第 1 章 Service Mesh 概述 ............................................................................................................ 1
1.1 Service Mesh 基本概念 ............................................................................................... 2
1.2 后 Kubernetes 時代的微服務(wù) ....................................................................................... 5
1.2.1 重要觀點 ......................................................................................................... 6
1.2.2 Kubernetes 與 Service Mesh .............................................................................. 6
1.2.3 kube-proxy 組件 ............................................................................................... 8
1.2.4 Kubernetes Ingress 與 Istio Gateway .................................................................. 8
1.2.5 xDS 協(xié)議 ......................................................................................................... 9
1.2.6 Envoy ............................................................................................................ 11
1.2.7 Istio Service Mesh .......................................................................................... 12
1.3 什么是 Istio .............................................................................................................. 12
1.3.1 為什么使用 Istio ............................................................................................ 13
1.3.2 Istio 的平臺支持 ............................................................................................ 13
1.4 本章小結(jié) .................................................................................................................. 14

第 2 章 核心功能 .......................................................................................................................... 15
2.1 流量控制 .................................................................................................................. 15
2.1.1 請求路由和流量轉(zhuǎn)移 ..................................................................................... 16
2.1.2 彈性功能 ....................................................................................................... 17
2.1.3 調(diào)試能力 ....................................................................................................... 18
2.1.4 實現(xiàn)流量控制的自定義資源 .......................................................................... 19
2.2 安全 ......................................................................................................................... 20
2.2.1 認(rèn)證 .............................................................................................................. 20
2.2.2 授權(quán) .............................................................................................................. 21
2.3 可觀察性 .................................................................................................................. 21
2.4 本章小結(jié) .................................................................................................................. 23

第 3 章 架構(gòu)解析 .......................................................................................................................... 24
3.1 Istio 的架構(gòu)組成 ....................................................................................................... 24
3.2 Istio 的設(shè)計目標(biāo) ....................................................................................................... 25
3.3 Istio 的架構(gòu)變遷 ....................................................................................................... 26
3.4 控制平面 .................................................................................................................. 27
3.4.1 Pilot ............................................................................................................... 27
3.4.2 Citadel ........................................................................................................... 37
3.4.3 Galley ............................................................................................................ 40
3.5 數(shù)據(jù)平面 .................................................................................................................. 45
3.5.1 數(shù)據(jù)平面的概念 ............................................................................................ 45
3.5.2 Sidecar 注入及透明流量劫持 ......................................................................... 47
3.5.3 Sidecar 流量路由機制分析 ............................................................................. 57
3.5.4 Envoy ............................................................................................................ 86
3.5.5 MOSN ........................................................................................................... 93
3.6 本章小結(jié) .................................................................................................................. 98

第 4 章 安裝與部署 ...................................................................................................................... 99
4.1 安裝 ......................................................................................................................... 99
4.1.1 環(huán)境準(zhǔn)備 ....................................................................................................... 99
4.1.2 安裝 Kubernetes 集群 ................................................................................... 100
4.1.3 安裝 Istio ..................................................................................................... 100
4.2 升級 ....................................................................................................................... 102
4.2.1 金絲雀升級 ................................................................................................. 102
4.2.2 熱升級 ......................................................................................................... 104
4.3 Bookinfo 實例 ......................................................................................................... 104
4.3.1 環(huán)境準(zhǔn)備 ..................................................................................................... 105
4.3.2 部署應(yīng)用 ..................................................................................................... 106
4.3.3 啟動應(yīng)用服務(wù) .............................................................................................. 106
4.3.4 確定 Ingress 的 IP 地址和端口 ..................................................................... 107
4.3.5 集群外部訪問應(yīng)用 ....................................................................................... 108
4.4 本章小結(jié) ................................................................................................................ 108

