Understanding the Istio Mixer: Extensibility and Config

    $ tree mixer_adapter

    ├── cmd             # 适配器的启动入口
    │   └── server     # Go 语言代码
    ├── config          # yaml 配置文件
    │   ├── config.pb.go    # protobuf 文件
    │   ├── config.proto    # protobuffer 文件定义
    │   ├── handler.go      # 适配器的实现
    │   ├── instance        # 策略模板
    │   │   ├── handler.go
    │   │   ├── template.yaml
    │   │   └── params.go
    │   ├── rule           # 策略实例
    │   │   ├── README.md
    │   │   └── sample.yaml
    ├── deployment      # kubernetes 渲染模板
    ├── go.mod         # 模块依赖文件
    ├── go.sum         # 模块 checksum 文件
    ├── Makefile       # makefile 脚本
    ├── main.go        # 适配器的主程序入口
    └── testdata       # 测试数据
    ├──...
    └── instance_handler_test.go
    
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
    代码解读

    syntax = "proto3";

    
    package adapter.sample;
    
      message Params {
      string bla = 1; // example field
      }
    
      message InstanceParam {
      option (istio.mixer.v1.config.common_pb.subject_to_oneof) = true;
    
      oneof adapter_specific_params {
          Params params = 1 [(istio.mixer.v1.template.default_instance_param)="{\n\"bla\": \"example\"\n}"]; // policy parameters for this instance
      }
      }
    
    service Handler {
    rpc HandleMetric(istio.policy.v1beta1.MetricInstance) returns (istio.policy.v1beta1.CheckResult);
    rpc HandleLog(istio.policy.v1beta1.LogEntry) returns (istio.policy.v1beta1.CheckResult);
    rpc HandleTraceSpan(istio.policy.v1beta1.TraceSpan) returns (istio.policy.v1beta1.CheckResult);
    rpc Close() returns (google.protobuf.Empty);
    }
    
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
    代码解读

    func HandleMetric(ctx context.Context, inst *pb.InstanceParam, attrs attribute.Bag) (*check.Result, error) {

    cfg := inst.Params
    fmt.Println("received metric:", cfg.Bla)
    return check.OK, nil
    }
    
         
         
         
         
    代码解读

    $ mkdir -p gen && protoc -I=$GOPATH/src:. --go_out=plugins=grpc:$GOPATH/src/mixer_adapter/gen config/config.proto

    
    代码解读

    import _ "istio.io/istio/mixer/adapter/myawesomeadapter" // register my awesome adapter

    
    func init() {
    registry.DefaultRegistry = append(registry.DefaultRegistry, myawesome.NewAwesomeAdapter())
    }
    
         
         
         
         
    代码解读

    ---

    apiVersion: "config.istio.io/v1alpha2"
    kind: attributemanifest
    metadata:
      name: istio-proxy
    spec:
      attributes:
    # Fill in the list of attributes here
    attribute_name:
      value_type: STRING
      description: Describes an attribute produced by the mesh owner or operator.
    
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: template
    metadata:
      name: myawesometemplate
    spec:
      workloadSelector:
    labels:
      app: myawesomeapp
      monitored_resources:
      - type: myawesomemetric
      param_sinks:
      - template_variety: TEMPLATE_VARIETY_ATTRIBUTE_GENERATOR
      params:
      - name: foobar
    required: false
    attribute_expression: request.headers["x-foobar"] | ""
    
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: handler
    metadata:
      name: myawesomehandler
    spec:
      compiled_adapter: myawesome-handler
      severity_levels:
    myawesomeseveritylevel: INFO
    default: INFO
      params:
      - name: foobar
    value: "defaultvalue"
      connection:
    address: 127.0.0.1:1234
    
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
    代码解读

    ---

    apiVersion: "config.istio.io/v1alpha2"
    kind: instance
    metadata:
      name: myawesomenamespace-myawesomeapp-myawesometemplate
    spec:
      compiledTemplate: myawesometemplate
      params:
    # Override any template parameters here. Note that it is not recommended to do so without strong reason as this could lead to inconsistent enforcement behavior across instances. In this case, we're only overriding the default value for `foobar` parameter from `"defaultvalue"` to `"newvalue"`.
    foobar: newvalue
    # If no override is needed, simply omit `params` section.
    
