在 Azure Kubernetes 服务 (AKS) 中安装 LinkerdInstall Linkerd in Azure Kubernetes Service (AKS)

Linkerd 是一种开源服务网格和 CNCF 孵化项目Linkerd is an open-source service mesh and CNCF incubating project. Linkerd 是一种超轻型服务网格,其提供的功能包括流量管理、服务标识和安全性、可靠性以及可观测性。Linkerd is an ultralight service mesh that provides features that include traffic management, service identity and security, reliability, and observability. 有关 Linkerd 的详细信息,请参阅官方的 Linkerd 常见问题解答Linkerd 体系结构文档。For more information about Linkerd, see the official Linkerd FAQ and Linkerd Architecture documentation.

本文介绍如何安装 Linkerd。This article shows you how to install Linkerd. Linkerd linkerd 客户端二进制文件安装到客户端计算机上,Linkerd 组件安装到 AKS 上的 Kubernetes 群集中。The Linkerd linkerd client binary is installed onto your client machine and the Linkerd components are installed into a Kubernetes cluster on AKS.

备注

这些说明引用 Linkerd 版本 stable-2.6.0These instructions reference Linkerd version stable-2.6.0.

可针对 Kubernetes 版本 1.13+ 运行 Linkerd stable-2.6.xThe Linkerd stable-2.6.x can be run against Kubernetes versions 1.13+. 可以在 GitHub - Linkerd 版本中找到 Stable 和 Edge 的其他 Linkerd 版本。You can find additional stable and edge Linkerd versions at GitHub - Linkerd Releases.

在本文中,学习如何:In this article, you learn how to:

  • 下载并安装 Linkerd linkerd 客户端二进制文件Download and install the Linkerd linkerd client binary
  • 在 AKS 上安装 LinkerdInstall Linkerd on AKS
  • 验证 Linkerd 安装Validate the Linkerd installation
  • 访问仪表板Access the Dashboard
  • 从 AKS 中卸载 LinkerdUninstall Linkerd from AKS

开始之前Before you begin

本文中详述的步骤假设已创建 AKS 群集(已启用 RBAC 的 Kubernetes 1.13 及更高版本)并已与该群集建立 kubectl 连接。The steps detailed in this article assume that you've created an AKS cluster (Kubernetes 1.13 and above, with RBAC enabled) and have established a kubectl connection with the cluster. 如果需要帮助完成这些项目,请参阅 AKS 快速入门If you need help with any of these items, then see the AKS quickstart.

必须对所有 Linkerd Pod 进行计划,使之在 Linux 节点上运行 - 在下面详述的安装方法中,此安装是默认设置,不需其他配置。All Linkerd pods must be scheduled to run on Linux nodes - this setup is the default in the installation method detailed below and requires no additional configuration.

本文将 Linkerd 安装指南分为多个独立步骤。This article separates the Linkerd installation guidance into several discrete steps. 结果的结构与官方 Linkerd 入门指南相同。The result is the same in structure as the official Linkerd getting started guidance.

下载并安装 Linkerd linkerd 客户端二进制文件Download and install the Linkerd linkerd client binary

在 Linux 或适用于 Linux 的 Windows 子系统上的基于 bash 的 shell 中,使用 curl 下载 Linkerd 发行版,如下所示:In a bash-based shell on Linux or Windows Subsystem for Linux, use curl to download the Linkerd release as follows:

# Specify the Linkerd version that will be leveraged throughout these instructions
LINKERD_VERSION=stable-2.6.0

curl -sLO "https://github.com/linkerd/linkerd2/releases/download/$LINKERD_VERSION/linkerd2-cli-$LINKERD_VERSION-linux"

linkerd 客户端二进制文件在客户端计算机上运行,用来与 Linkerd 服务网格交互。The linkerd client binary runs on your client machine and allows you to interact with the Linkerd service mesh. 在 Linux 或适用于 Linux 的 Windows 子系统上的基于 bash 的 shell 中使用以下命令安装 Linkerd linkerd 客户端二进制文件。Use the following commands to install the Linkerd linkerd client binary in a bash-based shell on Linux or Windows Subsystem for Linux. 这些命令可将 linkerd 客户端二进制文件复制到 PATH 中的标准用户程序位置。These commands copy the linkerd client binary to the standard user program location in your PATH.

