Istio对接虚拟机

按照官方文档配置，但是却没有成功，问题还在查询中，问题：生成的hosts文件为空，虚拟机上istio启动失败，以下是操作步骤：

大致原理：

istio通过workloadEntry和serviceEntry来关联和管理虚拟机，一个workloadEntry可以用来描述一个vm实例，serviceEntry通过workloadSelector标签来绑定workloadEntry,虚拟机启动一个实例时会自动注册，此时istio就可以访问虚拟机了。

serviceEntry的spec.host配置的主机名和virtualService和destinationRule来匹配，以进行流量管理。

虚拟机中安装istio sidecar中的DNS代理会生成k8s服务中的ip映射表，当虚拟机访问某个域名时，会先去DNS代理中查找，这样就实现了虚拟机访问集群的服务（官网配置虚拟机貌似没有使用智能代理，而是把域名文件hosts放到本地/etc/hosts文件中）

准备：一台作为k8s集群（用的阿里的容器服务，把config文件拷贝到本地操作），另一台作为需要注册的虚拟机（阿里的ECS）

集群：

1.设置环境变量

单一网格：
$ VM_APP="<将在这台虚机上运行的应用名>"
$ VM_NAMESPACE="<您的服务所在的命名空间>"
$ WORK_DIR="<证书工作目录>"
$ SERVICE_ACCOUNT="<为这台虚机提供的 Kubernetes 的服务账号名称>"
$ CLUSTER_NETWORK="" <用主集群的network>
$ VM_NETWORK=""
$ CLUSTER="Kubernetes" <用主集群的curstername>VM_APP="myvm"
VM_NAMESPACE="vmgpy"
WORK_DIR="root/myvm"
SERVICE_ACCOUNT="vm-gpy"
CLUSTER_NETWORK="8a33f7da-59e5-48ac-bb06-99b5458b168a"
VM_NETWORK=""
CLUSTER="network-8a33f7da-59e5-48ac-bb06-99b5458b168a"

2.创建工作目录

$ mkdir -p "${WORK_DIR}"

3.安装Istio

1) 配置IstioOperator

$ cat <<EOF > ./vm-cluster.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:name: istio
spec:values:global:meshID: mesh1multiCluster:clusterName: "${CLUSTER}"network: "${CLUSTER_NETWORK}"
EOF

2)执行安装

istioctl install -f vm-cluster.yaml --set values.pilot.env.PILOT_ENABLE_WORKLOAD_ENTRY_AUTOREGISTRATION=true --set values.pilot.env.PILOT_ENABLE_WORKLOAD_ENTRY_HEALTHCHECKS=true### PILOT_ENABLE_WORKLOAD_ENTRY_AUTOREGISTRATION=true：允许workloadentry自动注册
### PILOT_ENABLE_WORKLOAD_ENTRY_HEALTHCHECKS=true: 健康检查

3）.安装东西向网关

samples/multicluster/gen-eastwest-gateway.sh --single-cluster | istioctl install -y -f -

4）.通过东西向网关暴露istiod

kubectl apply -n istio-system -f samples/multicluster/expose-istiod.yaml

5）.创建对应虚拟机的namespace和serviceaccount

kubectl create namespace "${VM_NAMESPACE}"
kubectl create serviceaccount "${SERVICE_ACCOUNT}" -n "${VM_NAMESPACE}"

6）.创建WorkloadGroup资源yaml，该资源连接上虚拟机时会生成WorkloadEntry

cat <<EOF > workloadgroup.yaml
apiVersion: networking.istio.io/v1alpha3
kind: WorkloadGroup
metadata:name: "${VM_APP}"namespace: "${VM_NAMESPACE}"
spec:metadata:labels:app: "${VM_APP}"template:serviceAccount: "${SERVICE_ACCOUNT}"network: "${VM_NETWORK}"
EOF

7）.创建WorkloadGroup资源，控制workloadentry自动注册

kubectl --namespace "${VM_NAMESPACE}" apply -f workloadgroup.yaml

8）.使用WorkloadGroup资源生成cluster.env,hosts,istio-token,mesh.yaml,root-cert.pem

istioctl x workload entry configure -f workloadgroup.yaml -o "${WORK_DIR}" --clusterID "${CLUSTER}" --autoregister

4.把上述文件copy到虚拟机

##scp hosts root@虚拟机ip:虚拟机路径
scp hosts root@114.114.114.114:root
回车后需要输入虚拟机的连接密码
其他文件同样操作

5.虚拟机执行shell命令

#把生成的文件copy到对应目录
sudo mkdir -p /etc/certs
sudo mkdir -p /var/run/secrets/tokens
#文件拷贝到root路径下了
cd root
sudo cp root-cert.pem /etc/certs/root-cert.pem
sudo cp istio-token /var/run/secrets/tokens/istio-token
sudo cp cluster.env /var/lib/istio/envoy/cluster.env
sudo cp mesh.yaml /etc/istio/config/mesh
#在虚拟机上安装istio-sidecar
curl -LO https://storage.googleapis.com/istio-release/releases/1.11.2/rpm/istio-sidecar.rpm
sudo rpm -i istio-sidecar.rpm
#把hosts里的内容追加到本地hosts中
sudo sh -c 'cat hosts >> /etc/hosts'
#给istio-proxy配置权限
sudo mkdir -p /etc/istio/proxy
sudo chown -R istio-proxy /var/lib/istio /etc/certs /etc/istio/proxy /etc/istio/config /var/run/secrets /etc/certs/root-cert.pem
#启动istio
systemctl start istio

启动失败，错误信息

[root@iZbp1dsv500o7zmhce5ujtZ ~]# tail -f /var/log/istio/istio.log
2022-07-29T02:24:56.277986Z     warn    ca      ca request failed, starting attempt 1 in 92.310539ms
2022-07-29T02:24:56.371341Z     warn    ca      ca request failed, starting attempt 2 in 204.921376ms
2022-07-29T02:24:56.576767Z     warn    ca      ca request failed, starting attempt 3 in 416.397229ms
2022-07-29T02:24:56.993374Z     warn    ca      ca request failed, starting attempt 4 in 868.636453ms
2022-07-29T02:24:57.862217Z     warn    sds     failed to warm certificate: failed to generate workload certificate: create certificate: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial tcp: lookup istiod.istio-system.svc on 100.100.2.136:53: no such host"
2022-07-29T02:26:15.319286Z     warn    ca      ca request failed, starting attempt 1 in 94.854681ms
2022-07-29T02:26:15.414647Z     warn    ca      ca request failed, starting attempt 2 in 197.863245ms
2022-07-29T02:26:15.613329Z     warn    ca      ca request failed, starting attempt 3 in 425.648865ms
2022-07-29T02:26:16.039990Z     warn    ca      ca request failed, starting attempt 4 in 790.225062ms
2022-07-29T02:26:16.830675Z     warn    sds     failed to warm certificate: failed to generate workload certificate: create certificate: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial tcp: lookup istiod.istio-system.svc on 100.100.2.136:53: no such host"