Esta página foi traduzida pela API Cloud Translation.
Switch to English

Como adicionar gateways

  1. Crie um novo gateway de entrada seguindo o modelo para o gateway de entrada pré-instalado. É possível usar o seguinte NEG de definição de gateway para criar um novo gateway. No YAML de definição do gateway, substitua POD_NAMESPACE pelo seu namespace e, em seguida, copie e cole o YAML em um arquivo, GATEWAY_DEFINITION_FILE. Edite recursos como PodDisruptionBudget e HorizontalPodAutoscaler conforme apropriado para seu ambiente.

    YAML de definição de gateway

    apiVersion: v1
kind: ServiceAccount
metadata:
  name: user-ingressgateway-service-account
  namespace: istio-system
  labels:
    app: istio-ingressgateway
    chart: gateways
    heritage: Tiller
    release: istio
---
apiVersion: v1
kind: Service
metadata:
  name: user-ingressgateway
  namespace: istio-system
  annotations:
  labels:
    chart: gateways
    heritage: Tiller
    release: istio
    app: istio-ingressgateway
    istio: ingressgateway
spec:
  type: LoadBalancer
  selector:
    release: istio
    app: istio-ingressgateway
    istio: ingressgateway
  ports:
    -
      name: status-port
      port: 15020
      targetPort: 15020
    -
      name: http2
      nodePort: 31380
      port: 80
      targetPort: 80
    -
      name: https
      nodePort: 31390
      port: 443
    -
      name: tcp
      nodePort: 31400
      port: 31400
    -
      name: https-kiali
      port: 15029
      targetPort: 15029
    -
      name: https-prometheus
      port: 15030
      targetPort: 15030
    -
      name: https-grafana
      port: 15031
      targetPort: 15031
    -
      name: https-tracing
      port: 15032
      targetPort: 15032
    -
      name: tls
      port: 15443
      targetPort: 15443
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-ingressgateway
  namespace: istio-system
  labels:
    app: istio-ingressgateway
    chart: gateways
    heritage: Tiller
    istio: ingressgateway
    release: istio
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
      istio: ingressgateway
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      labels:
        app: istio-ingressgateway
        chart: gateways
        heritage: Tiller
        istio: ingressgateway
        release: istio
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      serviceAccountName: user-ingressgateway-service-account
      containers:
        - name: istio-proxy
          image: "gcr.io/istio-testing/proxyv2:1.4-dev"
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 15020
            - containerPort: 80
            - containerPort: 443
            - containerPort: 31400
            - containerPort: 15029
            - containerPort: 15030
            - containerPort: 15031
            - containerPort: 15032
            - containerPort: 15443
            - containerPort: 15090
              protocol: TCP
              name: http-envoy-prom
          args:
          - proxy
          - router
          - --domain
          - POD_NAMESPACE.svc.cluster.local
          - --log_output_level=default:info
          - --drainDuration
          - '45s' #drainDuration
          - --parentShutdownDuration
          - '1m0s' #parentShutdownDuration
          - --connectTimeout
          - '10s' #connectTimeout
          - --serviceCluster
          - user-ingressgateway
          - --zipkinAddress
          - zipkin:9411
          - --proxyAdminPort
          - "15000"
          - --statusPort
          - "15020"
          - --controlPlaneAuthPolicy
          - NONE
          - --discoveryAddress
          - istio-pilot:15010
          readinessProbe:
            failureThreshold: 30
            httpGet:
              path: /healthz/ready
              port: 15020
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            limits:
              cpu: 2000m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 128Mi
          env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: spec.nodeName
          - name: POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: INSTANCE_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP
          - name: HOST_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.hostIP
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                fieldPath: spec.serviceAccountName
          - name: ISTIO_META_POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: ISTIO_META_CONFIG_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: ISTIO_METAJSON_LABELS
            value: |
              {"app":"istio-ingressgateway","chart":"gateways","heritage":"Tiller","istio":"ingressgateway","release":"istio"}
          - name: ISTIO_META_CLUSTER_ID
            value: "Kubernetes"
          - name: SDS_ENABLED
            value: "false"
          - name: ISTIO_META_WORKLOAD_NAME
            value: user-ingressgateway
          - name: ISTIO_META_OWNER
            value: kubernetes://apis/apps/v1/namespaces/istio-system/deployments/user-ingressgateway
          - name: ISTIO_META_ROUTER_MODE
            value: sni-dnat
          volumeMounts:
          - name: istio-certs
            mountPath: /etc/certs
            readOnly: true
          - name: ingressgateway-certs
            mountPath: "/etc/istio/ingressgateway-certs"
            readOnly: true
          - name: ingressgateway-ca-certs
            mountPath: "/etc/istio/ingressgateway-ca-certs"
            readOnly: true
      volumes:
      - name: istio-certs
        secret:
          secretName: istio.user-ingressgateway-service-account
          optional: true
      - name: ingressgateway-certs
        secret:
          secretName: "istio-ingressgateway-certs"
          optional: true
      - name: ingressgateway-ca-certs
        secret:
          secretName: "istio-ingressgateway-ca-certs"
          optional: true
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - "amd64"
                - "ppc64le"
                - "s390x"
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 2
            preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - "amd64"
          - weight: 2
            preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - "ppc64le"
          - weight: 2
            preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - "s390x"
---
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: user-ingressgateway
  namespace: istio-system
  labels:
    chart: gateways
    heritage: Tiller
    release: istio
    app: istio-ingressgateway
    istio: ingressgateway
spec:
  minAvailable: 1
  selector:
    matchLabels:
      release: istio
      app: istio-ingressgateway
      istio: ingressgateway
—
apiVersion: autoscaling/v2beta1
kind: HorizontalPodAutoscaler
metadata:
  name: user-ingressgateway
  namespace: istio-system
  labels:
    chart: gateways
    heritage: Tiller
    release: istio
    app: istio-ingressgateway
    istio: ingressgateway
spec:
  maxReplicas: 5
  minReplicas: 1
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: user-ingressgateway
  metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageUtilization: 80
---