sudo cp ./linkerd2-cli-$LINKERD_VERSION-linux /usr/local/bin/linkerd
sudo chmod +x /usr/local/bin/linkerd

如果想要通过命令行完成 Linkerd linkerd 客户端二进制文件的下载和安装,则按如下所示进行设置:If you'd like command-line completion for the Linkerd linkerd client binary, then set it up as follows:

# Generate the bash completion file and source it in your current shell
mkdir -p ~/completions && linkerd completion bash > ~/completions/linkerd.bash
source ~/completions/linkerd.bash

# Source the bash completion file in your .bashrc so that the command-line completions
# are permanently available in your shell
echo "source ~/completions/linkerd.bash" >> ~/.bashrc

下载并安装 Linkerd linkerd 客户端二进制文件Download and install the Linkerd linkerd client binary

在 MacOS 上基于 bash 的 shell 中,使用 curl 下载 Linkerd 发行版,如下所示:In a bash-based shell on MacOS, use curl to download the Linkerd release as follows:

# Specify the Linkerd version that will be leveraged throughout these instructions
LINKERD_VERSION=stable-2.6.0

curl -sLO "https://github.com/linkerd/linkerd2/releases/download/$LINKERD_VERSION/linkerd2-cli-$LINKERD_VERSION-darwin"

linkerd 客户端二进制文件在客户端计算机上运行,用来与 Linkerd 服务网格交互。The linkerd client binary runs on your client machine and allows you to interact with the Linkerd service mesh. 在 MacOS 上基于 bash 的 shell 中使用以下命令安装 Linkerd linkerd 客户端二进制文件。Use the following commands to install the Linkerd linkerd client binary in a bash-based shell on MacOS. 这些命令可将 linkerd 客户端二进制文件复制到 PATH 中的标准用户程序位置。These commands copy the linkerd client binary to the standard user program location in your PATH.

sudo cp ./linkerd2-cli-$LINKERD_VERSION-darwin /usr/local/bin/linkerd
sudo chmod +x /usr/local/bin/linkerd

如果想要通过命令行完成 Linkerd linkerd 客户端二进制文件的下载和安装,则按如下所示进行设置:If you'd like command-line completion for the Linkerd linkerd client binary, then set it up as follows:

# Generate the bash completion file and source it in your current shell
mkdir -p ~/completions && linkerd completion bash > ~/completions/linkerd.bash
source ~/completions/linkerd.bash

# Source the bash completion file in your .bashrc so that the command-line completions
# are permanently available in your shell
echo "source ~/completions/linkerd.bash" >> ~/.bashrc

下载并安装 Linkerd linkerd 客户端二进制文件Download and install the Linkerd linkerd client binary

在 Windows 上基于 PowerShell 的 shell 中,使用 Invoke-WebRequest 下载 Linkerd 发行版,如下所示:In a PowerShell-based shell on Windows, use Invoke-WebRequest to download the Linkerd release as follows:

# Specify the Linkerd version that will be leveraged throughout these instructions
$LINKERD_VERSION="stable-2.6.0"

# Enforce TLS 1.2
[Net.ServicePointManager]::SecurityProtocol = "tls12"
$ProgressPreference = 'SilentlyContinue'; Invoke-WebRequest -URI "https://github.com/linkerd/linkerd2/releases/download/$LINKERD_VERSION/linkerd2-cli-$LINKERD_VERSION-windows.exe" -OutFile "linkerd2-cli-$LINKERD_VERSION-windows.exe"

