k8s资源之pod全面讲解

小鱼儿 2023-06-24 06:24 17阅读 0赞

#  欢迎关注我的公众号： #

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAaHhwamF2YTE_size_8_color_FFFFFF_t_70_g_se_x_16][]

目前刚开始写一个月，一共写了18篇原创文章，文章目录如下：

[istio多集群探秘，部署了50次多集群后我得出的结论][istio_50]

[istio多集群链路追踪，附实操视频][istio]

[istio防故障利器，你知道几个,istio新手不要读，太难！][istio_istio]

[istio业务权限控制，原来可以这么玩][istio 1]

[istio实现非侵入压缩，微服务之间如何实现压缩][istio 2]

[不懂envoyfilter也敢说精通istio系列-http-rbac-不要只会用AuthorizationPolicy配置权限][envoyfilter_istio_-http-rbac-_AuthorizationPolicy]

[不懂envoyfilter也敢说精通istio系列-02-http-corsFilter-不要只会vs][envoyfilter_istio_-02-http-corsFilter-_vs]

[不懂envoyfilter也敢说精通istio系列-03-http-csrf filter-再也不用再代码里写csrf逻辑了][envoyfilter_istio_-03-http-csrf filter-_csrf]

[不懂envoyfilter也敢说精通istio系列http-jwt\_authn-不要只会RequestAuthorization][envoyfilter_istio_http-jwt_authn-_RequestAuthorization]

[不懂envoyfilter也敢说精通istio系列-05-fault-filter-故障注入不止是vs][envoyfilter_istio_-05-fault-filter-_vs]

[不懂envoyfilter也敢说精通istio系列-06-http-match-配置路由不只是vs][envoyfilter_istio_-06-http-match-_vs]

[不懂envoyfilter也敢说精通istio系列-07-负载均衡配置不止是dr][envoyfilter_istio_-07-_dr]

[不懂envoyfilter也敢说精通istio系列-08-连接池和断路器][envoyfilter_istio_-08-]

[不懂envoyfilter也敢说精通istio系列-09-http-route filter][envoyfilter_istio_-09-http-route filter]

[不懂envoyfilter也敢说精通istio系列-network filter-redis proxy][envoyfilter_istio_-network filter-redis proxy]

[不懂envoyfilter也敢说精通istio系列-network filter-HttpConnectionManager][envoyfilter_istio_-network filter-HttpConnectionManager]

[不懂envoyfilter也敢说精通istio系列-ratelimit-istio ratelimit完全手册][envoyfilter_istio_-ratelimit-istio ratelimit]

\----------------------------------------------------------------------------------------------------------------------------------------

1）

•K8s核心资源，用于运行容器

•简称：po

•一个pod可以运行多个容器

•Pod中的容器可以共享网络和存储

常用命令：

kubectl create -f nginx-01.yaml 
    kubectl apply -f nginx-01.yaml
     kubectl get pod 
    kubectl get pod -l name=nginx
    kubectl delete pod nginx
    kubectl delete pod –all
    kubectl get pod -o wide
    kubectl edit pod nginx
    kubectl get pod nginx -o yaml
    Kubectl delete pod –f nginx-01.yaml
    kubectl label pod nginx project=web
    kubectl annotate pod nginx project=web
    kubectl exec -it nginx /bin/bash
    kubectl cp default/nginx:/etc/nginx/nginx.conf ~/nginx.conf
     kubectl cp ~/aa default/nginx:/tmp
     kubectl logs nginx

2）Pod生命周期

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70][]

