Istio安装「建议收藏」

大家好，又见面了，我是你们的朋友全栈君。

1、安装Istio自定义资源定义

kubectl apply -f install/kubernetes/helm/istio/templates/crds.yaml
customresourcedefinition.apiextensions.k8s.io/virtualservices.networking.istio.io created
customresourcedefinition.apiextensions.k8s.io/destinationrules.networking.istio.io created
customresourcedefinition.apiextensions.k8s.io/serviceentries.networking.istio.io created
customresourcedefinition.apiextensions.k8s.io/gateways.networking.istio.io created
customresourcedefinition.apiextensions.k8s.io/envoyfilters.networking.istio.io created
customresourcedefinition.apiextensions.k8s.io/policies.authentication.istio.io created
customresourcedefinition.apiextensions.k8s.io/meshpolicies.authentication.istio.io created
customresourcedefinition.apiextensions.k8s.io/httpapispecbindings.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/httpapispecs.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/quotaspecbindings.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/quotaspecs.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/rules.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/attributemanifests.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/bypasses.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/circonuses.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/deniers.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/fluentds.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/kubernetesenvs.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/listcheckers.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/memquotas.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/noops.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/opas.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/prometheuses.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/rbacs.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/redisquotas.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/servicecontrols.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/signalfxs.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/solarwindses.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/stackdrivers.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/statsds.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/stdios.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/apikeys.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/authorizations.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/checknothings.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/kuberneteses.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/listentries.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/logentries.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/edges.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/metrics.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/quotas.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/reportnothings.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/servicecontrolreports.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/tracespans.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/rbacconfigs.rbac.istio.io created
customresourcedefinition.apiextensions.k8s.io/serviceroles.rbac.istio.io created
customresourcedefinition.apiextensions.k8s.io/servicerolebindings.rbac.istio.io created
customresourcedefinition.apiextensions.k8s.io/adapters.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/instances.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/templates.config.istio.io created
customresourcedefinition.apiextensions.k8s.io/handlers.config.istio.io created

