对于 AI 代理：可在 https://www.mongodb.com/zh-cn/docs/llms.txt 获取文档索引—通过在任何 URL 路径后添加 .md 可获取所有页面的 Markdown 版本。

Istio 服务网格

虽然可以在没有服务网格的情况下部署多集群MongoDB Ops Manager、多集群分片集群和多集群副本集配置，但推荐的方法（此处介绍）是利用服务网格来处理跨多个Kubernetes集群。要学习；了解更多信息，请参阅Kubernetes Operator 如何建立连接。

本页将引导您完成跨多个Kubernetes集群部署和验证Istio 服务网格的进程。Istio 只是部署服务网格的众多选项之一， MongoDB不支持。

注意

MongoDB不支持 Istio

MongoDB不支持 Istio，并且 Istio 只是可用于跨Kubernetes集群部署服务网格的众多工具之一。

先决条件

开始之前，请执行以下任务：

  • 安装 kubectl。

  • 按照 GKE 集群指南 中的说明设置 K8S_CLUSTER_*_CONTEXT_NAME 环境变量。

源代码

您可以在MongoDB Kubernetes Operator存储库中找到所有包含的源代码。

步骤

1

克隆Kubernetes Operator存储库。

运行以下命令以克隆存储库。

git clone https://github.com/mongodb/mongodb-kubernetes.gitcd mongodb-kubernetesgit checkout 1.15.0cd public/architectures
2

安装 Istio 服务网格。

安装 Istio 服务网格，以支持跨集群 DNS 解析和Kubernetes集群之间的网络连接。

CTX_CLUSTER1=${K8S_CLUSTER_0_CONTEXT_NAME} \CTX_CLUSTER2=${K8S_CLUSTER_1_CONTEXT_NAME} \CTX_CLUSTER3=${K8S_CLUSTER_2_CONTEXT_NAME} \ISTIO_VERSION="1.20.2" \./install_istio_separate_network.sh
3

为Kubernetes命名空间添加标签。

标记每个集群中的Kubernetes命名空间，以启用Istio sidecar 注入。

kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "${OPERATOR_NAMESPACE}" istio-injection=enabled --overwritekubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "${OPERATOR_NAMESPACE}" istio-injection=enabled --overwritekubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "${OPERATOR_NAMESPACE}" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "${OM_NAMESPACE}" istio-injection=enabled --overwritekubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "${OM_NAMESPACE}" istio-injection=enabled --overwritekubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "${OM_NAMESPACE}" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "${MDB_NAMESPACE}" istio-injection=enabled --overwritekubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "${MDB_NAMESPACE}" istio-injection=enabled --overwritekubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "${MDB_NAMESPACE}" istio-injection=enabled --overwrite
4

可选。 检查集群连接。

以下可选脚本验证是否为跨集群 DNS 解析和连接正确配置了服务网格。

  1. 为连接测试创建Kubernetes命名空间。

    kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create namespace "connectivity-test"kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "connectivity-test" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" create namespace "connectivity-test"kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "connectivity-test" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" create namespace "connectivity-test"kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "connectivity-test" istio-injection=enabled --overwrite

  2. 在集群0上运行此脚本：

    kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF  apiVersion: apps/v1  kind: StatefulSet  metadata:    name: echoserver0  spec:    replicas: 1    selector:      matchLabels:        app: echoserver0    template:      metadata:        labels:          app: echoserver0      spec:        containers:          - image: k8s.gcr.io/echoserver:1.10            imagePullPolicy: Always            name: echoserver0            ports:              - containerPort: 8080EOF

  3. 在集群1上运行此脚本：

    kubectl apply --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF  apiVersion: apps/v1  kind: StatefulSet  metadata:    name: echoserver1  spec:    replicas: 1    selector:      matchLabels:        app: echoserver1    template:      metadata:        labels:          app: echoserver1      spec:        containers:          - image: k8s.gcr.io/echoserver:1.10            imagePullPolicy: Always            name: echoserver1            ports:              - containerPort: 8080EOF

