Istio 1.2.4 最新版安装 官方Bookinfo例子部署 踩坑

一、安装步骤：

1.下载所需文件及镜像

wget https://github.com/istio/istio/releases/download/1.0.0/istio-1.0.0-linux.tar.gz

docker pull docker.io/istio/proxyv2:1.2.4
docker pull docker.io/istio/proxy_init:1.2.4
docker pull docker.io/istio/sidecar_injector:1.2.4
docker pull docker.io/istio/galley:1.2.4
docker pull docker.io/istio/mixer:1.2.4
docker pull docker.io/istio/pilot:1.2.4
docker pull docker.io/istio/citadel:1.2.4
docker pull docker.io/istio/istio_init_crdt:1.2.4

2.生成istio的crds

helm template --name istio-init --namespace istio-system ./install/kubernetes/helm/istio-init > istio-init-1.2.4.yaml
#检查crds为23
kubectl get crds | grep 'istio.io\|certmanager.k8s.io' | wc -l
#正常情况返回23

3.生成istio配置文件，通过–set可以修改一些配置，这里修改istio-ingressgateway的类型为NodePort，避免kubernetes没有配置负载均衡，EXTERNAL-IP为pending状态

helm template --name istio --namespace istio-system ./install/kubernetes/helm/istio --set gateways.istio-egressgateway.type=NodePort > istio-1.2.4.yaml

4.通过yaml部署istio

kubectl apply -f istio-init-1.2.4.yaml
kubectl apply -f istio-1.2.4.yaml

5.查看istio-system命名空间的pod，Completed状态是初始化时使用的，已执行完成，其他pod状态都为Running

[root@k8s-master istio-1.2.4]# kubectl get pods -n istio-system -o wide
NAME                                      READY   STATUS      RESTARTS   AGE    IP             NODE         NOMINATED NODE   READINESS GATES
istio-citadel-66866dfc58-cfmrx            1/1     Running     0          3h2m   10.244.1.147   k8s-node1    <none>           <none>
istio-cleanup-secrets-1.2.4-vfbsz         0/1     Completed   0          3h2m   10.244.1.142   k8s-node1    <none>           <none>
istio-galley-b88497745-vpjbs              1/1     Running     0          160m   10.244.0.73    k8s-master   <none>           <none>
istio-ingressgateway-58c6b9d9f4-g4dx2     1/1     Running     0          3h2m   10.244.1.144   k8s-node1    <none>           <none>
istio-init-crd-10-pqbdn                   0/1     Completed   0          8h     10.244.1.118   k8s-node1    <none>           <none>
istio-init-crd-11-9lgff                   0/1     Completed   0          8h     10.244.1.119   k8s-node1    <none>           <none>
istio-init-crd-12-9vcql                   0/1     Completed   0          8h     10.244.1.120   k8s-node1    <none>           <none>
istio-pilot-84db4d8dc4-4hhdh              2/2     Running     0          3h2m   10.244.0.70    k8s-master   <none>           <none>
istio-policy-dd94d7657-cg2dx              2/2     Running     5          3h2m   10.244.1.145   k8s-node1    <none>           <none>
istio-security-post-install-1.2.4-8vm8f   0/1     Completed   0          3h2m   10.244.1.143   k8s-node1    <none>           <none>
istio-sidecar-injector-785d58b878-ljdz6   1/1     Running     0          3h2m   10.244.0.72    k8s-master   <none>           <none>
istio-telemetry-7f68bd6d4f-vj79c          2/2     Running     6          3h2m   10.244.1.146   k8s-node1    <none>           <none>
prometheus-776fdf7479-68zdb               1/1     Running     0          3h2m   10.244.0.71    k8s-master   <none>           <none>

二、Bookinfo例子

bookinfo例子包含productpage、 details、 reviews、ratings,其中reviews分为v1、v2、v3三个版本。调用链关系如下：

[外链图片转存失败(img-HLZr2xUE-1566566904691)(https://istio.io/docs/examples/bookinfo/noistio.svg)]

