当前位置：首页 > news >正文

从零实现一个服务网格：Istio的核心设计

news 2026/7/8 1:09:35

前言

你有没有想过：在Kubernetes中，Istio是怎么做到无侵入地实现流量管理、安全加密、可观测性的？

服务网格(Service Mesh) 通过注入Sidecar代理，劫持所有服务间流量，在不修改业务代码的情况下实现流量治理。

今天我们用C语言从零实现服务网格的核心功能：

· Sidecar代理（Envoy简化版）
· 流量拦截（iptables模拟）
· 服务发现（Pilot）
· 流量管理（VirtualService/DestinationRule）
· 安全（mTLS）
· 可观测性（Metrics/Tracing）

---

一、服务网格核心原理

1. 架构图

```
┌─────────────────────────────────────────────────────────────┐
│ Kubernetes Pod │
│ ┌─────────────┐ ┌─────────────┐ │
│ │ 应用容器 │───▶│ Sidecar │───▶ 服务A │
│ │ (业务代码) │◀───│ (Envoy) │◀─── │
│ └─────────────┘ └─────────────┘ │
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ 控制平面 │
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │
│ │ Pilot │ │ Citadel │ │ Galley │ │
│ │ (配置) │ │ (证书) │ │ (验证) │ │
│ └─────────────┘ └─────────────┘ └─────────────┘ │
└─────────────────────────────────────────────────────────────┘
```

2. 核心概念

概念说明
Sidecar 每个Pod中注入的代理容器
Pilot 配置下发，服务发现
Citadel 证书管理，mTLS
VirtualService 路由规则（灰度、金丝雀）
DestinationRule 负载均衡、连接池、熔断

---

二、完整代码实现

1. 基础数据结构

```c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <pthread.h>
#include <time.h>
#include <errno.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

#define MAX_SERVICES 100
#define MAX_INSTANCES 100
#define MAX_ROUTES 100
#define MAX_HEADERS 32

// 服务实例
typedef struct service_instance {
char host[32];
int port;
int weight;
int healthy;
time_t last_health_check;
struct service_instance *next;
} service_instance_t;

// 服务
typedef struct service {
char name[64];
service_instance_t *instances;
int instance_count;
struct service *next;
} service_t;

// 路由匹配
typedef struct route_match {
char uri_prefix[128];
char header_key[64];
char header_value[64];
int priority;
} route_match_t;

// 路由目标
typedef struct route_destination {
char service_name[64];
char subset[32];
int weight;
} route_destination_t;

// VirtualService
typedef struct virtual_service {
char name[64];
char host[64];
route_match_t match;
route_destination_t *destinations;
int dest_count;
struct virtual_service *next;
} virtual_service_t;

// DestinationRule
typedef struct destination_rule {
char name[64];
char host[64];
char subset[32];
char load_balancer[16];
int connection_pool_max;
int max_retries;
struct destination_rule *next;
} destination_rule_t;

// Sidecar配置
typedef struct sidecar_config {
char service_name[64];
char listen_host[32];
int listen_port;
int admin_port;
char pilot_host[32];
int pilot_port;
} sidecar_config_t;

// Sidecar代理
typedef struct sidecar_proxy {
sidecar_config_t config;
service_t *services;
virtual_service_t *virtual_services;
destination_rule_t *destination_rules;
pthread_mutex_t mutex;
int running;
pthread_t pilot_thread;
} sidecar_proxy_t;
```

