正文
一探istio-proxy(envoy)容器里的秘密
提示：扫一扫查出行【扫一扫了解最新限行尾号】
复制提示
今天，在测试环境跑通了istio。
惭愧，是用MicroK8s跑的，其它环境，不敢呀。
基本功能都OK了。
在运行了istio-injection=enabled之后，每个pod运行时，会多一个istio-proxy容器。这是istio功能实现的关键。
那，这里面都有什么进程呢？
/usr/local/bin/pilot-agent
/usr/local/bin/envoy
而pod运行时，启动参数和挂载目录呢？
Args:
proxy
sidecar
--configPath
/etc/istio/proxy
--binaryPath
/usr/local/bin/envoy
--serviceCluster
productpage
--drainDuration
45s
--parentShutdownDuration
1m0s
--discoveryAddress
istio-pilot.istio-system:15007
--discoveryRefreshDelay
1s
--zipkinAddress
zipkin.istio-system:9411
--connectTimeout
10s
--proxyAdminPort
15000
--controlPlaneAuthPolicy
NONE
最后，看看/etc/istio/proxy/envoy-rev0.json的内容，在这里，它应该已获取到控制面的数据，并且拦截了POD的所有流量了：
{
"node": {
"id": "sidecar~10.1.1.125~productpage-v1-6c5dc454fb-lxnwz.default~default.svc.cluster.local",
"cluster": "productpage",
"metadata": {"INTERCEPTION_MODE":"REDIRECT","ISTIO_PROXY_SHA":"istio-proxy:930841ca88b15365737acb7eddeea6733d4f98b9","ISTIO_PROXY_VERSION":"1.0.2","ISTIO_VERSION":"1.0.5","POD_NAME":"productpage-v1-6c5dc454fb-lxnwz","app":"productpage","istio":"sidecar","pod-template-hash":"6c5dc454fb","version":"v1"}
},
"stats_config": {
"use_all_default_tags": false,
"stats_tags": [{
"tag_name": "cluster_name",
"regex": "^cluster\\.((.+?(\\..+?\\.svc\\.cluster\\.local)?)\\.)"
},
{
"tag_name": "tcp_prefix",
"regex": "^tcp\\.((.*?)\\.)\\w+?$"
},
{
"tag_name": "response_code",
"regex": "_rq(_(\\d{3}))$"
},
{
"tag_name": "response_code_class",
"regex": "_rq(_(\\dxx))$"
},
{
"tag_name": "http_conn_manager_listener_prefix",
"regex": "^listener(?=\\.).*?\\.http\\.(((?:[_.[:digit:]]*|[_\\[\\]aAbBcCdDeEfF[:digit:]]*))\\.)"
},
{
"tag_name": "http_conn_manager_prefix",
"regex": "^http\\.(((?:[_.[:digit:]]*|[_\\[\\]aAbBcCdDeEfF[:digit:]]*))\\.)"
},
{
"tag_name": "listener_address",
"regex": "^listener\\.(((?:[_.[:digit:]]*|[_\\[\\]aAbBcCdDeEfF[:digit:]]*))\\.)"
}
]
},
"admin": {
"access_log_path": "/dev/null",
"address": {
"socket_address": {
"address": "127.0.0.1",
"port_value": 15000
}
}
},
"dynamic_resources": {
"lds_config": {
"ads": {}
},
"cds_config": {
"ads": {}
},
"ads_config": {
"api_type": "GRPC",
"refresh_delay": "1s",
"grpc_services": [
{
"envoy_grpc": {
"cluster_name": "xds-grpc"
}
}
]
}
},
"static_resources": {
"clusters": [
{
"name": "prometheus_stats",
"type": "STATIC",
"connect_timeout": "0.250s",
"lb_policy": "ROUND_ROBIN",
"hosts": [{
"socket_address": {
"protocol": "TCP",
"address": "127.0.0.1",
"port_value": 15000,
}
}],
},
{
"name": "xds-grpc",
"type": "STRICT_DNS",
"connect_timeout": "10s",
"lb_policy": "ROUND_ROBIN",
"hosts": [
{
"socket_address": {"address": "istio-pilot.istio-system", "port_value": 15010}
}
],
"circuit_breakers": {
"thresholds": [
{
"priority": "DEFAULT",
"max_connections": 100000,
"max_pending_requests": 100000,
"max_requests": 100000
},
{
"priority": "HIGH",
"max_connections": 100000,
"max_pending_requests": 100000,
"max_requests": 100000
}]
},
"upstream_connection_options": {
"tcp_keepalive": {
"keepalive_time": 300
}
},
"http2_protocol_options": { }
}
,
{
"name": "zipkin",
"type": "STRICT_DNS",
"connect_timeout": "1s",
"lb_policy": "ROUND_ROBIN",
"hosts": [
{
"socket_address": {"address": "zipkin.istio-system", "port_value": 9411}
}
]
}
],
"listeners":[
{
"address": {
"socket_address": {
"protocol": "TCP",
"address": "0.0.0.0",
"port_value": 15090,
}
},
"filter_chains": [{
"filters": [{
"name": "envoy.http_connection_manager",
"config": {
"codec_type": "AUTO",
"stat_prefix": "stats",
"route_config": {
"virtual_hosts": [{
"name": "backend",
"domains": [
"*"
],
"routes": [{
"match": {
"prefix": "/stats/prometheus"
},
"route": {
"cluster": "prometheus_stats"
}
}]
}]
},
"http_filters": {
"name": "envoy.router"
}
}
}]
}],
},
],
},
"tracing": {
"http": {
"name": "envoy.zipkin",
"config": {
"collector_cluster": "zipkin"
}
}
},
}
