# 1. 安装Istio
# 下载Istio
curl -L https://istio.io/downloadIstio | sh –
# 进入Istio目录
cd istio-1.16.0
# 添加istioctl到PATH
export PATH=$PATH:$(pwd)/bin
# 安装Istio
istioctl install –set profile=default -y
# 2. 配置服务网格
# 为命名空间启用自动注入
kubectl label namespace fgedu-production istio-injection=enabled
# 3. 部署应用
# 部署用户服务
cat > user-service.yaml << EOF apiVersion: apps/v1 kind: Deployment metadata: name: user-service namespace: fgedu-production spec: replicas: 3 selector: matchLabels: app: user-service template: metadata: labels: app: user-service version: v1 spec: containers: - name: user-service image: fgedu/user-service:v1.0 ports: - containerPort: 8080 --- apiVersion: v1 kind: Service metadata: name: user-service namespace: fgedu-production spec: selector: app: user-service ports: - port: 80 targetPort: 8080 type: ClusterIP EOF kubectl apply -f user-service.yaml # 部署订单服务 cat > order-service.yaml << EOF apiVersion: apps/v1 kind: Deployment metadata: name: order-service namespace: fgedu-production spec: replicas: 3 selector: matchLabels: app: order-service template: metadata: labels: app: order-service version: v1 spec: containers: - name: order-service image: fgedu/order-service:v1.0 ports: - containerPort: 8080 --- apiVersion: v1 kind: Service metadata: name: order-service namespace: fgedu-production spec: selector: app: order-service ports: - port: 80，更多视频教程www.fgedu.net.cn。 targetPort: 8080 type: ClusterIP EOF kubectl apply -f order-service.yaml # 4. 配置流量管理 # 创建VirtualService cat > virtualservice.yaml << EOF apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: user-service namespace: fgedu-production spec: hosts: - user-service http: - route: - destination: host: user-service subset: v1 weight: 100 EOF kubectl apply -f virtualservice.yaml # 创建DestinationRule cat > destinationrule.yaml << EOF apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: user-service namespace: fgedu-production spec: host: user-service subsets: - name: v1 labels: version: v1 - name: v2 labels: version: v2 EOF kubectl apply -f destinationrule.yaml # 5. 配置安全 # 启用mTLS cat > peerauthentication.yaml << EOF apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: default namespace: fgedu-production spec: mtls: mode: STRICT EOF kubectl apply -f peerauthentication.yaml # 6. 配置监控 # 部署Prometheus和Grafana istioctl install --set addonComponents.grafana.enabled=true --set addonComponents.prometheus.enabled=true -y # 7. 验证部署 kubectl get pods -n fgedu-production kubectl get services -n fgedu-production kubectl get virtualservices -n fgedu-production kubectl get destinationrules -n fgedu-production