下一篇【第68篇】SkyWalking观测Istio ALS模式——Envoy AccessLog直连OAP的完整配置指南上一篇【第70篇】代码性能剖析Profiling——生产环境线程栈采样与火焰图分析一、实战目标本文将带你完成以下目标------------------------------------------------------------------ | 部署目标架构 | ------------------------------------------------------------------ | | | ┌───────────────────────────────────────────────────────────┐ │ | │ Kubernetes Cluster │ │ | │ ┌─────────────┐ │ │ | │ │ istio-system│ ← Istio Control Plane │ │ | │ │ ┌───────┐ │ │ │ | │ │ │istiod │ │ │ │ | │ │ └───────┘ │ │ │ | │ └─────────────┘ │ │ | │ │ │ | │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │ | │ │ frontend │ │ order-svc │ │ payment-svc │ │ │ | │ │ Envoy │ │ Envoy │ │ Envoy │ │ │ | │ └─────────────┘ └─────────────┘ └─────────────┘ │ │ | │ │ │ | │ ┌───────────────────────────────────────────────┐ │ │ | │ │ SkyWalking (monitoring namespace) │ │ │ | │ │ ┌───────┐ ┌───────┐ ┌───────────────┐ │ │ │ | │ │ │ OAP-1 │ │ OAP-2 │ │ SkyWalking UI │ │ │ │ | │ │ └───────┘ └───────┘ └───────────────┘ │ │ │ | │ │ │ │ │ | │ │ ┌──────────────────────────────┐ │ │ │ | │ │ │ Elasticsearch (storage ns) │ │ │ │ | │ │ └──────────────────────────────┘ │ │ │ | │ └───────────────────────────────────────────────┘ │ │ | └───────────────────────────────────────────────────────────┘ │ | | ------------------------------------------------------------------二、步骤一Kubernetes集群准备# # 1.1 验证集群版本# kubectl version--short# 推荐版本: Kubernetes 1.24# # 1.2 创建命名空间# kubectl create namespace istio-system kubectl create namespace monitoring kubectl create namespace storage# # 1.3 安装Helm# # macOSbrewinstallhelm# Linuxcurlhttps://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3|bash# 验证helm version# # 1.4 添加Helm仓库# helm repoaddelastic https://helm.elastic.co helm repoaddskywalking https://apache.jfrog.io/artifactory/skywalking-helm helm repo update三、步骤二安装Elasticsearch存储# # 3.1 安装Elasticsearch (单节点用于测试)# catEOFes-values.yamlreplicas: 1 minimumMasterNodes: 1 clusterHealthCheckParams: wait_for_statusyellowtimeout1s resources: requests: cpu: 1000m memory: 2Gi limits: cpu: 2000m memory: 4Gi volumeClaimTemplate: accessModes: [ReadWriteOnce] resources: requests: storage: 50Gi esJavaOpts: -Xmx2g -Xms2g EOFhelminstallelasticsearch elastic/elasticsearch\--namespacestorage\--valueses-values.yaml\--wait# # 3.2 等待ES就绪# kubectlwait--forconditionready pod\-lappelasticsearch-master\-nstorage\--timeout300s# 验证ESkubectl port-forward-nstorage svc/elasticsearch-master9200:9200curlhttp://localhost:9200/_cluster/health# 预期输出: {cluster_name:...,status:yellow,...}四、步骤三安装Istio并开启ALS# # 4.1 下载Istio# curl-Lhttps://istio.io/downloadIstio|ISTIO_VERSION1.19.0sh-cdistio-1.19.0exportPATH$PWD/bin:$PATH# # 4.2 安装Istio开启ALS# istioctlinstall-f-EOF apiVersion: install.istio.io/v1alpha1 kind: IstioOperator spec: meshConfig: # 开启访问日志服务 enableEnvoyAccessLogService: true accessLogFile: # 禁用文件日志 defaultConfig: # 保持与OAP的连接 terminationDrainDuration: 30s components: pilot: k8s: resources: requests: cpu: 500m memory: 2048Mi values: global: proxy: resources: requests: cpu: 100m memory: 128Mi EOF# 验证Istio安装kubectl get pods-nistio-system# 预期输出: istiod-xxx Running五、步骤四部署SkyWalking# # 5.1 配置SkyWalking Helm Values# catEOFskywalking-values.yamloap: image: tag: 9.7.0 # OAP副本数 replicas: 2 # 资源配置 resources: requests: cpu: 2 memory: 4Gi limits: cpu: 4 memory: 8Gi # Java选项 javaOpts: - -Xmx4g -Xms4g -XX:UseG1GC # 环境变量 env: # 存储: Elasticsearch SW_STORAGE: elasticsearch SW_STORAGE_ES_CLUSTER_NODES: elasticsearch-master.storage:9200 # 启用Envoy mesh ALS SW_ENVOY_METRIC_ALS_ANALYSIS: true SW_ENVOY_METRIC_ALS_TCP_ANALYSIS: false # Telemetry SW_TELEMETRY: prometheus # Service配置 service: type: ClusterIP # 存储卷 storage: size: 20Gi ui: image: tag: 9.7.0 # UI资源配置 resources: requests: cpu: 500m memory: 512Mi # Service类型 service: type: LoadBalancer # 或者用NodePort # type: NodePort # nodePort: 30080 # Elasticsearch (可选: 如果使用内置的ES) elasticsearch: enabled: false # 使用外部ES EOF# # 5.2 安装SkyWalking# helminstallskywalking skywalking/skywalking\--namespacemonitoring\--valuesskywalking-values.yaml\--wait# # 5.3 验证部署# kubectl get pods-nmonitoring# 预期输出:# skywalking-oap-0 Running# skywalking-oap-1 Running# skywalking-ui-xxxxxxxxx-xxxxx