Week 02: 云原生架构实战 -- 下一代全栈基础设施

# 查看加载的 eBPF 程序
bpftool prog list

# 查看程序附加点
bpftool net show

# 追踪 eBPF 程序执行
cilium monitor --type trace

# 抓包 (在 eBPF 层)
cilium monitor --type drop  # 查看被丢弃的包

# /etc/cni/net.d/05-cilium.conflist
{
  "cniVersion": "1.0.0",
  "name": "cilium",
  "plugins": [
    {
      "type": "cilium-cni"  # 主插件: IP 分配, 路由配置
    },
    {
      "type": "portmap",     # 端口映射 (hostPort 支持)
      "capabilities": {"portMappings": true}
    },
    {
      "type": "bandwidth",   # 带宽限制
      "ingressRate": 1000000,
      "egressRate": 1000000
    }
  ]
}

{
  "cniVersion": "1.0.0",
  "interfaces": [
    {"name": "eth0", "sandbox": "/var/run/netns/cni-xxx"}
  ],
  "ips": [
    {"address": "10.97.0.15/24", "gateway": "10.97.0.1", "interface": 0}
  ],
  "routes": [
    {"dst": "0.0.0.0/0", "gw": "10.97.0.1"}
  ],
  "dns": {
    "nameservers": ["10.96.0.10"],
    "search": ["default.svc.cluster.local"]
  }
}

# 查看 CNI 配置
ls -la /etc/cni/net.d/
cat /etc/cni/net.d/05-cilium.conflist | jq

# 手动执行 CNI (测试)
CNI_COMMAND=ADD CNI_CONTAINERID=test CNI_NETNS=/var/run/netns/test \
  CNI_IFNAME=eth0 CNI_PATH=/opt/cni/bin \
  /opt/cni/bin/cilium-cni < /etc/cni/net.d/05-cilium.conflist

# 查看 Kubelet CNI 日志
journalctl -u kubelet | grep -i cni

helm repo add traefik https://traefik.github.io/charts
helm repo update

helm install traefik traefik/traefik \
  --namespace traefik-system --create-namespace \
  --set ports.web.exposedPort=80 \
  --set ports.websecure.exposedPort=443 \
  --set gatewayExtensions.enabled=true

apiVersion: "cilium.io/v2alpha1"
kind: CiliumLoadBalancerIPPool
metadata:
  name: "management-pool"
spec:
  blocks:
    - cidr: "192.168.20.104/32" # 明确指定我们要使用的虚拟 IP

apiVersion: "cilium.io/v2alpha1"
kind: CiliumL2AnnouncementPolicy
metadata:
  name: "l2-announcement-policy"
spec:
  externalIPs: true
  loadBalancerIPs: true
  interfaces:
    - ^eth[0-9]+ # 匹配物理网卡名称, 请根据实际 ip addr 结果修改
  nodeSelector:
    matchLabels:
      kubernetes.io/os: linux

# gateway-class.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: traefik
spec:
  controllerName: traefik.io/gateway-controller

# edge-gateway.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: edge-gateway
  namespace: traefik-system
  annotations:
    io.cilium/lb-ipam-ips: "192.168.20.104" # 核心动作: 向 Cilium 申请锁定 VIP
spec:
  gatewayClassName: traefik
  listeners:
  - name: http
    protocol: HTTP
    port: 8000
    allowedRoutes:
      namespaces:
        from: All

# 为 Namespace 创建 Waypoint
istioctl waypoint apply --namespace default --name default-waypoint

# 查看 Waypoint Pod
kubectl get pods -n default -l istio.io/gateway-name=default-waypoint

# 关键: 禁用 Cilium CNI 独占模式
helm upgrade cilium cilium/cilium \
  --namespace kube-system \
  --reuse-values \
  --set cni.exclusive=false

# 重启 Cilium 以应用新配置
kubectl rollout restart ds cilium -n kube-system

# macOS
brew install istioctl

# Linux
curl -L https://istio.io/downloadIstio | sh -
cd istio-1.*
sudo cp bin/istioctl /usr/local/bin/

istioctl install --set profile=ambient -y

kubectl create namespace monitoring-dev
kubectl label namespace monitoring-dev istio.io/dataplane-mode=ambient
kubectl describe namespace monitoring-dev

# pg-grafana.yaml
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: pg-grafana
  namespace: monitoring-dev
spec:
  instances: 3 
  imageName: ghcr.io/cloudnative-pg/postgresql:17.0
  storage:
    size: 20Gi
    storageClass: "nfs-client"
  # 数据库初始化
  bootstrap:
    initdb:
      database: grafana
      owner: grafana_user
      secret:
        name: pg-grafana-creds # 稍后创建这个 Secret 存放密码
  postgresql:
    parameters:
      archive_timeout: "5min"
      max_wal_senders: "10" 