3）Pod重启策略

•Pod的重启策略RestartPolicy可能的值为 Always、OnFailure 和 Never，默认为 Always

•Always：当容器失效时，由kubelet自动重启

•OnFailure：当容器终止运行且退出码不为0时，由kubelet自动重启

•Never：不论容器运行状态如何都不会重启

4）Pod健康检查

•LivenessProbe：存活性探测

ReadnessProbe：就绪性探测  
其存活性探测的方法可配置以下三种实现方式：

ExecAction：在容器内执行指定命令。如果命令退出时返回码为 0 则表明容器健康

•TCPSocketAction：对指定端口上的容器的 IP 地址进行 TCP 检查。如果能够建立连接，则表明容器健康。

•HTTPGetAction：对指定的端口和路径上的容器的 IP 地址执行 HTTP Get 请求。如果响应的状态码大于等于200 且小于 400则表明容器健康

initialDelaySeconds和timeoutSeconds参数，分别表示首次检查等待时间以及超时时间。

periodSeconds: 15 \#检查间隔时间

failureThreshold: 3最大失败次数

successThreshold: 1失败后测试成功的最小连接成功次数

[root@master01 readiness]# cat pod-readiness-exec.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      labels:
        test: readiness-exec
      name: readiness-exec
    spec:
      containers:
      - name: liveness
        image: busybox
        args:
        - /bin/sh
        - -c
        - echo ok > /tmp/health; sleep 10; rm -rf /tmp/health; sleep 600
        readinessProbe:
          exec:
            command:
            - cat
            - /tmp/health
          initialDelaySeconds: 15
          timeoutSeconds: 1

[root@master01 readiness]# cat pod-readiness-http.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-http-healthcheck
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80
        readinessProbe:
          httpGet:
            path: /_status/healthz
            port: 80
          initialDelaySeconds: 30
          timeoutSeconds: 1

[root@master01 readiness]# cat pod-readiness-tcp.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-tcp-healthcheck
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80
        readinessProbe:
          tcpSocket:
            port: 80
          initialDelaySeconds: 30
          timeoutSeconds: 1

liveness：

[root@master01 readiness]# cat pod-liveness-exec.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      labels:
        test: readiness-exec
      name: liveness-exec
    spec:
      containers:
      - name: liveness
        image: busybox
        args:
        - /bin/sh
        - -c
        - echo ok > /tmp/health; sleep 10; rm -rf /tmp/health; sleep 600
        livenessProbe:
          exec:
            command:
            - cat
            - /tmp/health
          initialDelaySeconds: 15
          timeoutSeconds: 1

[root@master01 readiness]# cat pod-liveness-http.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-liveness-http
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80
        livenessProbe:
          httpGet:
            path: /_status/healthz
            port: 80
          initialDelaySeconds: 30
          timeoutSeconds: 1

[root@master01 readiness]# cat pod-liveness-tcp.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-liveness-tcp
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80
        livenessProbe:
          tcpSocket:
            port: 80
          initialDelaySeconds: 30
          timeoutSeconds: 1

5）imagePullPolicy

三个选择Always、Never、IfNotPresent，每次启动时检查和更新（从registery）images的策略， \# Always，每次都检查 \# Never，每次都不检查（不管本地是否有） \# IfNotPresent，如果本地有就不检查，如果没有就拉取

6）资源管理

[root@master01 resources]# cat tomcat.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: volume-pod
    spec:
      containers:
      - name: tomcat
        image: tomcat
        ports:
        - containerPort: 8080
        volumeMounts:
        - name: app-logs
          mountPath: /usr/local/tomcat/logs
        resources:
          limits:
            cpu: 0.1
            memory: 100Mi
      - name: busybox
        image: busybox
        command: ["sh", "-c", "tail -f /logs/catalina*.log"]
        volumeMounts:
        - name: app-logs
          mountPath: /logs
      volumes:
      - name: app-logs
        emptyDir: {}

[root@master01 resources]# cat nginx.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
      labels:
        name: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80        
          hostPort: 80        
        resources:
          requests:
            cpu: 0.01
            memory: 1Mi
          limits:
            cpu: 0.5
            memory: 10Mi

• r equests

• limits

• yum -y install  httpd \-tools

• ab  \-c 500 -n 20000 http://172.20.2.23:8080/index.html

\# vim /etc/sysctl.conf

net.ipv4.tcp\_syncookies = 0

\# sysctl \-p

7）生命周期管理

• postStart : \# 容器运行之前运行的任务

• preStop :\# 容器关闭之前运行的任务

[root@master01 lifecycle]# cat nginx-postStart-exec.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
      labels:
        name: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80        
        lifecycle:
          postStart:
           exec:
             command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]

[root@master01 lifecycle]# cat nginx-preStop-exec.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
      labels:
        name: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80        
        lifecycle:
          preStop:
           exec:
             command: ["/usr/sbin/nginx","-s","quit"]

[root@master01 lifecycle]# cat nginx-preStop-httpGet.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
      labels:
        name: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80        
        lifecycle:
          preStop:
            httpGet:
              host: 192.168.4.170
              path: api/v2/devops/pkg/upload_hooks
              port: 8090

