istio实验5-熔断

1、部署httpbin服务

# 备份要修改的文件
cp /root/istio-1.24.3/samples/httpbin/httpbin.yaml{,.bak}

# 替换镜像地址
sed -i 's#docker.io/mccutchen/go-httpbin:v2.15.0#swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/mccutchen/go-httpbin:v2.15.0#' /root/istio-1.24.3/samples/httpbin/httpbin.yaml

# 部署httpbin应用
kubectl apply -f /root/istio-1.24.3/samples/httpbin/httpbin.yaml

httpbin.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: httpbin
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
  labels:
    app: httpbin
    service: httpbin
spec:
  ports:
  - name: http
    port: 8000
    targetPort: 8080
  selector:
    app: httpbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
      version: v1
  template:
    metadata:
      labels:
        app: httpbin
        version: v1
    spec:
      serviceAccountName: httpbin
      containers:
      - image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/mccutchen/go-httpbin:v2.15.0
        imagePullPolicy: IfNotPresent
        name: httpbin
        ports:
        - containerPort: 8080

2、配置熔断+连接池限制

• 基于 Istio 实现连接池限流
• 模拟高并发触发熔断机制
• 通过 outlierDetection 实现异常实例自动剔除
• 验证熔断恢复机制（3分钟后重新加入）

# 创建熔断器文件
cat <<EOF>> dr-httpbin.yaml
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: httpbin
spec:
  host: httpbin
  trafficPolicy:
    connectionPool:                   # 连接池配置
      tcp:
        maxConnections: 1             # 只能有1个tcp连接
      http:
        http1MaxPendingRequests: 1    # 只允许1个排队请求，超出直接503
        maxRequestsPerConnection: 1   # 每个连接只处理1个请求，即每个请求都强制新建连接
    outlierDetection:                 # 熔断配置
      consecutive5xxErrors: 1         # 只要1次5xx就踢出实例
      interval: 1s                    # 每 1 秒检测一次
      baseEjectionTime: 3m            # 被踢3分钟，3分钟后实例可以重新加入
      maxEjectionPercent: 100         # 可以踢掉所有实例
EOF

# 部署
kubectl apply -f dr-httpbin.yaml

3、配置客户端

• 创建一个名为 Fortio 的负载测试客户端

# 备份要修改的文件
cp /root/istio-1.24.3/samples/httpbin/sample-client/fortio-deploy.yaml{,.bak}

# 替换镜像地址
sed -i 's#fortio/fortio:latest_release#swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/fortio/fortio:1.71.2#' /root/istio-1.24.3/samples/httpbin/sample-client/fortio-deploy.yaml

# 部署客户端
kubectl apply -f /root/istio-1.24.3/samples/httpbin/sample-client/fortio-deploy.yaml

# 查找pod名称
export FORTIO_POD=$(kubectl get pods -l app=fortio -o 'jsonpath={.items[0].metadata.name}')

# 登入客户端 Pod 并使用 Fortio 工具调用 httpbin 服务
kubectl exec "$FORTIO_POD" -c fortio -- /usr/bin/fortio curl -quiet http://httpbin:8000/get

• 配置熔断+连接池限制的输出如下

4、触发熔断器

# 发送并发数为 3 的连接（-c 3），不限制每秒查询数QPS，请求 30 次（-n 30）：
kubectl exec "$FORTIO_POD" -c fortio -- /usr/bin/fortio load -c 3 -qps 0 -n 30 -loglevel Warning http://httpbin:8000/get

• 输出如下图

• 查询 istio-proxy 状态以了解更多熔断详情

kubectl exec "$FORTIO_POD" -c istio-proxy -- pilot-agent request GET stats | grep httpbin | grep pending