CentOS 7下Kubernetes与Istio服务网格部署实践

1. 项目概述与背景解析在云原生技术栈中服务网格(Service Mesh)已成为微服务通信的基础设施层。Istio作为目前最成熟的开源服务网格解决方案通过与Kubernetes的深度集成为容器化应用提供了细粒度的流量管理、可观测性和安全控制能力。本次实践将基于CentOS 7操作系统完整演示从零搭建Kubernetes集群到部署Istio服务网格并实现高级流量控制功能的全部过程。选择CentOS 7作为基础环境主要基于以下考量首先作为企业级Linux发行版CentOS 7具有长期支持周期截至2024年6月系统稳定性经过充分验证其次其内核版本3.10.x虽较旧但完全满足Kubernetes的最低要求最后大量传统企业仍在使用该版本具有广泛的实际应用场景。值得注意的是CentOS 7默认的防火墙规则和SELinux配置会对容器网络产生影响这将在后续章节专门处理。2. 基础环境准备与调优2.1 系统初始化配置在开始安装前需对CentOS 7进行必要的系统调优。以下操作需要在所有节点包括master和worker上执行# 关闭swapKubernetes 1.8要求 sudo swapoff -a sudo sed -i / swap / s/^\(.*\)$/#\1/g /etc/fstab # 关闭防火墙或配置放行规则 sudo systemctl stop firewalld sudo systemctl disable firewalld # 设置SELinux为permissive模式 sudo setenforce 0 sudo sed -i s/^SELINUXenforcing$/SELINUXpermissive/ /etc/selinux/config # 加载内核模块 cat EOF | sudo tee /etc/modules-load.d/k8s.conf br_netfilter ip_vs ip_vs_rr ip_vs_wrr ip_vs_sh nf_conntrack_ipv4 EOF # 配置sysctl参数 cat EOF | sudo tee /etc/sysctl.d/k8s.conf net.bridge.bridge-nf-call-ip6tables 1 net.bridge.bridge-nf-call-iptables 1 net.ipv4.ip_forward 1 vm.swappiness 0 EOF sudo sysctl --system注意生产环境中建议保留防火墙并精确配置规则而非直接关闭。示例中关闭防火墙仅用于简化实验环境搭建。2.2 Docker安装与配置Kubernetes 1.24版本已移除对Docker的直接支持但仍可通过CRI适配器使用。这里我们安装符合CRI标准的containerd# 安装必要工具 sudo yum install -y yum-utils device-mapper-persistent-data lvm2 # 添加Docker仓库 sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo # 安装containerd sudo yum install -y containerd.io # 生成默认配置并启用SystemdCgroup sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml sudo sed -i s/SystemdCgroup false/SystemdCgroup true/ /etc/containerd/config.toml # 启动服务 sudo systemctl restart containerd sudo systemctl enable containerd2.3 Kubernetes集群部署2.3.1 安装kubeadm/kubelet/kubectlcat EOF | sudo tee /etc/yum.repos.d/kubernetes.repo [kubernetes] nameKubernetes baseurlhttps://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64 enabled1 gpgcheck1 repo_gpgcheck1 gpgkeyhttps://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg EOF # 安装指定版本避免使用最新版可能的不兼容问题 sudo yum install -y kubelet-1.23.8 kubeadm-1.23.8 kubectl-1.23.8 --disableexcludeskubernetes # 设置kubelet自启动 sudo systemctl enable --now kubelet2.3.2 初始化Master节点sudo kubeadm init \ --pod-network-cidr10.244.0.0/16 \ --apiserver-advertise-addressMASTER_IP \ --image-repository registry.aliyuncs.com/google_containers \ --kubernetes-version v1.23.8 # 配置kubectl mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config2.3.3 安装网络插件Flannelkubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml2.3.4 加入Worker节点在Master节点上获取join命令kubeadm token create --print-join-command然后在每个Worker节点上执行输出的命令。3. Istio服务网格部署3.1 Istio安装前检查确保集群满足以下条件Kubernetes版本1.20-1.24Istio 1.15的兼容范围集群有至少2个CPU核心和4GB内存可供Istio使用kube-apiserver版本与kubectl版本匹配验证命令kubectl version --short kubectl get nodes -o wide3.2 下载并安装Istio# 下载指定版本避免使用最新版可能的不稳定问题 curl -L https://istio.io/downloadIstio | ISTIO_VERSION1.15.0 sh - cd istio-1.15.0 export PATH$PWD/bin:$PATH # 安装demo配置包含所有组件 istioctl install --set profiledemo -y # 验证安装 kubectl get pods -n istio-system3.3 启用自动Sidecar注入为default命名空间启用自动注入kubectl label namespace default istio-injectionenabled kubectl get namespace -L istio-injection4. 部署示例应用与流量控制实践4.1 部署Bookinfo示例应用kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml kubectl get services kubectl get pods验证应用运行kubectl exec $(kubectl get pod -l appratings -o jsonpath{.items[0].metadata.name}) -c ratings -- curl -s productpage:9080/productpage | grep -o title.