istio安装和入门实例
1 安装
下载istio最新安装包https://github.com/istio/istio/releases
wget https://github.com/istio/istio/releases/download/0.4.0/istio-0.4.0-linux.tar.gz解压安装包：
tar -zxvf istio-0.4.0-linux.tar.gz
cd istio-0.4.0
cp ./bin/istioctl /bin解压后，目录结构如下：
istio-0.4.0
├── bin
│ └── istioctl
├── install
│ ├── consul
│ │ ├── istio.yaml
│ │ └── README.md
│ ├── eureka
│ │ ├── istio.yaml
│ │ └── README.md
│ ├── gcp
│ │ ├── deployment_manager
│ │ │ ├── istio-cluster.yaml
│ │ │ └── README.md
│ │ └── README.md
│ ├── kubernetes
│ │ ├── addons
│ │ │ ├── grafana.yaml
│ │ │ ├── prometheus.yaml
│ │ │ ├── servicegraph.yaml
│ │ │ ├── zipkin-to-stackdriver.yaml
│ │ │ └── zipkin.yaml
│ │ ├── helm
│ │ │ └── istio
│ │ │ ├── charts
│ │ │ │ ├── initializer
│ │ │ │ │ ├── Chart.yaml
│ │ │ │ │ └── templates
│ │ │ │ │ └── istio-initializer.yaml
│ │ │ │ ├── mixer
│ │ │ │ │ ├── Chart.yaml
│ │ │ │ │ └── templates
│ │ │ │ │ └── istio-mixer.yaml
│ │ │ │ └── pilot
│ │ │ │ ├── Chart.yaml
│ │ │ │ └── templates
│ │ │ │ └── pilot.yaml
│ │ │ ├── Chart.yaml
│ │ │ ├── requirements.yaml
│ │ │ ├── templates
│ │ │ │ ├── istio-ca-one-namespace.yaml
│ │ │ │ ├── istio-ca-plugin-certs.yaml
│ │ │ │ ├── istio-ca.yaml
│ │ │ │ ├── istio-config.yaml
│ │ │ │ ├── istio-ingress.yaml
│ │ │ │ └── istio-rbac-beta.yaml
│ │ │ └── values.yaml
│ │ ├── istio-auth.yaml
│ │ ├── istio-ca-plugin-certs.yaml
│ │ ├── istio-initializer.yaml
│ │ ├── istio-one-namespace-auth.yaml
│ │ ├── istio-one-namespace.yaml
│ │ ├── istio.yaml
│ │ ├── mesh-expansion.yaml
│ │ └── README.md
│ ├── README.md
│ └── tools
│ ├── setupIstioVM.sh
│ └── setupMeshEx.sh
├── istio.VERSION
├── LICENSE
├── README.md
└── samples
├── bookinfo
│ ├── consul
│ │ ├── bookinfo.sidecars.yaml
│ │ ├── bookinfo.yaml
│ │ ├── cleanup.sh
│ │ ├── README.md
│ │ ├── route-rule-all-v1.yaml
│ │ ├── route-rule-ratings-db.yaml
│ │ ├── route-rule-ratings-test-delay.yaml
│ │ ├── route-rule-reviews-50-v3.yaml
│ │ ├── route-rule-reviews-test-v2.yaml
│ │ ├── route-rule-reviews-v2-v3.yaml
│ │ └── route-rule-reviews-v3.yaml
│ ├── eureka
│ │ ├── bookinfo.sidecars.yaml
│ │ ├── bookinfo.yaml
│ │ ├── cleanup.sh
│ │ ├── README.md
│ │ ├── route-rule-all-v1.yaml
│ │ ├── route-rule-ratings-db.yaml
│ │ ├── route-rule-ratings-test-delay.yaml
│ │ ├── route-rule-reviews-50-v3.yaml
│ │ ├── route-rule-reviews-test-v2.yaml
│ │ ├── route-rule-reviews-v2-v3.yaml
│ │ └── route-rule-reviews-v3.yaml
│ ├── kube
│ │ ├── bookinfo-add-serviceaccount.yaml
│ │ ├── bookinfo-db.yaml
│ │ ├── bookinfo-mysql.yaml
│ │ ├── bookinfo-ratings-v2-mysql-vm.yaml
│ │ ├── bookinfo-ratings-v2-mysql.yaml
│ │ ├── bookinfo-ratings-v2.yaml
│ │ ├── bookinfo-ratings.yaml
│ │ ├── bookinfo-reviews-v2.yaml
│ │ ├── bookinfo.yaml
│ │ ├── cleanup.sh
│ │ ├── destination-policy-reviews.yaml
│ │ ├── mixer-rule-additional-telemetry.yaml
│ │ ├── mixer-rule-deny-label.yaml
