如何通过 Istion 入口网关访问 prometheus 和 grafana？我已经通过 Helm 安装了 promethius anfd grafana

Question

我使用以下命令调出 pod：

kubectl create deployment grafana --image=docker.io/grafana/grafana:5.4.3 -n monitoring

然后我使用以下命令创建 custerIp：

kubectl expose deployment grafana --type=ClusterIP --port=80 --target-port=3000 --protocol=TCP -n monitoring

然后我使用了下面的虚拟服务：

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana
spec:
  hosts:
  - "*"
  gateways:
  - cogtiler-gateway.skydeck
  http:
  - match:
    - uri:
        prefix: /grafana
    route:
    - destination:
        port:
          number: 3000
        host: grafana

kubectl apply -f grafana-virtualservice.yaml -n monitoring

输出：

virtualservice.networking.istio.io/grafana created

现在，当我尝试访问它时，我从 grafana 收到以下错误：

 **If you're seeing this Grafana has failed to load its application files

 1. This could be caused by your reverse proxy settings.

 2. If you host grafana under subpath make sure your grafana.ini root_path setting includes subpath

 3. If you have a local dev build make sure you build frontend using: npm run dev, npm run watch, or npm run build

 4. Sometimes restarting grafana-server can help **

Answer 1

最简单且开箱即用的配置解决方案是使用 grafana host 和 / 前缀。

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: grafana-gateway
  namespace: monitoring
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http-grafana
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana-vs
  namespace: monitoring
spec:
  hosts:
  - "grafana.example.com"
  gateways:
  - grafana-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: grafana
        port:
          number: 80

---

正如您在 cmets 中提到的，I want to use path based routing something like my.com/grafana，也可以进行配置。您可以使用istio rewrite 进行配置。

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: grafana-gateway
  namespace: monitoring
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http-grafana
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana-vs
  namespace: monitoring
spec:
  hosts:
  - "*"
  gateways:
  - grafana-gateway
  http:
  - match:
    - uri:
        prefix: /grafana
    rewrite:
      uri: /
    route:
    - destination:
        host: grafana
        port:
          number: 80

但是，根据github issue，您还需要为此额外配置 grafana。没有正确的 grafana 配置将无法正常工作。

---

我找到了一种在 grafana 部署中使用以下 env 变量 GF_SERVER_ROOT_URL 配置具有不同 url 的方法。

apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  labels:
    app: grafana
  name: grafana
spec:
  replicas: 1
  selector:
    matchLabels:
      app: grafana
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: grafana
    spec:
      containers:
      - image: docker.io/grafana/grafana:5.4.3
        name: grafana
        env:
        - name: GF_SERVER_ROOT_URL
          value: "%(protocol)s://%(domain)s/grafana/"
        resources: {}

还有一个用于该部署的虚拟服务和网关。

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: grafana-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http-grafana
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana-vs
spec:
  hosts:
  - "*"
  gateways:
  - grafana-gateway
  http:
  - match:
    - uri:
        prefix: /grafana/
    rewrite:
      uri: /
    route:
    - destination:
        host: grafana
        port:
          number: 80

Answer 2

您需要创建一个Gateway 以允许在istio-ingressgateway 和您的VirtualService 之间进行路由。

以下内容：

kind: Gateway
metadata:
  name: ingress
  namespace: istio-system 
spec:
  selector:
    # Make sure that the istio-ingressgateway pods have this label
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - my.domain.com      

您还需要一个指向您的 istio-ingressgateway 的 IP 地址的域 (my-domain.com) 的 DNS 条目。

当您的浏览器点击my.domain.com 时，它将被重定向到istio-ingressgateway。 istio-ingressgateway 将检查请求中的 Host 字段，并将请求重定向到 grafana（根据 VirtualService 规则）。

您可以查看kubectl get svc -n istio-system | grep istio-ingressgateway 以获取您的入口网关的公共 IP。

如果您想启用 TLS，则需要为您的域提供 TLS 证书（使用 cert-manager 最简单）。然后您可以在网关中使用 https 重定向，如下所示：

kind: Gateway
metadata:
  name: ingress
  namespace: whatever
spec:
  selector:
    # Make sure that the istio-ingressgateway pods have this label
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - my.domain.com     
      tls:
        httpsRedirect: true
    - port: 
        number: 443
        name: https
        protocol: HTTPS
      hosts:
        - my.domain.com
      tls: 
        mode: SIMPLE
        # name of the secret containing the TLS certificate + keys. The secret must exist in the same namespace as the istio-ingressgateway (probably istio-system namespace)
        # This secret can be created by cert-manager
        # Or you can create a self-signed certificate
        # and add it to manually inside the browser trusted certificates
        credentialName: my-domain-tls

然后是虚拟服务

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana
spec:
  hosts:
  - "my.domain.com"
  gateways:
  - ingress
  http:
  - match:
    - uri:
        prefix: /grafana
    route:
    - destination:
        port:
          number: 3000
        host: grafana