Istio Gateway 流量控制策略实战：灰度发布与泳道隔离

# DestinationRule：定义服务版本（subset）
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: myapp
  namespace: production
spec:
  host: myapp.production.svc.cluster.local
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        h2UpgradePolicy: UPGRADE
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

# Deployment v1
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-v1
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
      version: v1
  template:
    metadata:
      labels:
        app: myapp
        version: v1
    spec:
      containers:
      - name: myapp
        image: myapp:1.0.0
---
# Deployment v2
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-v2
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
      version: v2
  template:
    metadata:
      labels:
        app: myapp
        version: v2
    spec:
      containers:
      - name: myapp
        image: myapp:2.0.0

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: myapp
  namespace: production
spec:
  hosts:
  - myapp.example.com
  gateways:
  - istio-system/istio-ingressgateway
  http:
  # 规则1：内灰流量 - 携带特定 Header 走 v2
  - match:
    - headers:
        x-gray-tag:
          exact: "internal-test"
        x-gray-token:
          exact: "secret-token-12345"  # 防止外部伪造
    route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v2
    
  # 规则2：默认流量 - 全部走 v1
  - route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v1

# 正常请求 - 走 v1
curl https://myapp.example.com/api/version
# 返回: v1

# 内灰请求 - 走 v2
curl -H "x-gray-tag: internal-test" \
     -H "x-gray-token: secret-token-12345" \
     https://myapp.example.com/api/version
# 返回: v2

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: myapp
  namespace: production
spec:
  hosts:
  - myapp.example.com
  gateways:
  - istio-system/istio-ingressgateway
  http:
  # 规则1：内灰流量（保留）
  - match:
    - headers:
        x-gray-tag:
          exact: "internal-test"
        x-gray-token:
          exact: "secret-token-12345"
    route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v2

  # 规则2：外灰 - 特定用户 ID（尾号为 0 的用户）
  - match:
    - headers:
        x-user-id:
          regex: ".*0$"  # 用户 ID 尾号为 0
    route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v2

  # 规则3：外灰 - 特定地区用户
  - match:
    - headers:
        x-user-region:
          exact: "beijing"
    route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v2

  # 规则4：外灰 - 特定渠道（如 iOS 灰度）
  - match:
    - headers:
        x-app-platform:
          exact: "ios"
        x-app-version:
          regex: "^3\\..*"  # iOS 3.x 版本
    route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v2

  # 默认：走 v1
  - route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v1

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: myapp
  namespace: production
spec:
  hosts:
  - myapp.example.com
  gateways:
  - istio-system/istio-ingressgateway
  http:
  # 保留内灰入口
  - match:
    - headers:
        x-gray-tag:
          exact: "internal-test"
        x-gray-token:
          exact: "secret-token-12345"
    route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v2

  # 按权重分流
  - route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v1
      weight: 90
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v2
      weight: 10

# 阶段 3.1: v1=90%, v2=10%
# 阶段 3.2: v1=70%, v2=30%
# 阶段 3.3: v1=50%, v2=50%
# 阶段 3.4: v1=20%, v2=80%
# 阶段 3.5: v1=0%,  v2=100%

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: myapp
  namespace: production
spec:
  hosts:
  - myapp.example.com
  gateways:
  - istio-system/istio-ingressgateway
  http:
  # 紧急回滚入口（运维使用）
  - match:
    - headers:
        x-rollback:
          exact: "v1"
        x-ops-token:
          exact: "ops-secret-token"
    route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v1