linkerd 客户端二进制文件在客户端计算机上运行,用来与 Linkerd 服务网格交互。The linkerd client binary runs on your client machine and allows you to interact with the Linkerd service mesh. 在 Windows 上基于 PowerShell 的 shell 中使用以下命令安装 Linkerd linkerd 客户端二进制文件。Use the following commands to install the Linkerd linkerd client binary in a PowerShell-based shell on Windows. 这些命令可将 linkerd 客户端二进制文件复制到某个 Linkerd 文件夹,然后你就可以通过 PATH 将其设置为立即可用(在当前 shell 中)和永久可用(跨 shell 重启)。These commands copy the linkerd client binary to a Linkerd folder and then make it available both immediately (in current shell) and permanently (across shell restarts) via your PATH. 不需要提升的(管理员)特权即可运行这些命令,不需重启 shell。You don't need elevated (Admin) privileges to run these commands and you don't need to restart your shell.

# Copy linkerd.exe to C:\Linkerd
New-Item -ItemType Directory -Force -Path "C:\Linkerd"
Copy-Item -Path ".\linkerd2-cli-$LINKERD_VERSION-windows.exe" -Destination "C:\Linkerd\linkerd.exe"

# Add C:\Linkerd to PATH. 
# Make the new PATH permanently available for the current User
$USER_PATH = [environment]::GetEnvironmentVariable("PATH", "User") + ";C:\Linkerd\"
[environment]::SetEnvironmentVariable("PATH", $USER_PATH, "User")
# Make the new PATH immediately available in the current shell
$env:PATH += ";C:\Linkerd\"

在 AKS 上安装 LinkerdInstall Linkerd on AKS

在安装 Linkerd 之前,我们将运行预安装检查,确定能否在 AKS 群集上安装控制平面:Before we install Linkerd, we'll run pre-installation checks to determine if the control plane can be installed on our AKS cluster:

linkerd check --pre

应该会看到如下所示内容,表明 AKS 群集是 Linkerd 的有效安装目标:You should see something like the following to indicate that your AKS cluster is a valid installation target for Linkerd:

kubernetes-api
--------------
√ can initialize the client
√ can query the Kubernetes API

kubernetes-version
------------------
√ is running the minimum Kubernetes API version
√ is running the minimum kubectl version

pre-kubernetes-setup
--------------------
√ control plane namespace does not already exist
√ can create Namespaces
√ can create ClusterRoles
√ can create ClusterRoleBindings
√ can create CustomResourceDefinitions
√ can create PodSecurityPolicies
√ can create ServiceAccounts
√ can create Services
√ can create Deployments
√ can create CronJobs
√ can create ConfigMaps
√ no clock skew detected

pre-kubernetes-capability
-------------------------
√ has NET_ADMIN capability
√ has NET_RAW capability

pre-linkerd-global-resources
----------------------------
√ no ClusterRoles exist
√ no ClusterRoleBindings exist
√ no CustomResourceDefinitions exist
√ no MutatingWebhookConfigurations exist
√ no ValidatingWebhookConfigurations exist
√ no PodSecurityPolicies exist

linkerd-version
---------------
√ can determine the latest version
√ cli is up-to-date

Status check results are √

现在可以安装 Linkerd 组件了。Now it's time to install the Linkerd components. 请使用 linkerdkubectl 二进制文件将 Linkerd 组件安装到 AKS 群集中。Use the linkerd and kubectl binaries to install the Linkerd components into your AKS cluster. 将会自动创建 linkerd 命名空间,并会将组件安装到此命名空间中。A linkerd namespace will be automatically created, and the components will be installed into this namespace.

linkerd install | kubectl apply -f -

Linkerd 部署许多对象。Linkerd deploys a number of objects. 上述 linkerd install 命令的输出会显示对象列表。You'll see the list from the output of your linkerd install command above. 部署 Linkerd 组件应该需要大约 1 分钟才能完成,具体取决于群集环境。The deployment of the Linkerd components should take around 1 minute to complete, depending on your cluster environment.