第 5 章 流量控制 ........................................................................................................................ 109
5.1 流量控制 CRD ........................................................................................................ 109
5.1.1 VirtualService ............................................................................................... 110
5.1.2 DestinationRule ............................................................................................ 111
5.1.3 Gateway ....................................................................................................... 112
5.1.4 ServiceEntry ................................................................................................. 114
5.1.5 Sidecar ......................................................................................................... 115
5.2 路由 ....................................................................................................................... 116
5.2.1 VirtualService ............................................................................................... 116
5.2.2 路由規(guī)則 ..................................................................................................... 118
5.2.3 DestinationRule ............................................................................................ 120
5.2.4 Gateway ....................................................................................................... 122
5.2.5 ServiceEntry ................................................................................................. 123
5.3 流量鏡像 ................................................................................................................ 127
5.3.1 流量鏡像能夠做什么 ................................................................................... 127
5.3.2 流量鏡像的實現(xiàn)原理 ................................................................................... 128
5.3.3 流量鏡像的配置 .......................................................................................... 130
5.3.4 流量鏡像實踐 .............................................................................................. 132
5.4 Ingress/Egress ......................................................................................................... 141
5.4.1 Ingress ......................................................................................................... 142
5.4.2 Egress .......................................................................................................... 158
5.5 超時 ....................................................................................................................... 174
5.6 重試 ....................................................................................................................... 178
5.7 熔斷 ....................................................................................................................... 181
5.8 故障注入 ................................................................................................................ 184
5.8.1 HTTPFaultInjection.Abort ............................................................................. 185
5.8.2 HTTPFaultInjection.Delay ............................................................................. 186
5.9 本章小結(jié) ................................................................................................................ 189

第 6 章 可觀察性 ........................................................................................................................ 190
6.1 指標(biāo)監(jiān)控 ................................................................................................................ 190
6.1.1 Prometheus .................................................................................................. 191
6.1.2 Prometheus 配置解析 ................................................................................... 195
6.1.3 Prometheus-Istio 指標(biāo) ................................................................................... 200
6.2 可視化 .................................................................................................................... 202
6.2.1 Grafana ........................................................................................................ 203
6.2.2 Kiali ............................................................................................................ 221
6.3 日志 ....................................................................................................................... 235
6.3.1 傳統(tǒng)日志 ..................................................................................................... 235
6.3.2 云原生日志 ................................................................................................. 236
6.3.3 Istio 日志 ..................................................................................................... 236
6.3.4 ELK ............................................................................................................ 236
6.3.5 EFK ............................................................................................................. 250
6.4 分布式追蹤 ............................................................................................................ 264
6.4.1 Jaeger .......................................................................................................... 265
6.4.2 Zipkin .......................................................................................................... 272
6.4.3 SkyWalking .................................................................................................. 277
6.5 本章小結(jié) ................................................................................................................ 293

第 7 章 安全 ............................................................................................................................... 294
7.1 認(rèn)證 ....................................................................................................................... 294
7.1.1 對等認(rèn)證 ..................................................................................................... 296
7.1.2 請求認(rèn)證 ..................................................................................................... 307
7.2 授權(quán) ....................................................................................................................... 312
7.2.1 授權(quán)策略 ..................................................................................................... 313
7.2.2 全局策略 ..................................................................................................... 314
7.2.3 局部策略 ..................................................................................................... 315
7.2.4 Match label .................................................................................................. 316
7.2.5 匹配算法 ..................................................................................................... 317
7.2.6 規(guī)則詳解 ..................................................................................................... 318
7.2.7 操作實例 ..................................................................................................... 320
7.2.8 JWT 授權(quán) .................................................................................................... 325
7.3 本章小結(jié) ................................................................................................................ 337

