curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.17.6 sh -

# 检查当前集群安装是否存在问题
istioctl x precheck

# 安装 DEMO 版本
istioctl install --set profile=demo -y

# 查看 POD 是否就绪
kubectl get pod -n istio-system

# 验证安装
istioctl verify-install

# 更新 istioctl

curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.19.0 sh -

istioctl version

istioctl x precheck 

istioctl upgrade

docker run -it --rm --link proxy curlimages/curl \
curl -X GET http://proxy:15000/stats

docker run -it --rm --link proxy curlimages/curl \
curl -X GET http://proxy:15000/stats | grep retry # 只显示包含 retry 的统计数据

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: catalog-vs-from-gw
spec:
  hosts:
  - "catalog.istioinaction.io"
  gateways:
  - coolstore-gateway
  http:
  - route:
    - destination:
        host: catalog
        port:
          number: 80

kubectl create -n istio-system secret tls webapp-credential \
--key ch4/certs/3_application/private/webapp.istioinaction.io.key.pem \
--cert ch4/certs/3_application/certs/webapp.istioinaction.io.cert.pem

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: coolstore-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "webapp.istioinaction.io"
    tls:
      httpsRedirect: true
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: webapp-credential
    hosts:
    - "webapp.istioinaction.io"
    
curl -L -v http://192.168.8.170:31193/api/catalog \
  -H "Host: webapp.istioinaction.io"

  servers:
  - port:
      number: 443             ❶
      name: https-webapp
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: webapp-credential
    hosts:
    - "webapp.istioinaction.io"
  - port:
      number: 443             ❷
      name: https-catalog
      protocol: HTTPS

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: echo-tcp-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 31400
      name: tcp-echo
      protocol: TCP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: tcp-echo-vs-from-gw
spec:
  hosts:
  - "*"
  gateways:
  - echo-tcp-gateway             ❶
  tcp:
  - match:
    - port: 31400                ❷
    route:
    - destination:
        host: tcp-echo-service   ❸
        port:
          number: 2701

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: sni-passthrough-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 31400                       ❶
      name: tcp-sni
      protocol: TLS
    hosts:
    - "simple-sni-1.istioinaction.io"     ❷
    tls:
      mode: PASSTHROUGH                   ❸
      
---
kubectl get svc -n istio-system istio-ingressgateway \
  -o jsonpath='{.spec.ports[?(@.name == "tcp")]}' 

curl -H "Host: simple-sni-1.istioinaction.io" \
https://simple-sni-1.istioinaction.io:31332/api/catalog \
--cacert ch4/sni/simple-sni-1/2_intermediate/certs/ca-chain.cert.pem  \
--resolve simple-sni-1.istioinaction.io:31332:192.168.8.170
{
  "name": "simple-tls-service-1",
  "uri": "/api/catalog",
  "type": "HTTP",
  "ip_addresses": [
    "10.42.4.12"
  ],
  "start_time": "2023-09-28T11:13:03.866815",
  "end_time": "2023-09-28T11:13:03.866956",
  "duration": "141.018µs",
  "body": "Hello from simple-tls-service-1!!!",
  "code": 200
}
---
# 测试请求使用相同证书的第二个服务
curl -H "Host: simple-sni-2.istioinaction.io" \
https://simple-sni-2.istioinaction.io:31332/api/catalog \
--cacert ch4/sni/simple-sni-2/2_intermediate/certs/ca-chain.cert.pem   \
--resolve simple-sni-2.istioinaction.io:31332:192.168.8.170
{
  "name": "simple-tls-service-2",
  "uri": "/api/catalog",
  "type": "HTTP",
  "ip_addresses": [
    "10.42.8.19"
  ],
  "start_time": "2023-09-28T11:15:05.359662",
  "end_time": "2023-09-28T11:15:05.359796",
  "duration": "134.13µs",
  "body": "Hello from simple-tls-service-2!!!",
  "code": 200
}

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: my-user-gateway-install
  namespace: istioinaction
spec:
  profile: empty
  values:
    gateways:
      istio-ingressgateway:
        autoscaleEnabled: false
  components:
    ingressGateways:
    - name: istio-ingressgateway
      enabled: false    
    - name: my-user-gateway
      namespace: istioinaction
      enabled: true
      label:
        istio: my-user-gateway
---
istioctl install -y -n istioinaction -f ch4/my-user-gateway.yaml

kubectl apply -f << EOF - 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-user-gateway-injected
  namespace: istioinaction
spec:
  selector:
    matchLabels:
      ingress: my-user-gateway-injected
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
        inject.istio.io/templates: gateway        
      labels:
        ingress: my-user-gateway-injected
    spec:
      containers:
      - name: istio-proxy
        image: auto 
---
apiVersion: v1
kind: Service
metadata:
  name: my-user-gateway-injected
  namespace: istioinaction
spec:
  type: LoadBalancer
  selector:
    ingress: my-user-gateway-injected
  ports:
  - port: 80
    name: http
  - port: 443
    name: https      
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-user-gateway-injected-sds
  namespace: istioinaction
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-user-gateway-injected-sds
  namespace: istioinaction
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: my-user-gateway-injected-sds
subjects:
- kind: ServiceAccount
  name: default
EOF

kubectl -n istio-system logs deploy/istio-ingressgateway

# 生产 Istio 安装禁用了 Access 日志记录。但是，您可以通过将 accessLogFile 属性设置为打印到标准输出流来更改此设置
istioctl install --set meshConfig.accessLogFile=/dev/stdout

# 默认情况下，Access 日志是关闭的，考虑到生产集群有数百或数千个工作负载，每个工作负载都处理大量流量，这是有道理的。

# 要仅显示入口网关工作负载的访问日志，您可以使用以下 Telemetry 配置：
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: ingress-gateway
  namespace: istio-system
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway    ❶ 与标签匹配的 Pod 获得遥测配置。
  accessLogging:
  - providers:
    - name: envoy                  ❷ 访问日志记录的提供者配置
    disabled: false                ❸ 通过设置disabled为false来启用

kubectl config set-context $(kubectl config current-context) \
 --namespace=istioinaction

kubectl delete deployment,svc,gateway,\
virtualservice,destinationrule --all -n istioinaction

#  catalog 服务的 v1
kubectl apply -f services/catalog/kubernetes/catalog.yaml

# 创建 暴露网关
kubectl apply -f ch5/catalog-gateway.yaml

# 创建 VirtualService
kubectl apply -f ch5/catalog-vs.yaml

# 测试
curl -I http://192.168.8.212/items -H "Host: catalog.istioinaction.io"
HTTP/1.1 200 OK
x-powered-by: Express
vary: Origin, Accept-Encoding
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
expires: -1
content-type: application/json; charset=utf-8
content-length: 502
etag: W/"1f6-ih2h+hDQ0yLLcKIlBvwkWbyQGK4"
date: Thu, 28 Sep 2023 12:37:28 GMT
x-envoy-upstream-service-time: 2
server: istio-envoy

# 部署 V2
kubectl apply -f services/catalog/kubernetes/catalog-deployment-v2.yaml

# 请求 10 次
for in in {1..10}; do curl http://192.168.8.212/items \
-H "Host: catalog.istioinaction.io"; printf "\n\n"; done