  # 全量走 v2
  - route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v2

# 紧急回滚配置
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: myapp
  namespace: production
spec:
  hosts:
  - myapp.example.com
  gateways:
  - istio-system/istio-ingressgateway
  http:
  - route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v1
      weight: 100

apiVersion: v1
kind: ConfigMap
metadata:
  name: gray-rules
  namespace: istio-system
data:
  rules.json: |
    {
      "myapp": {
        "default_version": "v1",
        "rules": [
          {
            "name": "internal-test",
            "priority": 100,
            "type": "header",
            "conditions": {"x-gray-tag": "internal-test", "x-gray-token": "secret-12345"},
            "version": "v2"
          },
          {
            "name": "user-tail-012",
            "priority": 90,
            "type": "user_id_tail",
            "tails": ["0", "1", "2"],
            "version": "v2"
          },
          {
            "name": "beijing-region",
            "priority": 80,
            "type": "header",
            "conditions": {"x-user-region": "beijing"},
            "version": "v2"
          },
          {
            "name": "ios-platform",
            "priority": 70,
            "type": "header",
            "conditions": {"x-app-platform": "ios"},
            "version": "v2"
          },
          {
            "name": "percentage-30",
            "priority": 10,
            "type": "percentage",
            "percent": 30,
            "version": "v2"
          }
        ]
      }
    }

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: gray-router
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: envoy.filters.http.router
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.lua
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
          inlineCode: |
            -- ============================================
            -- 灰度路由 Lua 脚本
            -- ============================================
            
            -- 灰度规则配置（生产环境可从共享内存加载）
            local gray_rules = {
              myapp = {
                default_version = "v1",
                rules = {
                  -- 规则1：内灰 - Header 精确匹配（优先级最高）
                  {
                    name = "internal-test",
                    priority = 100,
                    type = "header",
                    conditions = {
                      ["x-gray-tag"] = "internal-test",
                      ["x-gray-token"] = "secret-12345"
                    },
                    version = "v2"
                  },
                  -- 规则2：外灰 - 用户 ID 尾号
                  {
                    name = "user-tail-012",
                    priority = 90,
                    type = "user_id_tail",
                    tails = {"0", "1", "2"},  -- 尾号 0,1,2 走 v2（约 30%）
                    version = "v2"
                  },
                  -- 规则3：外灰 - 北京地区
                  {
                    name = "beijing-region",
                    priority = 80,
                    type = "header",
                    conditions = {["x-user-region"] = "beijing"},
                    version = "v2"
                  },
                  -- 规则4：外灰 - iOS 平台
                  {
                    name = "ios-platform",
                    priority = 70,
                    type = "header",
                    conditions = {["x-app-platform"] = "ios"},
                    version = "v2"
                  },
                  -- 规则5：按比例灰度（兜底）
                  {
                    name = "percentage-30",
                    priority = 10,
                    type = "percentage",
                    percent = 30,
                    version = "v2"
                  }
                }
              }
            }
            
            -- 计算字符串哈希
            local function hash_string(str)
              local hash = 0
              for i = 1, #str do
                hash = (hash * 31 + string.byte(str, i)) % 2147483647
              end
              return hash
            end
            
            -- 从 Host 提取服务名
            local function get_service(headers)
              local host = headers:get(":authority") or ""
              return string.match(host, "^([^%.]+)") or "default"
            end
            
            -- 检查规则是否匹配
            local function match_rule(rule, headers)
              local rule_type = rule.type
              
              if rule_type == "header" then
                -- Header 精确匹配
                for key, value in pairs(rule.conditions) do
                  if headers:get(key) ~= value then
                    return false
                  end
                end
                return true
                
              elseif rule_type == "user_id_tail" then
                -- 用户 ID 尾号匹配
                local user_id = headers:get("x-user-id")
                if not user_id then return false end
                local tail = string.sub(user_id, -1)
                for _, t in ipairs(rule.tails) do
                  if tail == t then return true end
                end
                return false
                
              elseif rule_type == "percentage" then
                -- 按比例匹配
                local user_id = headers:get("x-user-id") 
                              or headers:get("x-request-id") 
                              or tostring(os.time())
                local hash = hash_string(user_id)
                local threshold = (rule.percent / 100) * 2147483647
                return hash < threshold
                
              elseif rule_type == "cookie" then
                -- Cookie 匹配
                local cookie = headers:get("cookie") or ""
                for key, value in pairs(rule.conditions) do
                  if not string.find(cookie, key .. "=" .. value) then
                    return false
                  end
                end
                return true
              end
              
              return false
            end
            
            -- 主入口
            function envoy_on_request(handle)
              local headers = handle:headers()
              