1.部署bookinfo，线切换目录到istio安装目录，例如：/root/istio/istio-1.2.4，再执行：

#给default命名空间打labal，使istio的sidecar可以自动注入到pod
kubectl label namespace default istio-injection=enabled
#部署bookinfo
kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml

2.确认service和pod都正确定义和运行

[root@k8s-master istio-1.2.4]# kubectl get services,pods
NAME                  TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
service/details       ClusterIP   10.99.98.155     <none>        9080/TCP   52m
service/kubernetes    ClusterIP   10.96.0.1        <none>        443/TCP    92d
service/productpage   ClusterIP   10.97.102.0      <none>        9080/TCP   52m
service/ratings       ClusterIP   10.99.219.40     <none>        9080/TCP   52m
service/reviews       ClusterIP   10.104.130.170   <none>        9080/TCP   52m

NAME                                 READY   STATUS    RESTARTS   AGE
pod/details-v1-c5b5f496d-c78gw       2/2     Running   0          52m
pod/productpage-v1-c7765c886-ppbf8   2/2     Running   0          52m
pod/ratings-v1-f745cf57b-8ppwr       2/2     Running   0          52m
pod/reviews-v1-75b979578c-zmjfj      2/2     Running   0          52m
pod/reviews-v2-597bf96c8f-88bg4      2/2     Running   0          52m
pod/reviews-v3-54c6c64795-m4wn7      2/2     Running   0          52m

3.确认bookinfo正确运行

kubectl exec -it $(kubectl get pod -l app=ratings -o jsonpath='{.items[0].metadata.name}') -c ratings -- curl productpage:9080/productpage | grep -o ""
#返回
<title>Simple Bookstore App</title>

4.创建Gateway，使bookinfo可以被kubernetes集群外部访问，比如浏览器等

kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
#确认gateway创建成功
[root@k8s-master istio-1.2.4]# kubectl get gateway
NAME               AGE
bookinfo-gateway   55m

5.为了方便后续请求，添加IP和Port环境变量（以下配置是使用HTTP方式的变量获取和配置）

export INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].nodePort}')
export INGRESS_HOST=$(kubectl get po -l istio=ingressgateway -n istio-system -o jsonpath='{.items[0].status.hostIP}')
export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT

6.验证可以外网访问

curl -s http://${GATEWAY_URL}/productpage | grep -o ""
#返回
<title>Simple Bookstore App</title>

7.可以配置DestinationRule，DestinationRule可以实现复杂均衡、限流等功能

#不使用TLS（默认是轮询负载均衡）
kubectl apply -f samples/bookinfo/networking/destination-rule-all.yaml
#使用TLS
kubectl apply -f samples/bookinfo/networking/destination-rule-all-mtls.yaml
#reviews设置随机访问策略
kubectl apply -f samples/bookinfo/networking/destination-rule-reviews.yaml

8.在做完实验，官方例子还提供了清理功能，删除bookinfo的路由规则和应用pod

samples/bookinfo/platform/kube/cleanup.sh

9.确认所有bookinfo涉及的都被删掉

kubectl get virtualservices   #-- there should be no virtual services
kubectl get destinationrules  #-- there should be no destination rules
kubectl get gateway           #-- there should be no gateway
kubectl get pods              #-- the Bookinfo pods should be deleted

三、错误：

0/2 nodes are available: 1 Insufficient cpu, 1 node(s) had taints that the pod didn’t tolerate.

执行下面命令，使master节点可以参与pod分配

kubectl taint nodes --all node-role.kubernetes.io/master-

如果出现如下错误可忽略

[root@k8s-master istio-1.2.4]# kubectl taint nodes --all node-role.kubernetes.io/master-
node/k8s-master untainted
error: taint "node-role.kubernetes.io/master:" not found

此时可以看到istio-pilot-84db4d8dc4-hvllh成功分配到master节点

[root@k8s-master istio-1.2.4]# kubectl get pods -n istio-system -o wide|grep pilot
istio-pilot-84db4d8dc4-hvllh              2/2     Running     0          16m   10.244.0.41    k8s-master