# 将所有流量路由到目录服务的 v1

# 1. 创建 DestinationRule，Deplyment 分别配置 app & version 标签
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: catalog
spec:
  host: catalog
  subsets:
  - name: version-v1
    labels:
      version: v1
  - name: version-v2
    labels:
      version: v2
# 2 流量全部指向 v1 ，配置 v2 则流量全部前往 v2
  - route:
    - destination:
        host: catalog
        subset: version-v1     ❶
        
kubectl apply -f ch5/catalog-vs-v1.yaml 
kubectl apply -f ch5/catalog-vs-v2.yaml 

# 清理环境
kubectl delete vs,svc,deploy,destinationrule \
--all -n istioinaction
kubectl delete -f ch5/flagger
 
# 部署应用
kubectl config set-context $(kubectl config current-context) \
 --namespace=istioinaction
kubectl apply -f ./ch5/flagger/catalog-deployment-v1.yaml

#  创建 mesh 网关
kubectl apply -f << EOF -
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: mesh
  namespace: istioinaction
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"
EOF

# 部署 prometheus
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.19/samples/addons/prometheus.yaml

# 使用 helm 安装 Flagger
helm repo add flagger https://flagger.app
kubectl apply -f \
  https://raw.githubusercontent.com/fluxcd/flagger/main/artifacts/flagger/crd.yaml

helm install flagger flagger/flagger \
     --namespace=istio-system \
     --set crd.create=false \
     --set meshProvider=istio \
     --set metricsServer=http://prometheus:9090
     
# CRD 清单
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: catalog-release
  namespace: istioinaction
spec:
  targetRef:                  ❶ 部署到金丝雀
    apiVersion: apps/v1
    kind: Deployment
    name: catalog
  progressDeadlineSeconds: 60
  # Service / VirtualService Config
  service:                    ❷ 服务配置
    name: catalog
    port: 80
    targetPort: 3000
    gateways:
    - mesh
    hosts:
    - catalog
  analysis:                   ❸ 金丝雀进展参数
    interval: 45s
    threshold: 5
    maxWeight: 50
    stepWeight: 10
    metrics:
    - name: request-success-rate
      thresholdRange:
        min: 99
      interval: 1m
    - name: request-duration
      thresholdRange:
        max: 500
      interval: 30s
      
# 在此 Canary 资源中，我们指定哪个 Kubernetes Deployment 应作为金丝雀的目标、应自动创建哪些 Kubernetes Service 和 Istio VirtualService 以及如何继续金丝雀。 Canary 资源的最后一部分描述了推广金丝雀的速度、需要关注哪些指标来确定可行性以及确定成功的阈值。我们每 45 秒评估一次金丝雀步骤，每一步增加 10% 的流量；当流量达到 50% 时，我们将流量削减至 100%。
#   - 对于成功率指标，我们只能容忍 1 分钟内 99% 的成功检查。我们还只允许 P99（第 99 个百分位）的请求持续时间为 500 毫秒。如果这些指标偏离我们指定的值超过五个时间间隔，金丝雀将被停止并回滚。
kubectl apply -f << EOF -
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: catalog-release
  namespace: istioinaction
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: catalog  
  progressDeadlineSeconds: 60
  # Service / VirtualService Config
  service:
    name: catalog
    port: 80
    targetPort: 3000    
    gateways:
    - public-gateway.istio-system.svc.cluster.local   
    hosts:
    - test.example.com
  analysis:
    interval: 45s
    threshold: 5
    maxWeight: 50
    stepWeight: 10
    metrics:
    - name: request-success-rate
      thresholdRange:
        min: 99
      interval: 1m
    - name: request-duration
      thresholdRange:
        max: 500
      interval: 30s
EOF

# 更新镜像，触发更新
kubectl -n istioinaction set image deployment/catalog \
catalog=istio-catalog:latest

# 在此期间您可以检查金丝雀的状态，如存在问题时，可检查 flagger 中日志, 或执行 kubectl describe canary catalog-release
kubectl get canary catalog-release -w

# 此时，Flagger 已自动创建驱动金丝雀版本所需的一些 Kubernetes 资源，例如 Deployment 、 Service 和 VirtualService 对象。
kubectl get virtualservice catalog -o yaml

kubectl get gw -o yaml 

# 滚动更新时，需要有流量请求，来触发 analysis 中的阈值更新。请求网关地址时，需要正确可以路由到后端
while true; do curl "http://192.168.8.212" \
-H "Host: test.example.com" ; sleep 1; done

curl -s http://192.168.8.212 -H "Host: test.example.com"

kubectl apply -f << EOF -
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: public-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"
EOF

kubectl create ns test
kubectl label namespace test istio-injection=enabled

kubectl apply -k https://github.com/fluxcd/flagger//kustomize/podinfo?ref=main

kubectl apply -k https://github.com/fluxcd/flagger//kustomize/tester?ref=main


kubectl apply -f << EOF -
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: podinfo
  namespace: test
spec:
  # deployment reference
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: podinfo
  # the maximum time in seconds for the canary deployment
  # to make progress before it is rollback (default 600s)
  progressDeadlineSeconds: 60
  # HPA reference (optional)
  autoscalerRef:
    apiVersion: autoscaling/v2beta2
    kind: HorizontalPodAutoscaler
    name: podinfo
  service:
    # service port number
    port: 9898
    # container port number or name (optional)
    targetPort: 9898
    # Istio gateways (optional)
    gateways:
    - public-gateway.istio-system.svc.cluster.local
    # Istio virtual service host names (optional)
    hosts:
    - app.example.com
    # Istio traffic policy (optional)
    trafficPolicy:
      tls:
        # use ISTIO_MUTUAL when mTLS is enabled
        mode: DISABLE
    # Istio retry policy (optional)
    retries:
      attempts: 3
      perTryTimeout: 1s
      retryOn: "gateway-error,connect-failure,refused-stream"
  analysis:
    # schedule interval (default 60s)
    interval: 1m
    # max number of failed metric checks before rollback
    threshold: 5
    # max traffic percentage routed to canary
    # percentage (0-100)
    maxWeight: 50
    # canary increment step
    # percentage (0-100)
    stepWeight: 10
    metrics:
    - name: request-success-rate
      # minimum req success rate (non 5xx responses)
      # percentage (0-100)
      thresholdRange:
        min: 99
      interval: 1m
    - name: request-duration
      # maximum req duration P99
      # milliseconds
      thresholdRange:
        max: 500
      interval: 30s
    # testing (optional)
    webhooks:
      - name: acceptance-test
        type: pre-rollout
        url: http://flagger-loadtester.test/
        timeout: 30s
        metadata:
          type: bash
          cmd: "curl -sd 'test' http://podinfo-canary:9898/token | grep token"
      - name: load-test
        url: http://flagger-loadtester.test/
        timeout: 5s
        metadata:
          cmd: "hey -z 1m -q 10 -c 2 http://podinfo-canary.test:9898/"
EOF


# 更新镜像触发金丝雀更新

kubectl -n test set image deployment/podinfo \
podinfod=ghcr.io/stefanprodan/podinfo:6.0.1


# 查看正在进行的所有 金丝雀
watch kubectl get canaries --all-namespaces

curl -s http://192.168.8.212 -H "Host: app.example.com"

kubectl config set-context $(kubectl config current-context) \
 --namespace=istioinaction
kubectl delete virtualservice,deployment,service,\
destinationrule,gateway --all


kubectl apply -f ch6/simple-backend.yaml
kubectl apply -f ch6/simple-web.yaml
kubectl apply -f ch6/simple-web-gateway.yaml