第 8 章 進階實戰(zhàn) ........................................................................................................................ 338
8.1 集成服務(wù)注冊中心 .................................................................................................. 338
8.1.1 Istio 服務(wù)模型 .............................................................................................. 338
8.1.2 Pilot 服務(wù)模型源碼分析 ............................................................................... 339
8.1.3 第三方服務(wù)注冊表集成 ............................................................................... 341
8.2 對接 API 網(wǎng)關(guān) ........................................................................................................ 342
8.2.1 Envoy .......................................................................................................... 343
8.2.2 預(yù)備工作 ..................................................................................................... 343
8.2.3 開始監(jiān)聽 ..................................................................................................... 344
8.2.4 一條路由 ..................................................................................................... 346
8.2.5 一個服務(wù) ..................................................................................................... 348
8.3 分布式追蹤增強 ..................................................................................................... 352
8.3.1 OpenTracing ................................................................................................ 352
8.3.2 OpenTracing 概念模型 ................................................................................. 352
8.3.3 OpenTracing 數(shù)據(jù)模型 ................................................................................. 353
8.3.4 跨進程調(diào)用信息傳播 ................................................................................... 354
8.4 實現(xiàn)方法級別的調(diào)用跟蹤 ....................................................................................... 356
8.4.1 Istio 的分布式追蹤 ...................................................................................... 356
8.4.2 使用 OpenTracing 傳遞分布式跟蹤上下文 ................................................... 359
8.4.3 在 Istio 中加入方法級別的調(diào)用跟蹤 ............................................................ 360
8.5 實現(xiàn) Kafka 消息跟蹤 .............................................................................................. 363
8.5.1 eshop 實例程序結(jié)構(gòu) .................................................................................... 363
8.5.2 將 Kafka 消息處理加入調(diào)用鏈路跟蹤 .......................................................... 364
8.5.3 安裝 Kafka 集群 .......................................................................................... 365
8.5.4 部署實例應(yīng)用 .............................................................................................. 365
8.5.5 將調(diào)用跟蹤上下文從 Kafka 傳遞到 REST 服務(wù) ............................................ 367
8.6 部署模型 ................................................................................................................ 371
8.6.1 集群模型與控制平面模型 ............................................................................ 371
8.6.2 網(wǎng)絡(luò)模型 ..................................................................................................... 374
8.6.3 網(wǎng)格模型 ..................................................................................................... 374
8.6.4 身份和信任模型 .......................................................................................... 375
8.6.5 租戶模型 ..................................................................................................... 376
8.7 多集群部署與管理 .................................................................................................. 377
8.7.1 多控制平面 ................................................................................................. 377
8.7.2 單控制平面 ................................................................................................. 382
8.8 智能 DNS ............................................................................................................... 387
8.8.1 待解決問題 ................................................................................................. 388
8.8.2 功能開啟 ..................................................................................................... 389
8.8.3 訪問外部服務(wù) .............................................................................................. 390
8.8.4 自動地址分配 .............................................................................................. 391
8.8.5 跨集群訪問 ................................................................................................. 391
8.9 本章小結(jié) ................................................................................................................ 392

第 9 章 故障排查 ........................................................................................................................ 393
9.1 常見使用問題 ......................................................................................................... 393
9.1.1 Service 端口命名約束 .................................................................................. 394
9.1.2 流量控制規(guī)則下發(fā)順序問題 ........................................................................ 395
9.1.3 請求中斷分析 .............................................................................................. 396
9.1.4 Sidecar 和 user container 的啟動順序 ............................................................ 399
9.1.5 Ingress Gateway 和 Service 端口聯(lián)動 ............................................................ 400
9.1.6 VirtualService 作用域 ................................................................................... 401
9.1.7 VirtualService 不支持 host fragment .............................................................. 402
9.1.8 全鏈路跟蹤并非完全透明接入 ..................................................................... 403
9.1.9 mTLS 導(dǎo)致連接中斷 .................................................................................... 404
9.2 診斷工具 ................................................................................................................ 405
9.2.1 istioctl 命令行工具安裝 ............................................................................... 406
9.2.2 使用 proxy-status 命令進行診斷 ................................................................... 408
9.2.3 使用 proxy-config 命令進行診斷 .................................................................. 412
9.2.4 使用 analyze 命令診斷 ................................................................................. 415
9.2.5 啟用 Galley 自動配置分析診斷 .................................................................... 420
9.2.6 采用 describe 命令驗證并理解網(wǎng)格配置 ....................................................... 422
9.2.7 ControlZ 自檢工具 ....................................................................................... 427
9.3 本章小結(jié) ................................................................................................................ 429

第 10 章 Service Mesh 生態(tài) ...................................................................................................... 430
10.1 開源項目 .............................................................................................................. 430
10.1.1 Linkerd ..................................................................................................... 430
10.1.2 Envoy ....................................................................................................... 431
10.1.3 Istio .......................................................................................................... 431
10.1.4 Consul Connect ......................................................................................... 432
10.1.5 MOSN ...................................................................................................... 432
10.1.6 Kong Kuma ............................................................................................... 433
10.1.7 Aeraki ....................................................................................................... 433
10.2 商業(yè)化項目 ........................................................................................................... 434
10.2.1 AWS ......................................................................................................... 434
10.2.2 Google ...................................................................................................... 434
10.2.3 Microsoft .................................................................................................. 435
10.2.4 Red Hat ..................................................................................................... 435
10.2.5 Aspen Mesh .............................................................................................. 435
10.2.6 國內(nèi)項目 .................................................................................................. 436
10.3 標(biāo)準(zhǔn) ..................................................................................................................... 436
10.3.1 xDS .......................................................................................................... 437
10.3.2 SMI .......................................................................................................... 445
10.3.3 UDPA ....................................................................................................... 449
10.4 擴展 ..................................................................................................................... 450
10.4.1 WebAssembly ............................................................................................ 451
10.4.2 Contour ..................................................................................................... 454
10.5 本章小結(jié) .............................................................................................................. 470