2. Pilot实现（配置下发）

```c
// 创建Sidecar
sidecar_proxy_t *sidecar_create(sidecar_config_t *config) {
sidecar_proxy_t *proxy = malloc(sizeof(sidecar_proxy_t));
memset(proxy, 0, sizeof(sidecar_proxy_t));
memcpy(&proxy->config, config, sizeof(sidecar_config_t));
proxy->running = 1;
pthread_mutex_init(&proxy->mutex, NULL);

printf("[Sidecar] %s 启动，监听 %s:%d\n",
config->service_name, config->listen_host, config->listen_port);
return proxy;
}

// 从Pilot同步服务
void sidecar_sync_services(sidecar_proxy_t *proxy) {
pthread_mutex_lock(&proxy->mutex);

// 模拟从Pilot获取服务列表
// 实际通过xDS协议从控制平面获取

pthread_mutex_unlock(&proxy->mutex);
}

// 添加VirtualService
void sidecar_add_virtual_service(sidecar_proxy_t *proxy, const char *name,
const char *host, const char *uri_prefix) {
pthread_mutex_lock(&proxy->mutex);

virtual_service_t *vs = malloc(sizeof(virtual_service_t));
strcpy(vs->name, name);
strcpy(vs->host, host);
strcpy(vs->match.uri_prefix, uri_prefix);
vs->dest_count = 0;
vs->destinations = NULL;
vs->next = proxy->virtual_services;
proxy->virtual_services = vs;

pthread_mutex_unlock(&proxy->mutex);
printf("[Pilot] VirtualService: %s → %s\n", name, host);
}

// 添加路由目标
void sidecar_add_route_destination(sidecar_proxy_t *proxy, const char *vs_name,
const char *service_name, int weight) {
pthread_mutex_lock(&proxy->mutex);

virtual_service_t *vs = proxy->virtual_services;
while (vs) {
if (strcmp(vs->name, vs_name) == 0) break;
vs = vs->next;
}

if (!vs) {
pthread_mutex_unlock(&proxy->mutex);
return;
}

route_destination_t *dest = malloc(sizeof(route_destination_t));
strcpy(dest->service_name, service_name);
dest->weight = weight;
dest->next = vs->destinations;
vs->destinations = dest;
vs->dest_count++;

pthread_mutex_unlock(&proxy->mutex);
}
```

3. 流量拦截

```c
// 模拟iptables流量拦截
void sidecar_setup_iptables(sidecar_proxy_t *proxy) {
printf("[Sidecar] 设置流量拦截规则\n");
// 实际用iptables/ipvs/ebpf
// 本实现通过透明代理实现
}

// 透明代理处理
int sidecar_transparent_proxy(sidecar_proxy_t *proxy, int client_fd) {
// 读取原始请求
char buffer[4096];
int n = recv(client_fd, buffer, sizeof(buffer) - 1, 0);
if (n <= 0) return -1;
buffer[n] = '\0';

// 解析目标服务
char host[256] = "";
char method[16] = "";
char path[1024] = "";

sscanf(buffer, "%s %s", method, path);

// 从Host头提取目标
char *host_start = strstr(buffer, "Host:");
if (host_start) {
host_start += 6;
while (*host_start == ' ') host_start++;
char *host_end = strstr(host_start, "\r\n");
if (host_end) {
int len = host_end - host_start;
if (len < 255) {
strncpy(host, host_start, len);
host[len] = '\0';
}
}
}

// 路由匹配
char target_service[64] = "";
int target_port = 0;

virtual_service_t *vs = proxy->virtual_services;
while (vs) {
if (strstr(path, vs->match.uri_prefix) != NULL) {
// 选择目标
if (vs->dest_count > 0) {
route_destination_t *dest = vs->destinations;
int total_weight = 0;
while (dest) {
total_weight += dest->weight;
dest = dest->next;
}
int r = rand() % total_weight;
dest = vs->destinations;
while (dest) {
r -= dest->weight;
if (r < 0) {
strcpy(target_service, dest->service_name);
break;
}
dest = dest->next;
}
}
break;
}
vs = vs->next;
}

if (!target_service[0]) {
// 默认路由：从host解析
char *colon = strchr(host, ':');
if (colon) {
int len = colon - host;
strncpy(target_service, host, len);
target_service[len] = '\0';
target_port = atoi(colon + 1);
} else {
strcpy(target_service, host);
target_port = 80;
}
}

// 查找服务实例
service_t *svc = proxy->services;
while (svc) {
if (strcmp(svc->name, target_service) == 0) {
if (svc->instances) {
// 负载均衡（轮询）
service_instance_t *inst = svc->instances;
int idx = rand() % svc->instance_count;
for (int i = 0; i < idx && inst; i++) {
inst = inst->next;
}
if (inst) {
// 转发请求
int backend_fd = socket(AF_INET, SOCK_STREAM, 0);
struct sockaddr_in addr;
addr.sin_family = AF_INET;
addr.sin_port = htons(inst->port);
inet_pton(AF_INET, inst->host, &addr.sin_addr);

if (connect(backend_fd, (struct sockaddr*)&addr, sizeof(addr)) == 0) {
send(backend_fd, buffer, n, 0);
char response[8192];
int resp_len = recv(backend_fd, response, sizeof(response) - 1, 0);
if (resp_len > 0) {
send(client_fd, response, resp_len, 0);
}
close(backend_fd);
close(client_fd);
return 0;
}
close(backend_fd);
}
}
break;
}
svc = svc->next;
}

// 无可用实例
char *resp = "HTTP/1.1 503 Service Unavailable\r\n\r\n";
send(client_fd, resp, strlen(resp), 0);
close(client_fd);
return -1;
}
```