# 用 Istio DestinationRule 资源为调用 simple-backend 服务的任何客户端指定 ROUND_ROBIN 负载平衡。
curl -s -H "Host: simple-web.istioinaction.io" http://192.168.8.212


for in in {1..10}; do \
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212 \
| jq ".upstream_calls[0].body"; printf "\n"; done

# 安装
brew install fortio

# 运行
kubectl -n default run fortio --image=fortio/fortio:1.60.2 \
--restart='Never' -- load -H "Host: simple-web.istioinaction.io" \
-jitter -t 60s -c 10 -qps 1000 \
http://192.168.8.212

# Case-1 当 backend-1 存在故障时，将流量切换至 backend-2
kubectl apply -f ch6/simple-service-locality.yaml

for in in {1..10}; do \
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212 \
| jq ".upstream_calls[0].body"; printf "\n"; done


# 在 Istio 中实现本地感知负载均衡，我们还需要配置最后一块拼图：健康检查。
kubectl apply -f ch6/simple-backend-dr-outlier.yaml

for in in {1..10}; do \
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212 \
| jq ".upstream_calls[0].body"; printf "\n"; done


# 将 backend-1 设置为故障
for for in in {1..10}; do \
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212 \
| jq ".upstream_calls[0].body"; printf "\n"; done
null
"Hello from simple-backend-2"
"Hello from simple-backend-2"
"Hello from simple-backend-2"
"Hello from simple-backend-2"
"Hello from simple-backend-2"
"Hello from simple-backend-2"
"Hello from simple-backend-2"
"Hello from simple-backend-2"
"Hello from simple-backend-2"

# 为了完成这一配置，我们在 DestinationRule 资源中指定了本地化负载均衡首选项：

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: simple-backend-dr
spec:
  host: simple-backend.istioinaction.svc.cluster.local
  trafficPolicy:
    loadBalancer:                        ❶ 添加负载平衡器配置
      localityLbSetting:
        distribute:
        - from: us-west1/us-west1-a/*    ❷ 来自的区域
          to:
            "us-west1/us-west1-a/*": 70  ❸ 目的地区域
            "us-west1/us-west1-b/*": 30  ❹ 目的地区域
    connectionPool:
      http:
        http2MaxRequests: 10
        maxRequestsPerConnection: 10
    outlierDetection:
      consecutive5xxErrors: 1
      interval: 5s
      baseEjectionTime: 30s

# 应用
kubectl apply -f ch6/simple-backend-dr-outlier-locality.yaml

for for in in {1..10}; do \
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212 \
| jq ".upstream_calls[0].body"; printf "\n"; done
null

# 重置集群
kubectl apply -f ch6/simple-web.yaml
kubectl apply -f ch6/simple-backend.yaml
kubectl delete destinationrule simple-backend-dr

for in in {1..10}; do time curl -s \
-H "Host: simple-web.istioinaction.io" 192.168.8.212  \
| jq .code; printf "\n"; done

# 部署一个 simple-backend 服务版本，为该实例的 50% 调用插入一秒钟的处理延迟：
kubectl apply -f ch6/simple-backend-delayed.yaml


# 再次请求，有些请求需要一秒钟或更长的时间：
for in in {1..10}; do time curl -s \
-H "Host: simple-web.istioinaction.io" 192.168.8.212  \
| jq .code; printf "\n"; done
200
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212  0.00s user 0.00s system 0% cpu 1.068 total
jq .code  0.01s user 0.00s system 1% cpu 1.068 total

200
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212  0.00s user 0.01s system 0% cpu 1.035 total
jq .code  0.02s user 0.00s system 1% cpu 1.034 total

200
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212  0.01s user 0.01s system 5% cpu 0.194 total
jq .code  0.03s user 0.00s system 13% cpu 0.194 total


---
#  在 VirtualService 中指定超时时间
  http:
  - route:
    - destination:
        host: simple-backend
    timeout: 0.5s               ❶ 指定超时值
    
# 应用
kubectl apply -f ch6/simple-backend-vs-timeout.yaml


# 再次请求，此时大于 0.5s 的请求，会被判断为 500错误
for for in in {1..10}; do time curl -s \
-H "Host: simple-web.istioinaction.io" 192.168.8.212  \
| jq .code; printf "\n"; done
200
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212  0.00s user 0.00s system 4% cpu 0.176 total
jq .code  0.02s user 0.00s system 10% cpu 0.175 total

500
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212  0.01s user 0.01s system 2% cpu 0.550 total
jq .code  0.02s user 0.00s system 4% cpu 0.549 total

200
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212  0.01s user 0.01s system 6% cpu 0.188 total
jq .code  0.02s user 0.00s system 14% cpu 0.187 total

# Reset
kubectl apply -f ch6/simple-web.yaml
kubectl apply -f ch6/simple-backend.yaml

# Istio 默认启用了重试功能，最多重试两次。让我们禁用示例应用程序的默认重试, 将最大重试次数设置为 0
istioctl install --set profile=demo \
 --set meshConfig.defaultHttpRetryPolicy.attempts=0
 
# 部署一个有周期性（75%）故障的 simple-backend 服务版本。
kubectl apply -f ch6/simple-backend-periodic-failure-503.yaml

# 执行 多次调用该服务
for in in {1..10}; do curl -s \
-H "Host: simple-web.istioinaction.io" 192.168.8.212  \
| jq .code; printf "\n"; done
200
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212  0.00s user 0.00s system 3% cpu 0.176 total
jq .code  0.01s user 0.00s system 8% cpu 0.175 total

500
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212  0.00s user 0.01s system 31% cpu 0.034 total
jq .code  0.02s user 0.00s system 74% cpu 0.033 total

500
curl -s -H "Host: simple-web.istioinaction.io" 192.168.8.212  0.00s user 0.00s system 27% cpu 0.024 total
jq .code  0.02s user 0.00s system 73% cpu 0.023 total


# 调用 simple-backend 时的重试尝试明确配置为 2
  http:
  - route:
    - destination:
        host: simple-backend
    retries:
      attempts: 2
      
kubectl apply -f ch6/simple-backend-enable-retry.yaml

# 再次查看
for in in {1..10}; do curl -s \
-H "Host: simple-web.istioinaction.io" 192.168.8.212  \
| jq .code; printf "\n"; done
200
200
200

# 启用了 Istio 的重试策略来解决这些错误。默认情况下，HTTP 503 是可重试状态代码之一。
# 下面的 VirtualService 重试策略显示了重试时可配置的参数：
  http:
  - route:
    - destination:
        host: simple-backend
    retries:
      attempts: 2                                             ❶
      retryOn: gateway-error,connect-failure,retriable-4xx    ❷
      perTryTimeout: 300ms                                    ❸
      retryRemoteLocalities: true                             ❹
      
❶ 最大重试次数
❷ 需要重试的错误
❸ 超时
❹是否重试其他地区的端点

# 部署的 simple-backend 服务返回 HTTP 500 代码，默认重试行为将无法捕获
for in in {1..10}; do curl -s \
-H "Host: simple-web.istioinaction.io" 192.168.8.212  \
| jq .code; printf "\n"; done
200
200
200
200
200
200
200
200
500
200

