apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: bookinfo-ratings
spec:
  host: ratings.prod.svc.cluster.local # 路由规则的目标。客户端向服务端发送请求时用的地址。一般是写svc FQDN
  trafficPolicy: # 针对这一个svc，配置流量规则配置
    loadBalancer:
      simple: LEAST_REQUEST # 最小请求算法
  subsets: # 版本划分
  - name: v3 # 自己起一个版本名称
    labels:
      version: v3
    trafficPolicy: # 还可以对不同版本的服务做配置，这里的会覆盖掉外面的trafficPolicy
      loadBalancer:
        simple: ROUND_ROBIN # 轮询算法

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: ProductPage
  namespace: nsA
spec:
  hosts:
  # 路由规则的目标，客户端向服务端发动请求时使用的地址。
  # 如果是管理南北流量，写域名；管理东西流量，写svc的FQDN
  - bookinfo.com
  gateways:
  # 管理南北流量，写当前域名绑定的gateway的名称。
  # 管理东西流量，可以不用写
  - my-gateway
  http: # 配置七层代理规则 - 某个路径路由到哪个服务
  - match:
    - uri:
        prefix: /productpage/v1/
    route:
    - destination:
        host: productpage-v1.nsA.svc.cluster.local
  # 请求匹配到bookinfo.com/productpage/v1/，就走上面的svc
  # 没匹配到，就走这个默认的svc。下面的默认配置也可以不写。
  - route:
    - destination:
        host: productpage.nsA.svc.cluster.local

apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: my-gateway
  namespace: nsA
spec:
  selector: # 选择运行此网关配置的istio ingress gateway pod（一般一个集群内装一个ingress gateway）
    app:  my-gateway-controller
  servers:
  - port:
      name: http
      number: 80
      protocol: HTTP
    hosts:
    - "bookinfo.com"

#首先下载Istio的安装包： 
wget https://github.com/istio/istio/releases/download/1.27.0/istio-1.27.0-linux-amd64.tar.gz 
#解压后，将Istio的客户端工具istioctl，移动到/usr/local/bin 目录下： 
tar xf istio-1.27.0-linux-amd64.tar.gz 
cd istio-1.27.0 && mv bin/istioctl /usr/local/bin/ 
istioctl version

helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo update

# 如需离线保存 Chart
helm pull istio/base --version 1.27.1
helm pull istio/istiod --version 1.27.1
helm pull istio/gateway --version 1.27.1

# 安装顺序：CRD/base -> control plane -> gateway
helm upgrade --install istio-base istio/base \
  --namespace istio-system --create-namespace \
  --version 1.27.1 --set defaultRevision=default

meshConfig:
  enablePrometheusMerge: true
  accessLogEncoding: JSON
  accessLogFile: /dev/stdout

global:
  defaultResources:
    requests:
      cpu: 50m
      memory: 128Mi
  hub: m.daocloud.io/docker.io/istio
  imagePullPolicy: IfNotPresent

helm upgrade --install istiod istio/istiod \
  --namespace istio-system --version 1.27.1 \
  -f istiod-values.dev.yaml --wait

service:
  type: NodePort
  ports:
    - name: status-port
      port: 15020
      protocol: TCP
      targetPort: 15020
      nodePort: 30520
    - name: http2
      port: 80
      protocol: TCP
      targetPort: 8080
      nodePort: 30080
    - name: https
      port: 443
      protocol: TCP
      targetPort: 8443
      nodePort: 30443

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: "2"
    memory: 1Gi

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 5
  targetCPUUtilizationPercentage: 80

imagePullPolicy: IfNotPresent

helm upgrade --install istio-ingress istio/gateway \
  --namespace istio-system --version 1.27.1 \
  -f gateway-values.dev.yaml --wait

tar zxvf istio-1.13.1.tar.gz
cd istio-1.13.1
export PATH="$PWD/bin:$PATH"
install -m 0755 bin/istioctl /usr/local/bin/istioctl

