kubernetes基于Ingress實作灰度發布

Ingress的Canary注解

之前寫了篇基于Service實作灰度發布的文章 鏈接，使用Service實作的話只能保證新舊版本負載均衡時的權重，功能比較單一，
使用Ingress除了可以使用權重控制負載均衡外，還可以實作基于http協議的header、cookie指定轉發到指定版本的功能，這些功能是使用Ingress的Canary注解實作的，
詳細資訊可以參考官方檔案： https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#canary

具體實作

準備一個域名

在主機上配置hosts，保證有一個可以訪問到ingress-nginx-controller所在node的域名，這里我將www.test.com系結到我的node上面，

[root@master ingress]# cat /etc/hosts |grep www.test.com
192.168.1.15 www.test.com

創建版本v1的服務

這里創建了一次部署，使用的鏡像是nginx，同時創建來一個Service可以訪問這次部署，

[root@master ingress]# cat v1.yaml
apiVersion: v1
kind: Service
metadata:
  name: grayscale-svc
  namespace: test
spec:
  selector:
    app: grayscale-v1
  type: ClusterIP  
  ports:
  - name: grayscale-test
    port: 80   
    targetPort: 80  
    protocol: TCP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: grayscale-deploy-v1
  namespace: test
spec:
  selector:
    matchLabels:
      app: grayscale-v1
  replicas: 1
  template:
    metadata:
      labels:
        app: grayscale-v1
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80

[root@master ingress]# kubectl apply -f v1.yaml
service/grayscale-svc created
deployment.apps/grayscale-deploy-v1 created

創建服務v1的Ingress資源

這里使用前綴路由，將域名www.test.com的請求轉發給剛才創建的v1服務的Service，

[root@master ingress]# cat ingress-v1.yaml 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-v1
  namespace: test
spec:
  rules:
  - host: www.test.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: grayscale-svc
            port:
              number: 80

[root@master ingress]# kubectl apply -f ingress-v1.yaml
ingress.networking.k8s.io/ingress-v1 created              

創建版本v2的服務

使用nginx鏡像進行部署，并修改了默認頁的內容，同時創建了一個Service將流量轉發到這次部署的Pod上，

[root@master ingress]# cat v2.yaml 
apiVersion: v1
kind: Service
metadata:
  name: grayscale-svc-v2
  namespace: test
spec:
  selector:
    app: grayscale-v2
  type: ClusterIP
  ports:
  - name: grayscale-test
    port: 80
    targetPort: 80
    protocol: TCP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: grayscale-deploy-v2
  namespace: test
spec:
  selector:
    matchLabels:
     app: grayscale-v2
  replicas: 1
  template:
    metadata:
      labels:
        app: grayscale-v2
    spec:
      volumes:
       - name: for-input
         emptyDir: {}
      initContainers:
       - name: init
         image: alpine
         volumeMounts:
          - name: for-input
            mountPath: /test
         command: ["/bin/sh","-c","echo this is version 2 > /test/index.html;"]
      containers:
      - name: nginx
        image: nginx
        volumeMounts:
          - name: for-input
            mountPath: /usr/share/nginx/html
        ports:
        - containerPort: 80

[root@master ingress]# kubectl apply -f v2.yaml 
service/grayscale-svc-v2 created
deployment.apps/grayscale-deploy-v2 created

創建服務v2的Ingress資源

使用canary注解實作灰度發布的功能

• nginx.ingress.kubernetes.io/canary：是否開啟灰度發布的標識，設定為"true"標識開啟
• nginx.ingress.kubernetes.io/canary-by-header：用于通知Ingress的請求頭，當請求中這個請求頭的值是always的時候會被Ingress轉發到灰度版本，值是never的話保證不會路由到灰度版本，
• nginx.ingress.kubernetes.io/canary-weight：本次灰度所占的權重，優先級低于header和cookie方式的設定，也就是說在不指定header和cookie的時候才會生效，

[root@master ingress]# cat ingress-v2.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-v2
  namespace: test
  annotations: 
   nginx.ingress.kubernetes.io/canary: "true"
   nginx.ingress.kubernetes.io/canary-by-header: "grayscale"
   nginx.ingress.kubernetes.io/canary-weight: "50"
spec:
  rules:
  - host: www.test.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: grayscale-svc-v2
            port:
              number: 80
[root@master ingress]# kubectl apply -f ingress-v2.yaml 
ingress.networking.k8s.io/ingress-v2 created

最終效果測驗

默認不指定header訪問，可以看到會隨機根據權重將流量打到兩個版本的服務上

[root@master ingress]# curl www.test.com
this is version 2
[root@master ingress]# curl www.test.com
this is version 2
[root@master ingress]# curl www.test.com
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

指定header訪問，會只把流量打給新版本服務

[root@master ingress]# curl www.test.com -H "grayscale:always"
this is version 2
[root@master ingress]# curl www.test.com -H "grayscale:always"
this is version 2
[root@master ingress]# curl www.test.com -H "grayscale:always"
this is version 2
[root@master ingress]# curl www.test.com -H "grayscale:always"
this is version 2
[root@kmaster ingress]# curl www.test.com -H "grayscale:always"
this is version 2
[root@master ingress]# curl www.test.com -H "grayscale:always"
this is version 2
[root@master ingress]# curl www.test.com -H "grayscale:always"
this is version 2
[root@master ingress]# curl www.test.com -H "grayscale:always"
this is version 2