istioctl-commando: opties en 10 voorbeelden

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

A service mesh adds a proxy (Envoy) next to every pod, or a node proxy in ambient mode. The mesh then gives mTLS between services, retries, timeouts and traffic splitting — without changing the apps. istioctl installs Istio, checks the config (analyze) and shows what each proxy really does (proxy-config).

The traffic rules themselves are Kubernetes objects: VirtualService, DestinationRule, Gateway, PeerAuthentication.

Zo schrijf je het

istioctl COMMAND [OPTIONS]

Belangrijkste delen

Commands

install --set profile=NAME: Install Istio (default, demo, minimal, ambient).
verify-install: Check the install.
analyze [-A]: Find problems in the mesh config.
proxy-status: Is every proxy in sync with the control plane?
proxy-config routes|clusters|listeners POD: The Envoy config of one pod.
x describe pod POD: Which rules apply to a pod.
dashboard kiali|grafana|jaeger: Open a dashboard.
upgrade / uninstall --purge: Upgrade / remove Istio.
version: Client and control plane versions.

Opties 6

Meest gebruikt

Options

-n, --namespace NS: Namespace.
-A, --all-namespaces: All namespaces (analyze).
--set KEY=VALUE: Install setting.
-f FILE: IstioOperator file.
-y, --skip-confirmation: No question.
-o json|yaml: Output format.

Voorbeelden 10

$ als gewone gebruiker# als root (of met sudo)

1Install and add the sidecar to a namespace

$istioctl install --set profile=default -y
$kubectl label namespace shop istio-injection=enabled
$kubectl rollout restart deploy -n shop

2Ambient mode (no sidecars)

$istioctl install --set profile=ambient -y
$kubectl label namespace shop istio.io/dataplane-mode=ambient

3Check the config
```
$istioctl analyze -A
```
4Are all proxies in sync?
```
$istioctl proxy-status
```

5Force mTLS in a namespace

$cat peer-auth.yaml
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata: { name: default, namespace: shop }
spec: { mtls: { mode: STRICT } }
$kubectl apply -f peer-auth.yaml

6Canary: 90 % to v1, 10 % to v2

$cat vs.yaml
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata: { name: shop, namespace: shop }
spec:
  hosts: [shop]
  http:
    - route:
        - { destination: { host: shop, subset: v1 }, weight: 90 }
        - { destination: { host: shop, subset: v2 }, weight: 10 }
$kubectl apply -f vs.yaml

7Which rules apply to this pod?

$istioctl x describe pod shop-7d9c-abcde -n shop

8The routes Envoy really uses

$istioctl proxy-config routes deploy/shop -n shop

9Open Kiali (needs the add-on)
```
$istioctl dashboard kiali
```
10Versions
```
$istioctl version
```

Let op

Sidecars add CPU, memory and latency to every pod; size the nodes for it.
STRICT mTLS breaks callers outside the mesh; start with PERMISSIVE and check.

Tips om te onthouden

Linkerd is a lighter mesh with the same basic ideas.

Exitcodes

`0`	OK.
`1`	Error.
`79`	`analyze` found problems.

`istioctl`

Wat het doet

Zo schrijf je het

Belangrijkste delen

Commands

Opties 6

Options

Voorbeelden 10

1Install and add the sidecar to a namespace

2Ambient mode (no sidecars)

3Check the config

4Are all proxies in sync?

5Force mTLS in a namespace

6Canary: 90 % to v1, 10 % to v2

7Which rules apply to this pod?

8The routes Envoy really uses

9Open Kiali (needs the add-on)

10Versions

Let op

Tips om te onthouden

Exitcodes

Volledige handleiding

istioctl

Wat het doet

Zo schrijf je het

Belangrijkste delen

Commands

Opties 6

Options

Voorbeelden 10

1Install and add the sidecar to a namespace

2Ambient mode (no sidecars)

3Check the config

4Are all proxies in sync?

5Force mTLS in a namespace

6Canary: 90 % to v1, 10 % to v2

7Which rules apply to this pod?

8The routes Envoy really uses

9Open Kiali (needs the add-on)

10Versions

Let op

Tips om te onthouden

Exitcodes

Verwante commando's

Gebruikt in deze lessen

Volledige handleiding

`istioctl`