# 离线环境在工作节点导入所需镜像
docker load -i pilot.tar.gz
docker load -i proxyv2.tar.gz
docker load -i httpbin.tar.gz

# demo profile 仅用于学习和功能验证
istioctl install --set profile=demo -y
kubectl get pods -n istio-system

# 卸载
istioctl x uninstall --purge -y

kubectl create ns istio-system

apiVersion: install.istio.io/v1alpha1 
kind: IstioOperator 
metadata: 
  name: example-istio 
  namespace: istio-system 
spec: 
  hub: m.daocloud.io/docker.io/istio # 修改镜像地址
  meshConfig: 
    accessLogEncoding: JSON 
    accessLogFile: /dev/stdout 
  # https://istio.io/latest/docs/setup/additional-setup/config-profiles/
  profile: default # 生产环境建议直接用default就行。
  components: 
    base: 
      enabled: true 
    cni: 
      enabled: false 
    egressGateways: 
    - enabled: false 
      name: istio-egressgateway 
    ingressGateways: 
    - enabled: true 
      name: istio-ingressgateway 
      k8s: # ingressgateway自己的pod端口配置
        service:      # 将Service类型改成NodePort 
          type: NodePort 
          ports: 
          - name: status-port
            port: 15020 
            nodePort: 30520  
          - name: http2 
            port: 80  # 流量入口80端口映射到NodePort的30080，之后通过节点IP+30080即可访问Istio服务 
            nodePort: 30080 
            targetPort: 8080 
          - name: https 
            port: 443 
            nodePort: 30443 
            targetPort: 8443 

istioctl install -f istio-operator.yaml
# This will install the Istio 1.26.0 profile "default" into the cluster. 
# Proceed? (y/N) y 

istioctl profile dump demo

kubectl create ns istio-system

apiVersion: install.istio.io/v1alpha1 
kind: IstioOperator 
metadata: 
  name: example-istio 
  namespace: istio-system 
spec: 
  hub: m.daocloud.io/docker.io/istio 
  meshConfig: 
    accessLogEncoding: JSON 
    accessLogFile: /dev/stdout
  components: 
    base: 
      enabled: true 
    cni: 
      enabled: false 
    egressGateways: 
    - enabled: false 
      name: istio-egressgateway 
    pilot: # istiod组件的hpa
      k8s: 
        hpaSpec: 
          minReplicas: 2  # 默认为1 
          maxReplicas: 5 # 默认为5 
        resources: 
          limits: # 生产环境建议4C4G/4C8G
            memory: 2Gi 
            cpu: "2" 
          requests: # 生产环境建议4C4G/4C8G（和limit一样，提高QoS）
            memory: 128Mi
            cpu: "100m" 
    ingressGateways: 
    - enabled: true 
      name: istio-ingressgateway 
      k8s: # ingressGateway的hpa配置
        hpaSpec: 
          minReplicas: 2  # default 1 
          maxReplicas: 5 # default 5 
        resources: 
          limits: # 生产环境建议4C4G/4C8G
            memory: 2Gi 
            cpu: "2" 
          requests: # 生产环境建议4C4G/4C8G（和limit一样，提高QoS）
            memory: 128Mi 
            cpu: "100m" 
        service:      # 将Service类型改成NodePort 
          type: NodePort 
          ports: 
          - port: 15020 
            nodePort: 30520 
            name: status-port 
          - port: 80  # 流量入口80端口映射到NodePort的30080，之后通过节点IP+30080即可访问Istio服务 
            nodePort: 30080 
            name: http2 
            targetPort: 8080 
          - port: 443 
            nodePort: 30443 
            name: https 
            targetPort: 8443

istioctl install -f istio-operator.yaml 
# This will install the Istio 1.26.0 profile "default" into the cluster. 
# Proceed? (y/N) y 

kubectl create ns istio-test
kubectl label namespace istio-test istio-injection=enabled

cd istio-1.27.0/sample/sleep/
# 更改测试服务的镜像地址：
vim sleep.yaml
image: m.daocloud.io/docker.io/curlimages/curl 
# 创建测试服务：
kubectl apply -f sleep.yaml -n istio-test 

  template: 
    metadata: 
      labels:
        app: sleep
      annotations:
        sidecar.istio.io/inject: "true"

cd istio-1.27.0/samples/curl
vim curl.yaml

template: 
  metadata: 
      labels:
        app: curl
      annotations:
        sidecar.istio.io/inject: "false"
  spec: 
    terminationGracePeriodSeconds: 0 
    serviceAccountName: curl 
    containers: 
    - name: curl 
      image: m.daocloud.io/docker.io/curlimages/curl 

kubectl label namespace istio-test istio-injection-

apiVersion: v1 
kind: Service 
metadata: 
  name: kiali 
  namespace: "istio-system" 
spec: 
  type: NodePort

kubectl apply -f ./istio-1.27/samples/addons/kiali.yaml
# 通过NodePort高位端口访问UI界面

cd ./istio-1.27.0/samples/addons

# 首先更改镜像地址 
vim samples/addons/jaeger.yaml 
# 更改名称为tracing的svc为NodePort
vim samples/addons/jaeger.yaml

# Deployment/Pod template 中的镜像
image: "m.daocloud.io/docker.io/jaegertracing/all-in-one:1.67.0"
---
apiVersion: v1
kind: Service
metadata:
  name: tracing
  namespace: istio-system
  labels:
    app: jaeger
spec:
  type: NodePort
  ports:
    - name: http-query
      port: 80
      protocol: TCP
      targetPort: 16686
    # Note: Change port name if you add '--query.grpc.tls.enabled=true'
    - name: grpc-query
      port: 16685
      protocol: TCP
      targetPort: 16685
  selector:
    app: jaeger

