사전 설치된 인그레스 게이트웨이 템플릿을 따라 새 인그레스 게이트웨이를 만듭니다. 다음 게이트웨이 정의 YAML을 사용하여 새 게이트웨이를 만들 수 있습니다. 게이트웨이 정의 YAML에서
POD_NAMESPACE를 네임스페이스로 바꾼 후 YAML을 복사하여GATEWAY_DEFINITION_FILE파일에 붙여넣습니다. 사용자 환경에 맞게PodDisruptionBudget및HorizontalPodAutoscaler같은 리소스를 수정해야 합니다.게이트웨이 정의 YAML
apiVersion: v1 kind: ServiceAccount metadata: name: user-ingressgateway-service-account namespace: istio-system labels: app: istio-ingressgateway chart: gateways heritage: Tiller release: istio --- apiVersion: v1 kind: Service metadata: name: user-ingressgateway namespace: istio-system annotations: labels: chart: gateways heritage: Tiller release: istio app: istio-ingressgateway istio: ingressgateway spec: type: LoadBalancer selector: release: istio app: istio-ingressgateway istio: ingressgateway ports: - name: status-port port: 15020 targetPort: 15020 - name: http2 nodePort: 31380 port: 80 targetPort: 80 - name: https nodePort: 31390 port: 443 - name: tcp nodePort: 31400 port: 31400 - name: https-kiali port: 15029 targetPort: 15029 - name: https-prometheus port: 15030 targetPort: 15030 - name: https-grafana port: 15031 targetPort: 15031 - name: https-tracing port: 15032 targetPort: 15032 - name: tls port: 15443 targetPort: 15443 --- apiVersion: apps/v1 kind: Deployment metadata: name: user-ingressgateway namespace: istio-system labels: app: istio-ingressgateway chart: gateways heritage: Tiller istio: ingressgateway release: istio spec: selector: matchLabels: app: istio-ingressgateway istio: ingressgateway strategy: rollingUpdate: maxSurge: 100% maxUnavailable: 25% template: metadata: labels: app: istio-ingressgateway chart: gateways heritage: Tiller istio: ingressgateway release: istio annotations: sidecar.istio.io/inject: "false" spec: serviceAccountName: user-ingressgateway-service-account containers: - name: istio-proxy image: "gcr.io/istio-testing/proxyv2:1.4-dev" imagePullPolicy: IfNotPresent ports: - containerPort: 15020 - containerPort: 80 - containerPort: 443 - containerPort: 31400 - containerPort: 15029 - containerPort: 15030 - containerPort: 15031 - containerPort: 15032 - containerPort: 15443 - containerPort: 15090 protocol: TCP name: http-envoy-prom args: - proxy - router - --domain - POD_NAMESPACE.svc.cluster.local - --log_output_level=default:info - --drainDuration - '45s' #drainDuration - --parentShutdownDuration - '1m0s' #parentShutdownDuration - --connectTimeout - '10s' #connectTimeout - --serviceCluster - user-ingressgateway - --zipkinAddress - zipkin:9411 - --proxyAdminPort - "15000" - --statusPort - "15020" - --controlPlaneAuthPolicy - NONE - --discoveryAddress - istio-pilot:15010 readinessProbe: failureThreshold: 30 httpGet: path: /healthz/ready port: 15020 scheme: HTTP initialDelaySeconds: 1 periodSeconds: 2 successThreshold: 1 timeoutSeconds: 1 resources: limits: cpu: 2000m memory: 1024Mi requests: cpu: 100m memory: 128Mi env: - name: NODE_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: INSTANCE_IP valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: HOST_IP valueFrom: fieldRef: apiVersion: v1 fieldPath: status.hostIP - name: SERVICE_ACCOUNT valueFrom: fieldRef: fieldPath: spec.serviceAccountName - name: ISTIO_META_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: ISTIO_META_CONFIG_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: ISTIO_METAJSON_LABELS value: | {"app":"istio-ingressgateway","chart":"gateways","heritage":"Tiller","istio":"ingressgateway","release":"istio"} - name: ISTIO_META_CLUSTER_ID value: "Kubernetes" - name: SDS_ENABLED value: "false" - name: ISTIO_META_WORKLOAD_NAME value: user-ingressgateway - name: ISTIO_META_OWNER value: kubernetes://apis/apps/v1/namespaces/istio-system/deployments/user-ingressgateway - name: ISTIO_META_ROUTER_MODE value: sni-dnat volumeMounts: - name: istio-certs mountPath: /etc/certs