当前位置：首页 > news >正文

Argo rollouts + istio服务网格实现金丝雀灰度发布

news 来源：原创 2024/4/29 22:49:30

安装部署lstio
https://istio.io/latest/zh/docs/setup/getting-started/

curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.6.8 TARGET_ARCH=x86_64 sh -
cd istio-1.14.3
cp istio-1.14.3/bin/istioctl  /usr/bin
istioctl install --set profile=demo -y
kubectl label namespace default istio-injection=enabled

自建LoadBalancer当然也可以使用nodeport方式

#kubectl create  ns metallb-system
#cat metallb-configMap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  namespace: metallb-system
  name: config
data:
  config: |
    address-pools:
    - name: default
      protocol: layer2
      addresses:
      - 192.168.10.103-192.168.10.105   #地址池

#cat metallb.yaml
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  labels:
    app: metallb
  name: controller
  namespace: metallb-system
spec:
  allowPrivilegeEscalation: false
  allowedCapabilities: []
  allowedHostPaths: []
  defaultAddCapabilities: []
  defaultAllowPrivilegeEscalation: false
  fsGroup:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  hostIPC: false
  hostNetwork: false
  hostPID: false
  privileged: false
  readOnlyRootFilesystem: true
  requiredDropCapabilities:
  - ALL
  runAsUser:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  volumes:
  - configMap
  - secret
  - emptyDir
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  labels:
    app: metallb
  name: speaker
  namespace: metallb-system
spec:
  allowPrivilegeEscalation: false
  allowedCapabilities:
  - NET_ADMIN
  - NET_RAW
  - SYS_ADMIN
  allowedHostPaths: []
  defaultAddCapabilities: []
  defaultAllowPrivilegeEscalation: false
  fsGroup:
    rule: RunAsAny
  hostIPC: false
  hostNetwork: true
  hostPID: false
  hostPorts:
  - max: 7472
    min: 7472
  privileged: true
  readOnlyRootFilesystem: true
  requiredDropCapabilities:
  - ALL
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - configMap
  - secret
  - emptyDir
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: metallb
  name: controller
  namespace: metallb-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: metallb
  name: speaker
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: metallb
  name: metallb-system:controller
rules:
- apiGroups:
  - ''
  resources:
  - services
  verbs:
  - get
  - list
  - watch
  - update
- apiGroups:
  - ''
  resources:
  - services/status
  verbs:
  - update
- apiGroups:
  - ''
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - policy
  resourceNames:
  - controller
  resources:
  - podsecuritypolicies
  verbs:
  - use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: metallb
  name: metallb-system:speaker
rules:
- apiGroups:
  - ''
  resources:
  - services
  - endpoints
  - nodes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ''
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - policy
  resourceNames:
  - speaker
  resources:
  - podsecuritypolicies
  verbs:
  - use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: metallb
  name: config-watcher
  namespace: metallb-system
rules:
- apiGroups:
  - ''
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: metallb
  name: pod-lister
  namespace: metallb-system
rules:
- apiGroups:
  - ''
  resources:
  - pods
  verbs:
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: metallb
  name: metallb-system:controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metallb-system:controller
subjects:
- kind: ServiceAccount
  name: controller
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: metallb
  name: metallb-system:speaker
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metallb-system:speaker
subjects:
- kind: ServiceAccount
  name: speaker
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: metallb
  name: config-watcher
  namespace: metallb-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: config-watcher
subjects:
- kind: ServiceAccount
  name: controller
- kind: ServiceAccount
  name: speaker
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: metallb
  name: pod-lister
  namespace: metallb-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-lister
subjects:
- kind: ServiceAccount
  name: speaker
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: metallb
    component: speaker
  name: speaker
  namespace: metallb-system
spec:
  selector:
    matchLabels:
      app: metallb
      component: speaker
  template:
    metadata:
      annotations:
        prometheus.io/port: '7472'
        prometheus.io/scrape: 'true'
      labels:
        app: metallb
        component: speaker
    spec:
      containers:
      - args:
        - --port=7472
        - --config=config
        env:
        - name: METALLB_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: METALLB_HOST
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: METALLB_ML_BIND_ADDR
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: METALLB_ML_LABELS
          value: "app=metallb,component=speaker"
        - name: METALLB_ML_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: METALLB_ML_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: memberlist
              key: secretkey
        image: metallb/speaker:v0.9.3
        imagePullPolicy: Always
        name: speaker
        ports:
        - containerPort: 7472
          name: monitoring
        resources:
          limits:
            cpu: 100m
            memory: 100Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_ADMIN
            - NET_RAW
            - SYS_ADMIN
            drop:
            - ALL
          readOnlyRootFilesystem: true
      hostNetwork: true
      nodeSelector:
        beta.kubernetes.io/os: linux
      serviceAccountName: speaker
      terminationGracePeriodSeconds: 2
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: metallb
    component: controller
  name: controller
  namespace: metallb-system
spec:
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app: metallb
      component: controller
  template:
    metadata:
      annotations:
        prometheus.io/port: '7472'
        prometheus.io/scrape: 'true'
      labels:
        app: metallb
        component: controller
    spec:
      containers:
      - args:
        - --port=7472
        - --config=config
        image: metallb/controller:v0.9.3
        imagePullPolicy: Always
        name: controller
        ports:
        - containerPort: 7472
          name: monitoring
        resources:
          limits:
            cpu: 100m
            memory: 100Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - all
          readOnlyRootFilesystem: true
      nodeSelector:
        beta.kubernetes.io/os: linux
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
      serviceAccountName: controller
      terminationGracePeriodSeconds: 0