# 创建
kubectl create -f samples/addons/jaeger.yaml

# 通过NodePort高位端口访问UI界面

# 同样需要修改镜像地址 
vim samples/addons/grafana.yaml 
image: "m.daocloud.io/docker.io/grafana/grafana:11.3.1" 
vim samples/addons/prometheus.yaml
image: "m.daocloud.io/docker.io/prom/prometheus:v3.2.1" 

# 修改svc为NodePort
vim samples/addons/grafana.yaml # 修改name为grafana的svc
vim samples/addons/prometheus.yaml # 修改名为prometheus的svc

# 安装
kubectl create -f samples/addons/prometheus.yaml -f samples/addons/grafana.yaml 
# 完成后通过NodePort高位端口访问grafana

kubectl create ns bookinfo
kubectl label ns bookinfo istio-injection=enabled

vim samples/bookinfo/platform/kube/bookinfo.yaml
image: m.daocloud.io/docker.io/istio/examples-bookinfo-details-v1:1.20.3 
image: m.daocloud.io/docker.io/istio/examples-bookinfo-ratings-v1:1.20.3 
image: m.daocloud.io/docker.io/istio/examples-bookinfo-reviews-v1:1.20.3 
image: m.daocloud.io/docker.io/istio/examples-bookinfo-reviews-v2:1.20.3 
image: m.daocloud.io/docker.io/istio/examples-bookinfo-reviews-v3:1.20.3 
image: m.daocloud.io/docker.io/istio/examples-bookinfo-productpage-v1:1.20.3 

kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml -n bookinfo 

apiVersion: networking.istio.io/v1 
kind: Gateway 
metadata: 
  name: bookinfo-gateway 
  namespace: bookinfo 
spec:
  # The selector matches the ingress gateway pod labels.
  # If you installed Istio using Helm following the standard documentation, this would be "istio=ingress"
  selector: 
    istio: ingressgateway # 使用默认的istio ingress gateway 
  servers: 
  - port: 
      number: 80 
      name: http 
      protocol: HTTP 
    hosts: 
    - "bookinfo.kubeasy.com" # 发布域名

--- 
apiVersion: networking.istio.io/v1 
kind: VirtualService 
metadata: 
  name: bookinfo 
  namespace: bookinfo 
spec: 
  hosts: 
  - "bookinfo.kubeasy.com" 
  gateways: 
  - bookinfo-gateway 
  http: 
  - match: 
    - uri: 
        exact: /productpage 
    - uri: 
        prefix: /static 
    - uri: 
        exact: /login 
    - uri: 
        exact: /logout
    - uri: 
        prefix: /api/v1/products 
    route: 
    - destination: 
        host: productpage.bookinfo.svc.cluster.local 
        port: 
          number: 9080 

kubectl apply -f bookinfo-gateway.yaml -f bookinfo-vs.yaml -n bookinfo

kubectl get svc -n istio-system istio-ingressgateway

--- 
apiVersion: networking.istio.io/v1 
kind: VirtualService 
metadata: 
  name: bookinfo 
spec: 
  hosts: 
  - "bookinfo.kubeasy.com" 
  gateways: 
  - bookinfo-gateway 
  http: 
  - match: 
    - uri: 
        prefix: /hangx # 匹配/hangx
    redirect: 
      authority: edu.51cto.com  # 跳转的域名 
      uri: /lecturer/11062970.html  # 跳转的路径
  - match: 
    - uri: 
        exact: /productpage 
    - uri: 
        prefix: /static 
    - uri: 
        exact: /login 
    - uri: 
        exact: /logout 
    - uri: 
        prefix: /api/v1/products 
    route: 
    - destination: 
        host: productpage.bookinfo.svc.cluster.local
        port: 
          number: 9080 

