全部产品
Search
文档中心

服务网格 ASM:增强ASM网关高可用性

更新时间:Aug 24, 2023

ASM网关作为业务的流量入口,为了避免服务不可用,增强ASM网关的高可用性非常重要。本文介绍如何增强ASM网关的高可用性。

前提条件

在ACK集群中增强ASM网关高可用性

在ACK集群中,您可以在创建ASM网关时通过YAML配置Pod反亲和性策略,实现ASM网关的Pod分布到不同的Node节点或者可用区,从而增强ASM网关的高可用性。

  • 在ASM网关中配置podAntiAffinity参数,使ASM网关的Pod分布到不同的Node节点。

    apiVersion: istio.alibabacloud.com/v1beta1
    kind: IstioGateway
    metadata:   
      name: ingressgateway-1
      namespace: istio-system
    spec:  
      clusterIds:
        - "c954ee9df88f64f229591f0ea4c61****"
      cpu: 
        targetAverageUtilization: 80
      externalTrafficPolicy: Local
      maxReplicas: 4
      minReplicas: 2  
      ports:  
      - name: status-port
        port: 15020    
        targetPort: 15020  
      - name: http2    
        port: 80    
        targetPort: 80  
      - name: https    
        port: 443    
        targetPort: 80
      - name: tls    
        port: 15443    
        targetPort: 15443  
      replicaCount: 1  
      resources:
        limits:
          cpu: '2'
          memory: 2G
        requests:
          cpu: 200m
          memory: 256Mi
      sds:
        enabled: true
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 2000m
            memory: 1024Mi
      serviceType: LoadBalancer  
      affinity:
            podAntiAffinity:
              preferredDuringSchedulingIgnoredDuringExecution:
              - podAffinityTerm:
                  labelSelector:
                    matchExpressions:
                    - key: app
                      operator: In
                      values:
                      - istio-ingressgateway-1
                  topologyKey: kubernetes.io/hostname
                weight: 100 
      rollingMaxSurge: "100%"
      rollingMaxUnavailable: "25%"
    • preferredDuringSchedulingIgnoredDuringExecution:表示Pod反亲和性为软亲和性。在调度Pod到节点的时候,如果没有满足所设置要求,也可以继续调度Pod。

    • matchExpressions:设置keyappoperatorInvaluesistio-ingressgateway-1,表示Pod不能和包含app=istio-ingressgateway-1标签的Pod部署在一个节点上,即一个节点只能部署一个包含app=istio-ingressgateway-1标签的Pod。

    • topologyKey:设置Pod反亲和性生效的维度。

      本例设置kubernetes.io/hostname,表示在节点拓扑域中生效。

  • 在ASM网关中配置podAntiAffinity参数,使ASM网关的Pod分布到不同的可用区。

    apiVersion: istio.alibabacloud.com/v1beta1
    kind: IstioGateway
    metadata:   
      name: ingressgateway-1
      namespace: istio-system
    spec:  
      clusterIds:
        - "c954ee9df88f64f229591f0ea4c61****"
      cpu: 
        targetAverageUtilization: 80
      externalTrafficPolicy: Local
      maxReplicas: 4
      minReplicas: 2  
      ports:  
      - name: status-port
        port: 15020    
        targetPort: 15020  
      - name: http2    
        port: 80    
        targetPort: 80  
      - name: https    
        port: 443    
        targetPort: 80
      - name: tls    
        port: 15443    
        targetPort: 15443  
      replicaCount: 1  
      resources:
        limits:
          cpu: '2'
          memory: 2G
        requests:
          cpu: 200m
          memory: 256Mi
      sds:
        enabled: true
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 2000m
            memory: 1024Mi
      serviceType: LoadBalancer  
      affinity:
            podAntiAffinity:
              preferredDuringSchedulingIgnoredDuringExecution:
              - podAffinityTerm:
                  labelSelector:
                    matchExpressions:
                    - key: app
                      operator: In
                      values:
                      - istio-ingressgateway-1
                  topologyKey: topology.kubernetes.io/zone
                weight: 100 
      rollingMaxSurge: "100%"
      rollingMaxUnavailable: "25%"
    • preferredDuringSchedulingIgnoredDuringExecution:表示Pod反亲和性为软亲和性。在调度Pod到节点的时候,如果没有满足所设置要求,也可以继续调度Pod。

    • matchExpressions:设置keyappoperatorInvaluesistio-ingressgateway-1,表示Pod不能和包含app=istio-ingressgateway-1标签的Pod部署在一个可用区上,即一个可用区只能部署一个包含app=istio-ingressgateway-1标签的Pod。

    • topologyKey:设置Pod反亲和性生效的维度。

      本例设置topology.kubernetes.io/zone,表示在可用区拓扑域中生效。

ACK Serverless集群中增强ASM网关高可用性

ACK Serverless集群不支持Pod反亲和调度策略,但是您可以在ACK Serverless集群下创建ECI Pod ,使之分布在不同的可用区,从而增强ASM网关高可用性。

  1. ACK Serverless集群中配置多个可用区。具体操作,请参见创建多可用区的ECI Pod

  2. 在ASM网关中使用pod annotation关联可用区。

    apiVersion: istio.alibabacloud.com/v1beta1
    kind: IstioGateway
    metadata:   
      name: ingressgateway
      namespace: istio-system
    spec:  
      clusterIds:
        - "c954ee9df88f64f229591f0ea4c61****"
      cpu: 
        targetAverageUtilization: 80
      externalTrafficPolicy: Local
      maxReplicas: 4
      minReplicas: 2  
      ports:  
      - name: status-port
        port: 15020    
        targetPort: 15020  
      - name: http2    
        port: 80    
        targetPort: 80  
      - name: https    
        port: 443    
        targetPort: 80
      - name: tls    
        port: 15443    
        targetPort: 15443  
      replicaCount: 1  
      resources:
        limits:
          cpu: '2'
          memory: 2G
        requests:
          cpu: 200m
          memory: 256Mi
      sds:
        enabled: true
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 2000m
            memory: 1024Mi
      serviceType: LoadBalancer  
      podAnnotations:
        k8s.aliyun.com/eci-vswitch: "vsw-bp1b07j0miob3khtn****,vsw-bp12b85hh323se8ft****"
        k8s.aliyun.com/eci-schedule-strategy: "VSwitchRandom"
      rollingMaxSurge: "100%"
      rollingMaxUnavailable: "25%"
    • k8s.aliyun.com/eci-vswitch:对应VPC下的不同的交换机ID,用于关联可用区。

    • k8s.aliyun.com/eci-schedule-strategy:设置ECI调度策略。本文中必须使用VSwitchRandom策略,即使用随机的方式将ECI Pod调度到多个可用区。