流量的镜像

流量镜像

流量镜像，也称为影子流量，是一个以尽可能低的风险为生产带来变化的强大的功能。镜像会将实时流量的副本发送到镜像服务。镜像流量发生在主服务的关键请求路径之外。

恢复环境：

kubectl delete -f samples/httpbin/httpbin.yaml

kubectl delete -f samples/httpbin/networking/destination-rule-httpbin.yaml

kubectl delete -f samples/httpbin/sample-client/fortio-deploy.yaml

部署两个版本的 httpbin 服务，httpbin 服务已开启访问日志：

vim samples/httpbin/httpbin-deploy-v1.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin-v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
      version: v1
  template:
    metadata:
      labels:
        app: httpbin
        version: v1
    spec:
      containers:
      - image: docker.io/kennethreitz/httpbin
        imagePullPolicy: IfNotPresent
        name: httpbin
        command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]
        ports:
        - containerPort: 80

vim samples/httpbin/httpbin-deploy-v2.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin-v2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
      version: v2
  template:
    metadata:
      labels:
        app: httpbin
        version: v2
    spec:
      containers:
      - image: docker.io/kennethreitz/httpbin
        imagePullPolicy: IfNotPresent
        name: httpbin
        command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]
        ports:
        - containerPort: 80

vim samples/httpbin/httpbin-svc.yaml

apiVersion: v1
kind: Service
metadata:
  name: httpbin
  labels:
    app: httpbin
spec:
  ports:
  - name: http
    port: 8000
    targetPort: 80
  selector:
    app: httpbin

kubectl apply -f samples/httpbin/httpbin-deploy-v1.yaml

kubectl apply -f samples/httpbin/httpbin-deploy-v2.yaml

kubectl apply -f samples/httpbin/httpbin-svc.yaml

启动 sleep 服务，使用 curl 来提供负载：

vim samples/httpbin/sleep-deploy.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: sleep
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sleep
  template:
    metadata:
      labels:
        app: sleep
    spec:
      containers:
      - name: sleep
        image: tutum/curl
        command: ["/bin/sleep","infinity"]
        imagePullPolicy: IfNotPresent

kubectl apply -f samples/httpbin/sleep-deploy.yaml

创建默认路由策略：

默认情况下，Kubernetes 在 httpbin 服务的两个版本之间进行负载均衡。在此，把所有流量都路由到 v1。

如果 Istio 开启了 TLS 认证，在应用 DestinationRule 之前必须将 TLS 流量策略 mode: ISTIO_MUTUAL 添加到 DestinationRule。否则，请求将发生 503 错误。

创建一个默认路由规则，将所有流量路由到服务的 v1：

vim samples/httpbin/networking/destination-rule.yaml

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: httpbin
spec:
  host: httpbin
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

vim samples/httpbin/networking/virtual-service-v1.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
    - httpbin
  http:
  - route:
    - destination:
        host: httpbin
        subset: v1
      weight: 100

kubectl apply -f samples/httpbin/networking/destination-rule.yaml

kubectl apply -f samples/httpbin/networking/virtual-service-v1.yaml

向服务发送一下流量：

export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath={
     
     .items..metadata.name})

kubectl exec -it $SLEEP_POD -c sleep -- sh -c 'curl  http://httpbin:8000/headers' | python -m json.tool

{
    
    
    "headers": {
    
    
        "Accept": "*/*",
        "Content-Length": "0",
        "Host": "httpbin:8000",
        "User-Agent": "curl/7.35.0",
        "X-B3-Parentspanid": "372facbd5b406888",
        "X-B3-Sampled": "0",
        "X-B3-Spanid": "e60d58ce6b12ec8d",
        "X-B3-Traceid": "94127e32a64208bd372facbd5b406888",
        "X-Envoy-Attempt-Count": "1",
        "X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/default;Hash=4604a9f50d9b2ecbb94f71e00a73294408a0597af96f77ffba09c53377f4a925;Subject=\"\";URI=spiffe://cluster.local/ns/default/sa/default"
    }
}

分别查看 httpbin 服务 v1 和 v2 两个 Pod 的日志：

export V1_POD=$(kubectl get pod -l app=httpbin,version=v1 -o jsonpath={
     
     .items..metadata.name})

kubectl logs -f $V1_POD -c httpbin

127.0.0.1 - - [01/Mar/2021:06:29:37 +0000] "GET /headers HTTP/1.1" 200 553 "-" "curl/7.35.0"

export V2_POD=$(kubectl get pod -l app=httpbin,version=v2 -o jsonpath={
     
     .items..metadata.name})

kubectl logs -f $V2_POD -c httpbin

可以看到访问日志进入 v1，而 v2 中没有日志产生。

镜像流量到 v2：

改变流量规则将流量镜像到 v2：

vim samples/httpbin/networking/virtual-service-v1-mirror-v2.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
    - httpbin
  http:
  - route:
    - destination:
        host: httpbin
        subset: v1
      weight: 100
    mirror:
      host: httpbin
      subset: v2
    mirror_percent: 100

kubectl apply -f samples/httpbin/networking/virtual-service-v1-mirror-v2.yaml

这个路由规则发送 100% 流量到 v1。最后一段表示将镜像流量到 httpbin:v2 服务。当流量被镜像时，请求将发送到镜像服务中，并在 headers 中的 Host/Authority 属性值上追加 -shadow。例如 cluster-1 变为 cluster-1-shadow。

需要重点注意的是，这些被镜像的流量是 即发即弃 的，就是说镜像请求的响应会被丢弃。

可以使用 mirror_percent 属性来设置镜像流量的百分比，而不是镜像全部请求。如果这个属性不存在，将镜像所有流量。

发送流量：

kubectl exec -it $SLEEP_POD -c sleep -- sh -c 'curl http://httpbin:8000/headers' | python -m json.tool

{
    
    
    "headers": {
    
    
        "Accept": "*/*",
        "Content-Length": "0",
        "Host": "httpbin:8000",
        "User-Agent": "curl/7.35.0",
        "X-B3-Parentspanid": "e1e80c46db19f77d",
        "X-B3-Sampled": "0",
        "X-B3-Spanid": "f978596e99f13e2b",
        "X-B3-Traceid": "dc285fef04fa4e1ce1e80c46db19f77d",
        "X-Envoy-Attempt-Count": "1",
        "X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/default;Hash=4604a9f50d9b2ecbb94f71e00a73294408a0597af96f77ffba09c53377f4a925;Subject=\"\";URI=spiffe://cluster.local/ns/default/sa/default"
    }
}

kubectl logs -f $V1_POD -c httpbin

127.0.0.1 - - [01/Mar/2021:06:29:37 +0000] "GET /headers HTTP/1.1" 200 553 "-" "curl/7.35.0"
127.0.0.1 - - [01/Mar/2021:06:53:49 +0000] "GET /headers HTTP/1.1" 200 553 "-" "curl/7.35.0"

kubectl logs -f $V2_POD -c httpbin

127.0.0.1 - - [01/Mar/2021:06:53:49 +0000] "GET /headers HTTP/1.1" 200 560 "-" "curl/7.35.0"

可以看到 v1 和 v2 中都有了访问日志。v2 中的访问日志就是由镜像流量产生的，这些请求的实际目标是 v1。

流量镜像

猜你喜欢