管理设计篇之"服务网格" [2026重制版]

# 安装 istioctl (v1.22.0)
curl -L https://istio.io/downloadIstio | sh -
cd istio-1.22.0
export PATH=$PWD/bin:$PATH

# 使用 profile 安装 (推荐 demo 或 production)
istioctl install --set profile=demo -y

# 验证安装
kubectl get pods -n istio-system
kubectl get svc -n istio-system

# istio-operator.yaml - 生产环境配置
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: istio-controlplane
spec:
  # ====== 全局配置 ======
  profile: production  # 生产环境 Profile
  hub: gcr.io/istio-release
  tag: 1.22.0

  # ====== 组件配置 ======
  components:
    pilot:
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 500m
            memory: 2048Mi
          limits:
            cpu: 2000m
            memory: 4096Mi
        hpaSpec:
          minReplicas: 2
          maxReplicas: 5
          targetCPUUtilizationPercentage: 80

    ingressGateway:
      enabled: true
      name: istio-ingressgateway
      k8s:
        service:
          type: LoadBalancer
          annotations:
            service.beta.kubernetes.io/aws-load-balancer-type: nlb
        resources:
          requests:
            cpu: 200m
            memory: 128Mi
          limits:
            cpu: 1000m
            memory: 512Mi

    egressGateway:
      enabled: true
      name: istio-egressgateway

  # ====== 全局特性 ======
  meshConfig:
    accessLogFile: /dev/stdout
    defaultConfig:
      tracing:
        sampling: 10.0  # 10% 采样率
        custom_tags:
          app:
            environment:
              name: SOURCE_WORKLOAD_NAME
          version:
            environment:
              name: SOURCE_WORKLOAD_NAMESPACE
      proxyStatsMatcher:
        inclusionRegexps:
          - ".*cluster.*"
          - ".*upstream.*"
          - ".*circuit_breaker.*"

  # ====== 安全配置 ======
  meshExpansion:
    enabled: false

  # ====== 遥测配置 ======
  values:
    global:
      proxy:
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 512Mi
    pilot:
      autoscaleEnabled: true
    telemetry:
      enabled: true
      v2:
        prometheus:
          enabled: true
        stackdriver:
          enabled: false

# 方式一：命名空间自动注入（推荐）
kubectl label namespace default istio-injection=enabled

# 方式二：手动注入
kubectl apply -f <(istioctl kube-inject -f deployment.yaml)

# 验证 Sidecar 已注入
kubectl get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[*].name}{"\n"}{end}'

# virtualservice-canary.yaml - 金丝雀发布
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: order-service
  namespace: default
spec:
  hosts:
    - order-service
  http:
    - match:
        - headers:
            x-canary:
              exact: "true"
      route:
        - destination:
            host: order-service
            subset: v2
          weight: 100
    - route:
        - destination:
            host: order-service
            subset: v1
          weight: 95
        - destination:
            host: order-service
            subset: v2
          weight: 5
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: order-service
  namespace: default
spec:
  host: order-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        h2UpgradePolicy: DEFAULT
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2

# 安装 Ambient Mesh
istioctl install --set profile=ambient --skip-confirmation

# 标记命名空间使用 Ambient
kubectl label namespace default istio.io/data-plane-mode=ambient

# 部署 Waypoint Proxy (L7 策略，使用 Kubernetes Gateway API)
kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: waypoint
  labels:
    istio.io/waypoint-for: service
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 15008
    protocol: HBONE
EOF

# 使用 cilium CLI 安装
cilium install \
  --version 1.15.0 \
  --set kubeProxyReplacement=true \
  --set tls.secretsBackend=k8s \
  --set bpf.monitorAggregation=none \
  --set ipam.mode=kubernetes

# 启用 Hubble (可观测性)
cilium hubble enable --ui

# 验证状态
cilium status

# cilium-mesh-config.yaml - CiliumClusterwideNetworkPolicy
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: mesh-policy
specs:
  - endpointSelector: {}
    ingress:
      - fromEndpoints:
          - {}
        toPorts:
          - ports:
              - port: "443"
                protocol: TCP
            rules:
              http:
                - method: "GET"
                  path: "/"
    egress:
      - toEndpoints:
          - matchLabels:
              "k8s:io.kubernetes.pod.namespace": kube-system
              "k8s-app": kube-dns
        toPorts:
          - ports:
              - port: "53"
                protocol: ANY

# 01-gateway.yaml - 入口网关配置
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: ecommerce-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "ecommerce.example.com"
      tls:
        httpsRedirect: true
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: ecommerce-tls-secret
      hosts:
        - "ecommerce.example.com"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: ecommerce-routing
  namespace: istio-system
spec:
  hosts:
    - "ecommerce.example.com"
  gateways:
    - ecommerce-gateway
  http:
    - match:
        - uri:
            prefix: /api/user
      route:
        - destination:
            host: user-service.default.svc.cluster.local
            port:
              number: 8081
    - match:
        - uri:
            prefix: /api/product
      route:
        - destination:
            host: product-service.default.svc.cluster.local
            port:
              number: 8082
    - match:
        - uri:
            prefix: /api/order
      route:
        - destination:
            host: order-service.default.svc.cluster.local
            port:
              number: 8083

# 02-circuit-breaker.yaml - 熔断配置
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: circuit-breaker-rules
  namespace: default
spec:
  host: inventory-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 50
      http:
        http1MaxPendingRequests: 100
        http2MaxRequests: 500
        maxRequestsPerConnection: 10
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 60s
      maxEjectionPercent: 40
      minHealthPercent: 51

# 03-authz-policy.yaml - 授权策略
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
  namespace: default
spec:
  selector:
    matchLabels:
      app: order-service
  action: ALLOW
  rules:
    - from:
        - source:
            requestPrincipals: ["*"]
            jwt:
              issuer: "auth.ecommerce.example.com"
      to:
        - operation:
            methods: ["GET", "POST"]
            paths: ["/api/order/*"]