kubectl apply -f bookinfo-vs.yaml -n bookinfo

--- 
apiVersion: networking.istio.io/v1 
kind: VirtualService 
metadata: 
  name: bookinfo 
spec: 
  hosts: 
  - "bookinfo.kubeasy.com" 
  gateways: 
  - bookinfo-gateway
  http: 
  - match:
    - uri:
        exact: / # 匹配根路径
    rewrite: # 地址重写为/productpage
      uri: /productpage
    route: # 指定rewrite到哪个
    - destination:
        host: productpage.bookinfo.svc.cluster.local
        port:
          number: 9080
  - match: 
    - uri: 
        exact: /productpage 
    - uri: 
        prefix: /static 
    - uri: 
        exact: /login 
    - uri: 
        exact: /logout 
    - uri: 
        prefix: /api/v1/products 
    route: 
    - destination: 
        host: productpage.bookinfo.svc.cluster.local
        port: 
          number: 9080 

kubectl apply -f bookinfo-vs.yaml -n bookinfo

apiVersion: networking.istio.io/v1 
kind: DestinationRule 
metadata: 
  name: reviews 
spec: 
  host: reviews.bookinfo.svc.cluster.local
  subsets: 
  - name: v1 
    labels: 
      version: v1 # subset v1指向具有version=v1的Pod 
  - name: v2 
    labels: 
      version: v2 # subset v2指向具有version=v2的Pod 
  - name: v3 
    labels: 
      version: v3 # subset v3指向具有version=v3的Pod 

kubectl apply -f bookinfo-canary-dr.yaml -n bookinfo

apiVersion: networking.istio.io/v1 
kind: VirtualService 
metadata: 
  name: reviews 
spec: 
  hosts: 
  - reviews.bookinfo.svc.cluster.local 
  http: 
  - route: 
    - destination: 
        host: reviews.bookinfo.svc.cluster.local 
        subset: v1 # 将流量全部指向v1

kubectl apply -f vs-reviews-canary.yaml -n bookinfo

apiVersion: networking.istio.io/v1 
kind: VirtualService 
metadata: 
  name: reviews 
spec: 
  hosts: 
  - reviews.bookinfo.svc.cluster.local 
  http: 
  - route: 
      - weight: 80
        destination: 
          host: reviews.bookinfo.svc.cluster.local 
          subset: v1
      - weight: 20
        destination: 
          host: reviews.bookinfo.svc.cluster.local
          subset: v2    

kubectl apply -f vs-reviews-v2-all.yaml -n bookinfo

apiVersion: networking.istio.io/v1 
kind: VirtualService 
metadata: 
  name: reviews 
spec: 
  hosts: 
  - reviews.bookinfo.svc.cluster.local 
  http: 
  - route:
    - destination: 
        host: reviews.bookinfo.svc.cluster.local
        subset: v2

kubectl apply -f vs-reviews-v1-all.yaml -n bookinfo

apiVersion: networking.istio.io/v1 
kind: VirtualService 
metadata: 
  name: reviews 
spec: 
  hosts: 
  - reviews.bookinfo.svc.cluster.local 
  http: 
  - match: 
    - headers: # 匹配请求头 
        end-user: # 匹配请求头的key为end-user。根据实际情况填写合适的header头
          exact: jason # value 为jason，也支持prefix、regex 
    route: 
    - destination: 
        host: reviews.bookinfo.svc.cluster.local
        subset: v3 # 匹配到end-user=jason路由至v3版本
  - route: 
    - destination: 
        host: reviews.bookinfo.svc.cluster.local
        subset: v2 # 其余用户路由到v2版本

kubectl apply -f vs-ab-json-v3.yaml -n bookinfo

apiVersion: networking.istio.io/v1 
kind: DestinationRule 
metadata: 
  name: reviews 
spec: 
  trafficPolicy:  # 添加路由策略，在spec下对所有的subset生效，也可以在subset中配置
    loadBalancer: # 配置负载均衡
      simple: RANDOM # 策略为RANDOM
  host: reviews.bookinfo.svc.cluster.local
  subsets: 
  - name: v1 
    labels: 
      version: v1 # subset v1指向具有version=v1的Pod 
    trafficPolicy: # 对于v1的所有pod配置单独的负载均衡算法
      loadBalancer: # 配置负载均衡
        simple: LEAST_REQUEST # 策略为RANDOM
  - name: v2 
    labels: 
      version: v2 # subset v2指向具有version=v2的Pod 
  - name: v3 
    labels: 
      version: v3 # subset v3指向具有version=v3的Pod 

