成功最有效的方法就是向有经验的人学习！
        找回密码
当前位置：陈桂林博客 istio 正文

连接池和断路器

2022-04-05 分类：istio 阅读(855) 评论(0)

什么是连接池断路器

连接池指的是http或tcp连接完成时，不销毁连接把他放到池里，供下次连接使用，这样就可以提高效率。这里的连接池通过destinationrule实现，分为tcp配置和http配置。断路器概念来自电源保险丝的概念，当电流过大保险丝就熔断，起到防止电流过载的保护作用。istio中的断路器指的是当错误达到一定的值，就断开开关，直接返回错误，这时处于半开放状态，过一段时间合上开关，如果继续错误就继续断开开关返回错误等待baseEjectionTime时间。

实战

connectionPool

tcp

dr实现

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: productpage
spec:
  host: productpage
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
        connectTimeout: 30ms
        tcpKeepalive:
          time: 7200s
          interval: 75s
          probes: 10

envoyfilter实现

cat << EOF > ef-connectionPool-tcp.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: match
spec:
  workloadSelector:
    labels:
      app: productpage
  configPatches:
  - applyTo: CLUSTER
    match:
      cluster:
        portNumber: 9080
        name: outbound|9080||productpage.istio.svc.cluster.local
    patch:
      operation: REMOVE
  - applyTo: CLUSTER
    patch:
      operation: ADD
      value: 
          circuitBreakers:
            thresholds:
            - max_connections: 100
              maxPendingRequests: 4294967295
              maxRequests: 4294967295
              maxRetries: 4294967295
              trackRemaining: true
          connect_timeout: "0.030s"
          edsClusterConfig:
            edsConfig:
              ads: {}
              initialFetchTimeout: 0s
              resourceApiVersion: V3
            serviceName: outbound|9080||productpage.istio.svc.cluster.local
          filters:
          - name: istio.metadata_exchange
            typedConfig:
              '@type': type.googleapis.com/udpa.type.v1.TypedStruct
              typeUrl: type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange
              value:
                protocol: istio-peer-exchange
          metadata:
            filterMetadata:
              istio:
                default_original_port: 9080
                services:
                  host: productpage.istio.svc.cluster.local
                  name: productpage
                  namespace: istio
          name: outbound|9080||productpage.slime.svc.cluster.local
          transportSocketMatches:
          - match:
              tlsMode: istio
            name: tlsMode-istio
            transportSocket:
              name: envoy.transport_sockets.tls
              typedConfig:
                '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
                commonTlsContext:
                  alpnProtocols:
                  - istio-peer-exchange
                  - istio
                  combinedValidationContext:
                    defaultValidationContext: {}
                    validationContextSdsSecretConfig:
                      name: ROOTCA
                      sdsConfig:
                        apiConfigSource:
                          apiType: GRPC
                          grpcServices:
                          - envoyGrpc:
                              clusterName: sds-grpc
                          setNodeOnFirstMessageOnly: true
                          transportApiVersion: V3
                        initialFetchTimeout: 0s
                        resourceApiVersion: V3
                  tlsCertificateSdsSecretConfigs:
                  - name: default
                    sdsConfig:
                      apiConfigSource:
                        apiType: GRPC
                        grpcServices:
                        - envoyGrpc:
                            clusterName: sds-grpc
                        setNodeOnFirstMessageOnly: true
                        transportApiVersion: V3
                      initialFetchTimeout: 0s
                      resourceApiVersion: V3
                sni: outbound_.443_._.kubernetes.default.svc.cluster.local
          - match: {}
            name: tlsMode-disabled
            transportSocket:
              name: envoy.transport_sockets.raw_buffer
          type: EDS
          upstreamConnectionOptions:
            tcp_keepalive:
              keepalive_probes: 10
              keepalive_time: 7200
              keepalive_interval: 75
EOF

kubectl apply -f  ef-connectionPool-tcp.yaml -n istio --context context-cluster1

http

dr实现

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: productpage
spec:
  host: productpage.istio.svc.cluster.local
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 115
        connectTimeout: 30ms
        tcpKeepalive:
          time: 7200s
          interval: 75s
          probes: 10
      http:
        maxRequestsPerConnection: 115
        http1MaxPendingRequests: 115
        maxRetries: 115
        http2MaxRequests: 115
        h2UpgradePolicy: DEFAULT