              -- 1. 检查粘性 Cookie
              local cookie = headers:get("cookie") or ""
              local sticky = string.match(cookie, "x%-sticky%-version=([^;]+)")
              if sticky then
                headers:add("x-target-version", sticky)
                return
              end
              
              -- 2. 获取服务配置
              local service = get_service(headers)
              local config = gray_rules[service]
              if not config then return end
              
              -- 3. 按优先级匹配规则
              local target = config.default_version
              local matched = nil
              
              for _, rule in ipairs(config.rules) do
                if match_rule(rule, headers) then
                  target = rule.version
                  matched = rule.name
                  break
                end
              end
              
              -- 4. 设置路由 Header
              headers:add("x-target-version", target)
              if matched then
                headers:add("x-gray-rule", matched)
              end
              
              -- 5. 标记设置粘性 Cookie
              handle:streamInfo():dynamicMetadata():set(
                "envoy.filters.http.lua", "sticky_version", target
              )
            end
            
            function envoy_on_response(handle)
              local meta = handle:streamInfo():dynamicMetadata():get("envoy.filters.http.lua")
              if meta and meta["sticky_version"] then
                local cookie = string.format(
                  "x-sticky-version=%s; Path=/; Max-Age=604800; HttpOnly",
                  meta["sticky_version"]
                )
                handle:headers():add("set-cookie", cookie)
              end
            end

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: myapp
  namespace: production
spec:
  hosts:
  - myapp.example.com
  gateways:
  - istio-system/istio-ingressgateway
  http:
  # 只需根据 x-target-version 路由，无需复杂 match
  - match:
    - headers:
        x-target-version:
          exact: "v2"
    route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v2
  - route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v1

# 调整灰度比例：修改 Lua 配置中的 percent
# 添加新规则：在 rules 数组中添加
# 紧急关闭灰度：设置 default_version = "v1"，清空 rules

# 查看灰度命中情况
kubectl logs -n istio-system -l istio=ingressgateway | grep "x-gray-rule"

# 测试内灰
curl -H "x-gray-tag: internal-test" -H "x-gray-token: secret-12345" https://myapp.example.com

# 测试用户尾号灰度
curl -H "x-user-id: 12340" https://myapp.example.com  # 应该走 v2
curl -H "x-user-id: 12345" https://myapp.example.com  # 应该走 v1

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: myapp
  namespace: production
spec:
  host: myapp.production.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      consistentHash:
        httpCookie:
          name: x-app-version
          ttl: 86400s  # Cookie 有效期 24 小时
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: myapp
  namespace: production
spec:
  hosts:
  - myapp.example.com
  gateways:
  - istio-system/istio-ingressgateway
  http:
  # 规则1：已经标记为 v2 的用户，继续走 v2
  - match:
    - headers:
        cookie:
          regex: ".*app-version=v2.*"
    route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v2

  # 规则2：已经标记为 v1 的用户，继续走 v1
  - match:
    - headers:
        cookie:
          regex: ".*app-version=v1.*"
    route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v1

  # 规则3：新用户，按权重分配，应用需要在响应中设置 Cookie
  - route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v1
      weight: 50
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v2
      weight: 50

func handler(w http.ResponseWriter, r *http.Request) {
    // 检查是否已有版本 Cookie
    cookie, err := r.Cookie("app-version")
    if err != nil {
        // 新用户，设置版本 Cookie
        version := os.Getenv("APP_VERSION") // v1 或 v2
        http.SetCookie(w, &http.Cookie{
            Name:     "app-version",
            Value:    version,
            Path:     "/",
            MaxAge:   86400 * 7, // 7 天
            HttpOnly: true,
        })
    }
    // 业务逻辑...
}