# 使用 VirtualService 重试策略，重试所有 HTTP 500 代码（包括 connect-failure 和 refused-stream ）
  http:
  - route:
    - destination:
        host: simple-backend
    retries:
      attempts: 2
      retryOn: 5xx     ❶
      
kubectl apply -f ch6/simple-backend-vs-retry-500.yaml

# 此时执行，将不存在 500 异常
for in in {1..10}; do curl -s \
-H "Host: simple-web.istioinaction.io" 192.168.8.212  \
| jq .code; printf "\n"; done
200
200
200
200
200
200
200
200
200
200

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: simple-backend-retry-status-codes
  namespace: istioinaction
spec:
  workloadSelector:
    labels:
      app: simple-web
  configPatches:
  - applyTo: HTTP_ROUTE
    match:
      context: SIDECAR_OUTBOUND
      routeConfiguration:
        vhost:
          name: "simple-backend.istioinaction.svc.cluster.local:80"
    patch:
      operation: MERGE
      value:
        route:
          retry_policy:                ❶ 直接从Envoy配置中获取
            retry_back_off:
              base_interval: 50ms      ❷ 增加基本间隔
            retriable_status_codes:    ❸ 添加可重试代码
            - 408
            - 400
            
# 应用
kubectl apply -f ch6/simple-backend-ef-retry-status-codes.yaml

# 还希望更新 retryOn 字段，使其包含 retriable-status-codes

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: simple-backend-vs
spec:
  hosts:
  - simple-backend
  http:
  - route:
    - destination:
        host: simple-backend
    retries:
      attempts: 2
      retryOn: 5xx,retriable-status-codes     ❶ 包括可重试的状态码


kubectl apply -f ch6/simple-backend-vs-retry-on.yaml


# 更新 sample-backend 服务，使其返回 HTTP 408（超时），并验证是否能继续获得 HTTP 200
kubectl apply -f ch6/simple-backend-periodic-failure-408.yaml

# 验证
for in in {1..10}; do curl -s \
-H "Host: simple-web.istioinaction.io" 192.168.8.212  \
| jq .code; printf "\n"; done

# 要设置请求对冲，我们可以使用以下 EnvoyFilter 资源：
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: simple-backend-retry-hedge
  namespace: istioinaction
spec:
  workloadSelector:
    labels:
      app: simple-web
  configPatches:
  - applyTo: VIRTUAL_HOST
    match:
      context: SIDECAR_OUTBOUND
      routeConfiguration:
        vhost:
          name: "simple-backend.istioinaction.svc.cluster.local:80"
    patch:
      operation: MERGE
      value:
        hedge_policy:
          hedge_on_per_try_timeout: true

# 引入一秒钟的延迟
kubectl apply -f ch6/simple-backend-delayed.yaml


# 删除目的地规则
kubectl delete destinationrule --all

fortio load -H "Host: simple-web.istioinaction.io" \
-quiet -jitter -t 30s -c 1 -qps 1 http://192.168.8.212/
Error cases : count 0 avg 0 +/- 0 min 0 max 0 sum 0
# Socket and IP used for each connection:
[0]   1 socket used, resolved to 192.168.8.212:80, connection timing : count 1 avg 0.000936291 +/- 0 min 0.000936291 max 0.000936291 sum 0.000936291
Sockets used: 1 (for perfect keepalive, would be 1)
Uniform: false, Jitter: true, Catchup allowed: true
IP addresses distribution:
192.168.8.212:80: 1
Code 200 : 30 (100.0 %)
All done 30 calls (plus 1 warmup) 1029.536 ms avg, 1.0 qp

#引入一些连接和请求限制
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: simple-backend-dr
spec:
  host: simple-backend.istioinaction.svc.cluster.local
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 1               ❶ 连接总数
      http:
        http1MaxPendingRequests: 1      ❷ 排队请求
        maxRequestsPerConnection: 1     ❸ 每个连接的请求数量
        maxRetries: 1
        http2MaxRequests: 1             ❹ 所有主机的最大并发请求数量
        
kubectl apply -f ch6/simple-backend-dr-conn-limit.yaml

fortio load -H "Host: simple-web.istioinaction.io" \
-quiet -jitter -t 30s -c 1 -qps 1 http://192.168.8.212
Code 200 : 30 (100.0 %)

fortio load -H "Host: simple-web.istioinaction.io" \
-quiet -jitter -t 30s -c 2 -qps 2 -allow-initial-errors http://192.168.8.212
Code 200 : 31 (60.8 %)
Code 500 : 20 (39.2 %)

# 在 simple-web 中  应用注释
kubectl apply -f ch6/simple-web-stats-incl.yaml

# 重置 simple-web 服务中 Istio 代理的所有统计数据
kubectl exec -it deploy/simple-web -c istio-proxy \
-- curl -X POST localhost:15000/reset_counters
OK

# 再次产生负载时
fortio load -H "Host: simple-web.istioinaction.io" \
-quiet -jitter -t 30s -c 2 -qps 2 -allow-initial-errors http://192.168.8.212
Code 200 : 30 (55.6 %)
Code 500 : 24 (44.4 %)

# 运行下面的查询
kubectl exec -it deploy/simple-web -c istio-proxy \
-- curl localhost:15000/stats | grep simple-backend | grep overflow
cluster.outbound|80||simple-backend.istioinaction.svc.cluster.local.upstream_cx_overflow: 53
cluster.outbound|80||simple-backend.istioinaction.svc.cluster.local.upstream_cx_pool_overflow: 0
cluster.outbound|80||simple-backend.istioinaction.svc.cluster.local.upstream_rq_pending_overflow: 25
cluster.outbound|80||simple-backend.istioinaction.svc.cluster.local.upstream_rq_retry_overflow: 0

# upstream_cx_overflow 和 upstream_rq_pending_overflow 。这表明有足够多的连接和请求超过了我们指定的阈值（并行请求过多或排队请求过多），导致空气开关跳闸。

# 增加 http2MaxRequests 字段，以应对并行发生的更多请求呢？让我们将该值提高到 2 重置计数器，然后重新运行负载测试
kubectl patch destinationrule simple-backend-dr --type merge \
--patch \
'{"spec": {"trafficPolicy": {"connectionPool": {
  "http": {"http2MaxRequests": 2}}}}}'
  
kubectl exec -it deploy/simple-web -c istio-proxy \
-- curl -X POST localhost:15000/reset_counters

fortio load -H "Host: simple-web.istioinaction.io" \
-quiet -jitter -t 30s -c 2 -qps 2 -allow-initial-errors http://192.168.8.212
Code 200 : 31 (100.0 %)

# 熔断而受阻的请求减少：
kubectl exec -it deploy/simple-web -c istio-proxy \
-- curl localhost:15000/stats | grep simple-backend | grep overflow
cluster.outbound|80||simple-backend.istioinaction.svc.cluster.local.upstream_cx_overflow: 35
cluster.outbound|80||simple-backend.istioinaction.svc.cluster.local.upstream_cx_pool_overflow: 0
cluster.outbound|80||simple-backend.istioinaction.svc.cluster.local.upstream_rq_pending_overflow: 1
cluster.outbound|80||simple-backend.istioinaction.svc.cluster.local.upstream_rq_retry_overflow: 0