kubectl apply -f bookinfo-canary-dr.yaml -n bookinfo

# vim ratings-dr.yaml  
apiVersion: networking.istio.io/v1 
kind: DestinationRule 
metadata: 
  name: ratings 
  namespace: bookinfo 
spec: 
  host: ratings.bookinfo.svc.cluster.local
  trafficPolicy: # trafficPolicy配置，也可以配置在subsets级别 
    connectionPool: # 连接池配置，可以单独使用限制程序的并发数 
      tcp: 
        maxConnections: 3 # 最大并发数为3 
      http: 
        http1MaxPendingRequests: 1 # 最大的待处理请求。
        # 假如有2个待处理请求，就触发了熔断，不让你排队了，因为排队也没有用了
    outlierDetection:  # 熔断探测配置 
      consecutive5xxErrors: 1  # 如果连续出现的5xx错误超过1次，就会被熔断 
      interval: 10s # 每10秒探测一次后端实例 
      baseEjectionTime: 3m  # 熔断的时间。某个后端pod触发熔断后，也不能一直不接受请求。3分钟之后，估算着请求应该都处理完成了，重新接受请求。
      maxEjectionPercent: 100 # 被熔断实例最大的百分比。比如10个pod，10个都能触发熔断就是100。测试用写100。实际写50就可以，太高会造成其他实例出现性能问题。
  subsets: 
  - name: v1
    labels: 
      version: v1 

# 修改镜像
vim samples/httpbin/sample-client/fortio-deploy.yaml

# 部署
kubectl apply -f samples/httpbin/sample-client/fortio-deploy.yaml -n bookinfo

FORTIO_POD=$(kubectl get pod -n bookinfo | grep fortio | awk '{ print $1 }') 
echo $FORTIO_POD

kubectl exec -ti $FORTIO_POD -n bookinfo -- fortio load -curl http://ratings:9080/ratings/0

kubectl exec -ti $FORTIO_POD -n bookinfo -- fortio load -c 2 -qps 0 -n 20 -loglevel Warning http://ratings:9080/ratings/0 | grep Code 

kubectl exec -ti $FORTIO_POD -n bookinfo -- fortio load -c 20 -qps 0 -n 20 -loglevel Warning  http://ratings:9080/ratings/0 | grep Code

Code 200 : 5 (25.0 %)
Code 503 : 15 (75.0 %)

kubectl create deploy -n bookinfo debug-tools --image=registry.cn-beijing.aliyuncs.com/dotbalo/debug-tools -- sleep 36000

kubectl exec -ti debug-tools-5887bf6774-598tc -n bookinfo -- bash
time curl -I -s details:9080

# vim details-delay.yaml  
apiVersion: networking.istio.io/v1 
kind: VirtualService 
metadata: 
  name: details 
spec: 
  hosts: 
  - details.bookinfo.svc.cluster.local
  http: 
  - fault: # 添加一个错误 
      delay: # 添加类型为delay的故障 
        percentage: # 故障注入的百分比 
          value: 100 # 对所有请求注入故障 
        fixedDelay: 5s # 注入的延迟时间 
    route: 
    - destination: 
        host: details 

kubectl create -f details-delay.yaml -n bookinfo

time curl -I -s details:9080

# vim details-abort.yaml 
apiVersion: networking.istio.io/v1 
kind: VirtualService 
metadata: 
  name: details 
spec: 
  hosts: 
  - details 
  http: 
  - fault: 
      abort: # 更改为abort类型的故障 
        percentage: 
          value: 100 
        httpStatus: 400 # 故障状态码 
    route:
    - destination:
        host: details

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx:1.14-alpine
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  selector:
    app: nginx
  ports:
    - name: http
      port: 80
      targetPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tomcat
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tomcat
  template:
    metadata:
      labels:
        app: tomcat
    spec:
      containers:
        - name: tomcat
          image: docker.io/kubeguide/tomcat-app:v1
---
apiVersion: v1
kind: Service
metadata:
  name: tomcat-svc
spec:
  selector:
    app: tomcat
  ports:
    - name: http
      port: 8080
      targetPort: 8080

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: nginx-timeout
spec:
  hosts:
    - nginx-svc
  http:
    - timeout: 2s
      route:
        - destination:
            host: nginx-svc
---
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: tomcat-delay
spec:
  hosts:
    - tomcat-svc
  http:
    - fault:
        delay:
          fixedDelay: 10s
          percentage:
            value: 100
      route:
        - destination:
            host: tomcat-svc

kubectl run busybox --image=busybox:1.28 --restart=Never --rm -it -- /bin/sh

# Tomcat 约 10 秒返回
time wget -q -O - http://tomcat-svc.default.svc.cluster.local:8080

# Nginx 路由约 2 秒超时
time wget -q -O - http://nginx-svc.default.svc.cluster.local:80

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: tomcat-retry
spec:
  hosts:
    - tomcat-svc
  http:
    - timeout: 8s
      retries:
        attempts: 3
        perTryTimeout: 2s
        retryOn: 5xx,connect-failure,reset
      route:
        - destination:
            host: tomcat-svc

kubectl logs -f deploy/nginx -c istio-proxy