8）**Init** **Container**

[root@master01 initContainers]# cat init.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: myapp-pod
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp-container
        image: busybox
        command: ['sh', '-c', 'echo The app is running! && sleep 3600']
      initContainers:
      - name: init-myservice
        image: busybox
        command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;']
      - name: init-mydb
        image: busybox
        command: ['sh', '-c', 'until nslookup mydb; do echo waiting for mydb; sleep 2; done;']

[root@master01 initContainers]# cat service.yaml 
    kind: Service
    apiVersion: v1
    metadata:
      name: myservice
    spec:
      ports:
      - protocol: TCP
        port: 80
        targetPort: 9376
    ---
    kind: Service
    apiVersion: v1
    metadata:
      name: mydb
    spec:
      ports:
      - protocol: TCP
        port: 80
        targetPort: 9377

9）nodeSelector

[root@master01 nodeSelector]# cat nginx.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
      labels:
        name: nginx
    spec:
      nodeSelector:
        zone: node1
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80        
          hostPort: 80

10）affinity

•podAffinity

•nodeAffinity

[root@master01 affinity]# cat node-affinity.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: with-node-affinity
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/e2e-az-name
                operator: In
                values:
                - e2e-az1
                - e2e-az2
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 1
            preference:
              matchExpressions:
              - key: type
                operator: In
                values:
                - ssd
      containers:
      - name: with-node-affinity
        image: nginx
        ports:
        - containerPort: 80

[root@master01 podAffinity]# cat ./*
    apiVersion: v1
    kind: Pod
    metadata:
      name: with-anti-affinity
    spec:
      affinity:
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: security
                operator: In
                values:
                - S1
            topologyKey: "kubernetes.io/hostname"
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: security
                  operator: In
                  values:
                  - S2
              topologyKey: kubernetes.io/hostname
      containers:
      - name: with-anti-affinity
        image: nginx
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-flag-s2
      labels:
        security: "S2"
        app: "nginx"
    spec:
      containers:
      - name: nginx
        image: nginx
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-flag-s1
      labels:
        security: "S1"
        app: "nginx"
    spec:
      containers:
      - name: nginx
        image: nginx
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-affinity
    spec:
      affinity:
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: security
                operator: In
                values:
                - S1
            topologyKey: kubernetes.io/hostname
      containers:
      - name: with-pod-affinity
        image: nginx

11）activeDeadlineSeconds

[root@master01 activeDeadlineSeconds]# cat nginx.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
      labels:
        name: nginx
    spec:
      activeDeadlineSeconds: 30
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80        
          hostPort: 80

12）dnsConfig

[root@master01 dnsConfig]# cat dns-example.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      namespace: default
      name: dns-example
    spec:
      containers:
        - name: test
          image: busybox
          args:
            - "sh"
            - "-c"
            - "sleep 3600"  
      dnsPolicy: "None"
      dnsConfig:
        nameservers:
          - 114.114.115.115
        searches:
          - ns1.svc.cluster.local
          - my.dns.search.suffix
        options:
          - name: ndots
            value: "2"
          - name: edns0

13）dnsPolicy

•None

设置dnsConfig

•ClusterFirst

•ClusterFirstWithHostNet

•Default

[root@master01 dnsPolicy]# cat dns-policy-default.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: dns-example
    spec:
      containers:
        - name: test
          image: busybox
          args:
            - "sh"
            - "-c"
            - "sleep 3600"  
      dnsPolicy: "Default"

[root@master01 dnsPolicy]# cat dns-policy-hostNetwork.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: dns-example
    spec:
      containers:
        - name: test
          image: busybox
          args:
            - "sh"
            - "-c"
            - "sleep 3600"  
      dnsPolicy: "ClusterFirstWithHostNet"
      hostNetwork: true

14） ephemeralContainers

[root@master01 ephemeralContainers]# cat ephemeral.json 
    {
        "apiVersion": "v1",
        "kind": "EphemeralContainers",
        "metadata": {
                "name": "nginx"
        },
        "ephemeralContainers": [{
            "command": [
                "bash"
            ],
            "image": "shoganator/rpi-alpine-tools",
            "imagePullPolicy": "Always",
            "name": "diagtools",
            "stdin": true,
            "tty": true,
            "terminationMessagePolicy": "File"
        }]
    }