引用配置

kubectl create secret generic -n metallb-system memberlist --from-literal=secretkey="$(openssl rand -base64 128)"
kubectl apply -f metallb.yaml
kubectl apply -f metallb-configMap.yaml

查看istio的lb地址用于后面访问：
在这里插入图片描述

直接使用nodeport也行（2，4选一个）

kubectl  edit     svc   istio-ingressgateway   -n istio-system

在这里插入图片描述

部署argo rollouts
官网：https://argo-rollouts.readthedocs.io/en/v1.2.0/installation/

kubectl create namespace argo-rollouts
kubectl apply -n argo-rollouts -f https://github.com/argoproj/argo-rollouts/releases/latest/download/install.yaml

安装插件

curl -LO https://github.com/argoproj/argo-rollouts/releases/latest/download/kubectl-argo-rollouts-linux-amd64
chmod +x ./kubectl-argo-rollouts-darwin-amd64
sudo mv ./kubectl-argo-rollouts-darwin-amd64 /usr/local/bin/kubectl-argo-rollouts
kubectl argo rollouts version

在这里插入图片描述
基本使用可以先看看：https://argo-rollouts.readthedocs.io/en/v1.2.0/getting-started/

istio 业务部署：

#cat gateway.yaml
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: rollouts-demo-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"

#cat multipleVirtualsvc.yaml
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: rollouts-demo-vsvc1
spec:
  gateways:
  - rollouts-demo-gateway
  hosts:
  - "*"
  http:
  - match:
    - uri:
       exact: /23
    route:
    - destination:
        host: rollouts-demo-stable
        port:
          number: 8080
      weight: 0
    - destination:
        host: rollouts-demo-canary
        port:
          number: 8080
      weight: 100

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: rollouts-demo-vsvc2
spec:
  gateways:
  - rollouts-demo-gateway
  hosts:
  - "*"
  http:
  - match:
    - uri:
        exact: /
    route:
    - destination:
        host: rollouts-demo-stable
        port:
          number: 8080
      weight: 0
    - destination:
        host: rollouts-demo-canary
        port:
          number: 8080
      weight: 100

#cat rollout.yaml
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: rollouts-demo
spec:
  replicas: 1
  strategy:
    canary:
      canaryService: rollouts-demo-canary
      stableService: rollouts-demo-stable
      trafficRouting:
        istio:
          virtualServices:
          - name: rollouts-demo-vsvc1 # At least one virtualService is required
            #routes: #路由指向
            #- primary # At least one route is required
          - name: rollouts-demo-vsvc2
          #  routes:
          #  - secondary # At least one route is required
      steps:
      - setWeight: 100           #流量控制
      - pause: {}          #手动更新
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: rollouts-demo
  template:
    metadata:
      labels:
        app: rollouts-demo
        istio-injection: enabled
    spec:
      containers:
      - name: rollouts-demo
        image: argoproj/rollouts-demo:blue
        ports:
        - name: http
          containerPort: 8080
          protocol: TCP
        resources:
          requests:
            memory: 32Mi
            cpu: 5m

#cat services.yaml
apiVersion: v1
kind: Service
metadata:
  name: rollouts-demo-canary
spec:
  ports:
  - port: 8080
    targetPort: http
    protocol: TCP
    name: http
  selector:
    app: rollouts-demo
    # This selector will be updated with the pod-template-hash of the canary ReplicaSet. e.g.:
    # rollouts-pod-template-hash: 7bf84f9696

