什么是fault filter

fault filter是envoy用来实现故障注入的一个http类型的filter，名称为 envoy.filters.http.fault ，type url为envoy.extensions.filters.http.fault.v3.HTTPFault.故障注入有两种类型，一种是注入延迟，还有一种是返回错误。

配置详解

{
  "delay": "{...}",  注入延迟
  "abort": "{...}",  注入错误
  "upstream_cluster": "...",匹配上游cluster
  "headers": [], 匹配请求头
  "downstream_nodes": [],匹配下游node
  "max_active_faults": "{...}",最大活跃错误
  "response_rate_limit": "{...}",限流
  "delay_percent_runtime": "...", 下面是运行时key
  "abort_percent_runtime": "...",
  "delay_duration_runtime": "...",
  "abort_http_status_runtime": "...",
  "max_active_faults_runtime": "...",
  "response_rate_limit_percent_runtime": "...",
  "abort_grpc_status_runtime": "...",
  "disable_downstream_cluster_stats": "..."
}

实战

abort

VirtualService实现

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: bookinfo
  namespace: istio
spec:
  gateways:
  - bookinfo-gateway
  hosts:
  - '*'
  http:
  - fault:
      abort:
        httpStatus: 500
        percentage:
          value: 100
    match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage
        port:
          number: 9080

envoyfilter实现

cat << EOF > ef-fault-abort.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: fault
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        #name: 0.0.0.0_8080  
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          codec_type: AUTO
          stat_prefix: ingress_http
          route_config:
            name: http.8080
            virtual_hosts:
            - name: “*.80”
              domains:
              - "*"
              routes:
              - match:
                  path: "/productpage"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    abort:
                      httpStatus: 500
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
              - match:
                  prefix: "/static"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    abort:
                      httpStatus: 500
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
EOF

kubectl apply -f  ef-fault-abort.yaml -n istio-system --context context-cluster1

delay

VirtualService实现

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: bookinfo
  namespace: istio
spec:
  gateways:
  - bookinfo-gateway
  hosts:
  - '*'
  http:
  - fault:
      delay:
        percentage:
          value: 100.0
        fixedDelay: 7s
    match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage
        port:
          number: 9080

envoyfilter实现

cat << EOF > ef-fault-delay.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: fault
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        #name: 0.0.0.0_8080  
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          codec_type: AUTO
          stat_prefix: ingress_http
          route_config:
            name: http.8080
            virtual_hosts:
            - name: “*.80”
              domains:
              - "*"
              routes:
              - match:
                  path: "/productpage"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    delay:
                      fixedDelay: 7s
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
              - match:
                  prefix: "/static"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    delay:
                      fixedDelay: 7s
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
EOF

kubectl apply -f   ef-fault-delay.yaml -n istio-system --context context-cluster1

headers

VirtualService没有实现方式

envoyfilter实现

abort

cat << EOF > ef-fault-abort-headers.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: fault
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        #name: 0.0.0.0_8080  
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          codec_type: AUTO
          stat_prefix: ingress_http
          route_config:
            name: http.8080
            virtual_hosts:
            - name: “*.80”
              domains:
              - "*"
              routes:
              - match:
                  path: "/productpage"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    abort:
                      httpStatus: 500
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
                    headers:
                    - name: test
                      exact_match: test
              - match:
                  prefix: "/static"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    abort:
                      httpStatus: 500
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
                    headers:
                    - name: test
                      exact_match: test
EOF

kubectl apply -f  ef-fault-abort-headers.yaml -n istio-system --context context-cluster1

访问：curl http://192.168.229.134:32688/productpage -H "test:test"

delay

cat << EOF > ef-fault-delay-headers.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: fault
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        #name: 0.0.0.0_8080  
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          codec_type: AUTO
          stat_prefix: ingress_http
          route_config:
            name: http.8080
            virtual_hosts:
            - name: “*.80”
              domains:
              - "*"
              routes:
              - match:
                  path: "/productpage"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    delay:
                      fixedDelay: 7s
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
                    headers:
                    - name: test
                      exact_match: test
              - match:
                  prefix: "/static"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    delay:
                      fixedDelay: 7s
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
                    headers:
                    - name: test
                      exact_match: test
EOF

kubectl apply -f   ef-fault-delay-headers.yaml -n istio-system --context context-cluster1

