简体繁体 English

为什么 Istio 要求 Pod 至少属于 Kubernetes 中的一个 Service？

[英]Why does Istio require Pods belong to at least one Service in Kubernetes?

原文 2020-01-10 13:13:40 7 1 kubernetes/ istio

Istio's deployment requirements state that a Pod must belong to at least one Kubernetes Service in order to form part of an Istio mesh. Istio 的部署要求规定一个Pod 必须至少属于一个 Kubernetes 服务才能形成 Istio 网格的一部分。 One of the reasons for this as I understand it is to create an entry to refer to the Pod (or group of Pods) in configuration rules (eg <serviceName>.<namespace>.svc.cluster.local ).据我了解，这样做的原因之一是在配置规则（例如<serviceName>.<namespace>.svc.cluster.local ）中创建一个条目来引用 Pod（或 Pod 组）。

Are there any other reasons?还有其他原因吗？

1 个解决方案

Many of Istio's features (policy enforcement, distributed tracing, cross-service metrics) depend on knowing what service a request is coming from .许多Istio的功能（策略执行，分布式跟踪，跨服指标）依赖于知道什么服务的请求的来源。 Ordinarily you only need to create Kubernetes services to route inbound requests to specific pods, but Istio uses them more generally to associate pods with abstract "services".通常你只需要创建 Kubernetes 服务来将入站请求路由到特定的 pod，但 Istio 更普遍地使用它们来将 pod 与抽象的“服务”相关联。

Say pod A is calling pod B. Even in plain Kubernetes you need a service for B, and the request from A would target the service rather than the pod directly.假设 pod A 正在调用 pod B。即使在普通的 Kubernetes 中，您也需要为 B 提供服务，并且来自 A 的请求将针对服务而不是直接针对 pod。 If you set up, for example, metrics in Istio (maybe using its built-in Prometheus), then Istio also tries to look up a service for A. If it finds it then you'll see metrics like istio_requests_total(source_service="A", destination_service="B") .例如，如果您在 Istio 中设置指标（可能使用其内置的 Prometheus），那么 Istio 也会尝试查找 A 的服务。如果找到它，那么您将看到类似istio_requests_total(source_service="A", destination_service="B") 。 If it doesn't the source will just show up as "unknown".如果不是，则来源将仅显示为“未知”。