4. 负载均衡

```c
// 负载均衡算法
typedef enum {
LB_ROUND_ROBIN = 0,
LB_RANDOM,
LB_WEIGHTED,
LB_LEAST_CONN
} lb_algorithm_t;

// 负载均衡器
typedef struct load_balancer {
lb_algorithm_t algorithm;
int current_index;
pthread_mutex_t mutex;
} load_balancer_t;

load_balancer_t *lb_create(lb_algorithm_t algo) {
load_balancer_t *lb = malloc(sizeof(load_balancer_t));
lb->algorithm = algo;
lb->current_index = 0;
pthread_mutex_init(&lb->mutex, NULL);
return lb;
}

service_instance_t *lb_select(load_balancer_t *lb, service_t *service) {
if (!service || !service->instances) return NULL;

pthread_mutex_lock(&lb->mutex);

service_instance_t *selected = NULL;
int count = service->instance_count;

switch (lb->algorithm) {
case LB_ROUND_ROBIN: {
int idx = lb->current_index % count;
service_instance_t *inst = service->instances;
for (int i = 0; i < idx && inst; i++) {
inst = inst->next;
}
selected = inst;
lb->current_index++;
break;
}
case LB_RANDOM: {
int idx = rand() % count;
service_instance_t *inst = service->instances;
for (int i = 0; i < idx && inst; i++) {
inst = inst->next;
}
selected = inst;
break;
}
case LB_WEIGHTED: {
int total_weight = 0;
service_instance_t *inst = service->instances;
while (inst) {
total_weight += inst->weight;
inst = inst->next;
}
int r = rand() % total_weight;
inst = service->instances;
while (inst) {
r -= inst->weight;
if (r < 0) {
selected = inst;
break;
}
inst = inst->next;
}
break;
}
default:
selected = service->instances;
break;
}

pthread_mutex_unlock(&lb->mutex);
return selected;
}
```

5. 测试代码

```c
void test_service_mesh() {
printf("=== 服务网格测试 ===\n\n");

sidecar_config_t config;
strcpy(config.service_name, "app-v1");
strcpy(config.listen_host, "0.0.0.0");
config.listen_port = 8080;
config.admin_port = 15000;
strcpy(config.pilot_host, "127.0.0.1");
config.pilot_port = 9090;

sidecar_proxy_t *proxy = sidecar_create(&config);

// 添加服务
proxy->services = malloc(sizeof(service_t));
strcpy(proxy->services->name, "backend");
proxy->services->instances = malloc(sizeof(service_instance_t));
strcpy(proxy->services->instances->host, "127.0.0.1");
proxy->services->instances->port = 9001;
proxy->services->instances->weight = 50;
proxy->services->instances->healthy = 1;
proxy->services->instances->next = NULL;
proxy->services->instance_count = 1;

// 添加VirtualService
sidecar_add_virtual_service(proxy, "backend-route", "backend", "/api/");
sidecar_add_route_destination(proxy, "backend-route", "backend", 100);

printf("\n流量规则:\n");
printf(" /api/* → backend\n");
printf(" 负载均衡: Random\n");

printf("\n测试完成\n");
free(proxy);
}