Istio 企业 mTLS、授权与灰度升级

helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo update
export ISTIO_VERSION='REPLACE_VERSION'
export REVISION='prod-canary'
helm upgrade --install istio-base istio/base -n istio-system --create-namespace --version "$ISTIO_VERSION" --wait
# 已安全交付 cacerts 后继续。CNI 避免给业务 initContainer NET_ADMIN。
helm upgrade --install istio-cni istio/cni -n istio-system --version "$ISTIO_VERSION" --wait
helm upgrade --install "istiod-$REVISION" istio/istiod -n istio-system --version "$ISTIO_VERSION" --set "revision=$REVISION" --set pilot.cni.enabled=true --set pilot.replicaCount=3 --set pilot.autoscaleMin=3 --wait --timeout 10m
istioctl analyze -A

kubectl create namespace orders-mesh --dry-run=client -o yaml | kubectl apply -f -
kubectl label namespace orders-mesh "istio.io/rev=$REVISION" --overwrite
# 部署真实业务 overlay，自动注入发生在新建 Pod 时。
kubectl apply -k environments/staging/orders-mesh
kubectl -n orders-mesh rollout status deployment/orders-api --timeout=10m
istioctl proxy-status

apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata: {name: orders-api-mtls, namespace: orders-mesh}
spec:
  selector:
    matchLabels: {app.kubernetes.io/name: orders-api}
  mtls: {mode: STRICT}
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata: {name: orders-api-callers, namespace: orders-mesh}
spec:
  selector:
    matchLabels: {app.kubernetes.io/name: orders-api}
  action: ALLOW
  rules:
    - from:
        - source:
            principals: [cluster.local/ns/orders-mesh/sa/orders-worker]
      to:
        - operation: {ports: ["8080"]}

kubectl apply --dry-run=server -f orders-mesh-policy.yaml
kubectl apply -f orders-mesh-policy.yaml
istioctl analyze -n orders-mesh