2、安装 Istio 并且缺省启用 Sidecar 之间的双向 TLS 认证
kubectl apply -f install/kubernetes/istio-demo-auth.yaml
namespace/istio-system created
configmap/istio-galley-configuration created
configmap/istio-grafana-custom-resources created
configmap/istio-statsd-prom-bridge created
configmap/prometheus created
configmap/istio-security-custom-resources created
configmap/istio created
configmap/istio-sidecar-injector created
serviceaccount/istio-galley-service-account created
serviceaccount/istio-egressgateway-service-account created
serviceaccount/istio-ingressgateway-service-account created
serviceaccount/istio-grafana-post-install-account created
clusterrole.rbac.authorization.k8s.io/istio-grafana-post-install-istio-system created
clusterrolebinding.rbac.authorization.k8s.io/istio-grafana-post-install-role-binding-istio-system created
job.batch/istio-grafana-post-install created
serviceaccount/istio-mixer-service-account created
serviceaccount/istio-pilot-service-account created
serviceaccount/prometheus created
serviceaccount/istio-cleanup-secrets-service-account created
clusterrole.rbac.authorization.k8s.io/istio-cleanup-secrets-istio-system created
clusterrolebinding.rbac.authorization.k8s.io/istio-cleanup-secrets-istio-system created
job.batch/istio-cleanup-secrets created
serviceaccount/istio-security-post-install-account created
clusterrole.rbac.authorization.k8s.io/istio-security-post-install-istio-system created
clusterrolebinding.rbac.authorization.k8s.io/istio-security-post-install-role-binding-istio-system created
job.batch/istio-security-post-install created
serviceaccount/istio-citadel-service-account created
serviceaccount/istio-sidecar-injector-service-account created
customresourcedefinition.apiextensions.k8s.io/virtualservices.networking.istio.io configured
customresourcedefinition.apiextensions.k8s.io/destinationrules.networking.istio.io configured
customresourcedefinition.apiextensions.k8s.io/serviceentries.networking.istio.io configured
customresourcedefinition.apiextensions.k8s.io/gateways.networking.istio.io configured
customresourcedefinition.apiextensions.k8s.io/envoyfilters.networking.istio.io configured
customresourcedefinition.apiextensions.k8s.io/httpapispecbindings.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/httpapispecs.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/quotaspecbindings.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/quotaspecs.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/rules.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/attributemanifests.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/bypasses.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/circonuses.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/deniers.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/fluentds.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/kubernetesenvs.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/listcheckers.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/memquotas.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/noops.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/opas.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/prometheuses.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/rbacs.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/redisquotas.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/servicecontrols.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/signalfxs.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/solarwindses.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/stackdrivers.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/statsds.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/stdios.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/apikeys.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/authorizations.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/checknothings.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/kuberneteses.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/listentries.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/logentries.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/edges.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/metrics.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/quotas.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/reportnothings.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/servicecontrolreports.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/tracespans.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/rbacconfigs.rbac.istio.io configured
customresourcedefinition.apiextensions.k8s.io/serviceroles.rbac.istio.io configured
customresourcedefinition.apiextensions.k8s.io/servicerolebindings.rbac.istio.io configured
customresourcedefinition.apiextensions.k8s.io/adapters.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/instances.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/templates.config.istio.io configured
customresourcedefinition.apiextensions.k8s.io/handlers.config.istio.io configured
clusterrole.rbac.authorization.k8s.io/istio-galley-istio-system created
clusterrole.rbac.authorization.k8s.io/istio-egressgateway-istio-system created
clusterrole.rbac.authorization.k8s.io/istio-ingressgateway-istio-system created
clusterrole.rbac.authorization.k8s.io/istio-mixer-istio-system created
clusterrole.rbac.authorization.k8s.io/istio-pilot-istio-system created
clusterrole.rbac.authorization.k8s.io/prometheus-istio-system created
clusterrole.rbac.authorization.k8s.io/istio-citadel-istio-system created
clusterrole.rbac.authorization.k8s.io/istio-sidecar-injector-istio-system created
clusterrolebinding.rbac.authorization.k8s.io/istio-galley-admin-role-binding-istio-system created
clusterrolebinding.rbac.authorization.k8s.io/istio-egressgateway-istio-system created
clusterrolebinding.rbac.authorization.k8s.io/istio-ingressgateway-istio-system created
clusterrolebinding.rbac.authorization.k8s.io/istio-mixer-admin-role-binding-istio-system created
clusterrolebinding.rbac.authorization.k8s.io/istio-pilot-istio-system created
clusterrolebinding.rbac.authorization.k8s.io/prometheus-istio-system created
clusterrolebinding.rbac.authorization.k8s.io/istio-citadel-istio-system created
clusterrolebinding.rbac.authorization.k8s.io/istio-sidecar-injector-admin-role-binding-istio-system created
service/istio-galley created
service/istio-egressgateway created
service/istio-ingressgateway created
service/grafana created
service/istio-policy created
service/istio-telemetry created
service/istio-statsd-prom-bridge created
deployment.extensions/istio-statsd-prom-bridge created
service/istio-pilot created
service/prometheus created
service/istio-citadel created
service/servicegraph created
service/istio-sidecar-injector created
deployment.extensions/istio-galley created
deployment.extensions/istio-egressgateway created
deployment.extensions/istio-ingressgateway created
deployment.extensions/grafana created
deployment.extensions/istio-policy created
deployment.extensions/istio-telemetry created
deployment.extensions/istio-pilot created
deployment.extensions/prometheus created
deployment.extensions/istio-citadel created
deployment.extensions/servicegraph created
deployment.extensions/istio-sidecar-injector created
deployment.extensions/istio-tracing created
gateway.networking.istio.io/istio-autogenerated-k8s-ingress created
horizontalpodautoscaler.autoscaling/istio-egressgateway created
horizontalpodautoscaler.autoscaling/istio-ingressgateway created
horizontalpodautoscaler.autoscaling/istio-policy created
horizontalpodautoscaler.autoscaling/istio-telemetry created
horizontalpodautoscaler.autoscaling/istio-pilot created
service/jaeger-query created
service/jaeger-collector created
service/jaeger-agent created
service/zipkin created
service/tracing created
mutatingwebhookconfiguration.admissionregistration.k8s.io/istio-sidecar-injector created
attributemanifest.config.istio.io/istioproxy created
attributemanifest.config.istio.io/kubernetes created
stdio.config.istio.io/handler created
logentry.config.istio.io/accesslog created
logentry.config.istio.io/tcpaccesslog created
rule.config.istio.io/stdio created
rule.config.istio.io/stdiotcp created
metric.config.istio.io/requestcount created
metric.config.istio.io/requestduration created
metric.config.istio.io/requestsize created
metric.config.istio.io/responsesize created
metric.config.istio.io/tcpbytesent created
metric.config.istio.io/tcpbytereceived created
prometheus.config.istio.io/handler created
rule.config.istio.io/promhttp created
rule.config.istio.io/promtcp created
kubernetesenv.config.istio.io/handler created
rule.config.istio.io/kubeattrgenrulerule created
rule.config.istio.io/tcpkubeattrgenrulerule created
kubernetes.config.istio.io/attributes created
destinationrule.networking.istio.io/istio-policy created
destinationrule.networking.istio.io/istio-telemetry created