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: myapp
  namespace: production
spec:
  host: myapp.production.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      consistentHash:
        httpHeaderName: x-user-id
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: version-consistent-hash
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: envoy.filters.http.router
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.lua
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
          inlineCode: |
            -- 版本级一致性哈希 + Cookie 粘性
            function envoy_on_request(handle)
              local headers = handle:headers()
              local cookie = headers:get("cookie") or ""
              
              -- 1. 检查是否已有粘性 Cookie
              local sticky_version = string.match(cookie, "x%-sticky%-version=([^;]+)")
              if sticky_version then
                -- 已有粘性，直接使用
                headers:add("x-target-version", sticky_version)
                return
              end
              
              -- 2. 新用户，获取用户标识
              local user_id = headers:get("x-user-id")
              if not user_id then
                -- 尝试从 session cookie 获取
                user_id = string.match(cookie, "session%-id=([^;]+)")
              end
              if not user_id then
                -- 兜底：使用请求 ID
                user_id = headers:get("x-request-id") or tostring(os.time())
              end
              
              -- 3. 计算哈希值
              local hash = 0
              for i = 1, #user_id do
                hash = (hash * 31 + string.byte(user_id, i)) % 2147483647
              end
              
              -- 4. 根据哈希值决定版本（30% 走 v2）
              local threshold = 0.3 * 2147483647
              local target_version = "v1"
              if hash < threshold then
                target_version = "v2"
              end
              
              -- 5. 设置路由 Header
              headers:add("x-target-version", target_version)
              
              -- 6. 标记需要设置 Cookie（供响应阶段使用）
              handle:streamInfo():dynamicMetadata():set(
                "envoy.filters.http.lua", 
                "set_version_cookie", 
                target_version
              )
            end
            
            function envoy_on_response(handle)
              -- 检查是否需要设置粘性 Cookie
              local metadata = handle:streamInfo():dynamicMetadata():get("envoy.filters.http.lua")
              if metadata and metadata["set_version_cookie"] then
                local version = metadata["set_version_cookie"]
                -- 设置 Cookie，有效期 7 天
                local cookie = string.format(
                  "x-sticky-version=%s; Path=/; Max-Age=604800; HttpOnly; SameSite=Lax",
                  version
                )
                handle:headers():add("set-cookie", cookie)
              end
            end

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: myapp
  namespace: production
spec:
  hosts:
  - myapp.example.com
  gateways:
  - istio-system/istio-ingressgateway
  http:
  # Lua 脚本设置了 x-target-version: v2
  - match:
    - headers:
        x-target-version:
          exact: "v2"
    route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v2

  # 默认走 v1（兜底）
  - route:
    - destination:
        host: myapp.production.svc.cluster.local
        subset: v1

-- 10% 走 v2
local threshold = 0.1 * 2147483647

-- 50% 走 v2
local threshold = 0.5 * 2147483647

-- 100% 走 v2（全量）
local threshold = 1.0 * 2147483647

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: service-c
  namespace: production
spec:
  hosts:
  - service-c.production.svc.cluster.local
  http:
  # Service A 调用走 v2（部分权重）
  - match:
    - headers:
        x-source-service:
          exact: "service-a"
    route:
    - destination:
        host: service-c.production.svc.cluster.local
        subset: v1
      weight: 70
    - destination:
        host: service-c.production.svc.cluster.local
        subset: v2
      weight: 30

  # Service B 调用全部走 v1
  - match:
    - headers:
        x-source-service:
          exact: "service-b"
    route:
    - destination:
        host: service-c.production.svc.cluster.local
        subset: v1

  # 默认走 v1
  - route:
    - destination:
        host: service-c.production.svc.cluster.local
        subset: v1

# Service A 的 Deployment
spec:
  template:
    spec:
      containers:
      - name: service-a
        env:
        - name: OUTBOUND_HEADER_SOURCE_SERVICE
          value: "service-a"

req.Header.Set("x-source-service", "service-a")

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: service-c
  namespace: production
spec:
  hosts:
  - service-c.production.svc.cluster.local
  http:
  # 基于 source principal 路由
  - match:
    - sourceLabels:
        app: service-a
    route:
    - destination:
        host: service-c.production.svc.cluster.local
        subset: v2

