大规模Service Mesh落地实践之路（上）：从Sidecar到Ambient的架构演进

# Istio 1.22+ Ambient 模式安装配置
# istioctl install --set profile=ambient
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: ambient
  meshConfig:
    defaultConfig:
      proxyMetadata:
        # 优先使用 eBPF 进行流量重定向
        ISTIO_META_ENABLE_AMBIENT_EBPF: "true"
  components:
    cni:
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 100m
            memory: 128Mi

# Istio 1.22+ - 将命名空间纳入 Ambient Mesh
apiVersion: v1
kind: Namespace
metadata:
  name: my-app
  labels:
    istio.io/dataplane-mode: ambient  # 关键标签

# Cilium 1.16+ Helm 配置 - 启用 eBPF 替代 iptables
# helm install cilium cilium/cilium --version 1.16.x \
#   --set bpf.masquerade=true \
#   --set kubeProxyReplacement=true \
#   --set hostFirewall.enabled=true \
#   --set hubble.enabled=true
apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-config
  namespace: kube-system
data:
  # 完全替代 kube-proxy，使用 eBPF 实现 Service
  kube-proxy-replacement: "strict"
  # eBPF masquerade 替代 iptables MASQUERADE
  bpf-masquerade: "true"
  # 启用 eBPF host firewall
  enable-host-firewall: "true"
  # 启用 Cilium 与 Istio 集成
  istio-enabled: "true"

# Merbridge 安装 (Istio 1.22+ 兼容)
# kubectl apply -f https://raw.githubusercontent.com/merbridge/merbridge/main/deploy/all-in-one.yaml

# 验证 eBPF 程序加载
kubectl exec -n kube-system ds/cilium -- \
  bpftool prog list | grep -E "mb_|merbridge"

# Primary 集群配置
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: ambient
  values:
    global:
      meshID: weibo-mesh
      multiCluster:
        clusterName: cluster-primary
      network: network1
  components:
    cni:
      enabled: true
---
# Remote 集群配置
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: remote
  values:
    global:
      meshID: weibo-mesh
      multiCluster:
        clusterName: cluster-remote
      network: network1
    istiodRemote:
      injectionPath: /inject
    # 指向 Primary 集群的 Istiod
    configMaps:
      istio:
        discoveryAddress: istiod.istio-system.svc:15012

# Istio 1.22+ DestinationRule 连接池配置
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: my-service-pool
spec:
  host: my-service.my-namespace.svc.cluster.local
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 200          # 最大 TCP 连接数
        connectTimeout: 5s           # 连接超时
        tcpKeepalive:
          time: 7200s
          interval: 75s
      http:
        h2UpgradePolicy: UPGRADE     # 优先升级 HTTP/2
        maxRequestsPerConnection: 1000  # 每连接最大请求数
        maxRetries: 5
        maxPendingRequests: 1024
        maxRequests: 2000            # 最大并发请求数

# Sidecar 模式 - Envoy 资源配额 (Istio 1.22+)
apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-sidecar-injector
  namespace: istio-system
data:
  values: |
    global:
      proxy:
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 512Mi
---
# Ambient 模式 - ztunnel 资源配额
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: ztunnel
  namespace: istio-system
spec:
  template:
    spec:
      containers:
      - name: ztunnel
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: "1"
            memory: 512Mi

# Istio 1.22+ 启用 HTTP/3 (Alpha)
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: http3-support
spec:
  host: my-service.my-namespace.svc.cluster.local
  trafficPolicy:
    connectionPool:
      http:
        h2UpgradePolicy: UPGRADE
        http3ProtocolOptions:        # Istio 1.22+ Alpha
          quicProtocolOptions:
            maxConcurrentStreams: 100

# Istio 1.22+ Telemetry CRD 配置
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: mesh-default
  namespace: istio-system
spec:
  tracing:
  - providers:
    - name: otel          # OpenTelemetry Provider
    randomSamplingPercentage: 10.0  # 10% 采样率
    customTags:
      environment:
        literal:
          value: "production"
      cluster_name:
        environment:
          name: ISTIO_META_CLUSTER_ID
  accessLogging:
  - providers:
    - name: otel
  metrics:
  - providers:
    - name: prometheus
---
# OpenTelemetry Provider 配置
apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: otel-tracing
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: istiod
  url: oci://ghcr.io/open-telemetry/opentelemetry-collector-contrib
  phase: STATS
---
# OpenTelemetry Collector 部署
apiVersion: opentelemetry.io/v1beta1
kind: OpenTelemetryCollector
metadata:
  name: otel-collector
  namespace: istio-system
spec:
  config:
    receivers:
      otlp:
        protocols:
          grpc:
            endpoint: 0.0.0.0:4317
          http:
            endpoint: 0.0.0.0:4318
    processors:
      batch:
        timeout: 5s
        send_batch_size: 1024
      k8sattributes:
        extract:
          metadata:
          - k8s.pod.name
          - k8s.namespace.name
          - k8s.deployment.name
    exporters:
      prometheusremotewrite:
        endpoint: http://thanos-receive:19291/api/v1/write
      otlp/jaeger:
        endpoint: jaeger-collector:4317
      otlphttp/loki:
        endpoint: http://loki:3100/otlp
    service:
      pipelines:
        traces:
          receivers: [otlp]
          processors: [batch, k8sattributes]
          exporters: [otlp/jaeger]
        metrics:
          receivers: [otlp]
          processors: [batch, k8sattributes]
          exporters: [prometheusremotewrite]
        logs:
          receivers: [otlp]
          processors: [batch, k8sattributes]
          exporters: [otlphttp/loki]

# Cilium 1.16+ Hubble 配置
apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-config
  namespace: kube-system
data:
  enable-hubble: "true"
  hubble-listen-address: ":4244"
  hubble-socket-path: "/var/run/cilium/hubble.sock"
  hubble-event-queue-capacity: "4096"
  hubble-flow-buffer-size: "65535"
  # 启用 L7 协议解析 (无需 Sidecar)
  hubble-l7-proxy: "true"