readOnly: true - name: ingressgateway-certs mountPath: "/etc/istio/ingressgateway-certs" readOnly: true - name: ingressgateway-ca-certs mountPath: "/etc/istio/ingressgateway-ca-certs" readOnly: true volumes: - name: istio-certs secret: secretName: istio.user-ingressgateway-service-account optional: true - name: ingressgateway-certs secret: secretName: "istio-ingressgateway-certs" optional: true - name: ingressgateway-ca-certs secret: secretName: "istio-ingressgateway-ca-certs" optional: true affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: beta.kubernetes.io/arch operator: In values: - "amd64" - "ppc64le" - "s390x" preferredDuringSchedulingIgnoredDuringExecution: - weight: 2 preference: matchExpressions: - key: beta.kubernetes.io/arch operator: In values: - "amd64" - weight: 2 preference: matchExpressions: - key: beta.kubernetes.io/arch operator: In values: - "ppc64le" - weight: 2 preference: matchExpressions: - key: beta.kubernetes.io/arch operator: In values: - "s390x" --- apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: user-ingressgateway namespace: istio-system labels: chart: gateways heritage: Tiller release: istio app: istio-ingressgateway istio: ingressgateway spec: minAvailable: 1 selector: matchLabels: release: istio app: istio-ingressgateway istio: ingressgateway — apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: user-ingressgateway namespace: istio-system labels: chart: gateways heritage: Tiller release: istio app: istio-ingressgateway istio: ingressgateway spec: maxReplicas: 5 minReplicas: 1 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: user-ingressgateway metrics: - type: Resource resource: name: cpu targetAverageUtilization: 80 ---클러스터에 사용자 게이트웨이 파일을 적용합니다.
kubectl apply -f GATEWAY_DEFINITION_FILE외부 IP가 새 게이트웨이에 할당되었는지 확인합니다.
kubectl get svc -n istio-system출력은 다음과 비슷합니다. 기본 제공
istio-ingressgateway과 방금 만든 게이트웨이에 대한 IP 주소가 있습니다. 간략히 하기 위해 다른 Istio 서비스는 생략되었습니다.NAME TYPE CLUSTER-IP EXTERNAL-IP istio-ingressgateway LoadBalancer 10.103.245.98 35.225.130.192 ... user-ingressgateway LoadBalancer 10.103.240.33 104.198.174.26 ...
새 게이트웨이의 게이트웨이 리소스를 추가합니다. 게이트웨이에 대한 자세한 내용은 istio.io 참조를 확인하세요.
kind: Gateway metadata: name: user-gateway spec: selector: app: user-ingressgateway servers: - port: number: 80 name: http protocol: HTTP hosts: - "*"새 게이트웨이를 가리키도록 기본 제공 게이트웨이를 가리키는 모든
VirtualService를 수정합니다. 다음은 Bookinfo 예시의 항목을 기반으로 수정된VirtualService입니다.apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: bookinfo spec: hosts: - "*" gateways: - bookinfo-gateway - user-gateway http: - match: - uri: exact: /productpage - uri: prefix: /static - uri: exact: /login - uri: exact: /logout - uri: prefix: /api/v1/products route: - destination: host: productpage port: number: 9080kubectl apply를 사용하여 새Gateway및VirtualService를 클러스터에 적용합니다.이전 외부 IP 주소와 새 외부 IP 주소를 모두 사용하여 트래픽이 애플리케이션에 도달할 수 있는지 테스트합니다. Bookinfo 예시를 사용하면 할당된 외부 IP 주소에 대한 curl을 통해 수행할 수 있습니다.
curl http://35.225.130.192/productpage curl http://104.198.174.26/productpage새 외부 IP 주소로 트래픽을 라우팅하도록 DNS 또는 부하 분산기를 업데이트합니다.
기본 제공 인그레스를 가리키는 모든
Gateways에 대한VirtualServices에서 모든 참조를 삭제합니다.기본 제공 인그레스를 가리키는 모든
Gateways를 삭제합니다.
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2022-02-17 UTC.
[{
"type": "thumb-down",
"id": "hardToUnderstand",
"label":"이해하기 어려움"
},{
"type": "thumb-down",
"id": "incorrectInformationOrSampleCode",
"label":"잘못된 정보 또는 샘플 코드"
},{
"type": "thumb-down",
"id": "missingTheInformationSamplesINeed",
"label":"필요한 정보/샘플이 없음"
},{
"type": "thumb-down",
"id": "translationIssue",
"label":"번역 문제"
},{
"type": "thumb-down",
"id": "otherDown",
"label":"기타"
}]
[{
"type": "thumb-up",
"id": "easyToUnderstand",
"label":"이해하기 쉬움"
},{
"type": "thumb-up",
"id": "solvedMyProblem",
"label":"문제가 해결됨"
},{
"type": "thumb-up",
"id": "otherUp",
"label":"기타"
}]