*/title4.2 配置Gateway和VirtualServicekubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml获取访问入口export INGRESS_HOST$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath{.status.loadBalancer.ingress[0].ip}) export INGRESS_PORT$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath{.spec.ports[?(.namehttp2)].port}) export GATEWAY_URL$INGRESS_HOST:$INGRESS_PORT echo http://$GATEWAY_URL/productpage4.3 实现流量路由规则4.3.1 基于权重的流量切分将流量按7:3比例分配到v1和v2版本apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: reviews spec: hosts: - reviews http: - route: - destination: host: reviews subset: v1 weight: 70 - destination: host: reviews subset: v2 weight: 30 --- apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: reviews spec: host: reviews subsets: - name: v1 labels: version: v1 - name: v2 labels: version: v24.3.2 基于Header的路由将来自特定用户的请求导向v2版本apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: reviews spec: hosts: - reviews http: - match: - headers: end-user: exact: test-user route: - destination: host: reviews subset: v2 - route: - destination: host: reviews subset: v15. 高级流量管理技巧5.1 请求超时与重试配置apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: ratings spec: hosts: - ratings http: - route: - destination: host: ratings subset: v1 timeout: 1s retries: attempts: 3 perTryTimeout: 0.5s5.2 故障注入测试模拟ratings服务延迟apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: ratings spec: hosts: - ratings http: - fault: delay: percentage: value: 100 fixedDelay: 7s route: - destination: host: ratings subset: v15.3 流量镜像影子流量将生产流量复制到v2版本apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: reviews spec: hosts: - reviews http: - route: - destination: host: reviews subset: v1 weight: 100 mirror: host: reviews subset: v2 mirrorPercentage: value: 50.06. 监控与可视化6.1 部署Kiali仪表盘kubectl apply -f samples/addons kubectl rollout status deployment/kiali -n istio-system访问Kialiistioctl dashboard kiali6.2 使用Prometheus收集指标kubectl apply -f samples/addons/prometheus.yaml kubectl rollout status deployment/prometheus -n istio-system查询指标示例istioctl dashboard prometheus在Prometheus UI中尝试查询istio_requests_total{destination_serviceproductpage.default.svc.cluster.local}7. 生产环境注意事项资源规划Istio控制平面至少需要4核CPU和8GB内存每个Sidecar代理会增加约0.5vCPU和50MB内存开销使用HorizontalPodAutoscaler自动扩展组件性能调优istioctl install --set profiledefault \ --set values.global.proxy.resources.requests.cpu100m \ --set values.global.proxy.resources.requests.memory128Mi \ --set values.pilot.resources.requests.cpu500m \ --set values.pilot.resources.requests.memory2048Mi安全加固启用mTLS严格模式kubectl apply -n istio-system -f - EOF apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: default spec: mtls: mode: STRICT EOF版本升级策略使用金丝雀升级方式逐步替换控制平面保持数据平面兼容至少两个控制平面版本升级前使用istioctl analyze检查兼容性8. 常见问题排查Sidecar注入失败检查命名空间标签kubectl get ns namespace -L istio-injection查看MutatingWebhookConfigurationkubectl get mutatingwebhookconfiguration -A检查Pod事件kubectl describe pod pod-name流量路由不生效验证VirtualService配置istioctl analyze检查DestinationRule子集匹配标签查看Envoy配置istioctl proxy-config routes pod-name --name route-name -o json性能瓶颈诊断监控Sidecar CPU使用kubectl top pods -n istio-system检查Envoy日志kubectl logs pod-name -c istio-proxy分析Prometheus指标envoy_server_worker_*CentOS 7特定问题内核参数未生效sysctl -p后重启kubelet时间同步问题yum install -y ntp systemctl start ntpd文件描述符限制echo * soft nofile 65535 /etc/security/limits.conf9. 环境清理删除示例应用samples/bookinfo/platform/kube/cleanup.sh卸载Istioistioctl uninstall --purge kubectl delete namespace istio-system重置Kubernetes集群kubeadm reset rm -rf ~/.kube