week3

[ByeongHunKim]

• Introducing Envoy

  • Istio가 Envoy를 사용하기만 하는거라 Envoy가 블랙 박스 같다
  • istiod의 Envoy Configuration 컴파일 기능을 자세히 공부하면서 Istio가 Envoy를 쓰기 위해 어떻게 동작하는지, 그리고 Config를 모든 Envoy 사이드카에 전파하기 위한 Service Discovery API 이런 부분

• Telemetry

  • 트래픽을 추적(Tracing)하는 Jaeger, 그리고 서비스메쉬의 트래픽을 모니터링 하는 Kiali

• PR template

• contribution.md

[ByeongHunKim]

Issue 추천

1. istio-system ns

   istio-ingressgateway-9cc99c9db-jlpvl   1/1     Running
   istiod-77d7cbcfdb-467hh                1/1     Running

2. istio-system ns - ingress

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
   annotations: 
   ... 생략
   spec:
   rules:
   - http:
     paths:
     - backend:
         service:
           name: istio-ingressgateway
           port:
             number: 80
       path: /*
       pathType: ImplementationSpecific
   - http:
     paths:
     - backend:
         service:
           name: istio-ingressgateway
           port:
             number: 443
       path: /*
       pathType: ImplementationSpecific
   status:
   loadBalancer:
   ingress:
   - hostname: eks-cluster-alb-xxxxxxxxxxx

3. 이때 어떻게 다음 목적지를 찾아서 트래픽이 전달되는가?

[ByeongHunKim]

공유 링크

AWS Summit 2024

70DaysOfServiceMesh

서비스메시마스터책

[ByeongHunKim]

Week3 진행 순서

[ByeongHunKim]

Safe Harbor deployment

동작 흐름

MR pipeline

MR Merge 후 main branch pipeline

파이프라인 커스텀 (1차)

review_production:
  extends: .auto-deploy
  stage: review-production
  script:
    - auto-deploy check_kube_domain
    - auto-deploy download_chart
    - auto-deploy use_kube_context || true
    - auto-deploy ensure_namespace
    - |
      if kubectl get namespace ${KUBE_NAMESPACE} -o jsonpath='{.metadata.labels.istio-injection}' | grep -q "enabled"; then
        echo "istio-injection label already exists and is set to enabled. Skipping..."
      else
        echo "Setting istio-injection label..."
        kubectl label namespace "${KUBE_NAMESPACE}" istio-injection=enabled
      fi
    - auto-deploy initialize_tiller
    - auto-deploy create_secret
    - auto-deploy deploy
    - auto-deploy persist_environment_url
  environment:
    name: review-production/$CI_COMMIT_REF_NAME
    url: http://$CI_PROJECT_PATH_SLUG-review-prod.$KUBE_INGRESS_BASE_DOMAIN
    on_stop: stop_review_production
  artifacts:
    paths: [environment_url.txt, tiller.log]
    when: always
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main" && $REVIEW_PRODUCTION_ENABLED == "true" && $PRODUCTION_ADDITIONAL_HOSTS != null'
      when: manual

stop_review_production:
  extends: .auto-deploy
  stage: cleanup
  variables:
    GIT_STRATEGY: none
  script:
    - auto-deploy use_kube_context || true
    - auto-deploy initialize_tiller
    - auto-deploy delete
  environment:
    name: review-production/$CI_COMMIT_REF_NAME
    action: stop
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main" && $REVIEW_PRODUCTION_ENABLED == "true" && $PRODUCTION_ADDITIONAL_HOSTS != null'
      when: manual

route_to_production_only:
  extends: .auto-deploy
  stage: cleanup
  variables:
    GIT_STRATEGY: none
  script:
    - auto-deploy use_kube_context || true
    - |
      cat <<EOF > virtualService.yaml
      apiVersion: networking.istio.io/v1alpha3
      kind: VirtualService
      metadata:
        name: review-prod-virtual-service
        namespace: "${KUBE_NAMESPACE}"
      spec:
        gateways:
        - review-prod-gateway
        hosts:
        - "${PRODUCTION_ADDITIONAL_HOSTS}"
        http:
        - route:
          - destination:
              host: production-auto-deploy
              subset: production
      EOF
    - kubectl apply -f virtualService.yaml
  environment:
    name: review-production/$CI_COMMIT_REF_NAME
    action: stop
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main" && $REVIEW_PRODUCTION_ENABLED == "true" && $PRODUCTION_ADDITIONAL_HOSTS != null'
      when: manual

apply_istio_custom_resources:
  extends: .auto-deploy
  stage: review-production
  image: "registry.gitlab.com/gitlab-org/cluster-integration/auto-deploy-image:v2.17.0"
  script:
    - auto-deploy use_kube_context || true
    - |
      echo "Creating Istio Custom Resources"
      echo "${KUBE_CONTEXT}"
    - |
      cat <<EOF > gateway.yaml
      apiVersion: networking.istio.io/v1alpha3
      kind: Gateway
      metadata:
        name: review-prod-gateway
        namespace: "${KUBE_NAMESPACE}"
      spec:
        selector:
          istio: ingressgateway
        servers:
        - port:
            number: 80
            name: http
            protocol: HTTP
          hosts:
          - "${PRODUCTION_ADDITIONAL_HOSTS}"
      EOF
    - |
      cat <<EOF > virtualService.yaml
      apiVersion: networking.istio.io/v1alpha3
      kind: VirtualService
      metadata:
        name: review-prod-virtual-service
        namespace: "${KUBE_NAMESPACE}"
      spec:
        gateways:
        - review-prod-gateway
        hosts:
        - "${PRODUCTION_ADDITIONAL_HOSTS}"
        http:
        - match:
          - headers:
              x-forwarded-for:
                prefix: "${REVIEW_PRODUCTION_ALLOWED_IP}"
          route:
          - destination:
              host: review-production-orddqb-auto-deploy
              subset: review
        - route:
          - destination:
              host: production-auto-deploy
              subset: production
      EOF
    - |
      cat <<EOF > destinationRule.yaml
      apiVersion: networking.istio.io/v1alpha3
      kind: DestinationRule
      metadata:
        name: review-prod-destination-rule
        namespace: "${KUBE_NAMESPACE}"
      spec:
        host: review-production-orddqb-auto-deploy
        subsets:
        - name: review
          labels:
            app.kubernetes.io/name: review-production-orddqb
      ---
      apiVersion: networking.istio.io/v1alpha3
      kind: DestinationRule
      metadata:
        name: production-destination-rule
        namespace: "${KUBE_NAMESPACE}"
      spec:
        host: production-auto-deploy
        subsets:
        - name: production
          labels:
            app.kubernetes.io/name: production
      EOF
    - kubectl apply -f gateway.yaml
    - kubectl apply -f virtualService.yaml
    - kubectl apply -f destinationRule.yaml
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main" && $REVIEW_PRODUCTION_ENABLED == "true" && $PRODUCTION_ADDITIONAL_HOSTS != null'
      when: manual

[ByeongHunKim]

kubectl -n istio-system get configmap istio -o=jsonpath='{.data.mesh}' > mesh-config.yaml