流量的镜像

矫情吗；* 2022-10-06 01:56 94阅读 0赞

本文内容基于 [流量的熔断][Link 1]。

--------------------

### 流量镜像 ###

流量镜像，也称为影子流量，是一个以尽可能低的风险为生产带来变化的强大的功能。镜像会将实时流量的副本发送到镜像服务。镜像流量发生在主服务的关键请求路径之外。

*  恢复环境：

kubectl delete -f samples/httpbin/httpbin.yaml
    
    kubectl delete -f samples/httpbin/networking/destination-rule-httpbin.yaml
    
    kubectl delete -f samples/httpbin/sample-client/fortio-deploy.yaml

*  部署两个版本的 `httpbin` 服务，`httpbin` 服务已开启访问日志：

vim samples/httpbin/httpbin-deploy-v1.yaml

apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: httpbin-v1
    spec:
      replicas: 1
      selector:
        matchLabels:
          app: httpbin
          version: v1
      template:
        metadata:
          labels:
            app: httpbin
            version: v1
        spec:
          containers:
          - image: docker.io/kennethreitz/httpbin
            imagePullPolicy: IfNotPresent
            name: httpbin
            command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]
            ports:
            - containerPort: 80

vim samples/httpbin/httpbin-deploy-v2.yaml

apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: httpbin-v2
    spec:
      replicas: 1
      selector:
        matchLabels:
          app: httpbin
          version: v2
      template:
        metadata:
          labels:
            app: httpbin
            version: v2
        spec:
          containers:
          - image: docker.io/kennethreitz/httpbin
            imagePullPolicy: IfNotPresent
            name: httpbin
            command: ["gunicorn", "--access-logfile", "-", "-b", "0.0.0.0:80", "httpbin:app"]
            ports:
            - containerPort: 80

vim samples/httpbin/httpbin-svc.yaml

apiVersion: v1
    kind: Service
    metadata:
      name: httpbin
      labels:
        app: httpbin
    spec:
      ports:
      - name: http
        port: 8000
        targetPort: 80
      selector:
        app: httpbin

kubectl apply -f samples/httpbin/httpbin-deploy-v1.yaml
    
    kubectl apply -f samples/httpbin/httpbin-deploy-v2.yaml
    
    kubectl apply -f samples/httpbin/httpbin-svc.yaml

*  启动 `sleep` 服务，使用 curl 来提供负载：

vim samples/httpbin/sleep-deploy.yaml

apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: sleep
    spec:
      replicas: 1
      selector:
        matchLabels:
          app: sleep
      template:
        metadata:
          labels:
            app: sleep
        spec:
          containers:
          - name: sleep
            image: tutum/curl
            command: ["/bin/sleep","infinity"]
            imagePullPolicy: IfNotPresent

kubectl apply -f samples/httpbin/sleep-deploy.yaml

*  创建默认路由策略：

默认情况下，Kubernetes 在 `httpbin` 服务的两个版本之间进行负载均衡。在此，把所有流量都路由到 v1。

> 如果 Istio 开启了 TLS 认证，在应用 DestinationRule 之前必须将 TLS 流量策略 `mode: ISTIO_MUTUAL` 添加到 DestinationRule。否则，请求将发生 503 错误。

1.  创建一个默认路由规则，将所有流量路由到服务的 v1：

vim samples/httpbin/networking/destination-rule.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: DestinationRule
    metadata:
      name: httpbin
    spec:
      host: httpbin
      subsets:
      - name: v1
        labels:
          version: v1
      - name: v2
        labels:
          version: v2

vim samples/httpbin/networking/virtual-service-v1.yaml

apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: httpbin
    spec:
      hosts:
        - httpbin
      http:
      - route:
        - destination:
            host: httpbin
            subset: v1
          weight: 100

kubectl apply -f samples/httpbin/networking/destination-rule.yaml
    
    kubectl apply -f samples/httpbin/networking/virtual-service-v1.yaml

1.  向服务发送一下流量：

export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath={ .items..metadata.name})
    
    kubectl exec -it $SLEEP_POD -c sleep -- sh -c 'curl http://httpbin:8000/headers' | python -m json.tool
    