envoyfilter实现

cat << EOF > ef-connectionPool-http.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: match
spec:
  workloadSelector:
    labels:
      app: productpage
  configPatches:
  - applyTo: CLUSTER
    match:
      cluster:
        portNumber: 9080
        name: outbound|9080||productpage.istio.svc.cluster.local
    patch:
      operation: REMOVE
  - applyTo: CLUSTER
    patch:
      operation: ADD
      value: 
          circuitBreakers:
            thresholds:
            - maxConnections: 115
              maxPendingRequests: 115
              maxRequests: 115
              maxRetries: 115
              trackRemaining: true
          connectTimeout: 0.030s
          edsClusterConfig:
            edsConfig:
              ads: {}
              initialFetchTimeout: 0s
              resourceApiVersion: V3
            serviceName: outbound|9080||productpage.istio.svc.cluster.local
          filters:
          - name: istio.metadata_exchange
            typedConfig:
              '@type': type.googleapis.com/udpa.type.v1.TypedStruct
              typeUrl: type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange
              value:
                protocol: istio-peer-exchange
          maxRequestsPerConnection: 115
          metadata:
            filterMetadata:
              istio:
                default_original_port: 9080
                services:
                  host: productpage.istio.svc.cluster.local
                  name: productpage
                  namespace: istio
          name: outbound|9080||productpage.istio.svc.cluster.local
          transportSocketMatches:
          - match:
              tlsMode: istio
            name: tlsMode-istio
            transportSocket:
              name: envoy.transport_sockets.tls
              typedConfig:
                '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
                commonTlsContext:
                  alpnProtocols:
                  - istio-peer-exchange
                  - istio
                  combinedValidationContext:
                    defaultValidationContext:
                      matchSubjectAltNames:
                      - exact: spiffe://cluster.local/ns/istio/sa/bookinfo-productpage
                    validationContextSdsSecretConfig:
                      name: ROOTCA
                      sdsConfig:
                        apiConfigSource:
                          apiType: GRPC
                          grpcServices:
                          - envoyGrpc:
                              clusterName: sds-grpc
                          setNodeOnFirstMessageOnly: true
                          transportApiVersion: V3
                        initialFetchTimeout: 0s
                        resourceApiVersion: V3
                  tlsCertificateSdsSecretConfigs:
                  - name: default
                    sdsConfig:
                      apiConfigSource:
                        apiType: GRPC
                        grpcServices:
                        - envoyGrpc:
                            clusterName: sds-grpc
                        setNodeOnFirstMessageOnly: true
                        transportApiVersion: V3
                      initialFetchTimeout: 0s
                      resourceApiVersion: V3
                sni: outbound_.443_._.kubernetes.default.svc.cluster.local
          - match: {}
            name: tlsMode-disabled
            transportSocket:
              name: envoy.transport_sockets.raw_buffer
          type: EDS
          upstreamConnectionOptions:
            tcpKeepalive:
              keepaliveInterval: 75
              keepaliveProbes: 10
              keepaliveTime: 7200
EOF

kubectl apply -f  ef-connectionPool-http.yaml -n istio --context context-cluster1

outlierDetection

dr实现

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: productpage
spec:
  host: productpage.istio.svc.cluster.local
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 1
        connectTimeout: 30ms
      http:
        maxRequestsPerConnection: 1
        http1MaxPendingRequests: 1
    outlierDetection:
      consecutive5xxErrors: 1
      interval: 5s
      baseEjectionTime: 5s
      maxEjectionPercent: 100