upstream_cluster

VirtualService没有实现方式

envoyfilter实现

abort

cat << EOF > ef-fault-abort-upstream-clusters.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: fault
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        #name: 0.0.0.0_8080  
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          codec_type: AUTO
          stat_prefix: ingress_http
          route_config:
            name: http.8080
            virtual_hosts:
            - name: “*.80”
              domains:
              - "*"
              routes:
              - match:
                  path: "/productpage"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    abort:
                      httpStatus: 500
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
                    upstream_cluster: outbound|9080||productpage.istio.svc.cluster.local
              - match:
                  prefix: "/static"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    abort:
                      httpStatus: 500
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
                    upstream_cluster: outbound|9080||productpage.istio.svc.cluster.local
EOF

kubectl apply -f  ef-fault-abort-upstream-clusters.yaml -n istio-system --context context-cluster1

delay

cat << EOF > ef-fault-delay-upstream-clusters.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: fault
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        #name: 0.0.0.0_8080  
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          codec_type: AUTO
          stat_prefix: ingress_http
          route_config:
            name: http.8080
            virtual_hosts:
            - name: “*.80”
              domains:
              - "*"
              routes:
              - match:
                  path: "/productpage"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    delay:
                      fixedDelay: 7s
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
                    upstream_cluster: outbound|9080||productpage.istio.svc.cluster.local
              - match:
                  prefix: "/static"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    delay:
                      fixedDelay: 7s
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
                    upstream_cluster: outbound|9080||productpage.istio.svc.cluster.local
EOF

kubectl apply -f   ef-fault-delay-upstream-clusters.yaml -n istio-system --context context-cluster1

downstream_nodes

VirtualService没有实现方式

envoyfilter实现

不知道downstream_nodes的值

abort

cat << EOF > ef-fault-abort-downstream_nodes.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: fault
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        #name: 0.0.0.0_8080  
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          codec_type: AUTO
          stat_prefix: ingress_http
          route_config:
            name: http.8080
            virtual_hosts:
            - name: “*.80”
              domains:
              - "*"
              routes:
              - match:
                  path: "/productpage"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    abort:
                      httpStatus: 500
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
                    downstream_nodes: 
                    - router~172.20.0.105~istio-ingressgateway-67b6dd64bc-7wwk7.istio-system~istio-system.svc.cluster.local
              - match:
                  prefix: "/static"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    abort:
                      httpStatus: 500
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
                    downstream_nodes: 
                    - router~172.20.0.105~istio-ingressgateway-67b6dd64bc-7wwk7.istio-system~istio-system.svc.cluster.local
EOF

kubectl apply -f  ef-fault-abort-downstream_nodes.yaml -n istio-system --context context-cluster1

max_active_faults

abort

测试没效果

cat << EOF > ef-fault-abort-max_active_faults.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: fault
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        #name: 0.0.0.0_8080  
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          codec_type: AUTO
          stat_prefix: ingress_http
          route_config:
            name: http.8080
            virtual_hosts:
            - name: “*.80”
              domains:
              - "*"
              routes:
              - match:
                  path: "/productpage"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    abort:
                      httpStatus: 500
                      percentage:
                        denominator: MILLION
                        numerator: 100000
                    max_active_faults: 1
              - match:
                  prefix: "/static"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    abort:
                      httpStatus: 500
                      percentage:
                        denominator: MILLION
                        numerator: 100000
                    max_active_faults: 1
EOF

kubectl apply -f  ef-fault-abort-max_active_faults.yaml -n istio-system --context context-cluster1

response_rate_limit

abort

cat << EOF > ef-fault-abort-response_rate_limit.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: fault
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      listener:
        #name: 0.0.0.0_8080  
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          codec_type: AUTO
          stat_prefix: ingress_http
          route_config:
            name: http.8080
            virtual_hosts:
            - name: “*.80”
              domains:
              - "*"
              routes:
              - match:
                  path: "/productpage"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    response_rate_limit:
                      fixed_limit:
                        limit_kbps: 1
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
              - match:
                  prefix: "/static"
                route:
                  cluster: outbound|9080||productpage.istio.svc.cluster.local
                typed_per_filter_config:
                  envoy.filters.http.fault:
                    '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                    abort:
                      httpStatus: 500
                      percentage:
                        denominator: MILLION
                        numerator: 10000
                    response_rate_limit:
                      fixed_limit:
                        limit_kbps: 1
                      percentage:
                        denominator: MILLION
                        numerator: 1000000
EOF

kubectl apply -f  ef-fault-abort-response_rate_limit.yaml -n istio-system --context context-cluster1