Istio 服务网格

虽然可以在没有服务网格的情况下部署多集群MongoDB Ops Manager、多集群分片集群和多集群副本集配置，但推荐的方法（此处介绍）是利用服务网格来处理跨多个Kubernetes集群的网络。要学习；了解详情，请参阅 Kubernetes Operator 如何建立连接。

本页将引导您完成跨多个Kubernetes集群部署和验证 Istio 服务网格的进程。Istio 只是部署服务网格的众多选项之一， MongoDB不支持。

注意

MongoDB不支持 Istio

MongoDB不支持 Istio，并且 Istio 只是可用于跨Kubernetes集群部署服务网格的众多工具之一。

先决条件

开始之前，请执行以下任务：

安装 kubectl。
按照 GKE 集群指南中的说明设置 K8S_CLUSTER_*_CONTEXT_NAME 环境变量。

源代码

您可以在MongoDB Kubernetes Operator存储库中找到所有包含的源代码。

步骤

克隆Kubernetes Operator存储库。

运行以下命令以克隆存储库。

git clone https://github.com/mongodb/mongodb-kubernetes.git
cd mongodb-kubernetes
git checkout 1.2.0
cd public/architectures

安装 Istio 服务网格。

安装 Istio 服务网格以支持Kubernetes集群之间的跨集群 DNS 解析和网络连接。

1 CTX_CLUSTER1=${K8S_CLUSTER_0_CONTEXT_NAME} \
2 CTX_CLUSTER2=${K8S_CLUSTER_1_CONTEXT_NAME} \
3 CTX_CLUSTER3=${K8S_CLUSTER_2_CONTEXT_NAME} \
4 ISTIO_VERSION="1.20.2" \
5 ./install_istio_separate_network.sh

为Kubernetes命名空间添加标签。

标记每个集群中的Kubernetes命名空间，以启用Istio sidecar 注入。

kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "${OPERATOR_NAMESPACE}" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "${OPERATOR_NAMESPACE}" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "${OPERATOR_NAMESPACE}" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "${OM_NAMESPACE}" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "${OM_NAMESPACE}" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "${OM_NAMESPACE}" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "${MDB_NAMESPACE}" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "${MDB_NAMESPACE}" istio-injection=enabled --overwrite
kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "${MDB_NAMESPACE}" istio-injection=enabled --overwrite

可选。检查集群连接。

以下可选脚本验证是否为跨集群 DNS 解析和连接正确配置了服务网格。

为连接测试创建Kubernetes命名空间。

1 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create namespace "connectivity-test"
2 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "connectivity-test" istio-injection=enabled --overwrite
3 
4 kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" create namespace "connectivity-test"
5 kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "connectivity-test" istio-injection=enabled --overwrite
6 
7 kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" create namespace "connectivity-test"
8 kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "connectivity-test" istio-injection=enabled --overwrite

在集群0上运行此脚本：

1 kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2   apiVersion: apps/v1
3   kind: StatefulSet
4   metadata:
5     name: echoserver0
6   spec:
7     replicas: 1
8     selector:
9       matchLabels:
10         app: echoserver0
11     template:
12       metadata:
13         labels:
14           app: echoserver0
15       spec:
16         containers:
17           - image: k8s.gcr.io/echoserver:1.10
18             imagePullPolicy: Always
19             name: echoserver0
20             ports:
21               - containerPort: 8080
22 EOF

在集群1上运行此脚本：

1 kubectl apply --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2   apiVersion: apps/v1
3   kind: StatefulSet
4   metadata:
5     name: echoserver1
6   spec:
7     replicas: 1
8     selector:
9       matchLabels:
10         app: echoserver1
11     template:
12       metadata:
13         labels:
14           app: echoserver1
15       spec:
16         containers:
17           - image: k8s.gcr.io/echoserver:1.10
18             imagePullPolicy: Always
19             name: echoserver1
20             ports:
21               - containerPort: 8080
22 EOF

在集群2上运行此脚本：

1 kubectl apply --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2   apiVersion: apps/v1
3   kind: StatefulSet
4   metadata:
5     name: echoserver2
6   spec:
7     replicas: 1
8     selector:
9       matchLabels:
10         app: echoserver2
11     template:
12       metadata:
13         labels:
14           app: echoserver2
15       spec:
16         containers:
17           - image: k8s.gcr.io/echoserver:1.10
18             imagePullPolicy: Always
19             name: echoserver2
20             ports:
21               - containerPort: 8080
22 EOF

运行此脚本以等待创建 StatefulSet：

1 kubectl wait --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=echoserver0-0 --timeout=60s
2 kubectl wait --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=echoserver1-0 --timeout=60s
3 kubectl wait --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=echoserver2-0 --timeout=60s

在集群0上创建 Pod 服务：

1 kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2 apiVersion: v1
3 kind: Service
4 metadata:
5   name: echoserver0-0
6 spec:
7   ports:
8     - port: 8080
9       targetPort: 8080
10       protocol: TCP
11   selector:
12     statefulset.kubernetes.io/pod-name: "echoserver0-0"
13 EOF

