Istio 服务网格面试题库

graph LR
    A[用户创建 VS/DR] --> B[Istiod 控制平面]
    B --> C[Pilot: 路由规则翻译]
    B --> D[Citadel: 证书签发]
    B --> E[Galley: 配置验证]
    C --> F[xDS 推送]
    D --> F
    E --> F
    F --> G[Envoy Sidecar]
    G --> H[流量路由转发]
    G --> I[mTLS 身份验证]
    G --> J[遥测数据采集]
    G --> K[授权策略执行]

graph LR
    A[用户创建 Pod] --> B[Admission Controller 链处理]
    B --> C[Istio Mutating Webhook 拦截]
    C --> D[Istiod 检查命名空间/Pod 标签]
    D --> E[决策并读取 injector ConfigMap]
    E --> F[变更 Pod Spec]
    F --> F1[添加 istio-init Init 容器<br/>iptables 规则]
    F --> F2[添加 istio-proxy 主容器<br/>Envoy]
    F --> F3[添加关联 Volume<br/>SDS 套接字/网格配置]
    F1 --> G[变更后的 Pod Spec 写入 etcd]
    F2 --> G
    F3 --> G
    G --> H[Pod 调度到节点<br/>Init 容器执行 iptables]
    H --> I[Envoy Sidecar 启动<br/>连接 Istiod 获取 xDS]

# 检查 Pod 是否 2/2 Ready
kubectl get pods -n default

# 查看注入事件
kubectl describe pod <pod-name>
# 预期看到：Created container istio-init, Created container istio-proxy

graph LR
    subgraph 客户端Pod
        A[应用容器 A<br/>port 8080] --> B[Envoy Sidecar<br/>inbound]
    end
    subgraph 服务端Pod
        C[Envoy Sidecar<br/>outbound] --> D[应用容器 B<br/>port 8080]
    end
    B -->|mTLS 加密| C
    B -.-> E[iptables 规则集]
    C -.-> F[iptables 规则集]

graph LR
    A[Pod 创建 → Envoy 启动] --> B[Envoy 通过 gRPC 连接 Istiod]
    B --> C[Istiod 推送初始配置]
    C --> D1[LDS: 监听器定义]
    C --> D2[CDS: 集群定义]
    C --> D3[RDS: 路由规则]
    C --> D4[EDS: 端点列表]
    C --> D5[SDS: TLS 证书与私钥]
    D1 --> E[Envoy 建立连接池并开始转发]
    D2 --> E
    D3 --> E
    D4 --> E
    D5 --> E
    E --> F[配置变更 → Istiod 推送增量更新]

graph LR
    A[Waypoint Proxy<br/>可选，每命名空间共享<br/>L7 策略、流量管理] -->|HBONE 隧道| B[ztunnel 节点代理<br/>eBPF/iptables 流量拦截<br/>L4 安全策略、mTLS 加密]
    B --> C[应用 Pod<br/>无 Sidecar<br/>无需修改、无额外资源消耗]

# 注入决策伪代码
if sidecar.istio.io/inject == "false" or istio-injection == "disabled":
    return 不注入
if istio-injection == "enabled" or sidecar.istio.io/inject == "true" or istio.io/rev 存在:
    return 注入
if enableNamespacesByDefault == true:
    return 注入
return 不注入

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    metadata:
      annotations:
        sidecar.istio.io/proxyCPU: "100m"
        sidecar.istio.io/proxyCPULimit: "500m"
        sidecar.istio.io/proxyMemory: "128Mi"
        sidecar.istio.io/proxyMemoryLimit: "256Mi"
    spec:
      containers:
      - name: istio-proxy
        image: auto  # 自动选择匹配版本的 Sidecar 镜像
        env:
        - name: ISTIO_META_HTTP10
          value: "1"

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    sidecarInjectorWebhook:
      templates:
        custom: |
          spec:
            containers:
            - name: istio-proxy
              env:
              - name: CUSTOM_ENV
                value: custom-value          

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: custom-filter
  namespace: istio-system
spec:
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.lua
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
          inlineCode: |
            function envoy_on_request(request_handle)
              request_handle:headers():add("x-custom", "true")
            end            

apiVersion: networking.istio.io/v1beta1
kind: ProxyConfig
metadata:
  name: custom-proxy-config
  namespace: default
spec:
  selector:
    matchLabels:
      app: my-service
  concurrency: 2
  image:
    imageType: distroless
  environmentVariables:
    ENVOY_LOG_LEVEL: warning

graph TD
    subgraph 传统模式
        T1["Pod 启动"] --> T2["Init 容器运行"]
        T2 --> T3["iptables 设置"]
        T2 --> T4["需 NET_ADMIN"]
        T2 --> T5["需特权模式"]
        T3 --> T6["业务容器 + Envoy 启动"]
        T4 --> T6
        T5 --> T6
    end
    subgraph Istio CNI 模式
        C1["Pod 启动"] --> C2["CNI 插件配置网络"]
        C2 --> C3["iptables 设置<br/>节点级执行 / 无需特权"]
        C3 --> C4["业务容器 + Envoy 启动"]
    end

graph LR
    A[1. K8s Scheduler 将 Pod 分配到节点] --> B[2. 节点 kubelet 调用 CNI 插件链]
    B --> C[3. Istio CNI DaemonSet 处理 REDIRECT 规则]
    C --> D[4. Pod 网络命名空间配置 iptables 规则]
    D --> E[5. 业务容器启动<br/>流量通过 iptables 指向 Envoy]
    E --> F[6. Envoy Sidecar 容器启动<br/>无 Init 容器]

# IstioOperator 启用 CNI
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    cni:
      enabled: true
  values:
    cni:
      cniBinDir: /opt/cni/bin
      cniConfDir: /etc/cni/net.d
      chained: true
      privileged: false

graph LR
    A[客户端请求] --> B[ingressgateway/sidecar]
    B --> C[VirtualService 路由决策]
    C --> C1[匹配 header/URI/weight]
    C --> C2[选择 destination.host + subset]
    C --> C3[应用 retry/timeout/fault]
    C1 --> D[DestinationRule 策略执行]
    C2 --> D
    C3 --> D
    D --> D1[负载均衡算法]
    D --> D2[连接池配置]
    D --> D3[熔断与异常检测]
    D --> D4[TLS 设置]
    D1 --> E[目标 Pod]
    D2 --> E
    D3 --> E
    D4 --> E

# VirtualService：定义路由规则
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
  - reviews
  http:
  - match:
    - headers:
        end-user:
          exact: jason
    route:
    - destination:
        host: reviews
        subset: v2
  - route:
    - destination:
        host: reviews
        subset: v1
      weight: 80
    - destination:
        host: reviews
        subset: v3
      weight: 20
# DestinationRule：定义负载均衡和子集
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  trafficPolicy:
    loadBalancer:
      simple: LEAST_REQUEST
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        http1MaxPendingRequests: 10
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
  - name: v3
    labels:
      version: v3
    trafficPolicy:
      loadBalancer:
        simple: ROUND_ROBIN

