如何通过Istion ingress gateway访问prometheus & grafana？我已经通过 Helm 安装了 promethius anfd grafana

Question

我使用以下命令调出 pod：

kubectl create deployment grafana --image=docker.io/grafana/grafana:5.4.3 -n monitoring

然后我使用下面的命令创建了 custerIp:

kubectl expose deployment grafana --type=ClusterIP --port=80 --target-port=3000 --protocol=TCP -n monitoring

然后我使用了以下虚拟服务：

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana
spec:
  hosts:
  - "*"
  gateways:
  - cogtiler-gateway.skydeck
  http:
  - match:
    - uri:
        prefix: /grafana
    route:
    - destination:
        port:
          number: 3000
        host: grafana

kubectl apply -f grafana-virtualservice.yaml -n monitoring

输出：

virtualservice.networking.istio.io/grafana created

现在，当我尝试访问它时，grafana 出现以下错误：

 **If you're seeing this Grafana has failed to load its application files

 1. This could be caused by your reverse proxy settings.

 2. If you host grafana under subpath make sure your grafana.ini root_path setting includes subpath

 3. If you have a local dev build make sure you build frontend using: npm run dev, npm run watch, or npm run build

 4. Sometimes restarting grafana-server can help **

Answer 1

您需要创建一个 Gateway 以允许 istio-ingressgateway 和您的 VirtualService 之间的路由。

行中的内容：

kind: Gateway
metadata:
  name: ingress
  namespace: istio-system 
spec:
  selector:
    # Make sure that the istio-ingressgateway pods have this label
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - my.domain.com

您还需要一个指向您的 istio-ingressgateway IP 地址的域 (my-domain.com) 的 DNS 条目。

当您的浏览器点击 my.domain.com 时，它将被重定向到 istio-ingressgateway。 istio-ingressgateway 将检查请求中的 Host 字段，并将请求重定向到 grafana（根据 VirtualService 规则）。

您可以检查 kubectl get svc -n istio-system | grep istio-ingressgateway 以获取入口网关的 public IP。

如果您想启用 TLS，则需要为您的域提供 TLS 证书（使用 cert-manager 最简单）。然后你可以在你的网关中使用 https 重定向，像这样:


kind: Gateway
metadata:
  name: ingress
  namespace: whatever
spec:
  selector:
    # Make sure that the istio-ingressgateway pods have this label
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - my.domain.com     
      tls:
        httpsRedirect: true
    - port: 
        number: 443
        name: https
        protocol: HTTPS
      hosts:
        - my.domain.com
      tls: 
        mode: SIMPLE
        # name of the secret containing the TLS certificate + keys. The secret must exist in the same namespace as the istio-ingressgateway (probably istio-system namespace)
        # This secret can be created by cert-manager
        # Or you can create a self-signed certificate
        # and add it to manually inside the browser trusted certificates
        credentialName: my-domain-tls

那你VirtualService

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana
spec:
  hosts:
  - "my.domain.com"
  gateways:
  - ingress
  http:
  - match:
    - uri:
        prefix: /grafana
    route:
    - destination:
        port:
          number: 3000
        host: grafana

Answer 2

最简单且开箱即用的配置解决方案是使用 grafana host 和 / 前缀。

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: grafana-gateway
  namespace: monitoring
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http-grafana
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana-vs
  namespace: monitoring
spec:
  hosts:
  - "grafana.example.com"
  gateways:
  - grafana-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: grafana
        port:
          number: 80

正如您在评论中提到的，I want to use path based routing something like my.com/grafana，这也是可以配置的。您可以使用 istio rewrite 进行配置。

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: grafana-gateway
  namespace: monitoring
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http-grafana
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana-vs
  namespace: monitoring
spec:
  hosts:
  - "*"
  gateways:
  - grafana-gateway
  http:
  - match:
    - uri:
        prefix: /grafana
    rewrite:
      uri: /
    route:
    - destination:
        host: grafana
        port:
          number: 80

但是，根据此 github issue，您还需要为此额外配置 grafana。如果没有正确的 grafana 配置，将无法正常工作。

我找到了一种在 grafana 部署中使用以下环境变量 GF_SERVER_ROOT_URL 配置具有不同 url 的 grafana 的方法。

apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  labels:
    app: grafana
  name: grafana
spec:
  replicas: 1
  selector:
    matchLabels:
      app: grafana
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: grafana
    spec:
      containers:
      - image: docker.io/grafana/grafana:5.4.3
        name: grafana
        env:
        - name: GF_SERVER_ROOT_URL
          value: "%(protocol)s://%(domain)s/grafana/"
        resources: {}

该部署还有一个虚拟服务和网关。

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: grafana-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http-grafana
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: grafana-vs
spec:
  hosts:
  - "*"
  gateways:
  - grafana-gateway
  http:
  - match:
    - uri:
        prefix: /grafana/
    rewrite:
      uri: /
    route:
    - destination:
        host: grafana
        port:
          number: 80

如何通过Istion ingress gateway访问prometheus & grafana？我已经通过 Helm 安装了 promethius anfd grafana

How to access the prometheus & grafana via Istion ingress gateway? I have installed the promethius anfd grafana through Helm

kubernetes

grafana

kubernetes-ingress

istio

istio-sidecar