---
apiVersion: v1
kind: Service
metadata:
  name: rollouts-demo-stable
spec:
  ports:
  - port: 8080
    targetPort: http
    protocol: TCP
    name: http
  selector:
    app: rollouts-demo
    # This selector will be updated with the pod-template-hash of the stable ReplicaSet. e.g.:
    # rollouts-pod-template-hash: 789746c88d

引用配置

kubectl apply -f rollout.yaml
kubectl apply -f services.yaml
kubectl apply -f multipleVirtualsvc.yaml
kubectl apply -f gateway.yaml

在这里插入图片描述

查看：

kubectl argo rollouts get rollout rollouts-demo --watch

在这里插入图片描述

9.访问 istio-ingressgateway 的ip，如果是nodeport方式就需要加80映射的端口

kubectl get svc -A |grep  istio-ingressgateway

在这里插入图片描述

查看调度情况rollouts-demo-vsvc1 和rollouts-demo-vsvc2因该都一样的权重

kubectl describe  vs  rollouts-demo-vsvc1

在这里插入图片描述

修改镜像实现金丝雀：

  kubectl argo rollouts set image rollouts-demo rollouts-demo=tomcat:latest

在这里插入图片描述

再次访问地址2个页面都变成tomcat的页面
再次查看权重，流量全都走到了canary上去了，我们改成50权重看看，是不是就是负载均衡这种了。

 kubectl describe  vs  rollouts-demo-vsvc1

在这里插入图片描述

修改权重（2个地方都可以修应该权重，rollout.yaml 和multipleVirtualsvc.yaml）

kubectl apply -f multipleVirtualsvc.yaml

查看时候生效：
在这里插入图片描述
访问页面是否是负载均衡：

摸鱼三天，我写了一个通用的组建树TreeUtil工具

【Telegraf 介绍】

【React】类excel表格的开源项目handsontable

2022前端面试—js+vue篇(持续更新)

MySQL数据库管理（二）

【我的世界Minecraft-MC】常见及各种指令大杂烩【2022.8版】

mpls详解

Mac电脑配置Java环境和android环境,删除谷歌浏览器的自动更新

华为开发后端实习体验总结帖（详细）

认真研究ConcurrentHashMap中的元素统计策略

TinyRenderer学习笔记--Lesson 3、4

（附源码）springboot太原学院贫困生申请管理系统毕业设计 101517

Hive的独立安装

Smobiler 窗体

Android用户切换系统语言后，回到App，App重新加载导致的一些问题[android:configChanges=“layoutDirection“]

【Redis学习笔记】2018-06-28 redis命令源码学习1

CentOS 7 修改主机名

Codepen 每日精选（2018-3-25）

java取消线程实例

nodejs实现webservice问题总结

SpiderData 2019年2月23日 DApp数据排行榜

springMvc学习笔记（2）

Vue2 SSR 的优化之旅

webpack4 一点通

大数据与云计算学习：数据分析（二）

服务器之间，相同帐号，实现免密钥登录

前嗅ForeSpider教程：创建模板

如何解决微信端直接跳WAP端

智能合约Solidity教程-事件和日志（一）

回归生活：清理微信公众号

#14vue3生成表单并跳转到外部地址的方式

（二）Pytorch快速搭建神经网络模型实现气温预测回归(代码+详细注解)

（三） prometheus + grafana + alertmanager 配置Redis监控

（十一）手动添加用户和文件的特殊权限

(原創) 如何刪除Windows Live Writer留在本機的文章? (Web) (Windows Live Writer)

（转）http协议

（转）负载均衡，回话保持，cookie

... fatal error LINK1120：1个无法解析的外部命令的解决办法

.halo勒索病毒解密方法|勒索病毒解决|勒索病毒恢复|数据库修复

.helper勒索病毒的最新威胁：如何恢复您的数据？

.htaccess 强制https 单独排除某个目录

.net core 6 redis操作类

.net core 源码_ASP.NET Core之Identity源码学习

.NET core 自定义过滤器 Filter 实现webapi RestFul 统一接口数据返回格式

.NET Core引入性能分析引导优化

.NET DataGridView数据绑定说明

.NET/C# 使用反射注册事件

.net开源工作流引擎ccflow表单数据返回值Pop分组模式和表格模式对比

.net中调用windows performance记录性能信息

/var/spool/postfix/maildrop 下有大量文件

@在php中起什么作用？

[ IO.File ] FileSystemWatcher

[ 手记 ] 关于tomcat开机启动设置问题

[].shift.call( arguments ) 和 [].slice.call( arguments )

[1525]字符统计2 (哈希)SDUT

相关文章：