3、确认部署结果

kubectl get svc -n istio-system
NAME                       TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                                                                   AGE
grafana                    ClusterIP      10.98.226.135    <none>        3000/TCP                                                                                                                  14m
istio-citadel              ClusterIP      10.99.152.16     <none>        8060/TCP,9093/TCP                                                                                                         14m
istio-egressgateway        ClusterIP      10.109.110.204   <none>        80/TCP,443/TCP                                                                                                            14m
istio-galley               ClusterIP      10.105.148.245   <none>        443/TCP,9093/TCP                                                                                                          14m
istio-ingressgateway       LoadBalancer   10.110.234.85    <pending>     80:31380/TCP,443:31390/TCP,31400:31400/TCP,15011:32540/TCP,8060:32644/TCP,853:31602/TCP,15030:31229/TCP,15031:30435/TCP   14m
istio-pilot                ClusterIP      10.96.11.234     <none>        15010/TCP,15011/TCP,8080/TCP,9093/TCP                                                                                     14m
istio-policy               ClusterIP      10.100.71.18     <none>        9091/TCP,15004/TCP,9093/TCP                                                                                               14m
istio-sidecar-injector     ClusterIP      10.109.107.20    <none>        443/TCP                                                                                                                   14m
istio-statsd-prom-bridge   ClusterIP      10.100.33.112    <none>        9102/TCP,9125/UDP                                                                                                         14m
istio-telemetry            ClusterIP      10.98.115.225    <none>        9091/TCP,15004/TCP,9093/TCP,42422/TCP                                                                                     14m
jaeger-agent               ClusterIP      None             <none>        5775/UDP,6831/UDP,6832/UDP                                                                                                14m
jaeger-collector           ClusterIP      10.96.244.91     <none>        14267/TCP,14268/TCP                                                                                                       14m
jaeger-query               ClusterIP      10.106.138.221   <none>        16686/TCP                                                                                                                 14m
prometheus                 ClusterIP      10.101.104.212   <none>        9090/TCP                                                                                                                  14m
servicegraph               ClusterIP      10.111.125.65    <none>        8088/TCP                                                                                                                  14m
tracing                    ClusterIP      10.104.13.235    <none>        80/TCP                                                                                                                    14m
zipkin                     ClusterIP      10.98.177.38     <none>        9411/TCP                                                                                                                  14m
 

kubectl get pods -n istio-system
NAME                                        READY     STATUS      RESTARTS   AGE
grafana-85dbf49c94-bmcb5                    1/1       Running     0          15m
istio-citadel-545f49c58b-g5v27              1/1       Running     0          15m
istio-cleanup-secrets-96qbw                 0/1       Completed   0          15m
istio-egressgateway-7d59954f4-vsnhq         1/1       Running     0          15m
istio-galley-5b6449c48f-stkcc               1/1       Running     0          15m
istio-grafana-post-install-9grwq            0/1       Completed   0          15m
istio-ingressgateway-8455c8c6f7-t2v6z       1/1       Running     0          15m
istio-pilot-58ff4d6647-c26hq                2/2       Running     0          15m
istio-policy-59685fd869-2nvkk               2/2       Running     0          15m
istio-security-post-install-2w4kc           0/1       Completed   0          15m
istio-sidecar-injector-75b9866679-w7xlq     1/1       Running     0          15m
istio-statsd-prom-bridge-549d687fd9-bxl2w   1/1       Running     0          15m
istio-telemetry-6ccf9ddb96-pr25q            2/2       Running     0          15m
istio-tracing-7596597bd7-cnlmv              1/1       Running     0          15m
prometheus-6ffc56584f-zz9tg                 1/1       Running     0          15m
servicegraph-5d64b457b4-xslxv               1/1       Running     0          15m