• kubectl \-n default replace --raw / api /v1/namespaces/default/pods/ nginx / ephemeralcontainers \-f ./ ephemeral.json

15）hostalias

[root@master01 hostalias]# cat hostalias.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: hostaliases-pod
    spec:
      restartPolicy: Never
      hostAliases:
      - ip: "127.0.0.1"
        hostnames:
        - "foo.local"
        - "bar.local"
      - ip: "10.1.2.3"
        hostnames:
        - "foo.remote"
        - "bar.remote"
      containers:
      - name: cat-hosts
        image: nginx 
        command:
        - cat
        args:
        - "/etc/hosts"

16）hostname

[root@master01 hostname]# cat hostname.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: hostname-pod
    spec:
      restartPolicy: Never
      hostname: mark
      containers:
      - name: cat-hosts
        image: nginx 
        command:
        - hostname

17）nodeName

[root@master01 nodename]# cat nodename.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: nodename-pod
    spec:
      restartPolicy: Never
      nodeName: 192.168.198.156
      containers:
      - name: cat-hosts
        image: nginx

18）preemptionPolicy

[root@master01 preemptionPolicy]# cat preemption.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: preemption-pod
    spec:
      restartPolicy: Never
      preemptionPolicy: PreemptLowerPriority
      containers:
      - name: cat-hosts
        image: nginx

19）priority

[root@master01 priority]# cat priority.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: priority-pod
    spec:
      restartPolicy: Never
      preemptionPolicy: PreemptLowerPriority
      priority: 1000
      containers:
      - name: cat-hosts
        image: nginx

20）priorityClassName

[root@master01 priorityClass]# cat priorityClass.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: priorityclass-pod
    spec:
      restartPolicy: Never
      priorityClassName: high-priority
      containers:
      - name: cat-hosts
        image: nginx
    
    
    
    [root@master01 priorityClass]# cat high-priority.yaml 
    apiVersion: scheduling.k8s.io/v1
    kind: PriorityClass
    metadata:
      name: high-priority
    value: 1000000
    globalDefault: false
    description: "This priority class should be used for XYZ service pods only."

21）readinessGates

[root@master01 readinessGates]# cat nginx.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
      labels:
        name: nginx
    spec:
      readinessGates:
      - conditionType: "www.example.com/feature-1"
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80        
          hostPort: 80

22）Security Context

•Container-level Security Context：仅应用到指定的容器

•Pod-level Security Context：应用到Pod内所有容器以及Volume

•Pod Security Policies（PSP）：应用到集群内部所有Pod以及Volume

[root@master01 podSecurityContext]# cat ./*
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-10
    spec:
      securityContext:
        sysctls:
        - name: kernel.shm_rmid_forced
          value: "0"
      containers:
      - name: sec-ctx-4
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"  
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-1
    spec:
      securityContext:
        runAsUser: 1000
        fsGroup: 2000
      volumes:
      - name: sec-ctx-vol
        emptyDir: {}
      containers:
      - name: sec-ctx-demo
        image: busybox
        args:
        - "sh"
        -  "-c"
        -  "sleep 36000"
        securityContext:
          allowPrivilegeEscalation: false
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-2
    spec:
      securityContext:
        runAsUser: 1000
      containers:
      - name: sec-ctx-demo-2
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"
        securityContext:
          runAsUser: 2000
          allowPrivilegeEscalation: false
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-3
    spec:
      containers:
      - name: sec-ctx-4
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"
        securityContext:
          privileged: true
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-4-1
    spec:
      containers:
      - name: sec-ctx-4
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"
        securityContext:
          capabilities:
            add: ["NET_ADMIN", "SYS_TIME"]
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-5
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
      containers:
      - name: sec-ctx-4
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"
        securityContext:
          capabilities:
            add: ["NET_ADMIN", "SYS_TIME"]
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-6
    spec:
      securityContext:
        runAsNonRoot: true
      containers:
      - name: sec-ctx-4
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"
        securityContext:
          capabilities:
            add: ["NET_ADMIN", "SYS_TIME"]
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-7
    spec:
      securityContext:
        fsGroup: 1234
        supplementalGroups: [5678]
        seLinuxOptions:
          level: "s0:c123,c456"
      containers:
      - name: sec-ctx-4
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-8
    spec:
      containers:
      - name: sec-ctx-4
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"  
        securityContext:
          capabilities:
            drop:
            - NET_RAW
            - CHOWN
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-9
    spec:
      securityContext:
        sysctls:
        - name: net.ipv4.ip_forward
          value: "1"
      containers:
      - name: sec-ctx-4
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"