# 将待处理队列深度增加到 2 
kubectl patch destinationrule simple-backend-dr --type merge \
--patch \
'{"spec": {"trafficPolicy": {"connectionPool": {
  "http": {"http1MaxPendingRequests": 2}}}}}'
  
kubectl exec -it deploy/simple-web -c istio-proxy \
-- curl -X POST localhost:15000/reset_counters

fortio load -H "Host: simple-web.istioinaction.io" \
-quiet -jitter -t 30s -c 2 -qps 2 -allow-initial-errors http://192.168.8.212
Code 200 : 32 (100.0 %)

# 此时发生触发熔断重试为 0
kubectl exec -it deploy/simple-web -c istio-proxy \
-- curl localhost:15000/stats | grep simple-backend | grep overflow
cluster.outbound|80||simple-backend.istioinaction.svc.cluster.local.upstream_cx_overflow: 41
cluster.outbound|80||simple-backend.istioinaction.svc.cluster.local.upstream_cx_pool_overflow: 0
cluster.outbound|80||simple-backend.istioinaction.svc.cluster.local.upstream_rq_pending_overflow: 0
cluster.outbound|80||simple-backend.istioinaction.svc.cluster.local.upstream_rq_retry_overflow: 0

...
"upstream_calls": [
    {
      "uri": "http://simple-backend:80/",
      "headers": {
        "Content-Length": "81",
        "Content-Type": "text/plain",
        "Date": "Tue, 22 Sep 2020 20:01:44 GMT",
        "Server": "envoy",
        "x-envoy-overloaded": "true"      ❶
      },
...

kubectl apply -f ch6/simple-backend.yaml
kubectl delete destinationrule --all

kubectl apply -f ch6/simple-web-stats-incl.yaml

# 禁用整个网格的重试功能， 删除任何已配置重试的 VirtualService 资源
istioctl install --set profile=demo \
 --set meshConfig.defaultHttpRetryPolicy.attempts=0
 
kubectl delete vs simple-backend-vs


# 75% 的 simple-backend-1 端点调用都会以 HTTP 500 失败
kubectl apply -f ch6/simple-backend-periodic-failure-500.yaml

fortio load -H "Host: simple-web.istioinaction.io" \
-allow-initial-errors -quiet -jitter -t 30s -c 10 -qps 20 -allow-initial-errors http://192.168.8.212
Sockets used: 304 (for perfect keepalive, would be 10)
Uniform: false, Jitter: true, Catchup allowed: true
IP addresses distribution:
Code 200 : 304 (50.7 %)
Code 500 : 296 (49.3 %)

# 配置离群点检测 示例
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: simple-backend-dr
spec:
  host: simple-backend.istioinaction.svc.cluster.local
  trafficPolicy:
    outlierDetection:
      consecutive5xxErrors: 1 # 配置为 1 值。这意味着异常点检测只会在一个坏请求后跳闸
      interval: 5s # 设置指定 Istio 服务代理检查主机的频率，并根据 consecutive5xxErrors 设置决定是否弹出端点。
      baseEjectionTime: 5s # 如果服务端点被弹出，则弹出时间为 n * baseEjectionTime 。其中 n 是该端点被弹出的次数。时间结束后，该端点将重新加入负载平衡池。
      maxEjectionPercent: 100 # 上游服务负载均衡池中可被剔除的最大主机百分比。默认为10%。
      
kubectl apply -f ch6/simple-backend-dr-outlier-5s.yaml

fortio load -H "Host: simple-web.istioinaction.io" \
-allow-initial-errors -quiet -jitter -t 30s -c 10 -qps 20 -allow-initial-errors http://192.168.8.212
Code 200 : 581 (96.8 %)
Code 500 : 19 (3.2 %)

# 由于行为不端的端点被弹出一段时间，我们的错误率大幅降低。不过，我们仍有 19 次调用失败。为了证明这些错误是由行为不端的端点造成的，我们可以检查统计数据：

kubectl exec -it deploy/simple-web -c istio-proxy -- \
curl localhost:15000/stats | grep simple-backend | grep outlier

# simple-backend-1 主机被弹出三次。

# 添加默认重试设置，解决最后几个错误。我们可以添加默认重试设置为，总计3。
istioctl install --set profile=demo  \
  --set meshConfig.defaultHttpRetryPolicy.attempts=2

# vs 重建一下，再次执行测试
fortio load -H "Host: simple-web.istioinaction.io" \
-allow-initial-errors -quiet -jitter -t 30s -c 10 -qps 20 -allow-initial-errors http://192.168.8.212
Code 200 : 600 (100.0 %)

cd ~/Desktop/istio-1.19.0

kubectl delete -f samples/addons/


# 清理
kubectl config set-context $(kubectl config current-context) \
 --namespace=istioinaction
kubectl delete virtualservice,deployment,service,\
destinationrule,gateway --all


# 部署应用
kubectl apply -f services/catalog/kubernetes/catalog.yaml
kubectl apply -f services/webapp/kubernetes/webapp.yaml
kubectl apply -f services/webapp/istio/webapp-catalog-gw-vs.yaml


# 测试
curl -H "Host: webapp.istioinaction.io" http://192.168.8.212/api/catalog

# 查看 webapp 的统计数据

kubectl exec -it deploy/webapp -c istio-proxy \
-- curl localhost:15000/stats

# 使用  pilot-agent 查看，help: pilot-agent request GET help
kubectl exec -it deploy/webapp -c istio-proxy \
 -- pilot-agent request GET stats
 
 
 # 配置代理以报告更多特使统计数据
spec:
  profile: demo
  meshConfig:
    defaultConfig:                                    ❶ 为所有服务定义默认代理配置
      proxyStatsMatcher:                              ❷ 自定义报告的指标
        inclusionPrefixes:                            ❸ 与前缀匹配的指标将与默认指标一起报告。
        - "cluster.outbound|80||catalog.istioinaction"
        
# 在整个网格中增加收集的度量指标可能会使度量指标收集系统超负荷，因此应该非常谨慎。更好的方法是以注释的形式按工作量指定所包含的指标。
metadata:
 annotations:
   proxy.istio.io/config: |-    ❶
     proxyStatsMatcher:
       inclusionPrefixes:
       - "cluster.outbound|80||catalog.istioinaction"
       
kubectl apply -f ch7/webapp-deployment-stats-inclusion.yaml

curl -H "Host: webapp.istioinaction.io" http://192.168.8.212/api/catalog

kubectl exec -it deploy/webapp -c istio-proxy \
-- curl localhost:15000/stats | grep catalog
...
cluster.outbound|80||catalog.istioinaction.svc.cluster.local.bind_errors: 0
cluster.outbound|80||catalog.istioinaction.svc.cluster.local.circuit_breakers.default.cx_open: 0
cluster.outbound|80||catalog.istioinaction.svc.cluster.local.circuit_breakers.default.cx_pool_open: 0
...

