自动配置Istio服务网格的脚本

本文目录导读：

1. 基础安装脚本
2. 高级配置脚本
3. 应用部署脚本
4. 使用说明
5. 验证和监控

我来为您提供一个自动配置Istio服务网格的脚本方案。

基础安装脚本

#!/bin/bash
# install_istio.sh - Istio服务网格自动安装脚本
set -e
# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'
# 配置变量
ISTIO_VERSION="1.20.0"
ISTIO_DIR="istio-${ISTIO_VERSION}"
ISTIO_PROFILE="default"
NAMESPACE="istio-system"
# 日志函数
log_info() {
    echo -e "${GREEN}[INFO]${NC} $1"
}
log_warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}
log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}
# 检查前置条件
check_prerequisites() {
    log_info "Checking prerequisites..."
    # 检查kubectl
    if ! command -v kubectl &> /dev/null; then
        log_error "kubectl not found. Please install kubectl first."
        exit 1
    fi
    # 检查helm
    if ! command -v helm &> /dev/null; then
        log_warn "helm not found. Will install helm..."
        curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
        chmod 700 get_helm.sh
        ./get_helm.sh
        rm get_helm.sh
    fi
    # 检查集群连接
    if ! kubectl cluster-info &> /dev/null; then
        log_error "Cannot connect to Kubernetes cluster"
        exit 1
    fi
    log_info "Prerequisites check passed!"
}
# 下载Istio
download_istio() {
    log_info "Downloading Istio ${ISTIO_VERSION}..."
    if [ -d "${ISTIO_DIR}" ]; then
        log_warn "Istio directory already exists, skipping download"
        return
    fi
    curl -L "https://istio.io/downloadIstio" | ISTIO_VERSION=${ISTIO_VERSION} sh -
    if [ $? -ne 0 ]; then
        log_error "Failed to download Istio"
        exit 1
    fi
    log_info "Istio downloaded successfully!"
}
# 安装Istio
install_istio() {
    log_info "Installing Istio with profile: ${ISTIO_PROFILE}"
    # 添加istioctl到PATH
    export PATH=$PWD/${ISTIO_DIR}/bin:$PATH
    # 创建命名空间
    kubectl create namespace ${NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -
    # 使用istioctl安装
    istioctl install --set profile=${ISTIO_PROFILE} -y
    if [ $? -ne 0 ]; then
        log_error "Failed to install Istio"
        exit 1
    fi
    log_info "Istio installed successfully!"
}
# 启用Sidecar注入
enable_sidecar_injection() {
    local namespace=$1
    log_info "Enabling sidecar injection for namespace: ${namespace}"
    kubectl label namespace ${namespace} istio-injection=enabled --overwrite
    if [ $? -ne 0 ]; then
        log_error "Failed to enable sidecar injection"
        exit 1
    fi
    log_info "Sidecar injection enabled for namespace: ${namespace}"
}
# 安装附加组件
install_addons() {
    log_info "Installing Istio addons..."
    # 安装Kiali
    kubectl apply -f ${ISTIO_DIR}/samples/addons/kiali.yaml
    # 安装Prometheus
    kubectl apply -f ${ISTIO_DIR}/samples/addons/prometheus.yaml
    # 安装Grafana
    kubectl apply -f ${ISTIO_DIR}/samples/addons/grafana.yaml
    # 安装Jaeger
    kubectl apply -f ${ISTIO_DIR}/samples/addons/jaeger.yaml
    log_info "Addons installed successfully!"
}
# 验证安装
verify_installation() {
    log_info "Verifying Istio installation..."
    # 检查Pod状态
    echo "Waiting for all pods to be ready..."
    kubectl wait --for=condition=ready pods --all -n ${NAMESPACE} --timeout=300s
    # 显示所有组件
    echo -e "\n${GREEN}Istio Components:${NC}"
    kubectl get all -n ${NAMESPACE}
    # 检查istioctl版本
    echo -e "\n${GREEN}Istio Version:${NC}"
    ${ISTIO_DIR}/bin/istioctl version
}
# 主函数
main() {
    echo "================================================"
    echo "  Istio Service Mesh Auto-Installation Script"
    echo "================================================"
    # 检查参数
    if [ $# -eq 1 ]; then
        ISTIO_PROFILE=$1
    fi
    # 执行安装步骤
    check_prerequisites
    download_istio
    install_istio
    install_addons
    verify_installation
    # 提示启用sidecar注入
    echo -e "\n${GREEN}Installation Complete!${NC}"
    echo "To enable sidecar injection for a namespace, run:"
    echo "  ./install_istio.sh enable <namespace>"
}
# 处理命令行参数
case "${1:-}" in
    enable)
        if [ -z "$2" ]; then
            log_error "Please specify namespace"
            exit 1
        fi
        enable_sidecar_injection "$2"
        ;;
    *)
        main "$@"
        ;;
esac

高级配置脚本

#!/bin/bash
# configure_istio.sh - Istio高级配置脚本
set -e
# 配置Istio网关
configure_gateway() {
    local namespace=$1
    local gateway_name=${2:-"default-gateway"}
    cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: ${gateway_name}
  namespace: ${namespace}
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
EOF
    echo "Gateway ${gateway_name} configured in namespace ${namespace}"
}
# 配置VirtualService
configure_virtual_service() {
    local namespace=$1
    local service_name=$2
    local service_port=$3
    cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: ${service_name}-vs
  namespace: ${namespace}
spec:
  hosts:
  - "${service_name}"
  gateways:
  - default-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: ${service_name}
        port:
          number: ${service_port}
EOF
    echo "VirtualService configured for ${service_name}"
}
# 配置目标规则
configure_destination_rule() {
    local namespace=$1
    local service_name=$2
    cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: ${service_name}-dr
  namespace: ${namespace}
spec:
  host: ${service_name}
  trafficPolicy:
    loadBalancer:
      simple: RANDOM
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        http1MaxPendingRequests: 1024
        http2MaxRequests: 1024
    outlierDetection:
      consecutiveErrors: 5
      interval: 30s
      baseEjectionTime: 30s
EOF
    echo "DestinationRule configured for ${service_name}"
}
# 配置mTLS
enable_mtls() {
    local namespace=$1
    cat <<EOF | kubectl apply -f -
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: ${namespace}
spec:
  mtls:
    mode: STRICT
EOF
    echo "mTLS enabled for namespace ${namespace}"
}
# 配置授权策略
configure_authorization() {
    local namespace=$1
    local service_name=$2
    cat <<EOF | kubectl apply -f -
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: ${service_name}-auth
  namespace: ${namespace}
spec:
  selector:
    matchLabels:
      app: ${service_name}
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/${namespace}/sa/*"]
    to:
    - operation:
        methods: ["GET", "POST"]
EOF
    echo "Authorization policy configured for ${service_name}"
}
# 主命令处理
case "${1:-}" in
    gateway)
        configure_gateway "${2:-default}" "${3:-}"
        ;;
    vs)
        configure_virtual_service "${2:-default}" "${3:-}" "${4:-80}"
        ;;
    dr)
        configure_destination_rule "${2:-default}" "${3:-}"
        ;;
    mtls)
        enable_mtls "${2:-default}"
        ;;
    auth)
        configure_authorization "${2:-default}" "${3:-}"
        ;;
    *)
        echo "Usage: $0 {gateway|vs|dr|mtls|auth} [namespace] [args...]"
        echo ""
        echo "Examples:"
        echo "  $0 gateway default"
        echo "  $0 vs default my-service 8080"
        echo "  $0 dr default my-service"
        echo "  $0 mtls default"
        echo "  $0 auth default my-service"
        exit 1
        ;;
esac

应用部署脚本

#!/bin/bash
# deploy_app.sh - 自动部署应用到Istio网格
set -e
# 部署示例应用
deploy_bookinfo() {
    echo "Deploying Bookinfo sample application..."
    # 创建命名空间并启用注入
    kubectl create namespace bookinfo --dry-run=client -o yaml | kubectl apply -f -
    kubectl label namespace bookinfo istio-injection=enabled
    # 部署Bookinfo应用
    kubectl apply -f istio-1.20.0/samples/bookinfo/platform/kube/bookinfo.yaml -n bookinfo
    # 创建网关和VirtualService
    kubectl apply -f istio-1.20.0/samples/bookinfo/networking/bookinfo-gateway.yaml -n bookinfo
    # 等待Pod就绪
    echo "Waiting for pods to be ready..."
    kubectl wait --for=condition=ready pods --all -n bookinfo --timeout=300s
    # 获取网关地址
    echo "Getting ingress gateway URL..."
    INGRESS_HOST=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
    INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].port}')
    echo "Bookinfo deployed successfully!"
    echo "Access URL: http://${INGRESS_HOST}:${INGRESS_PORT}/productpage"
}
# 部署自定义应用
deploy_custom_app() {
    local app_name=$1
    local image=$2
    local port=$3
    echo "Deploying custom application: ${app_name}"
    # 创建命名空间
    kubectl create namespace ${app_name} --dry-run=client -o yaml | kubectl apply -f -
    kubectl label namespace ${app_name} istio-injection=enabled
    # 创建部署
    cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${app_name}
  namespace: ${app_name}
spec:
  replicas: 2
  selector:
    matchLabels:
      app: ${app_name}
  template:
    metadata:
      labels:
        app: ${app_name}
    spec:
      containers:
      - name: ${app_name}
        image: ${image}
        ports:
        - containerPort: ${port}
---
apiVersion: v1
kind: Service
metadata:
  name: ${app_name}
  namespace: ${app_name}
spec:
  selector:
    app: ${app_name}
  ports:
  - port: ${port}
    targetPort: ${port}
EOF
    echo "Application ${app_name} deployed to namespace ${app_name}"
}
# 重启Pod以注入Sidecar
restart_pods() {
    local namespace=$1
    echo "Restarting pods in namespace ${namespace}..."
    kubectl rollout restart deployment -n ${namespace}
    echo "Waiting for new pods with sidecar..."
    kubectl wait --for=condition=ready pods --all -n ${namespace} --timeout=300s
    echo "Pods restarted with Istio sidecar injected"
}
# 主命令处理
case "${1:-}" in
    bookinfo)
        deploy_bookinfo
        ;;
    custom)
        if [ $# -lt 4 ]; then
            echo "Usage: $0 custom <app-name> <image> <port>"
            exit 1
        fi
        deploy_custom_app "$2" "$3" "$4"
        ;;
    restart)
        restart_pods "${2:-default}"
        ;;
    *)
        echo "Usage: $0 {bookinfo|custom|restart} [args...]"
        echo ""
        echo "Examples:"
        echo "  $0 bookinfo"
        echo "  $0 custom myapp nginx:latest 80"
        echo "  $0 restart mynamespace"
        exit 1
        ;;
esac

使用说明

安装Istio

# 赋予执行权限
chmod +x install_istio.sh configure_istio.sh deploy_app.sh
# 安装Istio (使用默认配置)
./install_istio.sh
# 使用特定配置
./install_istio.sh demo
# 为命名空间启用Sidecar注入
./install_istio.sh enable mynamespace

配置Istio

# 配置网关
./configure_istio.sh gateway default
# 配置VirtualService
./configure_istio.sh vs default my-service 8080
# 配置目标规则
./configure_istio.sh dr default my-service
# 启用mTLS
./configure_istio.sh mtls default
# 配置授权策略
./configure_istio.sh auth default my-service

部署应用

# 部署Bookinfo示例
./deploy_app.sh bookinfo
# 部署自定义应用
./deploy_app.sh custom myapp nginx:latest 80
# 重启Pod注入Sidecar
./deploy_app.sh restart mynamespace

验证和监控

# 验证Sidecar注入
kubectl describe pod <pod-name> -n <namespace> | grep Istio
# 查看Istio配置
istioctl proxy-status
# 访问Kiali仪表板
istioctl dashboard kiali
# 查看指标
istioctl dashboard grafana

这些脚本提供了完整的Istio服务网格自动化配置解决方案，适用于开发和测试环境，在生产环境使用时,请根据实际需求调整配置参数。