# 下载Istio
$ curl -L https://istio.io/downloadIstio | sh –

# 进入学习交流加群风哥QQ113257174Istio目录
$ cd istio-1.18.0

# 添加Istio到PATH
$ export PATH=$PWD/bin:$PATH

# 安装Istio
$ istioctl install –set profile=default -y

# 验证Istio安装
$ kubectl get pods -n istio-system
NAME READY STATUS RESTARTS AGE
istio-ingressgateway-567890abc-12345 1/1 Running 0 5m
istiod-567890abc-67890 1/1 Running 0 5m

# 启用自动注入
$ kubectl label namespace default istio-injection=enabled

# 部署Bookinfo应用
$ kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml

# 查看应用状态
$ kubectl get pods
NAME READY STATUS RESTARTS AGE
details-v1-567890abc-12345 2/2 Running 0 5m
productpage-v1-567890abc-67890 2/2 Running 0 5m
ratings-v1-567890abc-abcde 2/2 Running 0 5m
reviews-v1-567890abc-fghij 2/2 Running 0 5m
reviews-v2-567890abc-ijklm 2/2 Running 0 5m
reviews-v3-567890abc-nopqr 2/2 Running 0 5m

# 查看服务
$ kubectl get services
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
details ClusterIP 10.96.123.45 <更多学习教程公众号风哥教程itpux_comnone> 9080/TCP 5m
productpage ClusterIP 10.96.78.90 9080/TCP 5m
ratings ClusterIP 10.96.34.56 9080/TCP 5m
reviews ClusterIP 10.96.56.78 9080/TCP 5m

# 部署网关
$ kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml

# 查看网关
$ kubectl get gateways -n istio-system
NAME AGE
bookinfo-gateway 2m

# 配置虚拟服务
$ kubectl apply -f samples/bookinfo/networking/destination-rule-all.yaml

# 配置流量路由
$ kubectl apply -f samples/bookinfo/networking/virtual-service-all-v1.yaml

# 查看虚拟服务
$ kubectl get virtualservices
NAME GATEWAYS HOSTS AGE
bookinfo [bookinfo-gateway] * 2m

# 查看目标规则
$ kubectl get destinationrules
NAME HOST AGE
details details 2m
productpage productpage 2m
ratings ratings 2m
reviews reviews 2m

# 配置金丝雀发布
$ kubectl apply -f samples/bookinfo/networking/virtual-service-reviews-50-v3.yaml

# 查看虚拟服务配置
$ kubectl get virtualservice reviews -o yaml
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: reviews
namespace: default
spec:
hosts:
– reviews
http:
– route:
– destination:
host: reviews
subset: v1
weight: 50
– destination:
host: reviews
subset: v3
weight: 50

# 配置熔断
$ kubectl apply -f samples/bookinfo/networking/destination-rule-reviews-circuit-breaker.yaml

# 查看目标规则配置
$ kubectl get destinationrule reviews -o yaml
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: reviews
namespace: default
spec:
host: reviews
subsets:
– name: v1
labels:
version: v1
– name: v2
labels:
version: v2
– name: v3
labels:
version: v3
trafficPolicy:
connectionPool:
tcp:
maxConnections: 100
http:
http1MaxPendingRequests: 100
maxRequestsPerConnection: 10
outlierDetection:
consecutive5xxErrors: 1
interval: 10s
baseEjectionTime: 30s

# 启用mTLS
$ kubectl apply -f samples/bookinfo/networking/authz-allow-all.yaml

# 配置访问控制
$ kubectl apply -f samples/bookinfo/networking/authz-productpage.yaml

# 查看授权策略
$ kubectl get authorizationpolicies
NAME AGE
authz-allow-all 2m
authz-productpage 2m

。

Part04-生产案例与实战讲解

4.1 企业级服务网格案例

某企业的服务网格实践如下：

• 技术栈：Kubernetes + Istio + Prometheus + Grafana
• 微服务数量：50+个微服务
• 流量管理：使用Istio的虚拟服务和目标规则实现金丝雀发布、A/B测试
• 安全策略：启用mTLS加密，配置基于角色的访问控制
• 监控体系：使用Prometheus监控服务网格指标，Grafana展示监控面板

4.2 服务网格性能优化案例

# 优化Istio代理资源配置
$ kubectl edit deployments -n istio-system istiod
# 修改资源配置
resources:
requests:
cpu: “500m”
memory: “1Gi”
limits:
cpu: “1”
memory: “2Gi”

# 优化Sidecar注入配置
$ kubectl edit configmaps -n istio-system istio
# 修改Sidecar资源配置
sidecarInjectorWebhook:
injectedAnnotations:
sidecar.istio.io/proxyCPU: “100m”
sidecar.istio.io/proxyMemory: “128Mi”
sidecar.istio.io/proxyCPULimit: “500m”
sidecar.istio.io/proxyMemoryLimit: “512Mi”

# 启用连接池优化
$ kubectl apply -f – << 'EOF' apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: default namespace: default spec: host: "*.default.svc.cluster.local" trafficPolicy: connectionPool: tcp: maxConnections: 1000 connectTimeout: 30ms tcpKeepalive: time: 7200s interval: 75s probes: 9 http: http1MaxPendingRequests: 1000 maxRequestsPerConnection: 100 maxRetries: 3 outlierDetection: consecutive5xxErrors: 5 interval: 30s baseEjectionTime: 30s maxEjectionPercent: 50 EOF

