问题描述
我使用以下命令来启动 pod：
kubectl create deployment grafana --image=docker.io/grafana/grafana:5.4.3 -n monitoring
然后我使用下面的命令来创建 custerIp：
kubectl expose deployment grafana --type=ClusterIP --port=80 --target-port=3000 --protocol=TCP -n monitoring
然后我使用了以下虚拟服务：
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
Metadata:
name: grafana
spec:
hosts:
- "*"
gateways:
- cogtiler-gateway.skydeck
http:
- match:
- uri:
prefix: /grafana
route:
- destination:
port:
number: 3000
host: grafana
kubectl apply -f grafana-virtualservice.yaml -n monitoring
输出：
virtualservice.networking.istio.io/grafana created
现在，当我尝试访问它时，我从 grafana 收到以下错误：
**If you're seeing this Grafana has Failed to load its application files
1. This Could be caused by your reverse proxy settings.
2. If you host grafana under subpath make sure your grafana.ini root_path setting includes subpath
3. If you have a local dev build make sure you build frontend using: npm run dev,npm run watch,or npm run build
4. Sometimes restarting grafana-server can help **
解决方法
您需要创建一个 Gateway 以允许在 istio-ingressgateway 和您的 VirtualService 之间进行路由。
以下内容：
kind: Gateway
metadata:
name: ingress
namespace: istio-system
spec:
selector:
# Make sure that the istio-ingressgateway pods have this label
istio: ingressgateway
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- my.domain.com
您的域 (my-domain.com) 还需要一个 DNS 条目，指向 istio-ingressgateway 的 IP 地址。
当您的浏览器点击 my.domain.com 时，它将被重定向到 istio-ingressgateway。 istio-ingressgateway 将检查请求中的 Host 字段，并将请求重定向到 grafana（根据 VirtualService 规则）。
您可以检查 kubectl get svc -n istio-system | grep istio-ingressgateway 以获取您的入口网关的公共 IP。
如果您想启用 TLS，那么您需要为您的域提供 TLS 证书（使用 cert-manager 最容易）。然后您可以在网关中使用 https 重定向，如下所示：
kind: Gateway
metadata:
name: ingress
namespace: whatever
spec:
selector:
# Make sure that the istio-ingressgateway pods have this label
istio: ingressgateway
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- my.domain.com
tls:
httpsRedirect: true
- port:
number: 443
name: https
protocol: HTTPS
hosts:
- my.domain.com
tls:
mode: SIMPLE
# name of the secret containing the TLS certificate + keys. The secret must exist in the same namespace as the istio-ingressgateway (probably istio-system namespace)
# This secret can be created by cert-manager
# Or you can create a self-signed certificate
# and add it to manually inside the browser trusted certificates
credentialName: my-domain-tls
然后你是 VirtualService
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: grafana
spec:
hosts:
- "my.domain.com"
gateways:
- ingress
http:
- match:
- uri:
prefix: /grafana
route:
- destination:
port:
number: 3000
host: grafana
最简单且开箱即用的配置解决方案是使用 grafana host 和 / 前缀。
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: grafana-gateway
namespace: monitoring
spec:
selector:
istio: ingressgateway
servers:
- port:
number: 80
name: http-grafana
protocol: HTTP
hosts:
- "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: grafana-vs
namespace: monitoring
spec:
hosts:
- "grafana.example.com"
gateways:
- grafana-gateway
http:
- match:
- uri:
prefix: /
route:
- destination:
host: grafana
port:
number: 80
正如您在评论中提到的，I want to use path based routing something like my.com/grafana，这也是可以配置的。您可以使用 istio rewrite 进行配置。
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: grafana-gateway
namespace: monitoring
spec:
selector:
istio: ingressgateway
servers:
- port:
number: 80
name: http-grafana
protocol: HTTP
hosts:
- "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: grafana-vs
namespace: monitoring
spec:
hosts:
- "*"
gateways:
- grafana-gateway
http:
- match:
- uri:
prefix: /grafana
rewrite:
uri: /
route:
- destination:
host: grafana
port:
number: 80
但是，根据此 github issue，您还需要为此额外配置 grafana。如果没有正确的 grafana 配置，将无法正常工作。
我找到了一种在 grafana 部署中使用以下环境变量 GF_SERVER_ROOT_URL 使用不同 url 配置 grafana 的方法。
apiVersion: apps/v1
kind: Deployment
metadata:
creationTimestamp: null
labels:
app: grafana
name: grafana
spec:
replicas: 1
selector:
matchLabels:
app: grafana
strategy: {}
template:
metadata:
creationTimestamp: null
labels:
app: grafana
spec:
containers:
- image: docker.io/grafana/grafana:5.4.3
name: grafana
env:
- name: GF_SERVER_ROOT_URL
value: "%(protocol)s://%(domain)s/grafana/"
resources: {}
还有用于该部署的虚拟服务和网关。
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: grafana-gateway
spec:
selector:
istio: ingressgateway
servers:
- port:
number: 80
name: http-grafana
protocol: HTTP
hosts:
- "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: grafana-vs
spec:
hosts:
- "*"
gateways:
- grafana-gateway
http:
- match:
- uri:
prefix: /grafana/
rewrite:
uri: /
route:
- destination:
host: grafana
port:
number: 80