# 查询，列出代理知道的所有后端群集及其各自端点的信息
# 该查询能够输出，端点位于哪个区域、区域和子区域；以及该上游端点的任何活动请求或错误。上一组统计数据提供的是整个集群的数据。通过这组统计信息，我们可以看到每个端点的详细信息。
# https://www.envoyproxy.io/docs/envoy/latest/configuration/upstream/cluster_manager/cluster_stats#general
kubectl exec -it deploy/webapp -c istio-proxy \
-- curl localhost:15000/clusters|grep catalog

# 要查看控制平面指标
kubectl exec -it -n istio-system deploy/istiod -- curl localhost:15014/metrics

# 查看 公开的 Prometheus 
kubectl exec -it deploy/webapp -c istio-proxy \
-- curl localhost:15090/stats/prometheus

cd ~/Desktop/istio-1.19.0 

kubectl delete -f samples/addons/

# 使用 helm 安装 prometheus
helm repo add prometheus-community \
https://prometheus-community.github.io/helm-charts

helm repo update

kubectl create ns prometheus

helm pull prometheus-community/kube-prometheus-stack --untar

helm install prom ./kube-prometheus-stack \
-n prometheus -f kube-prometheus-stack/values-prod.yaml

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: istio-component-monitor
  namespace: prometheus
  labels:
    monitoring: istio-components
    release: prom
spec:
  jobLabel: istio
  targetLabels: [app]
  selector:
    matchExpressions:
    - {key: istio, operator: In, values: [pilot]}
  namespaceSelector:
    any: true
  endpoints:
  - port: http-monitoring
    interval: 15s
    
---
kubectl apply -f ch7/service-monitor-cp.yaml


kubectl -n prometheus port-forward \
statefulset/prometheus-prom-kube-prometheus-stack-prometheus 9090

apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
  name: envoy-stats-monitor
  namespace: prometheus
  labels:
    monitoring: istio-proxies
    release: prom
spec:
  selector:
    matchExpressions:
    - {key: istio-prometheus-ignore, operator: DoesNotExist}
  namespaceSelector:
    any: true
  jobLabel: envoy-stats
  podMetricsEndpoints:
  - path: /stats/prometheus
    interval: 15s
    relabelings:
    - action: keep
      sourceLabels: [__meta_kubernetes_pod_container_name]
      regex: "istio-proxy"
    - action: keep
      sourceLabels: [__meta_kubernetes_pod_annotationpresent_prometheus_io_scrape]
    - sourceLabels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
      action: replace
      regex: ([^:]+)(?::\d+)?;(\d+)
      replacement: $1:$2
      targetLabel: __address__
    - action: labeldrop
      regex: "__meta_kubernetes_pod_label_(.+)"
    - sourceLabels: [__meta_kubernetes_namespace]
      action: replace
      targetLabel: namespace
    - sourceLabels: [__meta_kubernetes_pod_name]
      action: replace
      targetLabel: pod_name
      
---
kubectl apply -f ch7/pod-monitor-dp.yaml

# 为数据平面生成一些负载
for i in {1..100}; do curl http://192.168.8.212/api/catalog -H \
"Host: webapp.istioinaction.io"; sleep .5s;  done

# 查看已安装的 envoyfilter

kubectl get envoyfilter -n istio-system


    value:
      name: istio.stats       ❶ 过滤器名称
      typed_config:
        '@type': type.googleapis.com/udpa.type.v1.TypedStruct
        type_url: type.googleapis.com/
          envoy.extensions.filters.http.wasm.v3.Wasm
        value:
          config:             ❷ 过滤器配置
            configuration:

# 添加 upstream_proxy_version 和 source_mesh_id 维度
  profile: demo
  values:
    telemetry:
      v2:
        prometheus:
          configOverride:
            inboundSidecar:
              metrics:
              - name: requests_total
                dimensions:                                ❶ 新增维度
                  upstream_proxy_version: upstream_peer.istio_version
                  source_mesh_id: node.metadata['MESH_ID']
                tags_to_remove:                            ❷ 要删除的标记列表
                - request_protocol
            outboundSidecar:
            
istioctl install -f ch7/metrics/istio-operator-new-dimensions.yaml -y

# 让 Istio 的代理知道它。为此，我们必须使用 sidecar.istio.io/extraStatTags 注解注释部署 Pod 规范。
# 注意，该注解需要放在 spec.template.metadata Pod 模板上，而不是部署元数据本身
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webapp
  template:
    metadata:
      annotations:
        proxy.istio.io/config: |-
          extraStatTags:
          - "upstream_proxy_version"
          - "source_mesh_id"
      labels:
        app: webapp

kubectl -n istioinaction apply -f \
ch7/metrics/webapp-deployment-extrastats.yaml


curl -H "Host: webapp.istioinaction.io" \
http://192.168.8.212/api/catalog

kubectl -n istioinaction exec -it deploy/webapp -c istio-proxy \
-- curl localhost:15000/stats/prometheus | grep istio_requests_total

# 您应该会看到类似下面的内容（您可能会看到两个条目：一个是入站流量，一个是出站流量）：
istio_requests_total{
	...
	source_mesh_id="cluster.local",
	upstream_proxy_version="1.19.0"} 1
	
# 另外请注意， request_protocol 维度不在维度列表中，因为我们在之前的配置中删除了它

# 等效上面操作的示例 
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: add-dimension-tags
  namespace: istioinaction
spec:
  metrics:
  - providers:
      - name: prometheus
    overrides:
      - match: 
          metric: REQUEST_COUNT
          mode: CLIENT_AND_SERVER
        disabled: false
        tagOverrides:
          upstream_proxy_version:
            operation: UPSERT
            value: upstream_peer.istio_version
          source_mesh_id: 
            operation: UPSERT
            value: node.metadata['MESH_ID']
          request_protocol:
            operation: REMOVE
            
kubectl apply -f ch7/metrics/v2/add-dimensions-telemetry.yaml

# 示例, 为 stats 插件配置新的度量定义
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: demo
  values:
    telemetry:
      v2:
        prometheus:
          configOverride:
            inboundSidecar:
              definitions:
              - name: get_calls
                type: COUNTER
                value: "(request.method.startsWith('GET') ? 1 : 0)"
            outboundSidecar:
              definitions:
              - name: get_calls
                type: COUNTER
                value: "(request.method.startsWith('GET') ? 1 : 0)"
            gateway:
              definitions:
              - name: get_calls
                type: COUNTER
                value: "(request.method.startsWith('GET') ? 1 : 0)"

istioctl install -f ch7/metrics/istio-operator-new-metric.yaml -y

# pod 添加注解，在代理上公开这些 metrics
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webapp
  template:
    metadata:
      annotations:
        proxy.istio.io/config: |-
          proxyStatsMatcher:
            inclusionPrefixes:
            - "istio_get_calls"
      labels:
        app: webapp

kubectl -n istioinaction apply -f \
ch7/metrics/webapp-deployment-new-metric.yaml

curl -H "Host: webapp.istioinaction.io" \
http://192.168.8.212/api/catalog

kubectl -n istioinaction exec -it deploy/webapp -c istio-proxy \
-- curl localhost:15000/stats/prometheus | grep istio_get_calls
# TYPE istio_get_calls counter
istio_get_calls{} 2

# 使用 EnvoyFilter 资源配置 attribute-gen 插件

{
  "attributes": [
    {
      "output_attribute": "istio_operationId",      ❶ 属性名称
      "match": [
        {
          "value": "getitems",                      ❷ 属性值
          "condition": "request.url_path == '/items'
            && request.method == 'GET'"
        },
}

kubectl apply -f ch7/metrics/attribute-gen.yaml

# 创建一个名为 upstream_operation 的新维度，该维度使用 istio_requests_total 指标中的属性来识别对 catalog 的 API 调用。
istioctl install -y -f ch7/metrics/istio-operator-new-attribute.yaml

