istio-traffic-management

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Istio Traffic Management

Istio流量管理

Comprehensive guide to Istio traffic management for production service mesh deployments.

面向生产环境服务网格部署的Istio流量管理综合指南。

When to Use This Skill

何时使用该技能

Configuring service-to-service routing
Implementing canary or blue-green deployments
Setting up circuit breakers and retries
Load balancing configuration
Traffic mirroring for testing
Fault injection for chaos engineering

配置服务间路由
实现金丝雀发布或蓝绿部署
设置断路器与重试机制
负载均衡配置
用于测试的流量镜像
混沌工程中的故障注入

Core Concepts

核心概念

1. Traffic Management Resources

1. 流量管理资源

Resource	Purpose	Scope
VirtualService	Route traffic to destinations	Host-based
DestinationRule	Define policies after routing	Service-based
Gateway	Configure ingress/egress	Cluster edge
ServiceEntry	Add external services	Mesh-wide

资源名称	用途	作用范围
VirtualService	将流量路由至目标服务	基于主机
DestinationRule	定义路由后的策略	基于服务
Gateway	配置入口/出口流量	集群边缘
ServiceEntry	添加外部服务至网格	全网格范围

2. Traffic Flow

2. 流量流向

Client → Gateway → VirtualService → DestinationRule → Service
                   (routing)        (policies)        (pods)

Client → Gateway → VirtualService → DestinationRule → Service
                   (路由)        (策略)        (Pod实例)

Templates

模板

Template 1: Basic Routing

模板1：基础路由

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews-route
  namespace: bookinfo
spec:
  hosts:
    - reviews
  http:
    - match:
        - headers:
            end-user:
              exact: jason
      route:
        - destination:
            host: reviews
            subset: v2
    - route:
        - destination:
            host: reviews
            subset: v1
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews-destination
  namespace: bookinfo
spec:
  host: reviews
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2
    - name: v3
      labels:
        version: v3

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews-route
  namespace: bookinfo
spec:
  hosts:
    - reviews
  http:
    - match:
        - headers:
            end-user:
              exact: jason
      route:
        - destination:
            host: reviews
            subset: v2
    - route:
        - destination:
            host: reviews
            subset: v1
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews-destination
  namespace: bookinfo
spec:
  host: reviews
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2
    - name: v3
      labels:
        version: v3

Template 2: Canary Deployment

模板2：金丝雀发布

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-service-canary
spec:
  hosts:
    - my-service
  http:
    - route:
        - destination:
            host: my-service
            subset: stable
          weight: 90
        - destination:
            host: my-service
            subset: canary
          weight: 10
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: my-service-dr
spec:
  host: my-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        h2UpgradePolicy: UPGRADE
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
  subsets:
    - name: stable
      labels:
        version: stable
    - name: canary
      labels:
        version: canary

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-service-canary
spec:
  hosts:
    - my-service
  http:
    - route:
        - destination:
            host: my-service
            subset: stable
          weight: 90
        - destination:
            host: my-service
            subset: canary
          weight: 10
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: my-service-dr
spec:
  host: my-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        h2UpgradePolicy: UPGRADE
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
  subsets:
    - name: stable
      labels:
        version: stable
    - name: canary
      labels:
        version: canary

Template 3: Circuit Breaker

模板3：断路器

yaml

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: circuit-breaker
spec:
  host: my-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
        maxRequestsPerConnection: 10
        maxRetries: 3
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
      minHealthPercent: 30

yaml

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: circuit-breaker
spec:
  host: my-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
        maxRequestsPerConnection: 10
        maxRetries: 3
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
      minHealthPercent: 30

Template 4: Retry and Timeout

模板4：重试与超时

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: ratings-retry
spec:
  hosts:
    - ratings
  http:
    - route:
        - destination:
            host: ratings
      timeout: 10s
      retries:
        attempts: 3
        perTryTimeout: 3s
        retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503
        retryRemoteLocalities: true

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: ratings-retry
spec:
  hosts:
    - ratings
  http:
    - route:
        - destination:
            host: ratings
      timeout: 10s
      retries:
        attempts: 3
        perTryTimeout: 3s
        retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503
        retryRemoteLocalities: true

Template 5: Traffic Mirroring

模板5：流量镜像

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: mirror-traffic
spec:
  hosts:
    - my-service
  http:
    - route:
        - destination:
            host: my-service
            subset: v1
      mirror:
        host: my-service
        subset: v2
      mirrorPercentage:
        value: 100.0