此时已将 Linkerd 部署到 AKS 群集。At this point, you've deployed Linkerd to your AKS cluster. 为确保成功部署 Linkerd,让我们转到验证 Linkerd 安装部分。To ensure we have a successful deployment of Linkerd, let's move on to the next section to Validate the Linkerd installation.

验证 Linkerd 安装Validate the Linkerd installation

确认已成功创建资源。Confirm that the resources have been successfully created. 使用 kubectl get svckubectl get pod 命令查询 linkerd 命名空间,在其中通过 linkerd install 命令安装了 Linkerd 组件:Use the kubectl get svc and kubectl get pod commands to query the linkerd namespace, where the Linkerd components were installed by the linkerd install command:

kubectl get svc --namespace linkerd --output wide
kubectl get pod --namespace linkerd --output wide

以下示例输出显示了现在应该正在运行的服务和 Pod(在 Linux 节点上计划):The following example output shows the services and pods (scheduled on Linux nodes) that should now be running:

NAME                     TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)             AGE  SELECTOR
linkerd-controller-api   ClusterIP   10.0.110.67    <none>        8085/TCP            66s  linkerd.io/control-plane-component=controller
linkerd-destination      ClusterIP   10.0.224.29    <none>        8086/TCP            66s  linkerd.io/control-plane-component=controller
linkerd-dst              ClusterIP   10.0.225.148   <none>        8086/TCP            66s  linkerd.io/control-plane-component=destination
linkerd-grafana          ClusterIP   10.0.61.124    <none>        3000/TCP            65s  linkerd.io/control-plane-component=grafana
linkerd-identity         ClusterIP   10.0.6.104     <none>        8080/TCP            67s  linkerd.io/control-plane-component=identity
linkerd-prometheus       ClusterIP   10.0.27.168    <none>        9090/TCP            65s  linkerd.io/control-plane-component=prometheus
linkerd-proxy-injector   ClusterIP   10.0.100.133   <none>        443/TCP             64s  linkerd.io/control-plane-component=proxy-injector
linkerd-sp-validator     ClusterIP   10.0.221.5     <none>        443/TCP             64s  linkerd.io/control-plane-component=sp-validator
linkerd-tap              ClusterIP   10.0.18.14     <none>        8088/TCP,443/TCP    64s  linkerd.io/control-plane-component=tap
linkerd-web              ClusterIP   10.0.37.108    <none>        8084/TCP,9994/TCP   66s  linkerd.io/control-plane-component=web

NAME                                      READY   STATUS    RESTARTS   AGE   IP            NODE                            NOMINATED NODE   READINESS GATES
linkerd-controller-66ddc9f94f-cm9kt       3/3     Running   0          66s   10.240.0.50   aks-linux-16165125-vmss000001   <none>           <none>
linkerd-destination-c94bc454-qpkng        2/2     Running   0          66s   10.240.0.78   aks-linux-16165125-vmss000002   <none>           <none>
linkerd-grafana-6868fdcb66-4cmq2          2/2     Running   0          65s   10.240.0.69   aks-linux-16165125-vmss000002   <none>           <none>
linkerd-identity-74d8df4b85-tqq8f         2/2     Running   0          66s   10.240.0.48   aks-linux-16165125-vmss000001   <none>           <none>
linkerd-prometheus-699587cf8-k8ghg        2/2     Running   0          65s   10.240.0.41   aks-linux-16165125-vmss000001   <none>           <none>
linkerd-proxy-injector-6556447f64-n29wr   2/2     Running   0          64s   10.240.0.32   aks-linux-16165125-vmss000000   <none>           <none>
linkerd-sp-validator-56745cd567-v4x7h     2/2     Running   0          64s   10.240.0.6    aks-linux-16165125-vmss000000   <none>           <none>
linkerd-tap-5cd9fc566-ct988               2/2     Running   0          64s   10.240.0.15   aks-linux-16165125-vmss000000   <none>           <none>
linkerd-web-774c79b6d5-dhhwf              2/2     Running   0          65s   10.240.0.70   aks-linux-16165125-vmss000002   <none>           <none>

