Istio 服务网格部署与流量管理实战

一、概述

Istio 是一个开源的服务网格（Service Mesh）平台，为微服务架构提供流量管理、安全认证、可观测性等核心能力。本文介绍 Istio 在 Kubernetes 环境中的部署流程及核心流量管理功能实战。

核心特性

  • 流量管理：智能路由、负载均衡、故障注入、流量镜像
  • 安全认证：mTLS 加密、身份认证、授权策略
  • 可观测性：分布式追踪、指标监控、访问日志
  • 策略控制：速率限制、配额管理、访问控制

二、环境准备

2.1 前置要求

组件 版本要求 说明
Kubernetes 1.25+ 支持 Gateway API
kubectl 1.25+ 与 K8s 版本匹配
Helm 3.10+ 包管理工具
节点资源 4C8G+ 建议配置

2.2 检查集群状态

1
2
3
4
5
6
7
8
# 检查集群版本
kubectl version --short

# 检查节点状态
kubectl get nodes

# 检查命名空间
kubectl get namespaces

三、Istio 安装部署

3.1 下载 istioctl

1
2
3
4
5
6
7
8
# 下载指定版本
curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.20.0 sh -

# 进入目录
cd istio-1.20.0

# 添加到 PATH
export PATH=$PWD/bin:$PATH

3.2 预检查

1
2
3
4
5
# 检查集群兼容性
istioctl x precheck

# 分析现有配置
istioctl analyze

3.3 使用 Helm 安装（推荐生产环境）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
# 添加 Istio Helm 仓库
helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo update

# 创建 istio-system 命名空间
kubectl create namespace istio-system

# 安装 Istio 基础组件（CRDs）
helm install istio-base istio/base -n istio-system

# 安装 Istiod 控制平面
helm install istiod istio/istiod -n istio-system \
  --set pilot.resources.requests.cpu=500m \
  --set pilot.resources.requests.memory=2Gi \
  --set global.proxy.resources.requests.cpu=100m \
  --set global.proxy.resources.requests.memory=128Mi

# 安装入口网关
helm install istio-ingress istio/gateway -n istio-system

3.4 验证安装

1
2
3
4
5
6
7
8
# 检查 Pod 状态
kubectl get pods -n istio-system

# 检查服务
kubectl get svc -n istio-system

# 验证控制平面
istioctl verify-install

预期输出：

1
2
3
4
5
✔ Istio core installed
✔ Istiod installed
✔ Egress gateways installed
✔ Ingress gateways installed
✔ Installation complete

四、Sidecar 注入

4.1 自动注入

1
2
3
4
5
# 为命名空间启用自动注入
kubectl label namespace default istio-injection=enabled

# 验证标签
kubectl get namespace -L istio-injection

4.2 手动注入

1
2
3
4
5
# 对现有部署注入 Sidecar
istioctl kube-inject -f deployment.yaml | kubectl apply -f -

# 或重新滚动更新
kubectl rollout restart deployment/<deployment-name>

4.3 注入验证

1
2
3
4
5
# 检查 Pod 中的 Envoy 容器
kubectl get pod <pod-name> -o jsonpath='{.spec.containers[*].name}'

# 查看 Sidecar 配置
istioctl proxy-config bootstrap <pod-name> -n <namespace>

五、流量管理实战

5.1 部署示例应用

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
# bookinfo.yaml
apiVersion: v1
kind: Service
metadata:
  name: reviews
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: reviews
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: reviews-v1
spec:
  replicas: 2
  selector:
    matchLabels:
      app: reviews
      version: v1
  template:
    metadata:
      labels:
        app: reviews
        version: v1
    spec:
      containers:
      - name: reviews
        image: istio/examples-bookinfo-reviews-v1:latest
        ports:
        - containerPort: 9080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: reviews-v2
spec:
  replicas: 2
  selector:
    matchLabels:
      app: reviews
      version: v2
  template:
    metadata:
      labels:
        app: reviews
        version: v2
    spec:
      containers:
      - name: reviews
        image: istio/examples-bookinfo-reviews-v2:latest
        ports:
        - containerPort: 9080

5.2 虚拟服务配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# virtual-service.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
  - reviews
  http:
  - route:
    - destination:
        host: reviews
        subset: v1
      weight: 90
    - destination:
        host: reviews
        subset: v2
      weight: 10

5.3 目标规则配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# destination-rule.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

5.4 应用配置

1
2
3
4
5
kubectl apply -f virtual-service.yaml
kubectl apply -f destination-rule.yaml