# 入口网关：接收外部流量进入网格
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    istio: ingressgateway  # 选择 istio-ingressgateway Deployment
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "httpbin.example.com"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: httpbin-cert
    hosts:
    - "httpbin.example.com"
# 将 Gateway 与 VirtualService 绑定
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: httpbin
spec:
  gateways:  # 绑定到 ingressgateway
  - httpbin-gateway
  - mesh      # mesh 代表网格内部路由
  hosts:
  - "httpbin.example.com"
  http:
  - match:
    - uri:
        prefix: /status
    route:
    - destination:
        host: httpbin
        port:
          number: 8000

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: istio-egressgateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 443
      name: tls
      protocol: TLS
    hosts:
    - "*.external-api.com"
# 路由到出口网关
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: external-route
spec:
  hosts:
  - "api.external.com"
  gateways:
  - mesh  # 网格内部流量
  http:
  - match:
    - port: 443
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: egressgateway-for-external
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: my-service-circuit-breaker
spec:
  host: my-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100          # 后端最大 TCP 连接数
        connectTimeout: 30ms         # 连接超时
      http:
        http1MaxPendingRequests: 10  # HTTP/1.1 最大等待请求
        http2MaxRequests: 1000       # HTTP/2 最大并发请求
        maxRequestsPerConnection: 10 # 每连接最大请求数后关闭
    outlierDetection:
      consecutive5xxErrors: 5        # 连续 5 次 5xx 触发驱逐
      interval: 30s                  # 检测间隔
      baseEjectionTime: 30s          # 基础驱逐持续时间
      maxEjectionPercent: 50         # 最多驱逐 50% 端点
      minHealthPercent: 25           # 健康实例占比不低于 25%
      consecutiveGatewayErrors: 5    # 连续网关错误次数
      consecutiveLocalOriginFailures: 5  # 本地错误（连接失败）
      splitExternalLocalOriginErrors: true  # 区分外部与本地错误

graph LR
    A[正常状态] -->|连续错误| B[连续错误计数 +1<br/>5xx/超时/连接失败]
    B --> C[达到阈值<br/>consecutive5xxErrors=5]
    C --> D[弹回 Ejection<br/>端点从负载均衡池移除]
    D --> E[弹回时间到达<br/>端点重新加入]
    E --> F{健康检查}
    F -->|通过| G[恢复正常]
    F -->|失败| H[重新弹回<br/>倍增时间 30s → 60s → 120s]
    H --> D

graph LR
    A[请求到达 Sidecar] --> B[连接池资源检查]
    B --> C{TCP 连接数 <br/>maxConnections?}
    C -->|否| D[拒绝 503]
    C -->|是| E{HTTP 请求数 <br/>maxPendingRequests?}
    E -->|否| D
    E -->|是| F{目标端点是否<br/>被弹回 ejected?}
    F -->|是| G[跳过该端点<br/>选择其他端点]
    F -->|否| H{健康端点比例 ><br/>minHealthPercent?}
    H -->|否| I[熔断整个集群]
    H -->|是| J[转发请求]

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-api
spec:
  hosts:
  - "api.external.com"
  - "*.backup.external.com"
  addresses:
  - 192.0.2.0/24  # CIDR 或 IP
  ports:
  - number: 443
    name: https
    protocol: TLS
  - number: 80
    name: http
    protocol: HTTP
  location: MESH_EXTERNAL      # 或 MESH_INTERNAL
  resolution: DNS              # DNS/STATIC/NONE
  endpoints:
  - address: 203.0.113.1      # STATIC 模式时指定
    ports:
      https: 8443
    labels:
      version: v1
  - address: 203.0.113.2
    labels:
      version: v2

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: external-api-routing
spec:
  hosts:
  - "api.external.com"
  http:
  - timeout: 5s
    retries:
      attempts: 3
      perTryTimeout: 2s
    route:
    - destination:
        host: "api.external.com"
      weight: 90
    - destination:
        host: "api.external.com"
        subset: v2
      weight: 10
  - match:
    - uri:
        prefix: /health
    timeout: 2s
    route:
    - destination:
        host: "api.external.com"
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: external-api-circuit-breaker
spec:
  host: "api.external.com"
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 50
    outlierDetection:
      consecutive5xxErrors: 3
      interval: 10s
      baseEjectionTime: 30s

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: locality-lb
spec:
  host: my-service
  trafficPolicy:
    loadBalancer:
      localityLbSetting:
        enabled: true                    # 启用区域感知
        distribute:                      # 显式分布配置
        - from: us-east/zone1/*
          to:
            "us-east/zone1/*": 70
            "us-east/zone2/*": 20
            "us-west/*": 10
        failover:                        # 故障转移配置
        - from: us-east
          to: us-west
# 或简单启用
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: locality-lb-simple
spec:
  host: my-service
  trafficPolicy:
    loadBalancer:
      localityLbSetting:
        enabled: true

graph LR
    A[本地区域实例可用] -->|100% 路由到本地| B[最低延迟]
    A -->|本地实例部分故障| C[健康实例继续接收本地区域流量]
    C -->|本地实例全量故障| D[故障转移到同一区域其他可用区]
    D -->|本地区域全量故障| E[故障转移到最近区域<br/>如 us-west]

graph LR
    subgraph Cluster A [us-east-1]
        A1[Pod1 zone1]
        A2[Pod2 zone2]
        A3[Pod3 zone3]
    end
    subgraph Cluster B [us-west-2]
        B1[Pod3 zone1]
        B2[Pod4 zone2]
    end
    S[Service my-service<br/>locality us-east-1/zone1]
    A1 -->|70% 本地优先级| S
    A2 -->|70% 本地优先级| S
    A3 -->|70% 本地优先级| S
    B1 -.->|30%| S
    B2 -.->|30%| S

graph LR
    A[同一 Pod<br/>N/A Sidecar 与容器同节点] --> B[同一节点]
    B --> C[同一可用区 Zone]
    C --> D[同一区域 Region]
    D --> E[全局 Cross-Region]

graph LR
    Client[客户端] -->|HTTP Request<br/>x-request-id| PP[ProductPage]
    PP -->|Downstream Span<br/>x-request-id / x-b3-traceid / x-b3-spanid| Rev[Reviews]
    Rev -->|Downstream Span<br/>x-request-id / x-b3-traceid| Det[Details]
    Det -->|Response| Rev
    Rev -->|Response| PP
    PP -->|Response| Client
    Client -.-> Backend[Jaeger / Zipkin / SkyWalking / OpenTelemetry Collector]
    PP -.-> Backend
    Rev -.-> Backend
    Det -.-> Backend