    { 
        "headers": { 
            "Accept": "*/*",
            "Content-Length": "0",
            "Host": "httpbin:8000",
            "User-Agent": "curl/7.35.0",
            "X-B3-Parentspanid": "372facbd5b406888",
            "X-B3-Sampled": "0",
            "X-B3-Spanid": "e60d58ce6b12ec8d",
            "X-B3-Traceid": "94127e32a64208bd372facbd5b406888",
            "X-Envoy-Attempt-Count": "1",
            "X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/default;Hash=4604a9f50d9b2ecbb94f71e00a73294408a0597af96f77ffba09c53377f4a925;Subject=\"\";URI=spiffe://cluster.local/ns/default/sa/default"
        }
    }

1.  分别查看 `httpbin` 服务 v1 和 v2 两个 `Pod` 的日志：

export V1_POD=$(kubectl get pod -l app=httpbin,version=v1 -o jsonpath={ .items..metadata.name})
    
    kubectl logs -f $V1_POD -c httpbin
    
    127.0.0.1 - - [01/Mar/2021:06:29:37 +0000] "GET /headers HTTP/1.1" 200 553 "-" "curl/7.35.0"

export V2_POD=$(kubectl get pod -l app=httpbin,version=v2 -o jsonpath={ .items..metadata.name})
    
    kubectl logs -f $V2_POD -c httpbin

可以看到访问日志进入 v1，而 v2 中没有日志产生。

*  镜像流量到 v2：

1.  改变流量规则将流量镜像到 v2：

vim samples/httpbin/networking/virtual-service-v1-mirror-v2.yaml

kubectl apply -f samples/httpbin/networking/virtual-service-v1-mirror-v2.yaml

这个路由规则发送 100% 流量到 v1。最后一段表示将镜像流量到 `httpbin:v2` 服务。当流量被镜像时，请求将发送到镜像服务中，并在 `headers` 中的 `Host/Authority` 属性值上追加 `-shadow`。例如 `cluster-1` 变为 `cluster-1-shadow`。

需要重点注意的是，这些被镜像的流量是 **即发即弃** 的，就是说镜像请求的响应会被丢弃。

可以使用 `mirror_percent` 属性来设置镜像流量的百分比，而不是镜像全部请求。如果这个属性不存在，将镜像所有流量。

1.  发送流量：

kubectl exec -it $SLEEP_POD -c sleep -- sh -c 'curl http://httpbin:8000/headers' | python -m json.tool
    
    { 
        "headers": { 
            "Accept": "*/*",
            "Content-Length": "0",
            "Host": "httpbin:8000",
            "User-Agent": "curl/7.35.0",
            "X-B3-Parentspanid": "e1e80c46db19f77d",
            "X-B3-Sampled": "0",
            "X-B3-Spanid": "f978596e99f13e2b",
            "X-B3-Traceid": "dc285fef04fa4e1ce1e80c46db19f77d",
            "X-Envoy-Attempt-Count": "1",
            "X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/default;Hash=4604a9f50d9b2ecbb94f71e00a73294408a0597af96f77ffba09c53377f4a925;Subject=\"\";URI=spiffe://cluster.local/ns/default/sa/default"
        }
    }

kubectl logs -f $V1_POD -c httpbin
    
    127.0.0.1 - - [01/Mar/2021:06:29:37 +0000] "GET /headers HTTP/1.1" 200 553 "-" "curl/7.35.0"
    127.0.0.1 - - [01/Mar/2021:06:53:49 +0000] "GET /headers HTTP/1.1" 200 553 "-" "curl/7.35.0"

kubectl logs -f $V2_POD -c httpbin
    
    127.0.0.1 - - [01/Mar/2021:06:53:49 +0000] "GET /headers HTTP/1.1" 200 560 "-" "curl/7.35.0"

可以看到 v1 和 v2 中都有了访问日志。v2 中的访问日志就是由镜像流量产生的，这些请求的实际目标是 v1。

--------------------

[Link 1]: https://blog.csdn.net/miss1181248983/article/details/117531852