# 部署微服务示例
$ kubectl apply -f – << 'EOF' apiVersion: apps/v1 kind: Deployment metadata: name: user-service labels: app: user-service spec: replicas: 3 selector: matchLabels: app: user-service template: metadata: labels: app: user-service version: v1 spec: containers: - name: user-service image: harbor.fgedu.net.cn/library/user-service:v1.0.0 ports: - containerPort: 8080 resources: requests: cpu: "100m" memory: "256Mi" limits: cpu: "500m" memory: "512Mi" --- apiVersion: v1 kind: Service metadata: name: user-service spec: selector: app: user-service ports: - port: 80 targetPort: 8080 --- apiVersion: apps/v1 kind: Deployment metadata: name: order-service labels: app: order-service spec: replicas: 3 selector: matchLabels: app: order-service template: metadata: labels: app: order-service version: v1 spec: containers: - name: order-service image: harbor.fgedu.net.cn/library/order-service:v1.0.0 ports: - containerPort: 8080 resources: requests: cpu: "100m" memory: "256Mi" limits: cpu: "500m" memory: "512Mi" --- apiVersion: v1 kind: Service metadata: name: order-service spec: selector: app: order-service ports: - port: 80 targetPort: 8080 EOF # 配置服务网格规则 $ kubectl apply -f - << 'EOF' apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: user-service namespace: default spec: hosts: - user-service http: - route: - destination: host: user-service subset: v1 --- apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: order-service namespace: default spec: hosts: - order-service http: - route: - destination: host: order-service subset: v1 --- apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: user-service namespace: default spec: host: user-service subsets: - name: v1 labels: version: v1 trafficPolicy: connectionPool: tcp: maxConnections: 100 http: http1MaxPendingRequests: 100 maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 5 interval: 30s baseEjectionTime: 30s --- apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: order-service namespace: default spec: host: order-service subsets: - name: v1 labels: version: v1 trafficPolicy: connectionPool: tcp: maxConnections: 100 http: http1MaxPendingRequests: 100 maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 5 interval: 30s baseEjectionTime: 30s EOF

# 部署Prometheus和Grafana
$ kubectl apply -f samples/addons/prometheus.yaml
$ kubectl apply -f samples/addons/grafana.yaml

# 查看服务状态
$ kubectl get pods -n istio-system | grep -E ‘prometheus|grafana’
prometheus-567890abc-12345 2/2 Running 0 5m
grafana-567890abc-67890 1/1 Running 0 5m

# 配置Istio监控面板
$ istioctl dashboard grafana
# 打开浏览器访问http://localhost:3000

# 查看服务网格指标
$ kubectl port-forward -n istio-system svc/prometheus 9090:9090
# 打开浏览器访问http://localhost:9090

# 配置告警规则
$ kubectl apply -f – << 'EOF' apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: istio-alerts namespace: istio-system spec: groups: - name: istio rules: - alert: IstioServiceUnavailable expr: sum(istio_requests_total{response_code=~"5.."}) by (service) / sum(istio_requests_total) by (service) > 0.5
for: 5m
labels:
severity: critical
annotations:
summary: “服务不可用”
description: “服务 {{ $labels.service }} 的错误率超过50%”
– alert: IstioHighLatency
expr: histogram_quantile(0.95, sum(rate(istio_request_duration_milliseconds_bucket[5m])) by (le, service)) > 1000
for: 5m
labels:
severity: warning
annotations:
summary: “服务延迟过高”
description: “服务 {{ $labels.service }} 的95分位延迟超过1000ms”
EOF

from Linux:www.itpux.com。

Part05-风哥经验总结与分享

5.1 服务网格最佳实践

• 渐进式部署：从小规模开始，逐步扩大服务网格的覆盖范围
• 性能优化：根据实际需求调整服务网格代理的资源配置
• 监控体系：建立完善的监控体系，及时发现和处理问题
• 安全策略：启用mTLS加密，配置合理的访问控制策略
• 流量管理：使用金丝雀发布、A/B测试等策略，确保服务更新的安全性

5.2 微服务架构最佳实践

• 服务边界清晰：根据业务领域划分服务边界，避免服务过大或过小
• API设计规范：使用标准的API设计，确保服务间通信的一致性
• 数据管理：每个服务管理自己的数据，避免数据耦合
• 容错设计：实现服务的熔断、重试、超时等容错机制
• 自动化测试：为每个微服务编写单元测试、集成测试和端到端测试

5.3 常见问题与解决方案

• 服务网格性能开销：优化Sidecar资源配置，使用轻量级服务网格解决方案
• 配置复杂性：使用配置管理工具，统一管理服务网格配置
• 服务间通信延迟：优化网络通信，使用缓存减少重复调用
• 故障定位困难：建立完善的监控和追踪体系，使用分布式追踪工具
• 安全配置错误：定期审计安全配置，确保服务间通信的安全性

5.4 未来发展趋势

• 服务网格标准化：随着服务网格的普及，行业标准将逐渐形成
• 智能化管理：结合AI和机器学习，实现服务网格的智能化管理
• 边缘计算集成：将服务网格扩展到边缘设备，支持边缘计算场景
• 多集群管理：实现跨多个K8s集群的服务网格管理
• 云原生集成：与云原生生态系统深度集成，提供更完整的解决方案

风哥提示：服务网格和微服务架构是现代应用开发的重要趋势，需要持续学习和实践，以适应不断变化的业务需求和技术环境。