配置 Istio 进行外部路由

将 Istio 配置为入口控制器，以便从 Kubernetes 集群外部访问 Redis Enterprise 数据库。

适用于 Kubernetes 的 Redis Enterprise

Redis Enterprise for Kubernetes 能够使用 Istio Ingress 网关作为 NGINX 或 HaProxy Ingress 控制器的替代方案。

Istio 也可以理解 Ingress 资源，但使用该机制会剥夺原生 Istio 资源提供的优势和选项。Istio 使用自定义资源提供自己的配置方法。

要将 Istio 配置为与 Redis Kubernetes Operator 配合使用，我们将使用两个自定义资源：一个Gateway以及VirtualService.然后，您将能够建立对数据库的外部访问权限。

安装和配置 Istio for Redis Enterprise

  1. 下载并安装 Istio（请参阅 Istio 的入门指南中的说明）。

    安装完成后，所有部署、Pod 和服务都将部署在名为istio-system.此命名空间包含一个LoadBalancer键入名为service/istio-ingressgateway，这将公开外部 IP 地址。

  2. 查找EXTERNAL-IP对于istio-ingressgateway服务。

    kubectl get svc istio-ingressgateway -n istio-system

NAME                   TYPE           CLUSTER-IP     EXTERNAL-IP      PORT(S)                                                                      AGE
istio-ingressgateway   LoadBalancer   10.34.67.89   10.145.78.91   15021:12345/TCP,80:67891/TCP,443:23456/TCP,31400:78901/TCP,15443:10112/TCP   3h8m

  3. Create a DNS entry that resolves your chosen database hostname (or a wildcard * followed by your domain) to the Istio EXTERNAL-IP. Use this hostname to access your database from outside the cluster.

    In this example, any hostname that ends with .istio.k8s.my.example.com will resolve to the Istio LoadBalancer's external IP of 10.145.78.91. Substitute your own values accordingly.

  4. Verify the record was created successfully.

    dig api.istio.k8s.my.example.com

    Look in the ANSWER SECTION for the record you just created.

    ;; ANSWER SECTION:
api.istio.k8s.my.example.com 0 IN    A       10.145.78.91

Create custom resources

Gateway custom resource

  1. On a different namespace from istio-system, create a Gateway custom resource file (redis-gateway.yaml in this example).

    • Replace .istio.k8s.my.example.com with the domain that matches your DNS record.
    • Replace <selector-label> with the label set on your Istio ingress gateway pod (most common is istio: ingress).
    • TLS passthrough mode is required to allow secure access to the database.
    apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: redis-gateway
spec:
  selector:
    istio: <selector-label>
  servers:
  - hosts:
    - '*.istio.k8s.my.example.com'
    port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      mode: PASSTHROUGH

  2. Apply the Gateway custom resource file to create the Ingress gateway.

    kubectl apply -f redis-gateway.yaml

  3. Verify the gateway was created successfully.

    kubectl get gateway

NAME            AGE
redis-gateway   3h33m

VirtualService custom resource

  1. On a different namespace than istio-system, create the VirtualService custom resource file (redis-vs.yaml in this example).

    apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: redis-vs
spec:
  gateways:
  - redis-gateway
  hosts:
  - "*.istio.k8s.my.example.com"
  tls:
  - match:
    - port: 443
      sniHosts:
      - api.istio.k8s.my.example.com
    route:
    - destination:
        host: rec1
        port:
          number: 9443
  - match:
    - port: 443
      sniHosts:
      - db1.istio.k8s.my.example.com
    route:
    - destination:
        host: db1

    This creates both a route to contact the API server on the REC (rec1) and a route to contact one of the databases (db1).

    • Replace .istio.k8s.my.example.com with the domain that matches your DNS record.
    • The gateway's metadata name must be similar to the gateway's spec name (redis-gateway in this example).

  2. Apply VirtualService custom resource file to create the virtual service.

    kubectl apply -f redis-vs.yaml

  3. Verify the virtual service was created successfully.

    kubectl get vs

NAME       GATEWAYS            HOSTS                              AGE
redis-vs   ["redis-gateway"]   ["*.istio.k8s.my.example.com"]   3h33m

  4. Deploy the operator, Redis Enterprise Cluster (REC), and Redis Enterprise Database (REDB) on the same namespace as the gateway and virtual service.

Test your external access to the database

To test your external access to the database, you need a client that supports TLS and SNI.

See Test your access with Openssl or Test your access with Python for more info.

RATE THIS PAGE
Back to top ↑