# 使用新维度时，我们还需要将其添加到服务中的 extraStats 注解中
kubectl apply -f ch7/metrics/webapp-deployment-extrastats-new-attr.yaml

curl -H "Host: webapp.istioinaction.io" \
http://192.168.8.212/api/catalog

curl -H "Host: webapp.istioinaction.io" \
http://192.168.8.212/items

kubectl -n istioinaction exec -it deploy/webapp -c istio-proxy \
-- curl localhost:15000/stats/prometheus | grep istio_requests_total

kubectl exec -it deploy/webapp -c istio-proxy \
-- curl -X POST localhost:15000/reset_counters # 清理指标

# 清理环境
kubectl config set-context $(kubectl config current-context) \
 --namespace=istioinaction
kubectl delete virtualservice,deployment,service,\
destinationrule,gateway,WasmPlugin,Telemetry --all

# 创建应用
kubectl apply -f services/catalog/kubernetes/catalog.yaml
kubectl apply -f services/webapp/kubernetes/webapp.yaml
kubectl apply -f services/webapp/istio/webapp-catalog-gw-vs.yaml

# 测试
curl -H "Host: webapp.istioinaction.io" \
http://192.168.8.212/api/catalog

---
kubectl apply -f << EOF - 
apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: istio-attributegen-filter
  namespace: istioinaction
spec:
  selector:
    matchLabels:
      app: webapp
  url: https://storage.googleapis.com/istio-build/proxy/attributegen-359dcd3a19f109c50e97517fe6b1e2676e870c4d.wasm
  imagePullPolicy: Always
  phase: AUTHN
  pluginConfig:
    attributes:
    - output_attribute: "istio_operationId"
      match:
        - value: "ListCatalog"
          condition: "request.url_path == '/api/catalog' && request.method == 'GET'"
---
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: custom-tags
  namespace: istioinaction
spec:
  metrics:
    - overrides:
        - match:
            metric: REQUEST_COUNT
            mode: CLIENT_AND_SERVER
          tagOverrides:
            request_operation:
              value: istio_operationId
      providers:
        - name: prometheus 
EOF


# istioctl install -y -f ch7/metrics/istio-operator-new-attribute.yaml
---

for i in $(seq 1 5);do
  curl -H "Host: webapp.istioinaction.io" http://192.168.8.212/api/catalog && echo -e "\n"
done

while true;do
	curl -H "Host: webapp.istioinaction.io" http://192.168.8.212/api/catalog && echo -e "\n" && sleep 1
done

kubectl -n istioinaction exec -it deploy/webapp -c istio-proxy \
-- curl localhost:15000/stats/prometheus | grep istio_requests_total

# DEBUG
kubectl logs deploy/webapp  -c istio-proxy | grep -e "Config Error" -e "envoy wasm"

# 代理 Grafana ， U/P: admin prom-operator
kubectl -n prometheus port-forward svc/prom-grafana 3000:80

cd ch8/

kubectl -n prometheus create cm istio-dashboards \
--from-file=pilot-dashboard.json=dashboards/pilot-dashboard.json \
--from-file=istio-workload-dashboard.json=dashboards/\
istio-workload-dashboard.json \
--from-file=istio-service-dashboard.json=dashboards/\
istio-service-dashboard.json \
--from-file=istio-performance-dashboard.json=dashboards/\
istio-performance-dashboard.json \
--from-file=istio-mesh-dashboard.json=dashboards/\
istio-mesh-dashboard.json \
--from-file=istio-extension-dashboard.json=dashboards/\
istio-extension-dashboard.json

# 将 cm 注入成  grafana_dashboard
kubectl label -n prometheus cm istio-dashboards grafana_dashboard=1

# 从 Istio 示例目录安装示例 Jaeger 一体化部署

cd ~/Desktop/istio-1.19.0

kubectl apply -f samples/addons/jaeger.yaml

# 等待服务启动完成
kubectl get pod -n istio-system
kubectl get svc -n istio-system

# Istio 支持分布式跟踪后端，包括 Zipkin、Datadog、Jaeger（Zipkin 兼容）等。
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
spec:
  meshConfig:
    defaultConfig:
      tracing:
        lightstep: {}
        zipkin: {}
        datadog: {}
        stackdriver: {}

---
# 使用 Jaeger，它与 Zipkin 兼容，我们可以配置如下
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
spec:
  meshConfig:
    defaultConfig:
      tracing:
        sampling: 100
        zipkin:
          address: zipkin.istio-system:9411

istioctl install -y -f ch8/install-istio-tracing-zipkin.yaml

# 已经安装了 Istio 并且没有配置跟踪后端，或者想要更新配置，您可以在 istioconfigmap 中的 MeshConfig 对象中看到 Istio 的网格范围默认值在 istio-system 命名空间中
kubectl get cm istio -n istio-system -o yaml
...
data:
  mesh: |-
    defaultConfig:
      discoveryAddress: istiod.istio-system.svc:15012
      proxyMetadata: {}
      tracing:
        sampling: 100
        zipkin:
          address: zipkin.istio-system:9411
    defaultProviders:
      metrics:
      - prometheus
...

# 配置工作负载的 TRACING, 下面是 Deployment 的例子
apiVersion: apps/v1
kind: Deployment
...
spec:
  template:
    metadata:
      annotations:
        proxy.istio.io/config: |
          tracing:
            zipkin:
              address: zipkin.istio-system:9411


# 检查默认 TRACING 标头
# 使用 Istio 的入口网关调用外部 httpbin 服务并调用显示请求标头的端点。

kubectl apply -n istioinaction \
-f ch8/tracing/thin-httpbin-virtualservice.yaml

curl -H "Host: httpbin.istioinaction.io" http://192.168.8.212/headers
{
  "headers": {
    "Accept": "*/*", 
    "Host": "httpbin.istioinaction.io", 
    "User-Agent": "curl/8.1.2", 
    "X-Amzn-Trace-Id": "Root=1-65180064-39d6410b0b3e94550ef3b250", 
    "X-B3-Sampled": "1", 
    "X-B3-Spanid": "34914a388f45a982", 
    "X-B3-Traceid": "a8440b2adfa0236034914a388f45a982", 
    "X-Envoy-Attempt-Count": "1", 
    "X-Envoy-Decorator-Operation": "httpbin.org:80/*", 
    "X-Envoy-Internal": "true", 
    "X-Envoy-Peer-Metadata": "ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwodCgxJTlNUQU5DRV9JUFMSDRoLMTAuNDIuNC4xMTEKGQoNSVNUSU9fVkVSU0lPThIIGgYxLjE5LjAKnAMKBkxBQkVMUxKRAyqOAwodCgNhcHASFhoUaXN0aW8taW5ncmVzc2dhdGV3YXkKEwoFY2hhcnQSChoIZ2F0ZXdheXMKFAoIaGVyaXRhZ2USCBoGVGlsbGVyCjYKKWluc3RhbGwub3BlcmF0b3IuaXN0aW8uaW8vb3duaW5nLXJlc291cmNlEgkaB3Vua25vd24KGQoFaXN0aW8SEBoOaW5ncmVzc2dhdGV3YXkKGQoMaXN0aW8uaW8vcmV2EgkaB2RlZmF1bHQKMAobb3BlcmF0b3IuaXN0aW8uaW8vY29tcG9uZW50EhEaD0luZ3Jlc3NHYXRld2F5cwoSCgdyZWxlYXNlEgcaBWlzdGlvCjkKH3NlcnZpY2UuaXN0aW8uaW8vY2Fub25pY2FsLW5hbWUSFhoUaXN0aW8taW5ncmVzc2dhdGV3YXkKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CiIKF3NpZGVjYXIuaXN0aW8uaW8vaW5qZWN0EgcaBWZhbHNlChoKB01FU0hfSUQSDxoNY2x1c3Rlci5sb2NhbAovCgROQU1FEicaJWlzdGlvLWluZ3Jlc3NnYXRld2F5LTU5Yzc4Njc2OGQtY2duNTUKGwoJTkFNRVNQQUNFEg4aDGlzdGlvLXN5c3RlbQpdCgVPV05FUhJUGlJrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvaXN0aW8tc3lzdGVtL2RlcGxveW1lbnRzL2lzdGlvLWluZ3Jlc3NnYXRld2F5CicKDVdPUktMT0FEX05BTUUSFhoUaXN0aW8taW5ncmVzc2dhdGV3YXk=", 
    "X-Envoy-Peer-Metadata-Id": "router~10.42.4.111~istio-ingressgateway-59c786768d-cgn55.istio-system~istio-system.svc.cluster.local"
  }
}