{"name": "HTTP GET /reviews/1",         // Span 名称
 "trace_id": "a1b2c3d4e5f6...",        // 追踪 ID
 "span_id": "1234567890abcdef",        // Span ID
 "parent_span_id": "fedcba0987654321", // 父 Span ID
 "start_time": "2024-01-01T00:00:00Z", // 开始时间
 "duration": 150000000,                // 持续时间（纳秒）
 "tags": {
   "upstream_cluster": "outbound|9080||reviews.default.svc.cluster.local",
   "http.url": "/reviews/1",
   "http.method": "GET",
   "http.status_code": "200",
   "peer.service": "reviews.default.svc.cluster.local",
   "request_size": "0",
   "response_size": "375",
   "component": "envoy"
 }}

apiVersion: telemetry.istio.io/v1
kind: Telemetry
metadata:
  name: tracing-default
  namespace: istio-system
spec:
  tracing:
  - providers:
    - name: zipkin
    randomSamplingPercentage: 1.0    # 1% 采样率
    customTags:
      service.version:
        literal:
          value: "1.0.0"
apiVersion: telemetry.istio.io/v1
kind: Telemetry
metadata:
  name: tracing-high-sampling
  namespace: prod-critical
spec:
  tracing:
  - providers:
    - name: opentelemetry
    randomSamplingPercentage: 100.0  # 关键服务 100% 采样
    customTags:
      environment:
        literal:
          value: "production"

apiVersion: telemetry.istio.io/v1
kind: Telemetry
metadata:
  name: mesh-default
  namespace: istio-system
spec:
  # 指标配置
  metrics:
  - providers:
    - name: prometheus
    overrides:
    - match:
        metric: REQUEST_COUNT
      mode: CLIENT_AND_SERVER  # 客户端/服务端双方都记录
      tagOverrides:
        destination_port:
          value: "server_port"       # 覆盖默认标签值
        request_protocol:
          operation: REMOVE          # 移除标签减少基数
    - match:
        metric: ALL_METRICS
        mode: SERVER                 # 仅服务端记录
  # 访问日志配置
  accessLogging:
  - providers:
    - name: envoy
    match:
      mode: CLIENT_AND_SERVER
    filter:
      expression: response.code >= 400  # 仅记录 4xx/5xx
  # 追踪配置
  tracing:
  - providers:
    - name: zipkin
    randomSamplingPercentage: 10.0
    customTags:
      environment:
        literal:
          value: production
      mesh_version:
        header:
          name: x-mesh-version

# 自定义指标标签
apiVersion: telemetry.istio.io/v1
kind: Telemetry
metadata:
  name: custom-metrics
  namespace: bookinfo
spec:
  metrics:
  - overrides:
    - match:
        metric: REQUEST_COUNT
      tagOverrides:
        # 使用请求头中的 x-version 值作为指标标签
        service_version:
          header:
            name: x-version
            defaultValue: "unknown"
        # 移除不必要的标签降低基数
        source_principal:
          operation: REMOVE
        destination_principal:
          operation: REMOVE

# 访问日志输出到 stdout
apiVersion: telemetry.istio.io/v1
kind: Telemetry
metadata:
  name: access-log
spec:
  accessLogging:
  - providers:
    - name: envoy
    match:
      mode: CLIENT_AND_SERVER  # 同时记录客户端和服务端日志
    # 默认所有请求都记录，可通过 expression 过滤
# 使用 OpenTelemetry Collector 输出
apiVersion: telemetry.istio.io/v1
kind: Telemetry
metadata:
  name: otel-logging
spec:
  accessLogging:
  - providers:
    - name: opentelemetry
    filter:
      expression: response.code >= 500

graph LR
    subgraph 客户端 Sidecar
        C[Envoy 客户端侧]
    end
    subgraph 服务端 Sidecar
        S[Envoy 服务端侧]
    end
    C -->|1. TCP 连接建立| S
    C -->|2. TLS ClientHello| S
    S -->|3. TLS ServerHello + 服务端证书| C
    C -->|4. 验证服务端证书 CA + 安全命名| S
    C -->|5. 客户端证书 + 证书验证消息| S
    S -->|6. 验证完成 mTLS 连接建立| C
    C -->|7. HTTP/gRPC 请求 加密| S
    S -->|8. 服务端 Envoy 执行授权策略<br/>验证通过后转发给应用容器| C

# Mesh 级别：全网格 STRICT 模式
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT
# 命名空间级别覆盖
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: legacy
spec:
  mtls:
    mode: PERMISSIVE  # 允许明文和 mTLS 并存
# 工作负载级别 + 按端口覆盖
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: monitoring-port
  namespace: monitoring
spec:
  selector:
    matchLabels:
      app: prometheus
  mtls:
    mode: STRICT
  portLevelMtls:
    9090:
      mode: DISABLE  # Prometheus 原生 scrape 不需要 mTLS

graph LR
    A[Mesh 级别<br/>istio-system 空 selector<br/>全局默认] --> B[命名空间级别<br/>非 root namespace 空 selector]
    B --> C[工作负载级别<br/>非空 selector<br/>最优先]

graph LR
    A[阶段 1: 全部 PERMISSIVE<br/>安装 Istio Sidecar<br/>服务端同时接受 mTLS 和明文<br/>不影响已有客户端] --> B[阶段 2: 逐个服务切换到 STRICT<br/>确认所有客户端都有 Sidecar<br/>使用 Kiali 验证 mTLS 状态]
    B --> C[阶段 3: 全局 STRICT<br/>PeerAuthentication istio-system → STRICT<br/>全网格零信任]

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin-policy
  namespace: default
spec:
  selector:            # 目标选择
    matchLabels:
      app: httpbin
  action: ALLOW        # ALLOW/DENY/CUSTOM
  rules:
  - from:              # 请求来源
    - source:
        principals: ["cluster.local/ns/default/sa/sleep"]
        namespaces: ["default"]
        ipBlocks: ["10.0.0.0/8"]
        requestPrincipals: ["*"]
    to:                # 操作目标
    - operation:
        methods: ["GET", "POST"]
        paths: ["/status/*"]
        ports: ["8080"]
        hosts: ["httpbin.default.svc.cluster.local"]
    when:              # 附加条件
    - key: request.headers[X-Version]
      values: ["v1", "v2"]
    - key: source.ip
      values: ["10.0.0.0/8"]

graph LR
    A[请求到达 Sidecar] --> B[CUSTOM 策略评估]
    B -->|匹配 返回 DENY| C[请求被拒绝]
    B -->|不匹配| D[DENY 策略评估]
    D -->|匹配 不受后续策略影响| C
    D -->|不匹配| E[ALLOW 策略评估]
    E -->|无 ALLOW 策略| F[默认拒绝]
    E -->|有 ALLOW 且匹配| G[允许]
    E -->|有 ALLOW 但不匹配| F
    E -->|DENY 优先| C