│ │ ├── mixer-rule-deny-serviceaccount.yaml
│ │ ├── mixer-rule-ratings-denial.yaml
│ │ ├── mixer-rule-ratings-ratelimit.yaml
│ │ ├── README.md
│ │ ├── route-rule-all-v1.yaml
│ │ ├── route-rule-ratings-db.yaml
│ │ ├── route-rule-ratings-mysql-vm.yaml
│ │ ├── route-rule-ratings-mysql.yaml
│ │ ├── route-rule-ratings-test-delay.yaml
│ │ ├── route-rule-reviews-50-v3.yaml
│ │ ├── route-rule-reviews-test-v2.yaml
│ │ ├── route-rule-reviews-v2-v3.yaml
│ │ └── route-rule-reviews-v3.yaml
│ └── swagger.yaml
├── CONFIG-MIGRATION.md
├── helloworld
│ ├── helloworld.yaml
│ └── README.md
├── httpbin
│ ├── httpbin.yaml
│ └── README.md
├── rawvm
│ └── README.md
├── README.md
└── sleep
├── README.md
└── sleep.yaml- install目录下的yaml文件都是kubernetes部署脚本。
- samples目录下的是实例。
- bin目录下的istioctl是istio的客户端，istioctl主要用来创建路由规则和策略，注入envoy等。
- istio.VERSION是配置文件。
istio需要kubernetes 1.7.3或更高版本。
sidecar之间不开启TLS相互校验，执行下面的脚本：
kubectl apply -f install/kubernetes/istio.yamlsidecar之间开启TLS相互校验，执行下面的脚本：
kubectl apply -f install/kubernetes/istio-auth.yaml如果集群已经启用了Kubernetes alpha特性，并且希望能够自动注入sidecar，那么安装Istio-Initializer。
kubectl apply -f install/kubernetes/istio-initializer.yaml如果安装的过程中出现
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=attributemanifest
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=attributemanifest
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=stdio
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=logentry
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=rule
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=metric
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=metric
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=metric
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=metric
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=metric
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=metric
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=prometheus
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=rule
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=rule
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=kubernetesenv
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=rule
unable to recognize "install/kubernetes/istio.yaml": no matches for config.istio.io/, Kind=kubernetes那么等待所有pod都创建完成之后，可以删除istio，再重新安装。
安装验证：
kubectl get all -n istio-system显示结果：
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
deploy/istio-ca 1 1 1 1 6m
deploy/istio-ingress 1 1 1 1 6m
deploy/istio-mixer 1 1 1 1 6m
deploy/istio-pilot 1 1 1 1 6m
NAME DESIRED CURRENT READY AGE
rs/istio-ca-78b58d7b5d 1 1 1 6m
rs/istio-ingress-78545c5bc9 1 1 1 6m
rs/istio-mixer-6f7db9c9fc 1 1 1 6m
rs/istio-pilot-86cc8c88d5 1 1 1 6m
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
deploy/istio-ca 1 1 1 1 6m
deploy/istio-ingress 1 1 1 1 6m
deploy/istio-mixer 1 1 1 1 6m