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: mirror-traffic
spec:
  hosts:
    - my-service
  http:
    - route:
        - destination:
            host: my-service
            subset: v1
      mirror:
        host: my-service
        subset: v2
      mirrorPercentage:
        value: 100.0

Template 6: Fault Injection

模板6：故障注入

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: fault-injection
spec:
  hosts:
    - ratings
  http:
    - fault:
        delay:
          percentage:
            value: 10
          fixedDelay: 5s
        abort:
          percentage:
            value: 5
          httpStatus: 503
      route:
        - destination:
            host: ratings

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: fault-injection
spec:
  hosts:
    - ratings
  http:
    - fault:
        delay:
          percentage:
            value: 10
          fixedDelay: 5s
        abort:
          percentage:
            value: 5
          httpStatus: 503
      route:
        - destination:
            host: ratings

Template 7: Ingress Gateway

模板7：入口网关

yaml

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: my-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: my-tls-secret
      hosts:
        - "*.example.com"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-vs
spec:
  hosts:
    - "api.example.com"
  gateways:
    - my-gateway
  http:
    - match:
        - uri:
            prefix: /api/v1
      route:
        - destination:
            host: api-service
            port:
              number: 8080

yaml

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: my-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: my-tls-secret
      hosts:
        - "*.example.com"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-vs
spec:
  hosts:
    - "api.example.com"
  gateways:
    - my-gateway
  http:
    - match:
        - uri:
            prefix: /api/v1
      route:
        - destination:
            host: api-service
            port:
              number: 8080

Load Balancing Strategies

负载均衡策略

yaml

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: load-balancing
spec:
  host: my-service
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH
---

yaml

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: load-balancing
spec:
  host: my-service
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH
---

Consistent hashing for sticky sessions

会话一致性哈希（粘性会话）

apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: sticky-sessions spec: host: my-service trafficPolicy: loadBalancer: consistentHash: httpHeaderName: x-user-id # or: httpCookie, useSourceIp, httpQueryParameterName

undefined

undefined

Best Practices

最佳实践

Do's

建议做法

Start simple - Add complexity incrementally
Use subsets - Version your services clearly
Set timeouts - Always configure reasonable timeouts
Enable retries - But with backoff and limits
Monitor - Use Kiali and Jaeger for visibility

从简入手 - 逐步增加复杂度
使用子集 - 清晰标记服务版本
设置超时 - 始终配置合理的超时时间
启用重试 - 但需设置退避机制与限制
监控 - 使用Kiali和Jaeger实现可视化

Don'ts

避免做法

Don't over-retry - Can cause cascading failures
Don't ignore outlier detection - Enable circuit breakers
Don't mirror to production - Mirror to test environments
Don't skip canary - Test with small traffic percentage first

不要过度重试 - 可能导致级联故障
不要忽略异常实例检测 - 启用断路器
不要向生产环境镜像流量 - 镜像至测试环境
不要跳过金丝雀发布 - 先使用小流量比例测试

Debugging Commands

调试命令

bash

undefined

bash

undefined

Check VirtualService configuration

检查VirtualService配置

istioctl analyze

View effective routes

查看生效的路由规则

istioctl proxy-config routes deploy/my-app -o json

Check endpoint discovery

检查端点发现情况

istioctl proxy-config endpoints deploy/my-app

Debug traffic

调试流量

istioctl proxy-config log deploy/my-app --level debug

undefined

istioctl proxy-config log deploy/my-app --level debug

undefined

istio-traffic-management

Original

Translation

Istio Traffic Management

Istio流量管理

When to Use This Skill

何时使用该技能

Core Concepts

核心概念

1. Traffic Management Resources

1. 流量管理资源

2. Traffic Flow

2. 流量流向

Templates

模板

Template 1: Basic Routing

模板1：基础路由

Template 2: Canary Deployment

模板2：金丝雀发布

Template 3: Circuit Breaker

模板3：断路器

Template 4: Retry and Timeout

模板4：重试与超时

Template 5: Traffic Mirroring

模板5：流量镜像

Template 6: Fault Injection

模板6：故障注入

Template 7: Ingress Gateway

模板7：入口网关

Load Balancing Strategies

负载均衡策略

Consistent hashing for sticky sessions

会话一致性哈希（粘性会话）

Best Practices

最佳实践

Do's

建议做法

Don'ts

避免做法

Debugging Commands

调试命令

Check VirtualService configuration

检查VirtualService配置

View effective routes

查看生效的路由规则

Check endpoint discovery

检查端点发现情况

Debug traffic

调试流量

Resources

参考资源