# 默认拒绝所有（仅白名单模式）
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-nothing
  namespace: default
spec: {}  # 无 rules → 拒绝所有请求（需要其他 ALLOW 策略才放行）
# 强制 JWT 认证
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
spec:
  selector:
    matchLabels:
      app: secure-service
  action: ALLOW
  rules:
  - from:
    - source:
        requestPrincipals: ["*"]  # 必须有有效的 JWT principal
    when:
    - key: request.auth.claims[iss]
      values: ["https://auth.example.com"]
# 紧急拒绝（DENY 覆盖所有 ALLOW）
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: emergency-block
spec:
  action: DENY
  rules:
  - from:
    - source:
        ipBlocks: ["192.168.1.0/24"]
# 按命名空间隔离
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: namespace-isolation
  namespace: production
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        namespaces: ["production", "istio-system"]

graph LR
    A[Pod 启动 → Envoy Sidecar 启动] --> B[Istio Agent pilot-agent<br/>生成私钥 + CSR]
    B --> C[CSR 通过 gRPC 发送到 Istiod]
    C --> D[请求含 K8s Service Account Token]
    C --> E[目标身份<br/>spiffe://cluster.local/ns/.../sa/...]
    D --> F[Istiod Citadel CA 验证凭证]
    E --> F
    F --> G[通过 TokenReview API 验证 SA Token]
    F --> H[验证通过后使用 CA 证书签名 CSR]
    G --> I[签发的 X.509 证书返回给 Istio Agent]
    H --> I
    I --> J[SDS API 下发证书到 Envoy]
    J --> K[Envoy 使用证书进行 mTLS 通信]
    K --> L[Istio Agent 监控证书过期时间]
    L --> L1[默认有效期 24 小时]
    L --> L2[轮换触发: 剩余 80% 有效期]
    L --> L3[SDS 热更新新证书 Envoy 无需重启]

graph LR
    A["spiffe://trust-domain/ns/namespace/sa/service-account"] --> B["cluster.local"]
    A --> C["default"]
    A --> D["httpbin"]

graph TD
    subgraph 传统方式
        T1["证书文件挂载到容器"] --> T2["证书过期需要重启"]
        T1 --> T3["挂载延迟可能导致启动失败"]
        T1 --> T4["文件系统权限管理复杂"]
    end
    subgraph Istio SDS
        S1["SDS gRPC 流式推送"] --> S2["证书过期自动轮换"]
        S1 --> S3["启动即可获取证书"]
        S1 --> S4["无需文件系统访问"]
    end

# 使用自定义根证书
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    defaultConfig:
      proxyMetadata:
        ISTIO_META_CERT_SIGNER: custom-ca
  values:
    global:
      caAddress: custom-ca.istio-system:433  # 外部 CA 地址
# 集成 SPIRE
apiVersion: spiffeid.spiffe.io/v1beta1
kind: ClusterSPIFFEID
metadata:
  name: istio-workload
spec:
  spiffeIDTemplate: "spiffe://example.org/ns/XQOPEN.PodMetadata.NamespaceXQCLOSE/sa/XQOPEN.PodMetadata.ServiceAccountXQCLOSE"
  workloadSelectorTemplates:
  - "k8s:ns:XQOPEN.PodMetadata.NamespaceXQCLOSE"
  - "k8s:sa:XQOPEN.PodMetadata.ServiceAccountXQCLOSE"

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-auth
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
  - issuer: "https://accounts.example.com"
    audiences:
    - "my-service"
    jwksUri: "https://accounts.example.com/.well-known/jwks.json"
    # 或直接内嵌 JWKS
    # jwks: |
    #   {"keys": [{"kty": "RSA", "n": "...", "e": "AQAB"}]}
    fromHeaders:
    - name: Authorization
      prefix: "Bearer "
    fromParams:
    - "access_token"            # 也支持 URL 参数传递
    forwardOriginalToken: true   # 将原始 JWT 转发给后端
    outputPayloadToHeader: x-jwt-payload  # 将 payload 输出到请求头
  - issuer: "https://auth.backup.com"
    jwksUri: "https://auth.backup.com/.well-known/jwks.json"
# 命名空间级别：要求所有服务验证 JWT
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-auth-all
  namespace: default
spec:
  jwtRules:
  - issuer: "https://accounts.example.com"
    jwksUri: "https://accounts.example.com/.well-known/jwks.json"
  # 空 selector 表示应用到命名空间所有工作负载

# 要求所有请求都携带有效 JWT
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
  namespace: default
spec:
  selector:
    matchLabels:
      app: secure-service
  action: ALLOW
  rules:
  - from:
    - source:
        requestPrincipals: ["*"]  # 必须有 JWT 身份
# 按角色细粒度授权
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: role-based-access
spec:
  selector:
    matchLabels:
      app: backend
  action: ALLOW
  rules:
  - from:
    - source:
        requestPrincipals: ["*"]
    when:
    - key: request.auth.claims[role]
      values: ["admin"]
    to:
    - operation:
        methods: ["DELETE", "PUT", "POST"]
    - operation:
        methods: ["GET"]
      when:
      - key: request.auth.claims[role]
        values: ["admin", "viewer"]
# 放行健康检查路径（不需要 JWT）
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: health-check-exception
spec:
  selector:
    matchLabels:
      app: backend
  action: ALLOW
  rules:
  - to:
    - operation:
        notPaths: ["/healthz", "/metrics"]  # 排除健康检查路径
    from:
    - source:
        requestPrincipals: ["*"]

# 在授权策略中使用 JWT claims
when:
- key: request.auth.claims[iss]
  values: ["https://accounts.example.com"]
- key: request.auth.claims[aud]
  values: ["my-service"]
- key: request.auth.claims[sub]
  values: ["user-123"]
- key: request.auth.claims[groups]
  values: ["admin", "editor"]  # 数组类型匹配任一

graph LR
    GW[istio-ingressgateway] -->|80/tcp mTLS| PP[productpage v1<br/>5.2rps 50ms p99]
    PP -->|9080/http mTLS| Det[details v1<br/>1.0rps]
    PP -->|9080/http mTLS| Rev[reviews v2<br/>3.0rps]
    PP -->|9080/http mTLS| Rat1[ratings v1<br/>3.0rps]
    Rev -->|9080/http mTLS| Rat2[ratings v1<br/>3.0rps]

# Kiali 会检测并提示的配置问题
# 1. VirtualService 引用不存在的 subset
# 2. DestinationRule 中 subset label 不匹配 Pod 标签
# 3. 授权策略中 selector 不匹配任何工作负载
# 4. ServiceEntry 缺少 resolution 字段
# 5. 同一 host 的 DestinationRule 被多个 VirtualService 引用

# 安装 Kiali
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.22/samples/addons/kiali.yaml

# 通过 Gateway 暴露
kubectl port-forward -n istio-system svc/kiali 20001

graph LR
    subgraph Cluster A [Primary]
        A1[Istiod CA + Pilot]
        A2[API Server]
        A3[Service A]
        A4[East-West Gateway]
    end
    subgraph Cluster B [Primary]
        B1[Istiod CA + Pilot]
        B2[API Server]
        B3[Service B]
        B4[East-West Gateway]
    end
    A3 <-->|◄───►| B3
    A4 <--> B4
    A1 -.->|Remote Secret 共享端点发现| B1

# Cluster A: 创建 Cluster B 的 Remote Secret
istioctl create-remote-secret \
  --context=cluster-b \
  --name=cluster-b \
  | kubectl apply --context=cluster-a -f -

# Cluster B: 创建 Cluster A 的 Remote Secret
istioctl create-remote-secret \
  --context=cluster-a \
  --name=cluster-a \
  | kubectl apply --context=cluster-b -f -

graph LR
    subgraph Cluster A [Primary]
        A1[Istiod CA + Pilot]
        A2[API Server]
        A4[East-West Gateway]
    end
    subgraph Cluster B [Remote]
        B2[API Server]
        B3[Service B]
        B4[East-West Gateway]
    end
    A2 -->|Istiod 管理 Remote 的 Sidecar| B2
    A4 <--> B4

