kubernetes - istio是否允许相交规则？应用它的策略是什么？

Question

假设我有一个istio的配置(我使用GCP):

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-route
  namespace: my-service
spec:
  hosts:
  - "service.cluster.local"
  http:
  - match:
    - headers:
        specific-id:
          regex: ^(1|2|3|4|5)$
    route:
    - destination:
        host: "service.cluster.local"
        subset: s-01
  - match:
    - headers:
        specific-id:
          regex: ^(6|7|8|9|10)$
    route:
    - destination:
        host: "service.cluster.local"
        subset: s-02

我的目的地规则基于特定的 header (int值)。

现在，我想更改此配置(因为我需要重新分片)，并且我将得到以下内容:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-route
  namespace: my-service
spec:
  hosts:
 - "service.cluster.local"
  http:
 - match:
    - headers:
        specific-id:
          regex: ^(1|2|3|9|10)$
    route:
    - destination:
        host: "service.cluster.local"
        subset: s-03
 - match:
    - headers:
        specific-id:
          regex: ^(4|5|6|7|8|)$
    route:
    - destination:
        host: "service.cluster.local"
        subset: s-04
 - match:
    - headers:
        specific-id:
          regex: ^(1|3|5|7|9|)$
    route:
    - destination:
        host: "service.cluster.local"
        subset: s-05

我的问题是:

istio规则是否允许子集内有交集(例如
具有一个服务正则表达式:^(1|2|3|4|5)$和另一个^(1|3|5|7|9|)$)？

使用新规则部署新模式后，何时istio将
适用吗？ istio保证不会应用它吗？
删除旧规则)，然后再准备所有新实例
交通？

Answer 1

Does istio rules allows to have intersections inside subsets (like to have for one service regex: ^(1|2|3|4|5)$ and for another ^(1|3|5|7|9|)$)?

根据 istio文档:

Routing rules are evaluated in sequential order from top to bottom, with the first rule in the virtual service definition being given highest priority. In this case you want anything that doesn’t match the first routing rule to go to a default destination, specified in the second rule. Because of this, the second rule has no match conditions and just directs traffic to the v3 subset.

- route:
  - destination:
      host: reviews
      subset: v3

We recommend providing a default “no condition” or weight-based rule (described below) like this as the last rule in each virtual service to ensure that traffic to the virtual service always has at least one matching route.

路由规则按顺序进行评估。因此，将始终选择第一场比赛。
regex: ^(1|2|3|9|10)$将以 subset: s-03结尾
regex: ^(4|5|6|7|8|)$将以 subset: s-04结尾

由于 subset: s-05和 regex: ^(1|3|5|7|9|)$已经覆盖了 subset: s-03，因此没有匹配项会以 subset: s-04结尾。

请注意，您可以将 subset: s-05设置为默认匹配，并设置为“无条件”。

但是，您可以使用“权重”在匹配规则之间分配流量。

只需一点点创造力(通过将相交的组分成唯一的子集)，我们可以得到以下配置:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-route
  namespace: my-service
spec:
  hosts:
  - "service.cluster.local"
  http:
  - match:
    - headers:
        specific-id:
          regex: ^(1|3|9)$
    route:
    - destination:
        host: "service.cluster.local"
        subset: s-03
      weight: 50
    - destination:
        host: "service.cluster.local"
        subset: s-05
      weight: 50
  - match:
    - headers:
        specific-id:
          regex: ^(2|10)$
    route:
    - destination:
        host: "service.cluster.local"
        subset: s-03
  - match:
    - headers:
        specific-id:
          regex: ^(5|7)$
    route:
    - destination:
        host: "service.cluster.local"
        subset: s-04
      weight: 50
    - destination:
        host: "service.cluster.local"
        subset: s-05
      weight: 50
  - match:
    - headers:
        specific-id:
          regex: ^(4|6|8|)$
    route:
    - destination:
        host: "service.cluster.local"
        subset: s-04

这样，您可以:

匹配 subset: s-03的 regex: ^(1|3|9)$ OR ^(2|10)$
匹配 subset: s-04的 regex: ^(5|7)$ OR ^(4|6|8|)$
匹配 subset: s-05的 regex: ^(1|3|9)$ OR ^(5|7)$
正则表达式的流量:
^(1|3|9)$在 subset: s-03和 subset: s-05之间平均分配。
^(5|7)$在 subset: s-04和 subset: s-05之间平均分配。

After deployment of the new schema with new rules, when istio will apply it? Does istio guarantee that it won't be applied (to not remove old rules) before all of my new instances will be ready for traffic?

Istio使用envoy进行路由，并且 Envoy文档具有以下语句:

Service discovery and dynamic configuration: Envoy optionally consumes a layered set of dynamic configuration APIs for centralized management. The layers provide an Envoy with dynamic updates about: hosts within a backend cluster, the backend clusters themselves, HTTP routing, listening sockets, and cryptographic material. For a simpler deployment, backend host discovery can be done through DNS resolution (or even skipped entirely), with the further layers replaced by static config files.

因此，一旦istio对象修改了使节动态配置，它就会将其更改推送给使节代理。是的，特使将确保在关闭之前可以为新实例做好流量准备，并优雅地排出旧流量。

更多信息: Runtime configuration， Hot restart

希望这可以帮助。