# 可以清楚地看到 x-b3-* Zipkin 标头自动附加到我们的请求中。这些 Zipkin 标头用于创建 Span 并发送给 Jaeger

istioctl dashboard jaeger --browser=false

# 将服务网格中所有工作负载的全局采样率更改为 10%。
kubectl edit -n istio-system cm istio
apiVersion: v1
data:
  mesh: |-
    accessLogFile: /dev/stdout
    defaultConfig:
      discoveryAddress: istiod.istio-system.svc:15012
      proxyMetadata: {}
      tracing:
        sampling: 10
        zipkin:
          address: zipkin.istio-system:9411
          
# 除了全局配置之外，我们还可以在注释中针对每个工作负载进行配置。
apiVersion: apps/v1
kind: Deployment
...
spec:
  template:
    metadata:
      annotations:
        proxy.istio.io/config: |
          tracing:
            sampling: 10
            zipkin:
              address: zipkin.istio-system:9411
              
kubectl apply -f ch8/webapp-deployment-zipkin.yaml

# 将 x-envoy-force-trace 标头添加到请求中，以触发 Istio 捕获请求生成的特定调用图的跨度和跟踪。
curl -H "x-envoy-force-trace: true"  \
-H "Host: webapp.istioinaction.io" http://192.168.8.212/api/catalog

apiVersion: apps/v1
kind: Deployment
...
spec:
  template:
    metadata:
      annotations:
        proxy.istio.io/config: |
          tracing:
            sampling: 100
            customTags:
              custom_tag:
                literal:
                  value: "Test Tag"
            zipkin:
              address: zipkin.istio-system:9411
              
curl -H "Host: webapp.istioinaction.io" \
http://192.168.8.212/api/catalog

# 查看 默认跟踪配置
istioctl pc bootstrap -n istioinaction deploy/webapp \
-o json  | jq .bootstrap.tracing
{
  "http": {
    "name": "envoy.tracers.zipkin",
    "typedConfig": {
      "@type": "type.googleapis.com/envoy.config.trace.v3.ZipkinConfig",
      "collectorCluster": "zipkin",
      "collectorEndpoint": "/api/v2/spans",
      "traceId128bit": true,
      "sharedSpanContext": false,
      "collectorEndpointVersion": "HTTP_JSON"
    }
  }
}

# 跟踪引擎配置为基于Zipkin，发送到/api/v2/spans端点，并将其视为JSON端点。如果我们需要覆盖这些设置或以任何方式进行调整，则必须能够在使用Zipkin作为跟踪引擎时覆盖Istio中内置的静态定义。我们可以通过自定义启动配置来实现这一点。


# 在 Kubernetes configmap 中指定要调整的配置片段

apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-custom-zipkin
data:
  custom_bootstrap.json: |
    {
      "tracing": {
        "http": {
          "name": "envoy.tracers.zipkin",
          "typedConfig": {
            "@type": "type.googleapis.com/
              envoy.config.trace.v3.ZipkinConfig",
            "collectorCluster": "zipkin",
            "collectorEndpoint": "/zipkin/api/v1/spans",
            "traceId128bit": "true",
            "collectorEndpointVersion": "HTTP_JSON"
          }
        }
      }
    }
    
kubectl apply -f ch8/istio-custom-bootstrap.yaml \
-n istioinaction

# 在 Deployment 资源的 Pod 模板中添加一个注解来引用这个 configmap
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: webapp
  name: webapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webapp
  template:
    metadata:
      annotations:
        sidecar.istio.io/bootstrapOverride: "istio-custom-zipkin"
        
kubectl apply -f ch8/webapp-deployment-custom-boot.yaml \
-n istioinaction

# 自定义引导配置与幕后使用的 Envoy 代理版本相关，并且不能保证向后兼容性。任何错误配置都可能导致的服务瘫痪。
istioctl pc bootstrap -n istioinaction deploy/webapp \
-o json | jq .bootstrap.tracing
{
  "http": {
    "name": "envoy.tracers.zipkin",
    "typedConfig": {
      "@type": "type.googleapis.com/envoy.config.trace.v3.ZipkinConfig",
      "collectorCluster": "zipkin",
      "collectorEndpoint": "/zipkin/api/v1/spans",
      "traceId128bit": true,
      "collectorEndpointVersion": "HTTP_JSON"
    }
  }
}

# Reset
kubectl apply -f services/webapp/kubernetes/webapp.yaml 

kubectl create ns kiali-operator

helm repo add kiali https://kiali.org/helm-charts

helm repo update 

helm pull kiali/kiali-operator  --untar

cat > kiali-operator/values-prod.yaml << EOF
cr:
  create: false
  name: kiali
  namespace: "istio-system"
EOF

helm upgrade --install kiali-operator -f \
  ./kiali-operator/values-prod.yaml  \
  -n kiali-operator ./kiali-operator
---
# 创建 kiali 实例
# 配置模板 https://github.com/kiali/kiali-operator/blob/master/crd-docs/cr/kiali.io_v1alpha1_kiali.yaml
kubectl apply -f << EOF - 
apiVersion: kiali.io/v1alpha1
kind: Kiali
metadata:
  namespace: istio-system
  name: kiali
spec:
  istio_namespace: "istio-system"  
  istio_component_namespaces:
    prometheus: prometheus
  auth:    
    strategy: anonymous
  deployment:
    accessible_namespaces:
    - '**'
  external_services:    
    prometheus:
      cache_duration: 10
      cache_enabled: true
      cache_expiration: 300
      url: "http://prom-kube-prometheus-stack-prometheus.prometheus:9090"    
    tracing:
      enabled: true
      in_cluster_url: "http://tracing.istio-system:16685/jaeger"
      use_grpc: true
EOF


# 代理至本地
kubectl -n istio-system port-forward deploy/kiali 20001

# 创建 token
kubectl -n istio-system create token kiali-service-account


# 创建数据
for i in {1..20}; do curl http://192.168.8.212/api/catalog -H \
"Host: webapp.istioinaction.io"; sleep .5s;  done