23）serviceAccountName

[root@master01 serviceAccountName]# cat nginx.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
      labels:
        name: nginx
    spec:
      serviceAccountName: default
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80        
          hostPort: 80

24）subdomain

[root@master01 subdomain]# cat ./*
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
      labels:
        app: nginx-0
    spec:
      hostname: mark
      subdomain: com
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80        
          hostPort: 80

25）terminationGracePeriodSeconds

[root@master01 terminationGracePeriodSeconds]# cat nginx.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
      labels:
        name: nginx
    spec:
      terminationGracePeriodSeconds: 0
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80        
          hostPort: 80

26）tolerations

• **Taints** **和** **Tolerations**

• taint  定义在 node 上，排斥 pod

• toleration 定义在 pod 中， 容忍 taint

kubectl taint nodes node1 key=value:NoSchedule

kubectl taint nodes node1 key:NoSchedule\-

Affect:

NoSchedule

NoExecute

[root@master01 tolerations]# cat nginx.yaml 
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
      labels:
        env: test
    spec:
      containers:
      - name: nginx
        image: nginx
        imagePullPolicy: IfNotPresent
      tolerations:
      - key: "example-key"
        operator: "Exists"
        effect: "NoSchedule"

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAaHhwamF2YTE_size_8_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/20211007094240106.jpg?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAaHhwamF2YTE=,size_8,color_FFFFFF,t_70,g_se,x_16
[istio_50]: https://mp.weixin.qq.com/s/_OPMjmWCDSTlmbAxytg33A
[istio]: https://mp.weixin.qq.com/s/kjvtno_UzJAGr1joxm3tvw
[istio_istio]: https://mp.weixin.qq.com/s/e2-p_NY31Mc5y07S4Bb1JQ
[istio 1]: https://mp.weixin.qq.com/s/iTV0SCQLhSOTYncp3PxoHQ
[istio 2]: https://mp.weixin.qq.com/s/eINlrT242RlAwfuZu1_PcA
[envoyfilter_istio_-http-rbac-_AuthorizationPolicy]: https://mp.weixin.qq.com/s/Q-yTGBNqkjOov49LTXPrPA
[envoyfilter_istio_-02-http-corsFilter-_vs]: https://mp.weixin.qq.com/s/bFMdrT7OKSqoWv8pDXOIqQ
[envoyfilter_istio_-03-http-csrf filter-_csrf]: https://mp.weixin.qq.com/s/dlG9phV-kMMxs4UPzuRNYg
[envoyfilter_istio_http-jwt_authn-_RequestAuthorization]: https://mp.weixin.qq.com/s/IfrJ-FdLYsdhPkDrcO_YXA
[envoyfilter_istio_-05-fault-filter-_vs]: https://mp.weixin.qq.com/s/a4gDXqD8uswgglMwkUph2Q
[envoyfilter_istio_-06-http-match-_vs]: https://mp.weixin.qq.com/s/TpS3DHdcaJiPivIS_jsIGw
[envoyfilter_istio_-07-_dr]: https://mp.weixin.qq.com/s/k-zJm7n7OOKg6MotQJYPAA
[envoyfilter_istio_-08-]: https://mp.weixin.qq.com/s/n_bJ3saNeTtXRprIymhwzg
[envoyfilter_istio_-09-http-route filter]: https://mp.weixin.qq.com/s/JAeZr0BMVQxIrB3S_7Ru0A
[envoyfilter_istio_-network filter-redis proxy]: https://mp.weixin.qq.com/s/B9IPTI8F3q42nVkqbQRlPw
[envoyfilter_istio_-network filter-HttpConnectionManager]: https://mp.weixin.qq.com/s/W3OPQWkCVvuHGS49cTNhlg
[envoyfilter_istio_-ratelimit-istio ratelimit]: https://mp.weixin.qq.com/s/KgiDsELNol27mgZvDbFsqw
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/2019122109364865.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx,size_16,color_FFFFFF,t_70