# Primary 安装
istioctl install --context=cluster-a -f primary.yaml

# 创建 Remote Secret 并在 Remote 安装
istioctl create-remote-secret \
  --context=cluster-a \
  --name=cluster-a \
  | kubectl apply --context=cluster-b -f -

istioctl install --context=cluster-b -f remote.yaml

# 多副本 + 反亲和 + PDB
apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-ingressgateway
  namespace: istio-system
spec:
  replicas: 3
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0  # 零宕机更新
  template:
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app: istio-ingressgateway
            topologyKey: kubernetes.io/hostname
      topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: ScheduleAnyway
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: istio-ingressgateway
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: istio-ingressgateway

# 入口网关资源配置
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: 2000m
            memory: 1Gi
        hpaSpec:
          maxReplicas: 10
          metrics:
          - type: Resource
            resource:
              name: cpu
              targetAverageUtilization: 60
  values:
    gateways:
      istio-ingressgateway:
        autoscaleEnabled: true
# Envoy 资源配置
apiVersion: networking.istio.io/v1beta1
kind: ProxyConfig
metadata:
  name: ingress-gateway-config
  namespace: istio-system
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
  concurrency: 4          # worker 线程数 = CPU 核数
  proxyAdminPort: 15000
  tracing:
    zipkin:
      address: zipkin.istio-system:9411
      sampling: 0.1       # 网关采样率低一些

# 关键指标
- envoy_cluster_upstream_rq_xx: 网关错误率 > 1%
- envoy_server_memory_heap_size: 内存使用 > 80%
- envoy_listener_manager_total_listeners_warming: 配置推送延迟
- istio_requests_total{response_code=~"5.."}: 上游 5xx 比例

# istioctl 安装 (production)
cat <<EOF | istioctl install -f -
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
spec:
  profile: default
  # 控制平面配置
  components:
    pilot:
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 500m
            memory: 1Gi
          limits:
            cpu: 2000m
            memory: 2Gi
        hpaSpec:
          maxReplicas: 5
          minReplicas: 2
          metrics:
          - type: Resource
            resource:
              name: cpu
              targetAverageUtilization: 60
        strategy:
          rollingUpdate:
            maxSurge: 1
            maxUnavailable: 0
        podDisruptionBudget:
          minAvailable: 1
    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: 2000m
            memory: 1Gi
        hpaSpec:
          maxReplicas: 10
          minReplicas: 2
          metrics:
          - type: Resource
            resource:
              name: cpu
              targetAverageUtilization: 60
        service:
          type: LoadBalancer
          ports:
          - port: 80
            targetPort: 8080
            name: http2
          - port: 443
            targetPort: 8443
            name: https
  # 生产参数
  values:
    global:
      proxy:
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 256Mi
        logLevel: warning
        privileged: false
        readinessInitialDelaySeconds: 1
        readinessPeriodSeconds: 2
        readinessFailureThreshold: 30
    pilot:
      env:
        PILOT_ENABLE_ANALYSIS: "true"     # 启用在线的配置分析
        PILOT_TRACE_SAMPLING: "1"         # 控制面追踪采样
    meshConfig:
      enablePrometheusMerge: true         # 合并 Prometheus 指标
      defaultConfig:
        proxyMetadata:
          ISTIO_META_ENABLE_HBONE: "false"
    sidecarInjectorWebhook:
      enableNamespacesByDefault: false    # 不自动注入所有命名空间
      rewriteAppHTTPProbe: true           # 重写 Pod 健康检查探针
EOF

# 安装控制面
helm install istio-base istio/base -n istio-system --create-namespace

# 安装 Istiod
helm install istiod istio/istiod -n istio-system -f istiod-values.yaml

# 安装入口网关
helm install istio-ingressgateway istio/gateway -n istio-system

# 安装新 Revision 控制面
istioctl install --revision 1-22-0 -f istio-operator-1.22.yaml

# 将命名空间切换到新 Revision
kubectl label namespace default istio.io/rev=1-22-0 --overwrite

# 确认所有 Pod 迁移完成后，删除旧 Revision
istioctl uninstall --revision 1-21-0

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews-canary
spec:
  hosts:
  - reviews
  http:
  - route:
    - destination:
        host: reviews
        subset: stable
      weight: 90
    - destination:
        host: reviews
        subset: canary
      weight: 10
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews-subsets
spec:
  host: reviews
  subsets:
  - name: stable
    labels:
      version: v1
  - name: canary
    labels:
      version: v2

graph LR
    A[阶段 1: 金丝雀 10%] --> B[reviews]
    B -->|90%| C[reviews-v1 stable]
    B -->|10% 观察 5xx 和延迟| D[reviews-v2 canary]
    C --> E[阶段 2: 扩大 50%]
    D --> E
    E --> F[reviews]
    F -->|50%| C
    F -->|50% 对比指标| D
    C --> G[阶段 3: 全量 100%]
    D --> G
    G --> H[reviews]
    H -->|100% v1 流量归零| D
    H -.->|0%| C
    D --> I[阶段 4: 清理<br/>canary subset 升为 stable<br/>删除 v1 Deployment]

# 内测用户路由到新版本
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews-internal
spec:
  hosts:
  - reviews
  http:
  - match:
    - headers:
        x-user-group:
          exact: internal-beta
    route:
    - destination:
        host: reviews
        subset: canary-2
  - match:
    - headers:
        x-user-group:
          exact: beta
    route:
    - destination:
        host: reviews
        subset: canary-1
  - route:
    - destination:
        host: reviews
        subset: stable

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: httpbin-mirror
spec:
  hosts:
  - httpbin
  http:
  - route:
    - destination:
        host: httpbin
        subset: v1
      weight: 100
    mirror:
      host: httpbin
      subset: v2
    mirrorPercent:
      value: 50.0   # 镜像 50% 流量到 v2
    # 注意：mirror 不会等待 v2 的响应
    # 镜像请求的响应会被丢弃
    # 镜像请求使用 Host: v2（镜像目标）发送
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: httpbin-subsets
spec:
  host: httpbin
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-api
spec:
  hosts:
  - "api.github.com"
  - "api.stripe.com"
  ports:
  - number: 443
    name: https
    protocol: TLS
  location: MESH_EXTERNAL
  resolution: DNS
# 为外部服务配置 mTLS（如果需要）
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: external-api-tls
spec:
  host: "api.github.com"
  trafficPolicy:
    tls:
      mode: SIMPLE  # 单向 TLS
      # 或 MUTUAL（如果外部服务需要客户端证书）

# 将 VM 中的遗留服务纳入网格
apiVersion: networking.istio.io/v1beta1
kind: WorkloadEntry
metadata:
  name: legacy-vm-1
spec:
  address: 192.168.1.100
  labels:
    app: legacy-db
    version: v1
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: legacy-db
spec:
  hosts:
  - "legacy-db.internal"
  ports:
  - number: 5432
    name: tcp-postgres
    protocol: TCP
  location: MESH_INTERNAL
  resolution: STATIC
  endpoints:
  - address: 192.168.1.100
    labels:
      app: legacy-db
# 使用 MESH_INTERNAL 的服务可以应用全量流量管理策略
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: legacy-db-routing
spec:
  hosts:
  - "legacy-db.internal"
  tcp:
  - match:
    - port: 5432
    route:
    - destination:
        host: "legacy-db.internal"