envoyfilter实现

cat << EOF > ef-outlierDetection.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: match
spec:
  workloadSelector:
    labels:
      app: productpage
  configPatches:
  - applyTo: CLUSTER
    match:
      cluster:
        portNumber: 9080
        name: outbound|9080||productpage.istio.svc.cluster.local
    patch:
      operation: REMOVE
  - applyTo: CLUSTER
    patch:
      operation: ADD
      value: 
          circuitBreakers:
            thresholds:
            - maxConnections: 1
              maxPendingRequests: 1
              maxRequests: 4294967295
              maxRetries: 4294967295
              trackRemaining: true
          commonLbConfig:
            healthyPanicThreshold: {}
          connectTimeout: 0.030s
          edsClusterConfig:
            edsConfig:
              ads: {}
              initialFetchTimeout: 0s
              resourceApiVersion: V3
            serviceName: outbound|9080||productpage.istio.svc.cluster.local
          filters:
          - name: istio.metadata_exchange
            typedConfig:
              '@type': type.googleapis.com/udpa.type.v1.TypedStruct
              typeUrl: type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange
              value:
                protocol: istio-peer-exchange
          maxRequestsPerConnection: 1
          metadata:
            filterMetadata:
              istio:
                config: /apis/networking.istio.io/v1alpha3/namespaces/istio/destination-rule/productpage
                default_original_port: 9080
                services:
                - host: productpage.istio.svc.cluster.local
                  name: productpage
                  namespace: istio
          name: outbound|9080||productpage.istio.svc.cluster.local
          outlierDetection:
            baseEjectionTime: 5s
            consecutive5xx: 1
            enforcingConsecutive5xx: 100
            enforcingSuccessRate: 0
            interval: 5s
            maxEjectionPercent: 100
          transportSocketMatches:
          - match:
              tlsMode: istio
            name: tlsMode-istio
            transportSocket:
              name: envoy.transport_sockets.tls
              typedConfig:
                '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
                commonTlsContext:
                  alpnProtocols:
                  - istio-peer-exchange
                  - istio
                  combinedValidationContext:
                    defaultValidationContext:
                      matchSubjectAltNames:
                      - exact: spiffe://cluster.local/ns/istio/sa/bookinfo-productpage
                    validationContextSdsSecretConfig:
                      name: ROOTCA
                      sdsConfig:
                        apiConfigSource:
                          apiType: GRPC
                          grpcServices:
                          - envoyGrpc:
                              clusterName: sds-grpc
                          setNodeOnFirstMessageOnly: true
                          transportApiVersion: V3
                        initialFetchTimeout: 0s
                        resourceApiVersion: V3
                  tlsCertificateSdsSecretConfigs:
                  - name: default
                    sdsConfig:
                      apiConfigSource:
                        apiType: GRPC
                        grpcServices:
                        - envoyGrpc:
                            clusterName: sds-grpc
                        setNodeOnFirstMessageOnly: true
                        transportApiVersion: V3
                      initialFetchTimeout: 0s
                      resourceApiVersion: V3
                sni: outbound_.9080_._.productpage.istio.svc.cluster.local
          - match: {}
            name: tlsMode-disabled
            transportSocket:
              name: envoy.transport_sockets.raw_buffer
          type: EDS
EOF

kubectl apply -f  ef-outlierDetection.yaml -n istio --context context-cluster1
赞(0) 打赏
未经允许不得转载：陈桂林博客 » 连接池和断路器
分享到

陈桂林

CKA,CKS双认证，有多年kubernetes一线经验。 某知名企业高级DevOps工程师，K8s运维架构师，Linux集群架构专家。

相关推荐

大佬们的评论 抢沙发

取消

吐血推荐

女生也可以快速建出专业的网站

鼠标拖拽,所见即所得的编辑方式,页面灵活布局,模块自由删减,简单易用。
自主自助建站品牌,易于扩展，无限升级近千套精美网站模板,不断增加中。
自带网站空间,无需另外购买,快速开展业务。

热门专题

分类目录

猜你喜欢

全新“一站式”建站，高质量、高售后的一条龙服务

微信 抖音 支付宝 百度 头条 快手全平台打通信息流

橙子建站.极速智能建站8折购买虚拟主机

觉得文章有用就打赏一下文章作者

非常感谢你的打赏，我们将继续给力更多优质内容，让我们一起创建更加美好的网络世界！

支付宝扫一扫打赏

微信扫一扫打赏

登录

找回密码

注册