# 创建 secret
kubectl create secret generic pg-grafana-creds \
  --from-literal=username=grafana_user \
  --from-literal=password=Grafana123 \
  -n monitoring-dev

# 1. 环境变量注入 (数据库对接)
extraEnvs:
  - name: GF_DATABASE_TYPE
    value: "postgres"
  - name: GF_DATABASE_HOST
    value: "pg-grafana-rw.monitoring-dev.svc.cluster.local:5432"
  - name: GF_DATABASE_NAME
    value: "grafana"
  - name: GF_DATABASE_SSL_MODE
    value: "disable"
  - name: GF_DATABASE_USER
    valueFrom:
      secretKeyRef:
        name: pg-grafana-creds
        key: username
  - name: GF_DATABASE_PASSWORD
    valueFrom:
      secretKeyRef:
        name: pg-grafana-creds
        key: password

# 2. 基础运行配置
grafana.ini:
  log:
    level: info
  # 注意: database 部分在此保持空白, 以强制让环境变量生效

# 3. 高可用配置 (初次调试建议先设为 1)
replicas: 1

# 4. 存储与权限配置
persistence:
  enabled: true
  storageClassName: "nfs-client"
  size: 5Gi

podSecurityContext:
  fsGroup: 472
containerSecurityContext:
  runAsUser: 472

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: grafana-route
  namespace: monitoring-dev
spec:
  parentRefs:
  - name: edge-gateway
    namespace: traefik-system
  hostnames:
    - "grafana.example.com"
  rules:
  - backendRefs:
    - name: grafana
      port: 80

hubble observe --namespace monitoring-dev -f
# 只看发往 5432 端口（数据库）的流量
hubble observe --namespace monitoring-dev -f --dest-port 5432

# 如果没有 Hubble CLI, 可以直接在 Cilium Pod 里运行
kubectl exec -n kube-system ds/cilium -- hubble observe --namespace monitoring-dev -f

kubectl scale -n monitoring-dev deployment grafana-dev --replicas=2
kubectl -n kube-system exec pod/cilium-bc8hc -- cilium service list

kubectl get svc -n traefik-system
kubectl get svc -n traefik-system traefik -o yaml

kubectl get httproute grafana-route -n monitoring-dev -o yaml

kubectl get gatewayclass
kubectl get gatewayclass traefik -o yaml
kubectl get gateway -n traefik-system
kubectl get gateway -n traefik-system edge-gateway -o yaml

kubectl describe -n traefik-system pod  -l app.kubernetes.io/name=traefik

kubectl get crd | grep gateway.networking.k8s.io
kubectl logs -n istio-system -l app=ztunnel | grep -i grafana

# 集群内部测试
kubectl run test-curl --image=curlimages/curl -i --rm --restart=Never -- \
  curl -v http://grafana-dev.monitoring-dev.svc.cluster.local:80/api/health

# 重启 traefik
kubectl rollout restart deployment -n traefik-system traefik

# patch
kubectl patch deployment -n monitoring-dev -l app.kubernetes.io/name=grafana --type='json' -p='[
  {"op": "add", "path": "/spec/template/spec/containers/0/env", "value": []},
  {"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "GF_DATABASE_TYPE", "value": "postgres"}},
  {"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "GF_DATABASE_HOST", "value": "pg-grafana-rw.monitoring-dev.svc.cluster.local:5432"}},
  {"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "GF_DATABASE_NAME", "value": "grafana"}},
  {"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "GF_DATABASE_SSL_MODE", "value": "disable"}},
  {"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "GF_DATABASE_USER", "valueFrom": {"secretKeyRef": {"name": "pg-grafana-creds", "key": "username"}}}},
  {"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "GF_DATABASE_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "pg-grafana-creds", "key": "password"}}}}
]'

 curl -v -H "Host: grafana.example.com" http://192.168.20.104/api/health
*   Trying 192.168.20.104:80...
* Connected to 192.168.20.104 (192.168.20.104) port 80
> GET /api/health HTTP/1.1
> Host: grafana.example.com
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 200 OK
< Cache-Control: no-store
< Content-Length: 101
< Content-Type: application/json; charset=UTF-8
< Date: Wed, 31 Dec 2025 07:48:39 GMT
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-Xss-Protection: 1; mode=block
<
{
  "database": "ok",
  "version": "12.3.1",
  "commit": "3a1c80ca7ce612f309fdc99338dd3c5e486339be"
* Connection #0 to host 192.168.20.104 left intact
}