# 限制 reviews 命名空间只可访问自身和 istio-system
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: restrict-egress
  namespace: reviews
spec:
  workloadSelector:
    labels:
      app: reviews
  ingress:
  - defaultEndpoint: 0.0.0.0:8080  # 入站端口转发
    port:
      number: 8080
      protocol: HTTP
  egress:
  - hosts:
    - "./*"                          # 同一命名空间所有服务
    - "istio-system/*"               # istio-system 命名空间所有服务
# 命名空间全局限制（不指定 workloadSelector 时）
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: namespace-default
  namespace: reviews
spec:
  outboundTrafficPolicy:
    mode: REGISTRY_ONLY  # 只允许注册的服务
  egress:
  - hosts:
    - "./*"
    - "istio-system/*"

graph LR
    subgraph 无 Sidecar 资源限制["无 Sidecar 资源限制（N 个服务）"]
        A1["每个 Envoy 的监听器数 ≈ N"]
        A2["每个 Envoy 的集群数 ≈ N"]
        A3["每个 Envoy 的端点数 ≈ N * replicas"]
    end
    subgraph 有 Sidecar 资源限制["有 Sidecar 资源限制（M 个服务）"]
        B1["每个 Envoy 的监听器数 ≈ M"] --> R1["内存 O(N) → O(M)"]
        B2["每个 Envoy 的集群数 ≈ M"] --> R2["配置推送延迟 N → M"]
        B3["每个 Envoy 的端点数 ≈ M * replicas"]
    end

# 精细化限制：每个工作负载按需配置
# 命名空间 security 的服务只可访问认证服务和数据库
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: security-service
  namespace: security
spec:
  workloadSelector:
    labels:
      app: auth-service
  egress:
  - hosts:
    - "./*"
    - "istio-system/*"
    - "database/*"
# 入口网关不需要访问大多数服务
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: ingress-gateway
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: istio-ingressgateway
  egress:
  - hosts:
    - "*/istio-ingressgateway"
    - "default/*"
    - "monitoring/*"

# 自动协议选择
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: protocol-detection
spec:
  host: my-service
  trafficPolicy:
    portLevelSettings:
    - port:
        number: 8080
      # protocol 自动检测
    - port:
        number: 9090
      protocol: TCP  # 明确指定 TCP，跳过检测
# Service 端口命名规范（自动检测基础）
apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  ports:
  - name: http-metrics    # 前缀 http- 表示 HTTP 协议
    port: 8080
  - name: grpc-backend    # 前缀 grpc 表示 gRPC 协议
    port: 9090
  - name: tcp-custom      # 前缀 tcp 表示 TCP 协议
    port: 9091

graph LR
    A[Envoy 收到连接] --> B{端口命名前缀}
    B -->|http/grpc/tcp 前缀| C[直接使用已知协议]
    B -->|未知前缀| D[协议检测 Protocol Sniffing]
    D -->|HTTP/1.1| E[识别 Host、Method]
    D -->|HTTP/2| F[识别 Magic Bytes<br/>PRI * HTTP/2.0]
    D -->|gRPC| G[识别 HTTP/2 +<br/>Content-Type application/grpc]
    D -->|检测失败| H[回退为 TCP]

# 启用 DNS 代理
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    defaultConfig:
      proxyMetadata:
        ISTIO_META_DNS_CAPTURE: "true"   # 启用 DNS 捕获
        ISTIO_META_DNS_AUTO_ALLOCATE: "true"  # 自动分配 DNS 地址
# 安装时全局启用
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    global:
      proxy:
        dnsCaptureByDefault: true
    pilot:
      env:
        PILOT_ENABLE_DNS_PROXYING: "true"

graph LR
    A[Pod 内 DNS 查询] --> B[Envoy Sidecar 拦截 UDP:53 DNS 查询]
    B --> C{查询在 Istio<br/>服务注册表中?}
    C -->|是| D[返回虚拟 IP 或端点 IP]
    C -->|否| E[转发到 kube-dns / CoreDNS]
    E --> F[Envoy 使用 DNS 结果建立连接池]
    F --> G[自动处理 DNS TTL]
    F --> H[DNS 更新时自动重建连接池]

# 1. Sidecar 资源限制
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: restrict-scope
  namespace: default
spec:
  egress:
  - hosts:
    - "./*"
    - "istio-system/*"
# 2. ProxyConfig 调优
apiVersion: networking.istio.io/v1beta1
kind: ProxyConfig
metadata:
  name: proxy-tuning
  namespace: istio-system
spec:
  concurrency: 2
  image:
    imageType: distroless
  environmentVariables:
    ENVOY_LOG_LEVEL: warning
# 3. Pilot 配置优化
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    pilot:
      env:
        PILOT_PUSH_THROTTLE: "200"          # 推送限速
        PILOT_ENABLE_PROTOCOL_SNIFFING: "false"  # 关闭协议检测
        PILOT_SIDECAR_USE_REMOTE_ADDRESSES: "false"
# 4. 指标裁剪
apiVersion: telemetry.istio.io/v1
kind: Telemetry
metadata:
  name: metrics-trim
spec:
  metrics:
  - overrides:
    - match:
        metric: ALL_METRICS
        mode: CLIENT
      tagOverrides:
        source_principal:
          operation: REMOVE
        destination_principal:
          operation: REMOVE
        connection_security_policy:
          operation: REMOVE

# 1. 查看当前 Revision
istioctl version
# output: control plane version: 1.21-0

# 2. 安装新版本控制面（新旧共存）
istioctl install --revision 1-22-0 \
  --set profile=default \
  -f istio-operator-1.22.yaml

# 3. 验证新 Revision 状态
kubectl get pods -n istio-system -l istio.io/rev=1-22-0
kubectl get mutatingwebhookconfiguration -l istio.io/rev=1-22-0

# 4. 将测试命名空间迁移到新 Revision
kubectl label namespace test-ns istio.io/rev=1-22-0 --overwrite

# 5. 滚动重启测试命名空间的 Pod
kubectl rollout restart deployment -n test-ns

# 6. 验证测试命名空间 Pod 的新 Sidecar 版本
kubectl exec -n test-ns <pod-name> -c istio-proxy -- pilot-agent request GET /stats | grep istio.version

# 7. 确认无误后，批量迁移其他命名空间

# 8. 迁移完成后，删除旧 Revision
istioctl uninstall --revision 1-21-0

graph LR
    subgraph 升级前[一个版本]
        Pre[Istiod 1.21<br/>Webhook: 1.21<br/>default: 1.21<br/>prod: 1.21]
    end
    subgraph 升级中[新旧共存]
        Mid[Istiod 1.21 + 1.22<br/>Webhook: 1.21 + 1.22<br/>default: 1.21<br/>test: 1.22]
    end
    subgraph 升级后[新版本]
        Post[Istiod 1.22<br/>Webhook: 1.22<br/>default: 1.22<br/>prod: 1.22]
    end
    Pre --> Mid --> Post

