华为CCE安装isito实现ASM服务网格

注意这里需要修改的地方有三部分，除了官方文档标注的ELB的两部分外，还需要修改clusterIP的地址，应用生效后，我们可以再查看下SVC信息：

[root@testcce-68506-l3jp4 istio]# kubectl get svc istio-ingressgateway -n istio-system
NAME                   TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)                                                                      AGE
istio-ingressgateway   LoadBalancer   10.247.224.23   110.238.85.11   15021:32484/TCP,80:30294/TCP,443:31301/TCP,31400:30229/TCP,15443:32028/TCP   158m

四、验证确认

这时候我们可以通过内部变量获取访问信息，可以直接在浏览器上访问，也可以在命令行下验证：

[root@testcce-68506-l3jp4 istio]# export INGRESS_HOST=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
 -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].port}')
export SECURE_INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="https")].port}')
[root@testcce-68506-l3jp4 istio]# export INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].port}')
[root@testcce-68506-l3jp4 istio]# export SECURE_INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="https")].port}')
[root@testcce-68506-l3jp4 istio]# export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT
[root@testcce-68506-l3jp4 istio]# echo "$GATEWAY_URL"
110.238.85.11:80
[root@testcce-68506-l3jp4 istio]# echo "http://$GATEWAY_URL/productpage"
http://110.238.85.11:80/productpage
[root@testcce-68506-l3jp4 istio]# curl "http://$GATEWAY_URL/productpage"

还可以通过Kiali的界面来查看具体的调用链拓扑和访问信息。这里需要先安装下相关配套插件：

[root@testcce-68506-l3jp4 istio]# kubectl apply -f samples/addons
serviceaccount/grafana created
configmap/grafana created
service/grafana created
deployment.apps/grafana created
configmap/istio-grafana-dashboards created
configmap/istio-services-grafana-dashboards created
deployment.apps/jaeger created
service/tracing created
service/zipkin created
service/jaeger-collector created
serviceaccount/kiali created
configmap/kiali created
clusterrole.rbac.authorization.k8s.io/kiali-viewer created
clusterrole.rbac.authorization.k8s.io/kiali created
clusterrolebinding.rbac.authorization.k8s.io/kiali created
role.rbac.authorization.k8s.io/kiali-controlplane created
rolebinding.rbac.authorization.k8s.io/kiali-controlplane created
service/kiali created
deployment.apps/kiali created
serviceaccount/prometheus created
configmap/prometheus created
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
clusterrole.rbac.authorization.k8s.io/prometheus configured
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
clusterrolebinding.rbac.authorization.k8s.io/prometheus configured
service/prometheus created
deployment.apps/prometheus created
[root@testcce-68506-l3jp4 istio]# kubectl rollout status deployment/kiali -n istio-system
Waiting for deployment "kiali" rollout to finish: 0 of 1 updated replicas are available...
deployment "kiali" successfully rolled out

安装完成后，将 kiali 服务的管理界面暴漏出去：

[root@testcce-68506-l3jp4 ~]# istioctl dashboard kiali --address 0.0.0.0
http://0.0.0.0:20001/kiali
Failed to open browser; open http://0.0.0.0:20001/kiali in your browser.

因为需求公网访问，我这里把监听地址改成了0.0.0.0，这里需要注意下，需要在云SG安全策略里开下20001端口的访问，这里需要注意下，这里监听的地址不是ELB的地址，是node节点的公网或私网地址。
通过如下命令进行压测：

for i in $(seq 1 10000); do curl -s -o /dev/null "http://$GATEWAY_URL/productpage"; done

这里通过graph查看下几个图，这里看下workload图，如下：

如果需要查看进一步测试istio的功能，可以查看 https://istio.io/latest/docs/setup/getting-started/#next-steps 链接里的demo示例，可以对应的测试功能如下：
- Request routing
- Fault injection
- Traffic shifting
- Querying metrics
- Visualizing metrics
- Accessing external services
- Visualizing your mesh

五、删除

清理战场的命令如下：

kubectl delete -f samples/addons
istioctl manifest generate --set profile=demo | kubectl delete --ignore-not-found=true -f -
istioctl tag remove default
kubectl delete namespace istio-system
kubectl label namespace default istio-injection-