istio中的grafana等内部组件服务开放给集群外用户访问
1、前言
在安装完成istio后，默认状态下，集群外用户不能直接访问istio集群内的grafana等管理、监控服务。
有两种方法可以将集群内服务开放出来。一种是使用port-forward方式将本地端口流量转发到pod端口，实现集群内服务的访问；另一种方式是采用istio gateway方式，将集群内服务暴露到外网。
第二种方式需要将集群的默认网关服务ingressgateway的网络模式设置为nodeport模式，作为代理实现对外服务。
2、启用ingressgateway的NodePort模式
(1)设置ingress gateway的工作模式
istio安装时，可以通过参数 --set
gateways.istio-ingressgateway.type=NodePort设置ingress gateway组件的工作模式。
--创建istio并安装grafana、kiali、tracing等组件，并设置ingress gateway模式为NodePort
helm install istio.io/istio --name istio --namespace=istio-system --set gateways.istio-ingressgateway.type=NodePort --set grafana.enabled=true --set kiali.enabled=true --set tracing.enabled=true
如果Istio安装时没有指定该参数，可以通过以下方式更改
helm upgrade istio istio.io/istio --set gateways.istio-ingressgateway.type=NodePort --set grafana.enabled=true --set kiali.enabled=true --set tracing.enabled=true
或
kubectl patch service istio-ingressgateway -n istio-system -p '{"spec":{"type":"NodePort"}}'
(2)验证ingress gateway的网络模式
kubectl get svc -n istio-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
grafana ClusterIP 172.18.87.213 3000/TCP 3m45s
istio-citadel ClusterIP 172.18.62.138 8060/TCP,15014/TCP 4h56m
istio-galley ClusterIP 172.18.108.232 443/TCP,15014/TCP,9901/TCP 4h56m
-----------
istio-ingressgateway NodePort 172.18.24.214 15020:31970/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:32365/TCP,15030:30818/TCP,15031:30828/TCP,15032:31036/TCP,15443:30309/TCP 4h56m
-----------可以看到istio-ingressgateway当前是NodePort模式
istio-pilot ClusterIP 172.18.249.193 15010/TCP,15011/TCP,8080/TCP,15014/TCP 4h56m
istio-policy ClusterIP 172.18.236.243 9091/TCP,15004/TCP,15014/TCP 4h56m
istio-sidecar-injector ClusterIP 172.18.41.244 443/TCP,15014/TCP 4h56m
istio-telemetry ClusterIP 172.18.199.225 9091/TCP,15004/TCP,15014/TCP,42422/TCP 4h56m
jaeger-agent ClusterIP None 5775/UDP,6831/UDP,6832/UDP 3m45s
jaeger-collector ClusterIP 172.18.252.169 14267/TCP,14268/TCP 3m45s
jaeger-query ClusterIP 172.18.112.84 16686/TCP 3m45s
kiali ClusterIP 172.18.27.228 20001/TCP 3m45s
prometheus ClusterIP 172.18.67.104 9090/TCP 4h56m
tracing ClusterIP 172.18.118.65 80/TCP 3m45s
zipkin ClusterIP 172.18.105.196 9411/TCP 3m45s
[root@centos75 istio-ui]#
(3)查看作为边界代理的ingress-gateway的端口映射情况
[root@centos75 istio-ui]# kubectl describe svc istio-ingressgateway -n istio-system
Name: istio-ingressgateway
Namespace: istio-system
Labels: app=istio-ingressgateway
chart=gateways
heritage=Tiller
istio=ingressgateway
release=istio
Annotations:
Selector: app=istio-ingressgateway,istio=ingressgateway,release=istio
Type: NodePort
IP: 172.18.24.214
Port: status-port 15020/TCP
TargetPort: 15020/TCP
NodePort: status-port 31970/TCP
Endpoints: 192.168.148.92:15020
Port: http2 80/TCP
TargetPort: 80/TCP
NodePort: http2 31380/TCP
Endpoints: 192.168.148.92:80
Port: https 443/TCP
TargetPort: 443/TCP
NodePort: https 31390/TCP
Endpoints: 192.168.148.92:443
Port: tcp 31400/TCP
TargetPort: 31400/TCP
NodePort: tcp 31400/TCP
Endpoints: 192.168.148.92:31400
Port: https-kiali 15029/TCP
TargetPort: 15029/TCP
NodePort: https-kiali 32365/TCP
Endpoints: 192.168.148.92:15029
Port: https-prometheus 15030/TCP
TargetPort: 15030/TCP
NodePort: https-prometheus 30818/TCP
Endpoints: 192.168.148.92:15030
--------- https-grafana的15301端口映射到node的30828端口,我们需要将15031端口关联到grafana上
Port: https-grafana 15031/TCP
TargetPort: 15031/TCP
NodePort: https-grafana 30828/TCP
Endpoints: 192.168.148.92:15031
--------- 集群外用户通过访问网关所在机器的30828端口就可以访问到grafana服务
Port: https-tracing 15032/TCP
TargetPort: 15032/TCP
NodePort: https-tracing 31036/TCP
Endpoints: 192.168.148.92:15032
Port: tls 15443/TCP
TargetPort: 15443/TCP
NodePort: tls 30309/TCP
Endpoints: 192.168.148.92:15443
Session Affinity: None
External Traffic Policy: Cluster
Events:
[root@centos75 istio-ui]#
上图所示，ingressgateway创建时，自动预设了一些端口映射，其中https-grafana的15301端口映射到node的30828端口,我们将15031端口关联到grafana上，集群外就用户通过访问网关所在机器的30828端口访问到grafana服务
4、gateway方式暴露集群内服务
需要创建服务的gateway和virtual service资源如下
(1)创建grafana的gateway
gateway的服务端口是15031，正好对应ingressgateway的nodetype端口30828。
[root@centos75 istio-ui]# cat grafana-gateway.yaml
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: grafana-gateway
spec:
selector:
istio: ingressgateway
servers:
- port:
number: 15031
name: http
protocol: HTTP
hosts:
- "*"
[root@centos75 istio-ui]# kubectl apply -f grafana-gateway.yaml -n istio-system
gateway.networking.istio.io/grafana-gateway created
[root@centos75 istio-ui]#
(2)创建grafana的virtual service
设置virtual service与grafana-gateway绑定，将来自gateway的流量路由到内部grafana服务3000端口
[root@centos75 istio-ui]# cat grafana-vs.yaml
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: grafana-vs
spec:
hosts:
- "*"
gateways:
- grafana-gateway
http:
- route:
- destination:
host: grafana
port:
number: 3000
[root@centos75 istio-ui]# kubectl apply -f grafana-vs.yaml -n istio-system
virtualservice.networking.istio.io/grafana-vs unchanged
[root@centos75 istio-ui]#
(3)测试grafana的连通性
[root@centos75 istio-ui]# curl -I http://10.0.135.30:30828
HTTP/1.1 200 OK
content-type: text/html; charset=UTF-8
date: Sat, 14 Sep 2019 11:22:50 GMT
x-envoy-upstream-service-time: 1
server: istio-envoy
transfer-encoding: chunked
[root@centos75 istio-ui]#
测试成功
5 总结
本方式利用istio 边界gateway来实现内部服务的对外映射，可以发挥istio gateway流量管理的能力，比port-forward更适用。