# 升级前检查
# 1. 配置兼容性分析
istioctl x precheck

# 2. 检查现有配置问题
istioctl analyze --all-namespaces

# 3. 查看 API 版本变更（特别注意被移除的 API）
istioctl experimental version --remote=false

# 4. 确认所有 CRD 版本兼容
kubectl get crd -o name | grep istio | xargs -I {} sh -c 'echo "---"; echo {}; kubectl get {} -A --no-headers 2>/dev/null | head -5'

# 回滚方案 A：命名空间标签回退（如果 Migration 中）

# 1. 将迁移过的命名空间恢复到旧 Revision
kubectl label namespace test-ns istio.io/rev-  # 移除新标签
kubectl label namespace test-ns istio-injection=enabled  # 或旧的注入方式

# 2. 滚动重启恢复 Pod
kubectl rollout restart deployment -n test-ns

# 3. 确认 Pod 恢复到旧 Sidecar
kubectl get pods -n test-ns -o jsonpath='{.items[*].metadata.annotations.sidecar\.istio\.io/status}'

# 回滚方案 B：删除新控制面（如果新控制面导致全局问题）

# 1. 确认没有命名空间在使用新 Revision
kubectl get ns -o json | jq '.items[] | select(.metadata.labels["istio.io/rev"]=="1-22-0") | .metadata.name'

# 2. 删除新控制面
istioctl uninstall --revision 1-22-0 -y

# 3. 确认注入恢复正常
kubectl get mutatingwebhookconfiguration -l istio.io/rev=1-22-0
# 预期：No resources found

graph LR
    subgraph K8s["K8s Service + Istio CRDs"]
        Svc["Service (ClusterIP)"]
        Pod["Pod（由 Service selector 匹配）"]
        VS["VirtualService"]
        DR["DestinationRule"]
    end
    subgraph Envoy["Envoy 内部模型"]
        Cluster["Cluster（CDS）"]
        Endpoint["Endpoint（EDS）"]
        Listener["Listener（LDS）"]
        Route["Route（RDS）"]
    end
    Svc -->|"spec.ports / selector / type"| Cluster
    Svc -->|"ClusterIP:Port"| Listener
    Pod -->|"podIP + labels"| Endpoint
    VS -->|"hosts / match / route"| Route
    VS -->|"timeout / retries / fault"| Listener
    DR -->|"loadBalancer / connectionPool / outlierDetection / tls"| Cluster

# 以下 K8s Service
apiVersion: v1
kind: Service
metadata:
  name: reviews
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: reviews
# 映射为 Envoy Cluster（CDS）
{
  "name": "outbound|9080||reviews.default.svc.cluster.local",
  "type": "EDS",
  "eds_cluster_config": {
    "eds_config": { "ads": {} },
    "service_name": "outbound|9080||reviews.default.svc.cluster.local"
  },
  "connect_timeout": "10s",
  "circuit_breakers": {
    "thresholds": [{
      "max_connections": 100,
      "max_pending_requests": 10,
      "max_requests": 1000
    }]
  }
}
# 映射为 Envoy Endpoint（EDS）
{
  "endpoint": {
    "address": {
      "socket_address": {
        "address": "10.1.0.1",
        "port_value": 9080
      }
    },
    "metadata": {
      "filter_metadata": {
        "istio": {
          "workload": "reviews-v1",
          "namespace": "default",
          "canonical_service": "reviews"
        }
      }
    }
  }
}

graph LR
    A[请求到达 Envoy] --> B[Listener 匹配 LDS]
    B --> B1[入站 15006 → INBOUND listener]
    B --> B2[出站 15001 → OUTBOUND listener]
    B1 --> C[Route 查找 RDS]
    B2 --> C
    C --> C1[VirtualService match → route 匹配]
    C --> C2[不匹配 → 默认路由 original_dst cluster]
    C --> C3[匹配 → weighted_clusters 或 single cluster]
    C1 --> D[Cluster 定位 CDS]
    C2 --> D
    C3 --> D
    D --> D1[subset 匹配 DestinationRule labels]
    D --> D2[负载均衡算法选择实例]
    D --> D3[连接池/熔断检查]
    D1 --> E[Endpoint 转发 EDS]
    D2 --> E
    D3 --> E
    E --> F[根据 locality 优先级选端]
    E --> G[排除 ejected 熔断端点]
    E --> H[转发到 Pod IP:Port]

# 查看 Envoy 内部配置
istioctl proxy-config listener <pod-name>    # LDS 监听器
istioctl proxy-config route <pod-name>       # RDS 路由
istioctl proxy-config cluster <pod-name>     # CDS 集群
istioctl proxy-config endpoints <pod-name>   # EDS 端点

# 直接查看 Envoy admin 完整配置转储
kubectl exec <pod-name> -c istio-proxy -- curl -s http://127.0.0.1:15000/config_dump | jq '.'

# 1. 注入检查
istioctl analyze --namespace default

# 2. 验证注入条件
istioctl check-inject -n default deployment/my-app

# 3. 检查命名空间标签
kubectl get namespace default --show-labels

# 4. 查看注入日志
kubectl logs -n istio-system -l app=sidecar-injector --tail=100

# 5. 手动模拟注入（查看注入后的 YAML）
istioctl kube-inject -f deployment.yaml

# 6. 确认 Pod 注入状态
kubectl get pod my-app-pod -o jsonpath='{.metadata.annotations.sidecar\.istio\.io/status}' | jq .

# 1. 检查所有 Sidecar 与 Istiod 的连接状态
istioctl proxy-status

# 输出示例
# NAME                    CDS        LDS        EDS        RDS        ISTIOD         VERSION
# reviews-v1-xxxx.default  SYNCED     SYNCED     SYNCED     SYNCED     istiod-xxx      1.22.0
# reviews-v2-yyyy.default  STALE      SYNCED     SYNCED     SYNCED     istiod-xxx      1.22.0
#                        ↗ 未同步，可能配置推送失败

# 2. 查看特定代理的详细状态
istioctl proxy-status reviews-v1-xxxx.default

# 3. 检查 Istiod 推送指标
kubectl exec -n istio-system deploy/istiod -- curl -s http://localhost:15014/metrics | grep -E 'pilot_(push|xds|total)'

# 关键指标
# pilot_xds_push_time - 配置推送耗时（P99 > 10s 需关注）
# pilot_total_xds_internal - 总推送次数
# pilot_delta_xds - Delta 推送次数
# pilot_xds_pushes - 全量推送次数
# pilot_proxy_convergence_time - 代理配置收敛时间

# 1. 查看服务的完整路由拓扑
istioctl describe pod my-app-pod

# 输出包含：
# - 该 Pod 关联的 VirtualService/DestinationRule
# - 入站/出站监听器
# - mTLS 状态
# - 暴露的端口

# 2. 查看 Envoy 监听器配置
istioctl proxy-config listener my-app-pod
istioctl proxy-config listener my-app-pod --port 9080 --direction outbound