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: rule
    metadata:
      name: myawesomenamespace-myawesomeapp-myawesomerules
    spec:
      match: source.labels["app"] == "myawesomeapp" && destination.namespace!= "kube-system"
      actions:
      - handler: myawesomehandler
    instances: [myawesomenamespace-myawesomeapp-myawesometemplate]
    
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
         
    代码解读

    apiVersion: "config.istio.io/v1alpha2"
    kind: handler
    metadata:
      name: denyall
    spec:
      # Required: implementation must be "denyall".
      name: denyall
      compiled_adapter: denyall
      severity_levels:
    none: NONE
    default: DEFAULT
      templates:
      - empty:
      status:
        code: 7
        message: Access denied. You don't have permission to access this resource.
        details:
          authorize_url: http://example.com/authorize?svc=$(destination.service.host)
          allowed_domains: ["allowed.domain.net", "*.another.domain.org"]
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: instance
    metadata:
      name: mydenier
      namespace: default
    spec:
      compiledTemplate: empty
      params: {}
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: rule
    metadata:
      name: default-deny
      namespace: default
    spec:
      actions:
      - handler: denyall
    instances: [mydenier]
    
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
    
    代码解读

    apiVersion: "config.istio.io/v1alpha2"
    kind: prometheus
    metadata:
      name: handler
      namespace: istio-system
    spec:
      # The name of the Prometheus handler.
      # This should correspond to a unique name given to each handler within a config, however this is not enforced at present.
      handler: handler
    
      # Optional: number of worker threads processing metrics. Default is 1.
      threadPoolSize: 1
    
      # Optional: Interval between calls to metrics collection endpoint. Supports duration format strings. Default is 60 seconds.
      queryInterval: 60s
    
      # Optional: Specify label names and values for grouping collected metrics together.
      # Default is to use all dimensions specified in queries and ignore other dimensions.
      relabelings: []
    
      # Metrics specifies the list of individual metrics to fetch from the associated Prometheus endpoints.
      metrics:
      - name: request_count
    instance_name:'request_count'
    
    # Optional: Metric expiration time window. After this period, the cached result will become invalid and gets refreshed on next scrape. By default, this is disabled (-1).
    expire_after: 1h
    
    # Optional: How to aggregate multiple overloaded samples into one. Can be one of [UNSPECIFIED, AVERAGE, MAX, MIN, SUM]. Unspecified means inherit from original metrics settings. Default is unspecified.
    # aggregation_method: unspecified
    
      - name: request_duration
    instance_name:'request_duration'
    label_names:
      # Label names are defined as part of an output expression using Prometheus querying language.
      # They need to be quoted with backticks when used elsewhere in expressions, such as `metric_labels`.
      # We define these statically to avoid hardcoding them in code.
      verb: '"'"${verb}'"'
      path: '"'"${path}'"'
    
    # Expire after defaults to 1 hour if left unset.
    # aggregation_method inherits from parent metric setting unless explicitly set here.
    