deploy/istio-pilot 1 1 1 1 6m
NAME DESIRED CURRENT READY AGE
rs/istio-ca-78b58d7b5d 1 1 1 6m
rs/istio-ingress-78545c5bc9 1 1 1 6m
rs/istio-mixer-6f7db9c9fc 1 1 1 6m
rs/istio-pilot-86cc8c88d5 1 1 1 6m
NAME READY STATUS RESTARTS AGE
po/istio-ca-78b58d7b5d-hngbh 1/1 Running 0 6m
po/istio-ingress-78545c5bc9-9ws5k 1/1 Running 0 6m
po/istio-mixer-6f7db9c9fc-cjcps 3/3 Running 0 6m
po/istio-pilot-86cc8c88d5-sv4pb 2/2 Running 0 6m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
svc/istio-ingress LoadBalancer 10.109.0.75 <pending> 80:30352/TCP,443:30289/TCP 6m
svc/istio-mixer ClusterIP 10.101.183.186 <none> 9091/TCP,15004/TCP,9093/TCP,9094/TCP,9102/TCP,9125/UDP,42422/TCP 6m
svc/istio-pilot ClusterIP 10.110.227.241 <none> 15003/TCP,443/TCP 6m卸载：
kubectl delete -f install/kubernetes/istio-initializer.yaml
kubectl delete -f install/kubernetes/istio.yaml
kubectl delete -f install/kubernetes/istio-auth.yaml安装插件：
kubectl apply -f install/kubernetes/addons/prometheus.yaml
kubectl apply -f install/kubernetes/addons/grafana.yaml
kubectl apply -f install/kubernetes/addons/servicegraph.yaml
kubectl apply -f install/kubernetes/addons/zipkin.yaml2 helloworld实例
进入helloworld实例：
cd samples/helloworld手动注入sidecar,并生成新的yaml文件:
istioctl kube-inject -f helloworld.yaml -o helloworld-istio.yaml创建服务：
kubectl create -f helloworld-istio.yaml获取访问地址,并访问服务：
export HELLOWORLD_URL=$(kubectl get po -l app=helloworld -o 'jsonpath={.items[0].status.hostIP}'):$(kubectl get svc helloworld -o 'jsonpath={.spec.ports[0].nodePort}')
curl http://$HELLOWORLD_URL/hello多尝试几次，会返回v1或v2服务的结果。查看servicegraph的服务的cluster-ip和端口号，在kubernetes集群集群上cluster-ip和端口号访问servicegraph服务。
kubectl get svc -n istio-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
grafana ClusterIP 10.106.6.18 <none> 3000/TCP 1d
istio-ingress LoadBalancer 10.109.0.75 <pending> 80:30352/TCP,443:30289/TCP 1d
istio-mixer ClusterIP 10.101.183.186 <none> 9091/TCP,15004/TCP,9093/TCP,9094/TCP,9102/TCP,9125/UDP,42422/TCP 1d
istio-pilot ClusterIP 10.110.227.241 <none> 15003/TCP,443/TCP 1d
prometheus ClusterIP 10.110.151.106 <none> 9090/TCP 1d
servicegraph ClusterIP 10.106.239.250 <none> 8088/TCP 1d
zipkin ClusterIP 10.100.45.253 <none> 9411/TCP 19h根据上面的输出，servicegraph服务的地址是http://10.106.239.250:8088/dotviz,可以看到服务拓扑图。
3 bookinfo实例
官方实例中有一个简单的应用程序bookinfo项目，该应用程序显示关于一本书的信息，类似于在线书店的单一目录条目。页面上显示的是该书的描述、书的详细信息(ISBN、页数等)，以及一些书评。
手动注入sidecar:
kubectl apply -f <(istioctl kube-inject -f samples/bookinfo/kube/bookinfo.yaml)获取访问地址,并访问服务：
export PRODUCTPAGE_URL=$(kubectl get svc -l app=productpage -o 'jsonpath={.items[0].spec.clusterIP}'):$(kubectl get svc productpage -o 'jsonpath={.spec.ports[0].port}')
echo $PRODUCTPAGE_URL在kubernetes集群中的机器上访问$PRODUCTPAGE_URL这个地址，再使用servicegraph、zipkin等服务查看服务情况。
参考：
- https://istio.io/docs/setup/kubernetes/quick-start.html
- https://istio.io/docs/guides/bookinfo.html