Linkerd 通过 linkerd 客户端二进制文件提供了一个命令,用于验证是否已成功安装并配置 Linkerd 控制平面。Linkerd provides a command via the linkerd client binary to validate that the Linkerd control plane was successfully installed and configured.

linkerd check

应该会看到如下所示内容,表明安装已成功:You should see something like the following to indicate that your installation was successful:

kubernetes-api
--------------
√ can initialize the client
√ can query the Kubernetes API

kubernetes-version
------------------
√ is running the minimum Kubernetes API version
√ is running the minimum kubectl version

linkerd-config
--------------
√ control plane Namespace exists
√ control plane ClusterRoles exist
√ control plane ClusterRoleBindings exist
√ control plane ServiceAccounts exist
√ control plane CustomResourceDefinitions exist
√ control plane MutatingWebhookConfigurations exist
√ control plane ValidatingWebhookConfigurations exist
√ control plane PodSecurityPolicies exist

linkerd-existence
-----------------
√ 'linkerd-config' config map exists
√ heartbeat ServiceAccount exist
√ control plane replica sets are ready
√ no unschedulable pods
√ controller pod is running
√ can initialize the client
√ can query the control plane API

linkerd-api
-----------
√ control plane pods are ready
√ control plane self-check
√ [kubernetes] control plane can talk to Kubernetes
√ [prometheus] control plane can talk to Prometheus
√ no invalid service profiles

linkerd-version
---------------
√ can determine the latest version
√ cli is up-to-date

control-plane-version
---------------------
√ control plane is up-to-date
√ control plane and cli versions match

Status check results are √

访问仪表板Access the dashboard

Linkerd 带有一个说明服务网格和工作负荷情况的仪表板。Linkerd comes with a dashboard that provides insight into the service mesh and workloads. 若要访问该仪表板,请使用 linkerd dashboard 命令。To access the dashboard, use the linkerd dashboard command. 此命令利用 kubectl port-forward 在客户端计算机与 AKS 群集中相关 Pod 之间建立安全连接。This command leverages kubectl port-forward to create a secure connection between your client machine and the relevant pods in your AKS cluster. 然后,它会在默认浏览器中自动打开仪表板。It will then automatically open the dashboard in your default browser.

linkerd dashboard

此命令还会创建端口转发并返回一个用于 Grafana 仪表板的链接。The command will also create a port-forward and return a link for the Grafana dashboards.

Linkerd dashboard available at:
http://127.0.0.1:50750
Grafana dashboard available at:
http://127.0.0.1:50750/grafana
Opening Linkerd dashboard in the default browser

从 AKS 中卸载 LinkerdUninstall Linkerd from AKS

警告

从正在运行的系统中删除 Linkerd 可能会导致服务之间出现流量相关的问题。Deleting Linkerd from a running system may result in traffic related issues between your services. 在继续之前,请确保对系统进行预配,以便在没有 Linkerd 的情况下系统仍可正常运行。Ensure that you have made provisions for your system to still operate correctly without Linkerd before proceeding.

首先,需删除数据平面代理。First you'll need to remove the data plane proxies. 请从工作负荷命名空间中删除任何自动代理注入注释,然后展开工作负荷部署。Remove any Automatic Proxy Injection annotations from workload namespaces and roll out your workload deployments. 工作负荷不应该再有任何关联的数据平面组件。Your workloads should no longer have any associated data plane components.

最后,请删除控制平面,如下所示:Finally, remove the control plane as follows:

linkerd install --ignore-cluster | kubectl delete -f -

后续步骤Next steps

若要了解 Linkerd 的更多安装和配置选项,请参阅以下官方 Linkerd 指南:To explore more installation and configuration options for Linkerd, see the following official Linkerd guidance:

也可使用以下项按照其他方案操作:You can also follow additional scenarios using: