💡 핵심 요약 (Executive Summary)
본 가이드는 쿠버네티스 Helm 패키지 매니저 istio 핵심 가이드 및 실전 아키텍처의 핵심 개념, 실전 구성 명령어 및 아키텍처 베스트 프랙티스를 다룹니다. 클라우드 네이티브 및 인프라 엔지니어링 실무에 즉시 활용 가능하도록 체계적으로 정리했습니다.
📑 Table of Contents
Install
bash
helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo update
kubectl create namespace istio-system
helm pull istio/base --untar
helm pull istio/istiod --untar
cd base
helm install -n istio-system base .
cd ../istiod
helm install -n istio-system istiod --wait .
helm ls -n istio-system
helm status istiod -n istio-system
kubectl get deployments -n istio-system --output wide
# 설치된 리소스 확인
helm get all istiod -n istio-system | grep "kind:"
#사이드카 주입할 ns
kubectl label ns $ns istio-injection=enabledIngress Gateway 엔진 배포
Reference & Guidelines (NOTE)
반드시 istio-ingress 배포시 istio=ingressgateway 라벨을 함께 배포한다. (gateway에서 라벨로 셀렉트)
bash
#kubernetes Gateway api 활성화
#kubectl get crd gateways.gateway.networking.k8s.io &> /dev/null || \
{ kubectl kustomize "github.com/kubernetes-sigs/gateway-api/config/crd?ref=444631bfe06f3bcca5d0eadf1857eac1d369421d" | kubectl apply -f -; }
helm pull istio/gateway --untar
cd ../gateway
kubectl create namespace istio-ingress
helm install -n istio-ingress gateway --wait .Ingress Gateway 리소스 등록
Reference & Guidelines (NOTE)
https gateway에 등록할 TLScredentialName은 반드시 istio-ingressgateway가 배포되어있는 namespace에 존재해야 한다.
bash
kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: httpbin-gateway
spec:
# The selector matches the ingress gateway pod labels.
# If you installed Istio using Helm following the standard documentation, this would be "istio=ingress"
selector:
istio: ingressgateway
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- "httpbin.example.com"
EOF
kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: httpbin
spec:
hosts:
- "httpbin.example.com"
gateways:
- httpbin-gateway
http:
- match:
- uri:
prefix: /status
- uri:
prefix: /delay
route:
- destination:
port:
number: 8000
host: httpbin
EOFgateway 유효성 검사
bash
istioctl analyze -n $nsPrometheus Install
bash
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.21/samples/addons/prometheus.yamlKiali Install
bash
helm repo add kiali https://kiali.org/helm-charts
helm pull kiali/kiali-server --untar
helm install -n istio-system kiali-server .Jaeger Install
bash
helm pull bitnami/jaeger --untar
helm install -n monitoring jaeger .
kubectl apply -f - << EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: jaeger
namespace: monitoring
annotations:
cert-manager.io/cluster-issuer: ca-issuer
nginx.ingress.kubernetes.io/add-base-url: "true"
nginx.ingress.kubernetes.io/from-to-www-redirect: "true"
spec:
ingressClassName: nginx
tls:
- hosts:
- jaeger.fredric.playground.cld
secretName: jaeger.fredric.playground.cld-tls
rules:
- host: jaeger.fredric.playground.cld
http:
paths:
- path: /
backend:
service:
name: jaeger-query
port:
number: 16686
pathType: Prefix
EOFClean Delete
bash
helm delete istio-ingress -n istio-ingress
kubectl delete namespace istio-ingress
helm delete istiod -n istio-system
helm delete istio-base -n istio-system
kubectl delete namespace istio-system
#stable revision label resource
helm template istiod istio/istiod -s templates/revision-tags.yaml --set revisionTags={prod-canary} --set revision=canary -n istio-system | kubectl delete -f -
#installed crd (installed by istio)
kubectl get crd -oname | grep --color=never 'istio.io' | xargs kubectl delete
Leave a Reply