  2. Aplique o arquivo de gateway do usuário ao cluster:

    kubectl apply -f GATEWAY_DEFINITION_FILE

  3. Verifique se um IP externo foi atribuído ao novo gateway:

    kubectl get svc -n istio-system

    A saída é semelhante à seguinte, com endereços IP para o istio-ingressgateway integrado e o gateway que você acabou de criar. Outros serviços do Istio são omitidos para abreviar.

    NAME                   TYPE           CLUSTER-IP       EXTERNAL-IP
istio-ingressgateway   LoadBalancer   10.103.245.98    35.225.130.192 ...
user-ingressgateway    LoadBalancer   10.103.240.33    104.198.174.26 ...

  4. Adicione um recurso de gateway para o novo gateway. Para outras referências sobre gateways, consulte a referência istio.io (em inglês).

    kind: Gateway
metadata:
  name: user-gateway
spec:
  selector:
    app: user-ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"

  5. Modifique qualquer VirtualService que aponte para o gateway integrado também para apontar para o novo gateway. Veja o VirtualService modificado com base no exemplo do Bookinfo (em inglês):

    apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "*"
  gateways:
    - bookinfo-gateway
    - user-gateway
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage
        port:
          number: 9080

  6. Aplique os novos Gateway e VirtualService ao cluster usando kubectl apply.

  7. Teste se o tráfego alcança seus aplicativos, tanto do endereço antigo quanto do novo. Usando o exemplo do Bookinfo, isso pode ser feito com curl nos endereços IP externos atribuídos:

    curl http://35.225.130.192/productpage
curl http://104.198.174.26/productpage

  8. Atualize seu DNS ou balanceador de carga para rotear o tráfego para o novo endereço IP externo.

  9. Remova todas as referências a VirtualServices em qualquer Gateways que aponte para a entrada integrada.

  10. Remova qualquer Gateways que aponte para a entrada integrada.