      # Optional: Absolute path to export metrics. Only metrics mentioned in `metrics` configuration block can be exported.
      # Set this to enable scraping support for this handler.
      custom_metrics:
    # Custom metrics are fetched from Prometheus directly via a dedicated endpoint (`prometheus`) which serves the `/api/v1/series` endpoint for direct querying of series data.
    url: http://localhost:9090
    # Comma separated list of supported metric types. Supported values include `counter`, `gauge`, `histogram` and `summary`.
    # All non-matching types will be rejected during validation. If left blank or omitted, all types will be accepted.
    supported_types: counter, gauge, histogram, summary
    # Provide an optional authorization header that the adapter should use while making requests to the Prometheus API.
    authorization: Bearer <your token>
    
      # Optional: RetryPolicy defines retry policy for failed scrapes. Retries occur whenever there's a failure fetching metrics due to network errors or missing metrics etc., up to the maximum retries limit defined below.
      # Defaults to no retries if left unset.
      retry_policy:
    attempts: 1               # Number of times to attempt scraping before giving up. Must be greater than zero.
    initial_interval: 1s      # Initial interval between retries. Supports duration formats like "1m", "10s" etc.
    max_elapsed_time: 1m      # Maximum amount of time spent attempting retries. Once elapsed, the last error encountered will be returned.
    backoff_factor: 2         # Factor multiplied by previous delay duration to obtain the next delay duration. Values <= 1 indicate no backoff.
    
    # Retries are done based on per-metric basis. These configurations apply to all failing metrics together, irrespective of their configured name or group name.
    # To customize retry policies per-metric, you can provide a separate configuration block for each named or grouped metric. Here's an example:
    # 
    # # Configure different retry policies for two particular groups of metrics separately
    # retry_configs:
    # - name: "foo.*"                     # Apply retry configs to metrics matching this regex pattern
    #   attempts: 2
    #   initial_interval: 5s            # Overrides global initial_interval
    #   max_elapsed_time: 2m            # Overrides global max_elapsed_time
    #   
    # - name: "^http_.*$"                 # Another group of metrics to apply specific overrides to
    #   attempts: 1                      # Overrides inherited value of 1
    #   backoff_factor: 1                # Applies exponential backoff instead of linear backoff
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: rule
    metadata:
      name: prom-rule
      namespace: istio-system
    spec:
      match: context.protocol == "http" || context.protocol == "grpc"
      actions:
      - handler: handler
    instances: [promtcp, promhttp]
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: rule
    metadata:
      name: grpc-requests
      namespace: istio-system
    spec:
      match: context.protocol == "grpc" && api.operation == "grpc.health.v1.Health.Check"
      actions:
      - handler: handler
    instances: [promgrpc]
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: rule
    metadata:
      name: tcp-connections
      namespace: istio-system
    spec:
      match: context.protocol == "tcp"
      actions:
      - handler: handler
    instances: [promtcp]
    
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
    
    代码解读

    apiVersion: "config.istio.io/v1alpha2"
    kind: stdio
    metadata:
      name: handler
      namespace: istio-system
    spec:
      # The name of the logger factory to use. If empty, "project" is assumed, where project is the same as the control plane namespace.
      # Use "root" to configure a root logger.
      log_name: statshandler
    
      # Severity levels in order of increasing verbosity. Should be one of "debug", "info", "warn", "error", "critical".
      severity_levels:
    info: INFO
    warning: WARNING
    error: ERROR
    critical: CRITICAL
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: rule
    metadata:
      name: stdio-rule
      namespace: istio-system
    spec:
      match: context.protocol == "tcp"
      actions:
      - handler: handler
    instances: [statssocket]
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: instance
    metadata:
      name: statssocket
      namespace: istio-system
    spec:
      template: metric
      params:
    value: "1"
    dimensions:
      requestsize: "responseSize"
      responsesize: "bytesSent"
      destination: "tcp://{{.Value}}"
      reporter: "{{.Reporter}}"
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: metric
    metadata:
      name: requestsize
      namespace: istio-system
    spec:
      value: request.size | 0
      factor: 1
      dimension_labels:
    requestsize: responseSize
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: metric
    metadata:
      name: responsesize
      namespace: istio-system
    spec:
      value: response.size | 0
      factor: 1
      dimension_labels:
    responsesize: bytesSent
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: reportertype
    metadata:
      name: istio-proxy
      namespace: istio-system
    spec:
      builtIn: envoy
    
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
      
    
    代码解读