 Sep 2019 11:22:50 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
transfer-encoding: chunked

[root@centos75 istio-ui]#

测试成功

5 总结

本方式利用istio 边界gateway来实现内部服务的对外映射,可以发挥istio gateway流量管理的能力,比port-forward更适用。

你可能感兴趣的:(k8s,istio)