备考ICA----Istio实验18---单集群中部署多个Istio控制面

备考ICA----Istio实验18—单集群中部署多个Istio控制面

单个 Kubernetes 控制面以及多个 Istio 控制面和多个网格。通过 Kubernetes 命名空间和 RBAC 实现软多租户业务隔离。

1. 环境准备

1.1 创建2个命名空间

kubectl create ns usergroup-1
kubectl label ns usergroup-1 usergroup=usergroup-1
kubectl create ns usergroup-2
kubectl label ns usergroup-2 usergroup=usergroup-2

1.2 确认istioctl正确安装

istioctl x precheck

2. 部署多个控制面

2.1 usergroup1 安装istiod

istio-install-usergroup1.yaml

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: usergroup-1
spec:
  profile: demo
  revision: usergroup-1
  meshConfig:
    discoverySelectors:
      - matchLabels:
          usergroup: usergroup-1
  values:
    global:
      istioNamespace: usergroup-1
    pilot:
      env:
        ENABLE_ENHANCED_RESOURCE_SCOPING: true

usergroup1 安装istio

istioctl install -y -f istio-install-usergroup1.yaml

2.2 usergroup2 安装istiod

istio-install-usergroup1.yaml

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: usergroup-2
spec:
  profile: demo
  revision: usergroup-2
  meshConfig:
    discoverySelectors:
      - matchLabels:
          usergroup: usergroup-2
  values:
    global:
      istioNamespace: usergroup-2
    pilot:
      env:
        ENABLE_ENHANCED_RESOURCE_SCOPING: true

usergroup2 安装istio

istioctl install -y -f istio-install-usergroup2.yaml

3. 双向TLS

strict-usergroup-1.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: "usergroup-1-peerauth"
  namespace: "usergroup-1"
spec:
  mtls:
    mode: STRICT

strict-usergroup-2.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: "usergroup-2-peerauth"
  namespace: "usergroup-2"
spec:
  mtls:
    mode: STRICT

配置生效

kubectl apply -f strict-usergroup-1.yaml
kubectl apply -f strict-usergroup-2.yaml

4. 验证控制多控制平面

kubectl get ns --show-labels|grep usergroup
kubectl get pods -n usergroup-1 
kubectl get pods -n usergroup-2
kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io 
kubectl get mutatingwebhookconfigurations.admissionregistration.k8s.io 

5. 部署应用负载

5.1 创建命名空间

创建3个命名空间

kubectl create ns app-ns-1
kubectl create ns app-ns-2
kubectl create ns app-ns-3

5.2 将命名空间与控制平面关联

kubectl label ns app-ns-1 usergroup=usergroup-1 istio.io/rev=usergroup-1
kubectl label ns app-ns-2 usergroup=usergroup-2 istio.io/rev=usergroup-2
kubectl label ns app-ns-3 usergroup=usergroup-2 istio.io/rev=usergroup-2

5.3 部署应用

kubectl apply -f istio/samples/sleep/sleep.yaml -n app-ns-1
kubectl apply -f istio/samples/httpbin/httpbin.yaml -n app-ns-1
kubectl apply -f istio/samples/sleep/sleep.yaml -n app-ns-2
kubectl apply -f istio/samples/httpbin/httpbin.yaml -n app-ns-2
kubectl apply -f istio/samples/sleep/sleep.yaml -n app-ns-3
kubectl apply -f istio/samples/httpbin/httpbin.yaml -n app-ns-3

确认pod被正确创建

kubectl get pods -n app-ns-1
kubectl get pods -n app-ns-2
kubectl get pods -n app-ns-3

5.4 访问测试

for NS in app-ns-1 app-ns-2 app-ns-3;do
  for APPS in app-ns-1 app-ns-2 app-ns-3;do
    echo "${NS} TO ${APPS}:"
	kubectl -n ${NS} exec deployments/sleep -- curl -sIL http://httpbin.${APPS}:8000 |grep HTTP/1.1
  done
done

根据测试结果我们可以看到,在同一个控制平面的app-ns-2和app-ns-3可以互访,而另一个控制平面的app-ns-1只能访问自己平面的httpbin服务
至此备考ICA----Istio实验18—单集群中部署多个Istio控制面实验完成