  4. 在集群2上运行此脚本：

    kubectl apply --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF  apiVersion: apps/v1  kind: StatefulSet  metadata:    name: echoserver2  spec:    replicas: 1    selector:      matchLabels:        app: echoserver2    template:      metadata:        labels:          app: echoserver2      spec:        containers:          - image: k8s.gcr.io/echoserver:1.10            imagePullPolicy: Always            name: echoserver2            ports:              - containerPort: 8080EOF

  5. 运行此脚本以等待创建 StatefulSet：

    kubectl wait --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=echoserver0-0 --timeout=60skubectl wait --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=echoserver1-0 --timeout=60skubectl wait --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=echoserver2-0 --timeout=60s

  6. 在集群0上创建 Pod 服务：

    kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOFapiVersion: v1kind: Servicemetadata:  name: echoserver0-0spec:  ports:    - port: 8080      targetPort: 8080      protocol: TCP  selector:    statefulset.kubernetes.io/pod-name: "echoserver0-0"EOF

  7. 在集群1上创建 Pod 服务：

    kubectl apply --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOFapiVersion: v1kind: Servicemetadata:  name: echoserver1-0spec:  ports:    - port: 8080      targetPort: 8080      protocol: TCP  selector:    statefulset.kubernetes.io/pod-name: "echoserver1-0"EOF

  8. 在集群2上创建 Pod 服务：

    kubectl apply --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOFapiVersion: v1kind: Servicemetadata:  name: echoserver2-0spec:  ports:    - port: 8080      targetPort: 8080      protocol: TCP  selector:    statefulset.kubernetes.io/pod-name: "echoserver2-0"EOF

  9. 在集群0上创建循环服务：

    kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOFapiVersion: v1kind: Servicemetadata:  name: echoserverspec:  ports:    - port: 8080      targetPort: 8080      protocol: TCP  selector:    app: echoserver0EOF

  10. 在集群1上创建循环服务：

    kubectl apply --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOFapiVersion: v1kind: Servicemetadata:  name: echoserverspec:  ports:    - port: 8080      targetPort: 8080      protocol: TCP  selector:    app: echoserver1EOF

  11. 在集群2上创建循环服务：

    kubectl apply --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOFapiVersion: v1kind: Servicemetadata:  name: echoserverspec:  ports:    - port: 8080      targetPort: 8080      protocol: TCP  selector:    app: echoserver2EOF

  12. 验证集群0 中的 Pod1 ：

    source_cluster=${K8S_CLUSTER_1_CONTEXT_NAME}target_pod="echoserver0-0"source_pod="echoserver1-0"target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \  /bin/bash -c "curl -v ${target_url}" 2>&1);
if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"then  echo "SUCCESS"else  echo "ERROR: ${out}"  return 1fi

  13. 验证集群1 中的 Pod0 ：

    source_cluster=${K8S_CLUSTER_0_CONTEXT_NAME}target_pod="echoserver1-0"source_pod="echoserver0-0"target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \  /bin/bash -c "curl -v ${target_url}" 2>&1);
if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"then  echo "SUCCESS"else  echo "ERROR: ${out}"  return 1fi

  14. 验证集群1 中的 Pod2 ：

    source_cluster=${K8S_CLUSTER_2_CONTEXT_NAME}target_pod="echoserver1-0"source_pod="echoserver2-0"target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \  /bin/bash -c "curl -v ${target_url}" 2>&1);
if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"then  echo "SUCCESS"else  echo "ERROR: ${out}"  return 1fi

  15. 验证集群2 中的 Pod0 ：

    source_cluster=${K8S_CLUSTER_0_CONTEXT_NAME}target_pod="echoserver2-0"source_pod="echoserver0-0"target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \  /bin/bash -c "curl -v ${target_url}" 2>&1);
if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"then  echo "SUCCESS"else  echo "ERROR: ${out}"  return 1fi

  16. 运行清理脚本：

    kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" delete statefulset echoserver0kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" delete statefulset echoserver1kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" delete statefulset echoserver2kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" delete service echoserverkubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" delete service echoserverkubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" delete service echoserverkubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" delete service echoserver0-0kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" delete service echoserver1-0kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" delete service echoserver2-0kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" delete ns "connectivity-test"kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" delete ns "connectivity-test"kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" delete ns "connectivity-test"
后退
GKE 集群
来年
TLS 证书
给本页内容打分

在此页面上