服务网格：Istio 流量治理与 mTLS

sidecar 模式（每个 Pod 一个代理）        ambient 模式（每个节点一个 ztunnel）
  ┌────────┐   ┌────────┐              Pod A ──► ztunnel ──mTLS──► ztunnel ──► Pod B
  │ app    │   │ app    │                          ▲ 需要七层时再挂 waypoint
  │  ▼     │   │  ▲     │
  │ Envoy ─┼───┼─ Envoy │   加密区间 = sidecar ──► sidecar（应用↔本机代理是明文）
  └────────┘   └────────┘
       └── mTLS：工作负载证书 + SPIFFE 身份，自动轮转

curl -L https://istio.io/downloadIstio | sh -
cd istio-1.29.1 && export PATH="$PWD/bin:$PATH"
istioctl version --remote=false
istioctl install --set profile=demo -y
kubectl -n istio-system get pods

apiVersion: apps/v1
kind: Deployment
metadata: {name: api-v1, namespace: demo}
spec:
  selector: {matchLabels: {app: api, version: v1}}
  template:
    metadata: {labels: {app: api, version: v1}}
    spec:
      containers:
        - name: api
          image: hashicorp/http-echo:1.0
          args: ["-listen=:5678", "-text=hello from api v1"]
          ports:
            - {name: http, containerPort: 5678}

apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata: {name: api, namespace: demo}
spec:
  host: api
  trafficPolicy:
    connectionPool: {tcp: {maxConnections: 100}}
    outlierDetection: {consecutive5xxErrors: 5, interval: 10s, baseEjectionTime: 30s, maxEjectionPercent: 50}
  subsets:
    - {name: v1, labels: {version: v1}}
    - {name: v2, labels: {version: v2}}

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata: {name: api, namespace: demo}
spec:
  hosts: [api]
  http:
    - match:
        - headers:
            x-canary:
              exact: "true"
      route:
        - destination:
            host: api
            subset: v2
    - route:
        - destination:
            host: api
            subset: v1
          weight: 90
        - destination:
            host: api
            subset: v2
          weight: 10
      timeout: 3s
      retries:
        attempts: 2
        perTryTimeout: 1s
        retryOn: 5xx,reset,connect-failure

kubectl -n demo apply -f api-v1.yaml -f api-v2.yaml -f api-dr.yaml -f api-vs.yaml
kubectl -n demo run client --image=curlimages/curl:8.10.1 --restart=Never -- sleep 3600
kubectl -n demo exec client -- sh -c 'for i in $(seq 1 20); do curl -s http://api:5678; echo; done'
kubectl -n demo exec client -- curl -s -H 'x-canary: true' http://api:5678

apiVersion: networking.istio.io/v1
kind: Gateway
metadata: {name: demo-gateway, namespace: demo}
spec:
  selector: {istio: ingressgateway}
  servers:
    - {port: {number: 80, name: http, protocol: HTTP}, hosts: ["kube101.local"]}

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata: {name: api-gateway, namespace: demo}
spec:
  hosts: ["kube101.local"]
  gateways: ["demo-gateway"]
  http:
    - route: [{destination: {host: api, port: {number: 5678}}}]

INGRESS_HOST=$(kubectl -n istio-system get svc istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
curl -s -H "Host: kube101.local" "http://$INGRESS_HOST/api"

GatewayClass（用哪个实现：istio / kgateway / nginx）
      │
      ▼
Gateway（平台团队：监听端口、TLS 证书、允许哪些命名空间接入）
      │ parentRefs
      ▼
HTTPRoute（业务团队：host、路径、header 匹配、权重）
      │ backendRefs
      ▼
Service → Pod（进了网格就自动带 mTLS 与代理治理）

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata: {name: main-gateway, namespace: istio-system}
spec:
  gatewayClassName: istio
  listeners:
    - name: http
      hostname: "*.example.com"
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: Selector
          selector: {matchLabels: {gateway-access: main-gateway}}
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata: {name: api, namespace: demo}
spec:
  parentRefs:
    - {name: main-gateway, namespace: istio-system}
  hostnames: ["api.example.com"]
  rules:
    - matches:
        - path: {type: PathPrefix, value: /api}
      filters:
        - type: URLRewrite
          urlRewrite: {path: {type: ReplacePrefixMatch, replacePrefixMatch: /}}
      timeouts: {request: 30s, backendRequest: 10s}
      backendRefs:
        - {name: api, port: 5678}

kubectl label namespace demo gateway-access=main-gateway
kubectl -n demo describe httproute api     # Conditions 里 Accepted=True 才算挂上
GATEWAY_HOST=$(kubectl -n istio-system get gateway main-gateway -o jsonpath='{.status.addresses[0].value}')
curl -H "Host: api.example.com" "http://$GATEWAY_HOST/api"

apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata: {name: default, namespace: demo}
spec:
  mtls:
    mode: STRICT

POD=$(kubectl -n demo get pod -l app=api -o jsonpath='{.items[0].metadata.name}')
istioctl x describe pod "$POD" -n demo        # 打印生效的 PeerAuthentication 与 mTLS 模式
istioctl proxy-config secret "$POD" -n demo   # 看到 default 与 ROOTCA 证书，说明已下发