在集群1上创建 Pod 服务：

1 kubectl apply --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2 apiVersion: v1
3 kind: Service
4 metadata:
5   name: echoserver1-0
6 spec:
7   ports:
8     - port: 8080
9       targetPort: 8080
10       protocol: TCP
11   selector:
12     statefulset.kubernetes.io/pod-name: "echoserver1-0"
13 EOF

在集群2上创建 Pod 服务：

1 kubectl apply --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2 apiVersion: v1
3 kind: Service
4 metadata:
5   name: echoserver2-0
6 spec:
7   ports:
8     - port: 8080
9       targetPort: 8080
10       protocol: TCP
11   selector:
12     statefulset.kubernetes.io/pod-name: "echoserver2-0"
13 EOF

在集群0上创建循环服务：

1 kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2 apiVersion: v1
3 kind: Service
4 metadata:
5   name: echoserver
6 spec:
7   ports:
8     - port: 8080
9       targetPort: 8080
10       protocol: TCP
11   selector:
12     app: echoserver0
13 EOF

在集群1上创建循环服务：

1 kubectl apply --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2 apiVersion: v1
3 kind: Service
4 metadata:
5   name: echoserver
6 spec:
7   ports:
8     - port: 8080
9       targetPort: 8080
10       protocol: TCP
11   selector:
12     app: echoserver1
13 EOF

在集群2上创建循环服务：

1 kubectl apply --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2 apiVersion: v1
3 kind: Service
4 metadata:
5   name: echoserver
6 spec:
7   ports:
8     - port: 8080
9       targetPort: 8080
10       protocol: TCP
11   selector:
12     app: echoserver2
13 EOF

验证集群0 中的 Pod1 ：

1 source_cluster=${K8S_CLUSTER_1_CONTEXT_NAME}
2 target_pod="echoserver0-0"
3 source_pod="echoserver1-0"
4 target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"
5 echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"
6 out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \
7   /bin/bash -c "curl -v ${target_url}" 2>&1);
8 
9 if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"
10 then
11   echo "SUCCESS"
12 else
13   echo "ERROR: ${out}"
14   return 1
15 fi

1 Checking cross-cluster DNS resolution and connectivity from echoserver1-0 in gke_scratch-kubernetes-team_europe-central2-b_k8s-mdb-1-68bf14632610a500070df2fa-24743 to echoserver0-0
2 SUCCESS

验证集群1 中的 Pod0 ：

1 source_cluster=${K8S_CLUSTER_0_CONTEXT_NAME}
2 target_pod="echoserver1-0"
3 source_pod="echoserver0-0"
4 target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"
5 echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"
6 out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \
7   /bin/bash -c "curl -v ${target_url}" 2>&1);
8 
9 if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"
10 then
11   echo "SUCCESS"
12 else
13   echo "ERROR: ${out}"
14   return 1
15 fi

1 Checking cross-cluster DNS resolution and connectivity from echoserver0-0 in gke_scratch-kubernetes-team_europe-central2-a_k8s-mdb-0-68bf14632610a500070df2fa-24743 to echoserver1-0
2 SUCCESS

验证集群1 中的 Pod2 ：

1 source_cluster=${K8S_CLUSTER_2_CONTEXT_NAME}
2 target_pod="echoserver1-0"
3 source_pod="echoserver2-0"
4 target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"
5 echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"
6 out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \
7   /bin/bash -c "curl -v ${target_url}" 2>&1);
8 
9 if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"
10 then
11   echo "SUCCESS"
12 else
13   echo "ERROR: ${out}"
14   return 1
15 fi

1 Checking cross-cluster DNS resolution and connectivity from echoserver2-0 in gke_scratch-kubernetes-team_europe-central2-c_k8s-mdb-2-68bf14632610a500070df2fa-24743 to echoserver1-0
2 SUCCESS

验证集群2 中的 Pod0 ：

1 source_cluster=${K8S_CLUSTER_0_CONTEXT_NAME}
2 target_pod="echoserver2-0"
3 source_pod="echoserver0-0"
4 target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"
5 echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"
6 out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \
7   /bin/bash -c "curl -v ${target_url}" 2>&1);
8 
9 if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"
10 then
11   echo "SUCCESS"
12 else
13   echo "ERROR: ${out}"
14   return 1
15 fi

1 Checking cross-cluster DNS resolution and connectivity from echoserver0-0 in gke_scratch-kubernetes-team_europe-central2-a_k8s-mdb-0-68bf14632610a500070df2fa-24743 to echoserver2-0
2 SUCCESS

运行清理脚本：

1 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" delete statefulset echoserver0
2 kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" delete statefulset echoserver1
3 kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" delete statefulset echoserver2
4 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" delete service echoserver
5 kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" delete service echoserver
6 kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" delete service echoserver
7 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" delete service echoserver0-0
8 kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" delete service echoserver1-0
9 kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" delete service echoserver2-0
10 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" delete ns "connectivity-test"
11 kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" delete ns "connectivity-test"
12 kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" delete ns "connectivity-test"

