安裝Istio前要確認一下目前k8s版本跟要安裝的istio版本是否支援

目前最新版的istio的k8s地板已經是1.19了= =

下載istio

這邊的istio版本為1.11.3，如果有需要執行istioctl可以加入istioctl的path

curl -L https://istio.io/downloadIstio | sh -
Downloading istio-1.11.3 from https://github.com/istio/istio/releases/download/1.11.3/istio-1.11.3-osx.tar.gz ...
Istio 1.11.3 Download Complete!

Istio has been successfully downloaded into the istio-1.11.3 folder on your system.

Next Steps:
See https://istio.io/latest/docs/setup/install/ to add Istio to your Kubernetes cluster.

To configure the istioctl client tool for your workstation,
add the /Users/your_name/istio-1.11.3/bin directory to your environment path variable with:
	 export PATH="$PATH:/Users/your_name/istio-1.11.3/bin"

如果想要下載指定檔案可以使用以下指令

curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.11.2 TARGET_ARCH=x86_64 sh -

打開istio來看看，如果看到這些folder就沒錯啦~

部署istio

官網是什麼istioctl進行安裝，這邊就使用前面介紹的helm來安裝吧!

先確認自己在哪個context，對k8s進行部署前都要先確認一下比較安全

kubectl config current-context

建立namespace istio-system，為什麼叫istio-system嗎？打完看一下values的設定就知道了/images/emoticon/emoticon01.gif

kubectl create namespace istio-system

安裝istio基礎元件

helm install istio-base manifests/charts/base -n istio-system
NAME: istio-base
LAST DEPLOYED: Tue Sep 28 09:35:10 2021
NAMESPACE: istio-system
STATUS: deployed
REVISION: 1
TEST SUITE: None

安裝istiod 全家桶

helm install istiod manifests/charts/istio-control/istio-discovery -n istio-system
NAME: istiod
LAST DEPLOYED: Tue Sep 28 09:36:04 2021
NAMESPACE: istio-system
STATUS: deployed
REVISION: 1
TEST SUITE: None

安裝istio ingress/egress，如果會有外部流量進來的需求時就要裝istio-ingress，需要導流量至外部時就裝

helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
helm install istio-egress manifests/charts/gateways/istio-egress -n istio-system

檢驗是否istio安裝完成

helm這邊都有deployed 加上 istio的pod都有正常啟動

helm ls -ANAME            NAMESPACE       REVISION        UPDATED                             STATUS   CHART                   APP VERSION
istio-base      istio-system    1               2021-09-28 10:42:49.10494 +0800 CST deployed base-1.11.3                        
istio-egress    istio-system    1               2021-09-28 11:27:06.46828 +0800 CST deployed istio-egress-1.11.3                
istio-ingress   istio-system    2               2021-09-28 11:25:58.629334 +0800 CSTdeployed istio-ingress-1.11.3               
istiod          istio-system    2               2021-09-28 11:06:49.568821 +0800 CSTdeployed istio-discovery-1.11.3             

kubectl get pods -n istio-system
NAME                                    READY   STATUS    RESTARTS   AGE
istio-egressgateway-5f6bd66bcd-mtdqs    1/1     Running   0          3m54s
istio-ingressgateway-86b7fdcc6c-cf7nc   1/1     Running   0          5m2s
istiod-7c486676f8-gbppd                 1/1     Running   0          24m

加上istio-injection

istio-injection是以namespace來做注入，所以要幫namesapce加上label

kubectl label namespace default istio-injection=enabled

測試部署服務

這邊就直接使用istio 1.11.3裡面的sample/bookinfo的yaml來測試

kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml

這時候如果發現deployment部署不起來時，如果錯誤為

Error creating: Internal error occurred: failed calling webhook "namespace.sidecar-injector.istio.io": Post "https://istiod.istio-system.svc:443/inject?timeout=10s": context deadline exceeded

這是k8s node的防火牆沒有開啟15017跟9443這二個port喔

移除istio

helm ls -n istio-system
NAME            NAMESPACE       REVISIONUPDATED                             STATUS   CHART                   APP VERSION
istio-base      istio-system    1               2021-09-28 10:42:49.10494 +0800 CST deployed base-1.11.3                        
istio-egress    istio-system    1               2021-09-28 11:27:06.46828 +0800 CST deployed istio-egress-1.11.3                
istio-ingress   istio-system    2               2021-09-28 11:25:58.629334 +0800 CSTdeployed istio-ingress-1.11.3               
istiod          istio-system    2               2021-09-28 11:06:49.568821 +0800 CSTdeployed istio-discovery-1.11.3     

helm delete istio-egress
helm delete istio-ingress 
helm delete istiod
helm delete istio-base
kubectl delete namespace istio-system
kubectl label namespace default istio-injection-

基本上helm delete已經把部署上去的istio相關component都移除了啦~~