# 验证配置
istioctl analyze

六、高级流量管理

6.1 金丝雀发布

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: productpage
spec:
  hosts:
  - productpage
  http:
  - match:
    - headers:
        end-user:
          exact: "test-user"
    route:
    - destination:
        host: productpage
        subset: v2
  - route:
    - destination:
        host: productpage
        subset: v1
      weight: 95
    - destination:
        host: productpage
        subset: v2
      weight: 5

6.2 故障注入测试

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: ratings
spec:
  hosts:
  - ratings
  http:
  - fault:
      delay:
        percentage:
          value: 100
        fixedDelay: 7s
    route:
    - destination:
        host: ratings
        subset: v1

6.3 流量镜像

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: productpage-mirror
spec:
  hosts:
  - productpage
  http:
  - route:
    - destination:
        host: productpage
        subset: v1
    mirror:
      host: productpage
      subset: v2
    mirrorPercentage:
      value: 100

6.4 超时与重试

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
  - reviews
  http:
  - route:
    - destination:
        host: reviews
        subset: v1
    timeout: 10s
    retries:
      attempts: 3
      perTryTimeout: 2s
      retryOn: 5xx,reset,connect-failure

七、安全配置

7.1 启用 mTLS

1
2
3
4
5
6
7
8
9
# PeerAuthentication - 命名空间级别
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: default
spec:
  mtls:
    mode: STRICT

7.2 授权策略

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: reviews-policy
  namespace: default
spec:
  selector:
    matchLabels:
      app: reviews
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/sa/bookinfo-productpage"]
    to:
    - operation:
        methods: ["GET", "POST"]

八、可观测性

8.1 安装 Kiali

1
2
3
4
# 使用 Helm 安装
helm install kiali kiali/kiali -n istio-system \
  --set auth.strategy=anonymous \
  --set server.port=20001

8.2 访问 Kiali 仪表盘

1
2
3
4
# 端口转发
kubectl port-forward svc/kiali -n istio-system 20001:20001

# 浏览器访问 http://localhost:20001

8.3 分布式追踪

1
2
3
4
5
# 安装 Jaeger
helm install jaeger jaegertracing/jaeger -n istio-system

# 端口转发
kubectl port-forward svc/jaeger-query -n istio-system 16686:16686

8.4 指标查询示例

1
2
3
4
5
6
7
8
9
# 请求成功率
sum(rate(istio_requests_total{response_code="200"}[5m])) 
/ 
sum(rate(istio_requests_total[5m]))

# P99 延迟
histogram_quantile(0.99, 
  sum(rate(istio_request_duration_milliseconds_bucket[5m])) 
  by (le, destination_service))

九、常见问题排查

9.1 Sidecar 注入失败

1
2
3
4
5
# 检查注入配置
kubectl get mutatingwebhookconfiguration istio-sidecar-injector -o yaml

# 查看注入日志
kubectl logs -n istio-system -l app=istiod

9.2 流量不通

1
2
3
4
5
6
7
8
# 检查 VirtualService
istioctl analyze -n <namespace>

# 查看 Envoy 配置
istioctl proxy-config routes <pod-name> -n <namespace>

# 检查服务发现
istioctl proxy-config cluster <pod-name> -n <namespace>

9.3 mTLS 连接失败

1
2
3
4
5
# 检查证书状态
istioctl proxy-config secret <pod-name> -n <namespace>

# 验证 PeerAuthentication
kubectl get peerauthentication -A

十、性能调优建议

10.1 资源限制

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
# istiod 资源配置
resources:
  requests:
    cpu: 500m
    memory: 2Gi
  limits:
    cpu: 2000m
    memory: 4Gi

# Proxy 资源配置
global:
  proxy:
    resources:
      requests:
        cpu: 100m
        memory: 128Mi
      limits:
        cpu: 500m
        memory: 512Mi

10.2 连接池优化

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: connection-pool
spec:
  host: myservice
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
        connectTimeout: 30s
      http:
        h2UpgradePolicy: UPGRADE
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
        maxRequestsPerConnection: 10

十一、总结

Istio 服务网格为微服务架构提供了强大的流量管理、安全和可观测性能力。关键要点：

  1. 渐进式采用：从观察模式开始，逐步启用 mTLS 和策略
  2. 资源规划：合理设置 Sidecar 资源限制，避免资源浪费
  3. 配置验证：使用 istioctl analyze 定期检查配置
  4. 监控告警：建立关键指标的监控和告警机制
  5. 版本管理：生产环境使用 Helm 管理，便于回滚和升级

参考文档