后退

GKE 集群

来年

TLS 证书

1	CTX_CLUSTER1=${K8S_CLUSTER_0_CONTEXT_NAME} \
2	CTX_CLUSTER2=${K8S_CLUSTER_1_CONTEXT_NAME} \
3	CTX_CLUSTER3=${K8S_CLUSTER_2_CONTEXT_NAME} \
4	ISTIO_VERSION="1.20.2" \
5	./install_istio_separate_network.sh

1	kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create namespace "connectivity-test"
2	kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" label namespace "connectivity-test" istio-injection=enabled --overwrite
3
4	kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" create namespace "connectivity-test"
5	kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" label namespace "connectivity-test" istio-injection=enabled --overwrite
6
7	kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" create namespace "connectivity-test"
8	kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" label namespace "connectivity-test" istio-injection=enabled --overwrite

1	kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2	apiVersion: apps/v1
3	kind: StatefulSet
4	metadata:
5	name: echoserver0
6	spec:
7	replicas: 1
8	selector:
9	matchLabels:
10	app: echoserver0
11	template:
12	metadata:
13	labels:
14	app: echoserver0
15	spec:
16	containers:
17	- image: k8s.gcr.io/echoserver:1.10
18	imagePullPolicy: Always
19	name: echoserver0
20	ports:
21	- containerPort: 8080
22	EOF

1	kubectl apply --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2	apiVersion: apps/v1
3	kind: StatefulSet
4	metadata:
5	name: echoserver1
6	spec:
7	replicas: 1
8	selector:
9	matchLabels:
10	app: echoserver1
11	template:
12	metadata:
13	labels:
14	app: echoserver1
15	spec:
16	containers:
17	- image: k8s.gcr.io/echoserver:1.10
18	imagePullPolicy: Always
19	name: echoserver1
20	ports:
21	- containerPort: 8080
22	EOF

1	kubectl apply --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2	apiVersion: apps/v1
3	kind: StatefulSet
4	metadata:
5	name: echoserver2
6	spec:
7	replicas: 1
8	selector:
9	matchLabels:
10	app: echoserver2
11	template:
12	metadata:
13	labels:
14	app: echoserver2
15	spec:
16	containers:
17	- image: k8s.gcr.io/echoserver:1.10
18	imagePullPolicy: Always
19	name: echoserver2
20	ports:
21	- containerPort: 8080
22	EOF

1	kubectl wait --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=echoserver0-0 --timeout=60s
2	kubectl wait --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "connectivity-test" --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=echoserver1-0 --timeout=60s
3	kubectl wait --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "connectivity-test" --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=echoserver2-0 --timeout=60s

1	kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "connectivity-test" -f - <<EOF
2	apiVersion: v1
3	kind: Service
4	metadata:
5	name: echoserver0-0
6	spec:
7	ports:
8	- port: 8080
9	targetPort: 8080
10	protocol: TCP
11	selector:
12	statefulset.kubernetes.io/pod-name: "echoserver0-0"
13	EOF

1	source_cluster=${K8S_CLUSTER_1_CONTEXT_NAME}
2	target_pod="echoserver0-0"
3	source_pod="echoserver1-0"
4	target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"
5	echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"
6	out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \
7	/bin/bash -c "curl -v ${target_url}" 2>&1);
8
9	if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"
10	then
11	echo "SUCCESS"
12	else
13	echo "ERROR: ${out}"
14	return 1
15	fi

1	Checking cross-cluster DNS resolution and connectivity from echoserver1-0 in gke_scratch-kubernetes-team_europe-central2-b_k8s-mdb-1-68bf14632610a500070df2fa-24743 to echoserver0-0
2	SUCCESS

1	source_cluster=${K8S_CLUSTER_0_CONTEXT_NAME}
2	target_pod="echoserver1-0"
3	source_pod="echoserver0-0"
4	target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"
5	echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"
6	out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \
7	/bin/bash -c "curl -v ${target_url}" 2>&1);
8
9	if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"
10	then
11	echo "SUCCESS"
12	else
13	echo "ERROR: ${out}"
14	return 1
15	fi

1	source_cluster=${K8S_CLUSTER_2_CONTEXT_NAME}
2	target_pod="echoserver1-0"
3	source_pod="echoserver2-0"
4	target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"
5	echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"
6	out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \
7	/bin/bash -c "curl -v ${target_url}" 2>&1);
8
9	if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"
10	then
11	echo "SUCCESS"
12	else
13	echo "ERROR: ${out}"
14	return 1
15	fi

1	source_cluster=${K8S_CLUSTER_0_CONTEXT_NAME}
2	target_pod="echoserver2-0"
3	source_pod="echoserver0-0"
4	target_url="http://${target_pod}.connectivity-test.svc.cluster.local:8080"
5	echo "Checking cross-cluster DNS resolution and connectivity from ${source_pod} in ${source_cluster} to ${target_pod}"
6	out=$(kubectl exec --context "${source_cluster}" -n "connectivity-test" "${source_pod}" -- \
7	/bin/bash -c "curl -v ${target_url}" 2>&1);
8
9	if grep "Hostname: ${target_pod}" &>/dev/null <<< "${out}"
10	then
11	echo "SUCCESS"
12	else
13	echo "ERROR: ${out}"
14	return 1
15	fi

注意