使用Istio对某个服务进行限流控制测试

3,164 阅读3分钟

每日一句:今天最好的表现,是明天最低的要求!

因为要对微服务项目进行流量限制,于是就是学习了下istio的官网教程,下面示例代码需要改成你自己的服务名就可生效了。

开启限流

  • istio默认是开启的,为false表示已经开启了。
kubectl -n istio-system get cm istio -o jsonpath="{@.data.mesh}" | grep disablePolicyChecks
  • 没有启动的话,修改一下就可以了
istioctl manifest apply --set values.global.disablePolicyChecks=false

限流的组成部分

限速配置分为两个部分

client Side

  • QuotaSpec: 定义客户端应该请求的配额名称和数量 (指定quota)
  • QuotaSpecBinding: 有条件的将QuotaSpec与一项或多项服务相关联(把quota spec绑定到你想要绑定的服务上去。如果是service:'*' ,则把所有服务都绑定到QuotaSpec上)

Mixer Side

  • quota instance : 定义Mixer如何确定(根据那些字段)配额
  • memquota handler : 定义memquota适配器(adapter)配置
  • quota rule: 定义何时将配额实例调度到memquota适配器(为handler指定对应的instance)
  • 生产系统中建议使用redisquota,两种配置是一样的。
  • redis的话,修改redisServerUrl 和rateLimitAlgorithm两个字段就可用了。
  • Redis quota 依赖redis server 来储存quota values, redis作为一个共享的数据储存

代码示例

  • 定义了上面的5个对象:
apiVersion: config.istio.io/v1alpha2
kind: memquota
metadata:
  name: handler
  namespace: istio-system
spec:
  quotas:
  - name: requestcount.quota.istio-system
    maxAmount: 500
    validDuration: 1s
    # The first matching override is applied.
    # A requestcount instance is checked against override dimensions.
    overrides:
    # The following override applies to 'reviews' regardless
    # of the source.
    - dimensions:
        destination: reviews
      maxAmount: 1
      validDuration: 5s
    # The following override applies to 'productpage' when
    # the source is a specific ip address.
    - dimensions:
        destination: productpage
        source: "10.28.11.20"
      maxAmount: 500
      validDuration: 1s
    # The following override applies to 'productpage' regardless
    # of the source.
    - dimensions:
        destination: productpage
      maxAmount: 2
      validDuration: 5s
---
apiVersion: config.istio.io/v1alpha2
kind: quota
metadata:
  name: requestcount
  namespace: istio-system
spec:
  dimensions:
    source: request.headers["x-forwarded-for"] | "unknown"
    destination: destination.labels["app"] | destination.service.name | "unknown"
    destinationVersion: destination.labels["version"] | "unknown"
---
apiVersion: config.istio.io/v1alpha2
kind: QuotaSpec
metadata:
  name: request-count
  namespace: istio-system
spec:
  rules:
  - quotas:
    - charge: 1
      quota: requestcount
---
apiVersion: config.istio.io/v1alpha2
kind: QuotaSpecBinding
metadata:
  name: request-count
  namespace: istio-system
spec:
  quotaSpecs:
  - name: request-count
    namespace: istio-system
  services:
  - name: productpage
    namespace: default
    #  - service: '*'  # Uncomment this to bind *all* services to request-count
---
apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: quota
  namespace: istio-system
spec:
  # quota only applies if you are not logged in.
  # match: match(request.headers["cookie"], "user=*") == false
  actions:
  - handler: handler.memquota
    instances:
    - requestcount.quota

代码内容解释

  • memquota里面4个不同的限速方案:
  1. 如果下面的没有匹配的,默认每秒最大500个请求
  2. 如果目标服务是reviews, 每5s最多1个请求
  3. 如果目标服务是productpage and source is 10.28.11.20,每秒500请求
  4. 如果目标服务是productpage ,每5s最多2个请求

代码运行结果

当部署完后,刷新productpage页面,会出现RESOURCE_EXHAUSTED:Quota is exhausted for: requestcount.

部署和确认创建结果

服务需要使用VirtualService

kubectl apply -f mixer-ratelimit.yaml

确认quota instance 是否created

这个查询不到,但是也限速测试也生效了

kubectl get instance requestcountquota -o yaml  -n istio-system

kubectl get instance    -n istio-system

确认quota rule 是否被创建

kubectl  get rule quota -o yaml -n istio-system
kubectl  get rule  -n istio-system

确认quotaSpec 是否被创建

kubectl get QuotaSpec request-count -o yaml -n istio-system

确认quotaSpecBinding 是否被创建

kubectl -n istio-system get QuotaSpecBinding request-count -o yaml

clean up

上面测试完了后就可以清理掉了

kubectl delete -f  mixer-ratelimit-crd.yaml

其它

根据条件限制速率

  • 比如根据cookie,确保已经登录的用户不受速率限制的影响
kubectl -n istio-system edit rules quota
...
spec:
  match: match(request.headers["cookie"], "session=*") == false
  actions:
...

对速率限制的理解

通过前面的例子,我们理解了Mixer是如何根据匹配的条件对请求进行速率限制的

  • 当最后一个validDuration期限内请求数超过了maxAmount,Mixer 会向Envoy代理返回一个RESOURCE_EXHAUSTED消息,Envoy会像调用者返回HTTP 429
  • memquota 使用滑动窗口协议来进行速率限制,可以配置为ROLLING_WINDOW 或者 FIXED_WINDOW
  • FIXED_WINDOW 允许两倍峰值的指定速率,而滚动窗口则不允许
  • ROLLING_WINDOW 精度的提高是以增加Redis资源使用为代价的

参考质料

  • istio官网