在匹配的主机上找不到 Istio DestinationRule 子集标签

Question

我正在尝试配置 Istio VirtialService / DestinationRule，以便从标记为 datacenter=chi5 的 pod 对服务的 grpc 调用路由到标记为 datacenter=chi5 的 pod 上的 grpc 服务器。

我在运行 Kubernetes 1.15 的集群上安装了 Istio 1.4。

route 未在 istio-sidecar envoy 配置中为 chi5 子集创建，并且无论 pod 标签如何，流量都在每个服务端点之间循环路由。

Kiali 在DestinationRule 配置中报告错误：“在任何匹配的主机中都找不到此子集的标签”。

是我误解了这些 Istio 流量管理对象的功能还是我的配置有错误？

我相信我的 pod 的标签是正确的：

$ (dev) kubectl get pods -n istio-demo --show-labels
NAME                            READY   STATUS    RESTARTS   AGE    LABELS
ticketclient-586c69f77d-wkj5d   2/2     Running   0          158m   app=ticketclient,datacenter=chi6,pod-template-hash=586c69f77d,run=client-service,security.istio.io/tlsMode=istio
ticketserver-7654cb5f88-bqnqb   2/2     Running   0          158m   app=ticketserver,datacenter=chi5,pod-template-hash=7654cb5f88,run=ticket-service,security.istio.io/tlsMode=istio
ticketserver-7654cb5f88-pms25   2/2     Running   0          158m   app=ticketserver,datacenter=chi6,pod-template-hash=7654cb5f88,run=ticket-service,security.istio.io/tlsMode=istio

我的 k8s 服务对象上的端口名称正确地以 grpc 协议为前缀：

$ (dev) kubectl describe service -n istio-demo ticket-service
Name:              ticket-service
Namespace:         istio-demo
Labels:            app=ticketserver
Annotations:       <none>
Selector:          run=ticket-service
Type:              ClusterIP
IP:                10.234.14.53
Port:              grpc-ticket  10000/TCP
TargetPort:        6001/TCP
Endpoints:         10.37.128.37:6001,10.44.0.0:6001
Session Affinity:  None
Events:            <none>

我已将以下 Istio 对象部署到 Kubernetes：

Kind:         VirtualService
Name:         ticket-destinationrule
Namespace:    istio-demo
Labels:       app=ticketserver
Annotations:  <none>
API Version:  networking.istio.io/v1alpha3
Kind:         DestinationRule
Spec:
  Host:  ticket-service.istio-demo.svc.cluster.local
  Subsets:
    Labels:
      Datacenter:  chi5
    Name:          chi5
    Labels:
      Datacenter:  chi6
    Name:          chi6
Events:            <none>
---
Name:         ticket-virtualservice
Namespace:    istio-demo
Labels:       app=ticketserver
Annotations:  <none>
API Version:  networking.istio.io/v1alpha3
Kind:         VirtualService
Spec:
  Hosts:
    ticket-service.istio-demo.svc.cluster.local
  Http:
    Match:
      Name:  ticket-chi5
      Port:  10000
      Source Labels:
        Datacenter:  chi5
    Route:
      Destination:
        Host:    ticket-service.istio-demo.svc.cluster.local
        Subset:  chi5
Events:          <none>

Answer 1

我已经用 2 个 nginx pod 重现了您的问题。

你想要的可以用sourceLabel来实现，看看下面的例子，我想它解释了一切。

首先我制作了 2 个 ubuntu pod，1 个带有 label app:ubuntu，1 个没有任何标签。

apiVersion: v1
kind: Pod
metadata:
  name: ubu2
  labels:
    app: ubuntu
spec:
  containers:
  - name: ubu2
    image: ubuntu
    command: ["/bin/sh"]
    args: ["-c", "apt-get update && apt-get install curl -y && sleep 3000"]

---

apiVersion: v1
kind: Pod
metadata:
  name: ubu1
spec:
  containers:
  - name: ubu1
    image: ubuntu
    command: ["/bin/sh"]
    args: ["-c", "apt-get update && apt-get install curl -y && sleep 3000"]

然后进行 2 次服务部署。

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx1
spec:
  selector:
    matchLabels:
      run: nginx1
  replicas: 1
  template:
    metadata:
      labels:
        run: nginx1
        app: frontend
    spec:
      containers:
      - name: nginx1
        image: nginx
        ports:
        - containerPort: 80
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh", "-c", "echo Hello nginx1 > /usr/share/nginx/html/index.html"]

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx2
spec:
  selector:
    matchLabels:
      run: nginx2
  replicas: 1
  template:
    metadata:
      labels:
        run: nginx2
        app: frontend
    spec:
      containers:
      - name: nginx2
        image: nginx
        ports:
        - containerPort: 80
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh", "-c", "echo Hello nginx2 > /usr/share/nginx/html/index.html"]

---

apiVersion: v1
kind: Service
metadata:
  name: nginx
  labels:
    app: frontend
spec:
  ports:
  - port: 80
    protocol: TCP
  selector:
    app: frontend

---

另一件事是virtual service 带有网状网关，所以它只在网状网中工作，有 2 个匹配项，1 个带有 sourceLabel，从带有 app: ubuntu 标签的 pod 到带有 v1 子集的 nginx pod，另一个匹配到带有 v2 子集的 nginx pod。

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginxvirt
spec:
  gateways:
  - mesh
  hosts:
  - nginx.default.svc.cluster.local
  http:
  - name: match-myuid
    match:
    - sourceLabels:
        app: ubuntu
    route:
    - destination:
        host: nginx.default.svc.cluster.local
        port:
          number: 80
        subset: v1
  - name: default
    route:
    - destination:
        host: nginx.default.svc.cluster.local
        port:
          number: 80
        subset: v2

---

最后一件事是 DestinationRule，它从虚拟服务中获取子集并将其发送到带有标签 nginx1 或 nginx2 的适当 nginx pod

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: nginxdest
spec:
  host: nginx.default.svc.cluster.local
  subsets:
  - name: v1
    labels:
      run: nginx1
  - name: v2
    labels:
      run: nginx2

---

kubectl 获取 pod --show-labels

---

NAME                      READY   STATUS    RESTARTS   AGE     LABELS
nginx1-5c5b84567c-tvtzm   2/2     Running   0          23m     app=frontend,run=nginx1,security.istio.io/tlsMode=istio
nginx2-5d95c8b96-6m9zb    2/2     Running   0          23m     app=frontend,run=nginx2,security.istio.io/tlsMode=istio
ubu1                      2/2     Running   4          3h19m   security.istio.io/tlsMode=istio
ubu2                      2/2     Running   2          10m     app=ubuntu,security.istio.io/tlsMode=istio

---

来自 ubuntu pod 的结果

---

带标签的 Ubuntu

curl nginx/
Hello nginx1

---

Ubuntu 无标签

curl nginx/
Hello nginx2

---

如果有帮助，请告诉我。