1. 简介

如果想控制被注入的pod访问外部流量,那么需要把外界主机拉入到网格,serviceEntry把网格之外的主机,假象是在网格里,之后便可通过vs控制出口流量。

2. 创建se

2.1 DNS解析

1
2
3
4
5
6
7
8
9
10
11
12
13
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: myes
spec:
hosts:
- www.baidu.com
ports:
- number: 443
name: https
protocol: HTTPS
resolution: DNS
location: MESH_EXTERNAL

MESH_EXTERNAL – 网格外部
MESH_INTERNAL – 网格内

2.2 静态指定

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: myes
spec:
hosts:
- test.k8s.com
ports:
- number: 8888
name: http
protocol: HTTP
resolution: STATIC
location: MESH_EXTERNAL
endpoints:
- address: 192.168.10.10

2.3 创建vs

延迟4秒响应

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: myvs3
spec:
hosts:
- test.k8s.com
http:
- timeout: 5s
fault:
delay:
percent: 100
fixedDelay: 4s
route:
- destination:
host: test.k8s.com

2.4 exportTo

是否影响其他命名空间,如果是.则不影响,如果是*则影响,默认是 *

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: myes
spec:
hosts:
- test.k8s.com
exportTo:
- "."
ports:
- number: 8888
name: http
protocol: HTTP
resolution: STATIC
location: MESH_EXTERNAL
endpoints:
- address: 192.168.10.10

3. 默认策略

默认允许访问所有地址,修改为只允许访问注入的地址

1
istioctl install --set profile=demo -y --set meshConfig.outboundTrafficPolicy.mode=REGISTRY_ONLY

kubectl edit configmap istio -n istio-system

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
data:
mesh: |-
accessLogFile: /dev/stdout
defaultConfig:
discoveryAddress: istiod.istio-system.svc:15012
proxyMetadata: {}
tracing:
zipkin:
address: zipkin.istio-system:9411
enablePrometheusMerge: true
outboundTrafficPolicy:
mode: REGISTRY_ONLY
rootNamespace: istio-system
trustDomain: cluster.local
meshNetworks:
'
networks: {}'

3.1 创建se

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: myes
spec:
hosts:
- www.baidu.com
ports:
- number: 443
name: https
protocol: HTTPS
- number: 80
name: http
protocol: HTTP
resolution: DNS
location: MESH_EXTERNAL