Running六、步骤五配置EnvoyFilterALS# # 6.1 确认OAP服务地址# kubectl get svc-nmonitoring skywalking-oap# # 6.2 应用EnvoyFilter# catEOF|kubectl apply-f-apiVersion: networking.istio.io/v1alpha3 kind: EnvoyFilter metadata: name: skywalking-als namespace: istio-system spec: configPatches: - applyTo: NETWORK_FILTER match: context: SIDECAR_OUTBOUND listener: filterChain: filter: name: envoy.filters.network.http_connection_manager patch: operation: MERGE value: typed_config: type: type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager access_log: - name: envoy.access_loggers.http_grpc typed_config: type: type.googleapis.com/envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig common_config: log_name: skywalking transport_api_version: V3 grpc_service: envoy_grpc: cluster_name: outbound|11800||skywalking-oap.monitoring.svc.cluster.local buffer_flush_interval: 5s buffer_size_bytes: 1048576 EOF七、步骤六部署示例应用# # 7.1 创建应用命名空间并注入Envoy# kubectl create namespace demo kubectl label namespace demo istio-injectionenabled# # 7.2 部署示例微服务# catEOF|kubectl apply-ndemo-f-apiVersion: apps/v1 kind: Deployment metadata: name: frontend spec: replicas: 2 selector: matchLabels: app: frontend template: metadata: labels: app: frontend spec: containers: - name: frontend image: nginx:alpine ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: frontend spec: selector: app: frontend ports: - port: 80 targetPort: 80 --- apiVersion: apps/v1 kind: Deployment metadata: name: backend spec: replicas: 2 selector: matchLabels: app: backend template: metadata: labels: app: backend spec: containers: - name: backend image: nginx:alpine ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: backend spec: selector: app: backend ports: - port: 80 targetPort: 80 EOF# # 7.3 验证Pod中已注入Envoy Sidecar# kubectl get pods-ndemo# 每个Pod应该显示 2/2 Running (App Envoy)八、步骤七验证全链路可观测# # 8.1 生成测试流量# # 在frontend Pod中向backend发起请求kubectlexec-it-ndemo deployment/frontend --\sh-cfor i in \$(seq1100); do wget -q -O- http://backend; done# # 8.2 访问SkyWalking UI# # 获取UI的访问地址kubectl get svc-nmonitoring skywalking-ui# 使用port-forwardkubectl port-forward-nmonitoring svc/skywalking-ui8080:80# 浏览器打开 http://localhost:8080九、步骤八配置告警规则# skywalking-alerts.yamlapiVersion:v1kind:ConfigMapmetadata:name:skywalking-oap-alert-rulesnamespace:monitoringdata:alert-rules.yml:|rules: # Service Mesh 服务健康告警 service_resp_time_rule: metrics-name: service_resp_time op: threshold: 1000 period: 10 count: 3 silence-period: 5 message: Service {name} response time 1000ms in last 10 minutes service_sla_rule: metrics-name: service_sla op: threshold: 95 period: 10 count: 2 silence-period: 5 message: Service {name} SLA 95% in last 10 minutes # 端点告警 endpoint_resp_time_rule: metrics-name: endpoint_resp_time op: threshold: 2000 period: 10 count: 2 silence-period: 5 message: Endpoint {name} response time 2000ms# 应用告警规则kubectl apply-fskywalking-alerts.yaml# 重启OAP使告警规则生效kubectl rollout restart deployment-nmonitoring skywalking-oap十、探索你的全链路平台------------------------------------------------------------------ | SkyWalking UI 功能探索地图 | ------------------------------------------------------------------ | | | 菜单栏: | | ┌──────────────┐ | | │ General │ | | │ ├── Service │ ← 查看所有服务、端点、实例 | | │ ├── Topology │ ← 查看服务拓扑图 | | │ └── Trace │ ← 查看完整调用链 | | ├──────────────┤ | | │ Mesh │ | | │ ├── Service │ ← 查看Mesh服务的指标 | | │ ├── Instance │ ← 查看Envoy实例的指标 | | │ └── Topology │ ← Mesh拓扑图 | | ├──────────────┤ | | │ L1 Aggregation│ | | │ └── Layer │ ← 分层查看K8s层/Service Mesh层/通用层 | | ├──────────────┤ | | │ Database │ | | │ └── Browse │ ← 浏览存储的原始数据 | | ├──────────────┤ | | │ Settings │ | | │ └── Alarm │ ← 告警配置 | | └──────────────┘ | | | ------------------------------------------------------------------十一、清理与总结# # 清理命令当不再需要时# # 删除示例应用kubectl delete namespace demo# 卸载SkyWalkinghelm uninstall skywalking-nmonitoring# 卸载Elasticsearchhelm uninstall elasticsearch-nstorage# 卸载Istioistioctl uninstall--purgekubectl delete namespace istio-system实战总结步骤关键点K8s准备确保集群版本、Helm可用存储Elasticsearch作为持久化后端Istio安装时启用ALS禁用文件日志SkyWalking通过Helm安装配置ALS AnalysisEnvoyFilter配置Envoy将日志发送给OAP验证生成流量查看拓扑图下一篇【第68篇】SkyWalking观测Istio ALS模式——Envoy AccessLog直连OAP的完整配置指南上一篇【第70篇】代码性能剖析Profiling——生产环境线程栈采样与火焰图分析