微博Service Mesh实践之路（下）

# Istio 1.22+ VirtualService — 机房级流量切换
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: user-service
spec:
  hosts:
    - user-service
  http:
    - route:
        - destination:
            host: user-service
            subset: yongfeng    # 永丰机房
          weight: 80
        - destination:
            host: user-service
            subset: tucheng     # 土城机房
          weight: 20
      retries:
        attempts: 3
        perRetryTimeout: 2s
        retryOn: 5xx,connect-failure

# DestinationRule — 机房子集定义 + 离群检测
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: user-service
spec:
  host: user-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        h2UpgradePolicy: DEFAULT
        http1MaxPendingRequests: 1024
        http2MaxRequests: 1024
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
      minHealthPercent: 25
  subsets:
    - name: yongfeng
      labels:
        topology.kubernetes.io/zone: yongfeng
    - name: tucheng
      labels:
        topology.kubernetes.io/zone: tucheng

# Argo Rollouts 1.7+ — 金丝雀发布策略
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: user-service
spec:
  strategy:
    canary:
      canaryService: user-service-canary
      stableService: user-service-stable
      trafficRouting:
        istio:
          virtualService:
            name: user-service
            routes:
              - primary
      steps:
        - setWeight: 5
        - pause: {duration: 5m}
        - setWeight: 10
        - pause: {duration: 5m}
        - analysis:
            templates:
              - templateName: success-rate
                clusterScope: true
            args:
              - name: service-name
                value: user-service-canary
        - setWeight: 30
        - pause: {duration: 5m}
        - setWeight: 50
        - pause: {duration: 10m}
        - setWeight: 80
        - pause: {duration: 5m}
        - setWeight: 100
        - pause: {duration: 0}

# Istio 1.22+ Telemetry CRD
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: default
  namespace: istio-system
spec:
  metrics:
    - providers:
        - name: prometheus
      overrides:
        - match:
            metric: REQUEST_COUNT
          operation: ADD
          value:
            request_method: request.method
        - match:
            metric: REQUEST_DURATION
          operation: ADD
          value:
            request_host: request.host
  tracing:
    - providers:
        - name: otel
      randomSamplingPercentage: 10.0
      customTags:
        source_ip:
          header:
            name: X-Envoy-External-Address

# Cilium Hubble 配置
apiVersion: v1
kind: ConfigMap
metadata:
  name: hubble-config
  namespace: kube-system
data:
  hubble.yaml: |
    metrics:
      enabled:
        - dns
        - drop
        - flow
        - http
        - icmp
        - tcp
      server:
        enabled: true
        port: 8080
    observe:
      observability:
        enabled: true

# Istio 1.22+ — 全命名空间 mTLS 严格模式
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT

# AuthorizationPolicy — 服务级访问控制
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: user-service-policy
  namespace: production
spec:
  selector:
    matchLabels:
      app: user-service
  rules:
    - from:
        - source:
            principals:
              - "cluster.local/ns/frontend/sa/frontend-sa"
            namespaces:
              - frontend
      to:
        - operation:
            methods:
              - GET
            paths:
              - /api/v1/users/*
      when:
        - key: request.headers[x-token]
          values:
            - "valid-token-*"

// Rust Wasm Plugin — 自定义 AccessLog 扩展
use proxy_wasm::traits::*;
use proxy_wasm::types::*;

#[proxy_wasm_main]
fn main() {
    proxy_wasm::set_log_level(LogLevel::Trace);
    proxy_wasm::set_vm_context(VmContext);
}

struct VmContext;
impl Context for VmContext {}
impl VmContext for VmContext {
    fn create_http_context(&self, context_id: u32) -> Option<HttpContext> {
        Some(HttpContext { context_id })
    }
}

struct HttpContext {
    context_id: u32,
}

impl Context for HttpContext {}
impl HttpContext for HttpContext {
    fn on_http_response_headers(&mut self, _num_headers: usize, _end_of_stream: bool) {
        let status = self.get_http_response_header(":status").unwrap_or("unknown");
        let path = self.get_http_request_header(":path").unwrap_or("unknown");
        let method = self.get_http_request_header(":method").unwrap_or("unknown");

        // 自定义日志格式
        self.log(LogLevel::Info,
            &format!("access_log: method={}, path={}, status={}", method, path, status));
    }
}

# Istio 1.22+ WasmPlugin CRD
apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: custom-accesslog
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  url: oci://registry.example.com/wasm/accesslog:v1.0.0
  imagePullPolicy: IfNotPresent
  imagePullSecret: registry-credentials
  phase: AUTHN
  pluginConfig:
    log_format: "method={{method}} path={{path}} status={{status}}"
    output_destination: stdout
  priority: 100

# Kubernetes Gateway API — API Gateway 配置
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: api-gateway
  namespace: istio-system
spec:
  gatewayClassName: istio
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      hostname: "*.example.com"
      allowedRoutes:
        namespaces:
          from: All
    - name: https
      port: 443
      protocol: HTTPS
      hostname: "*.example.com"
      tls:
        mode: Terminate
        certificateRefs:
          - name: example-com-cert
            kind: Secret
            namespace: istio-system

# HTTPRoute — 路由规则
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: user-service-route
spec:
  parentRefs:
    - name: api-gateway
      namespace: istio-system
  hostnames:
    - "api.example.com"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /api/v1/users
      backendRefs:
        - name: user-service
          port: 8080
          weight: 90
        - name: user-service-canary
          port: 8080
          weight: 10
      filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            add:
              - name: X-Source
                value: gateway