# 3. 查看 Envoy 路由配置
istioctl proxy-config route my-app-pod
istioctl proxy-config route my-app-pod --name 9080 -o json

# 4. 查看 Envoy 集群和端点
istioctl proxy-config cluster my-app-pod
istioctl proxy-config endpoints my-app-pod --cluster "outbound|9080||reviews.default.svc.cluster.local"

# 5. 验证熔断状态
istioctl proxy-config cluster my-app-pod -o json | jq '.circuit_breakers'

# 进入 Sidecar 容器
kubectl exec -it my-app-pod -c istio-proxy -- bash

# 1. 配置完整转储（最重要的端点）
curl -s http://127.0.0.1:15000/config_dump | jq '.'
# config_dump 包含完整的 LDS/RDS/CDS/EDS 状态

# 2. 动态日志级别调整（不停机修改 Envoy 日志级别）
curl -s 'http://127.0.0.1:15000/logging?level=debug'
curl -s 'http://127.0.0.1:15000/logging?filter=debug'
# 恢复：?level=warning

# 3. 统计信息
curl -s http://127.0.0.1:15000/stats | grep -E 'upstream_rq_5xx|upstream_rq_time|cluster.health'
# 关键指标
# cluster.health - 集群健康状态（healthy/ejected）
# upstream_rq_5xx - 上游 5xx 比例
# upstream_rq_time - 上游响应时间
# ssl.ssl_error - TLS 握手错误

# 4. 集群健康检查
curl -s http://127.0.0.1:15000/clusters | grep -E 'health_flags|host_status'
# health_flags: /healthy（正常）/ degraded（降级）/ excluded（排除）/ pending（待定）

# 5. 证书信息
curl -s http://127.0.0.1:15000/certs | jq '.'

# 6. 优雅退出
curl -s http://127.0.0.1:15000/quitquitquit

# 执行分析
istioctl analyze --all-namespaces

# 输出示例
# WARN [IST0102] (Namespace default) Namespace without Istio injection label
#   - 命名空间未启用自动注入，预期行为或需添加标签
#
# ERR [IST0131] (VirtualService reviews) VirtualService references subset "v3" which is not defined in DestinationRule
#   - VirtualService 引用了不存在的 subset，需检查 DestinationRule
#
# WARN [IST0126] (DestinationRule reviews) DestinationRule in namespace default has no subsets
#   - DestinationRule 未定义 subsets，但可能是有意的无子集配置
#
# ERR [IST0143] (AuthorizationPolicy require-jwt) Selector doesn't match any workload in namespace
#   - 授权策略 selector 不匹配任何工作负载
#
# INFO [IST0118] (Service httpbin) Service port 8080 targets container port 0, which is invalid
#   - Service 端口映射错误

# 解决建议后重新验证
istioctl analyze --all-namespaces --failure-threshold Error

# 启用详细访问日志
kubectl exec my-app-pod -c istio-proxy -- curl -s 'http://127.0.0.1:15000/logging?level=info'

# 查看访问日志（默认输出到 stderr 或文件）
kubectl logs my-app-pod -c istio-proxy --tail=50

# 访问日志格式
# [2024-01-01T10:00:00.000Z] "GET /reviews/1 HTTP/1.1" 200 - "-" 0 375 5 2 "-" "curl/7.60.0"
# ↑时间戳         ↑方法路径        ↑状态码   ↑body大小  ↑总耗时  ↑upstream耗时

graph TD
    A[问题现象] --> B[istioctl analyze]
    B -->|CRD 配置错误| C[修复 CRD]
    B -->|检查通过| D{Pod Ready 2/2?}
    D -->|No| E[istioctl check-inject]
    E --> F[修复标签或 webhook 配置]
    D -->|Yes| G[istioctl proxy-status]
    G -->|STALE| H[检查 Istiod 指标和网络连通性]
    G -->|SYNCED| I[istioctl describe pod]
    I --> J[查看注入配置摘要]
    J --> K[istioctl proxy-config route]
    K --> L[确认路由规则是否符合预期]
    L --> M[istioctl proxy-config endpoints]
    M --> N[确认端点列表是否完整]
    N --> O[Envoy admin: /stats]
    O --> P[查看流量和错误指标]
    P --> Q[Envoy admin: /logging]
    Q --> R[调整日志级别深入诊断]
    R --> S[Envoy admin: /certs]
    S --> T[确认证书链和有效期]
    ```

graph LR
    A[开发者提交<br/>Deployment 变更] --> B[Flagger Controller<br/>监听 Canary CRD]
    B --> C[创建 Canary<br/>Deployment + Service<br/>DestinationRule + VirtualService]
    C --> D[逐步提升 canary 权重<br/>0% → 10% → 20% → ... → 100%]
    D --> E[每阶段查询<br/>Prometheus 指标]
    E --> F{指标阈值判定}
    F -->|通过| G[继续提升权重]
    F -->|失败| H[自动回滚<br/>权重归零 + 缩减 canary 副本]
    G --> D
    G -->|100% 达成| I[主 Deployment 切换<br/>canary 提升为 primary<br/>清理临时资源]

apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: reviews
  namespace: default
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: reviews
  service:
    port: 9080
    targetPort: 9080
    gateways:
    - istio-system/public-gateway
    hosts:
    - reviews.example.com
    trafficPolicy:
      tls:
        mode: ISTIO_MUTUAL
  analysis:
    interval: 1m
    threshold: 5
    maxWeight: 50
    stepWeight: 10
    metrics:
    - name: request-success-rate
      thresholdRange:
        min: 99
      interval: 1m
    - name: request-duration
      thresholdRange:
        max: 500
      interval: 1m
    webhooks:
    - name: load-test
      type: rollout
      url: http://flagger-loadtester/
      metadata:
        cmd: "hey -z 1m -q 10 -c 2 http://reviews:9080/"

# 请求成功率
sum(rate(istio_requests_total{reporter="destination",destination_service_name=~"reviews-canary.*",response_code!~"5.*"}[1m]))
/
sum(rate(istio_requests_total{reporter="destination",destination_service_name=~"reviews-canary.*"}[1m]))

# 请求延迟 P99
histogram_quantile(0.99, sum(rate(istio_request_duration_milliseconds_bucket{reporter="destination",destination_service_name=~"reviews-canary.*"}[1m])) by (le))

# 仅安装控制平面（Istiod）
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: control-plane
  namespace: istio-system
spec:
  profile: default
  components:
    pilot:
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 500m
            memory: 1Gi
        hpaSpec:
          maxReplicas: 5
          minReplicas: 2
    ingressGateways:
    - name: istio-ingressgateway
      enabled: false
# 独立安装入口网关（可由不同团队管理）
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: ingress-gateway
  namespace: istio-system
spec:
  profile: empty
  components:
    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
      namespace: istio-system
      label:
        istio: ingressgateway
      k8s:
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: 2000m
            memory: 1Gi
        service:
          type: LoadBalancer
          ports:
          - port: 80
            targetPort: 8080
            name: http2
          - port: 443
            targetPort: 8443
            name: https
# 独立安装出口网关
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: egress-gateway
  namespace: istio-system
spec:
  profile: empty
  components:
    egressGateways:
    - name: istio-egressgateway
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 200m
            memory: 256Mi