  - route:
    - destination:
        host: service-c.production.svc.cluster.local
        subset: v1

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: frontend
  namespace: production
spec:
  hosts:
  - "*.example.com"
  gateways:
  - istio-system/istio-ingressgateway
  http:
  # 已染色的请求，直接透传
  - match:
    - headers:
        x-swimlane:
          regex: ".+"
    route:
    - destination:
        host: frontend.production.svc.cluster.local
  
  # 灰度用户，染色为 gray 泳道
  - match:
    - headers:
        x-user-id:
          regex: ".*0$"  # 尾号 0 的用户
    headers:
      request:
        set:
          x-swimlane: "gray"
    route:
    - destination:
        host: frontend.production.svc.cluster.local
  
  # 默认用户，染色为 production 泳道
  - headers:
      request:
        set:
          x-swimlane: "production"
    route:
    - destination:
        host: frontend.production.svc.cluster.local

// Go 示例：HTTP 客户端传播 Header
func callDownstream(ctx context.Context, url string) (*http.Response, error) {
    req, _ := http.NewRequestWithContext(ctx, "GET", url, nil)
    
    // 从上游请求中获取泳道 Header
    if swimlane := ctx.Value("x-swimlane"); swimlane != nil {
        req.Header.Set("x-swimlane", swimlane.(string))
    }
    
    // 也传播其他追踪 Header
    propagateHeaders := []string{
        "x-request-id",
        "x-b3-traceid",
        "x-b3-spanid",
        "x-swimlane",
    }
    // ...
    
    return http.DefaultClient.Do(req)
}

# Service A 的路由
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: service-a
  namespace: production
spec:
  hosts:
  - service-a.production.svc.cluster.local
  http:
  - match:
    - headers:
        x-swimlane:
          exact: "gray"
    route:
    - destination:
        host: service-a.production.svc.cluster.local
        subset: v2  # gray 泳道走 v2
  - route:
    - destination:
        host: service-a.production.svc.cluster.local
        subset: v1  # production 泳道走 v1
---
# Service B 的路由（同样配置）
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: service-b
  namespace: production
spec:
  hosts:
  - service-b.production.svc.cluster.local
  http:
  - match:
    - headers:
        x-swimlane:
          exact: "gray"
    route:
    - destination:
        host: service-b.production.svc.cluster.local
        subset: v2
  - route:
    - destination:
        host: service-b.production.svc.cluster.local
        subset: v1
---
# Service C 的路由（同样配置）
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: service-c
  namespace: production
spec:
  hosts:
  - service-c.production.svc.cluster.local
  http:
  - match:
    - headers:
        x-swimlane:
          exact: "gray"
    route:
    - destination:
        host: service-c.production.svc.cluster.local
        subset: v2
  - route:
    - destination:
        host: service-c.production.svc.cluster.local
        subset: v1

# 泳道 Header（全链路传播）
x-swimlane: gray          # 全链路灰度，A/B/C 都走 gray 泳道

# 服务级版本（仅入口使用，不传播）
# 通过 sourceLabels 或 入口 match 实现，不依赖传播

# Service A 的 VirtualService - 服务级灰度
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: service-a
spec:
  hosts:
  - service-a.production.svc.cluster.local
  http:
  # 规则1：来自 Gateway 的流量，根据用户特征灰度
  - match:
    - headers:
        x-user-id:
          regex: ".*[0-2]$"
      sourceLabels:
        istio: ingressgateway  # 只匹配来自 Gateway 的流量
    route:
    - destination:
        host: service-a.production.svc.cluster.local
        subset: v2
  
  # 规则2：内部服务调用，走默认版本（不受灰度影响）
  - route:
    - destination:
        host: service-a.production.svc.cluster.local
        subset: v1

// App1 必须主动 set header
func handleRequest(w http.ResponseWriter, r *http.Request) {
    swimlane := r.Header.Get("x-swimlane")  // 从入站请求读取
    
    // 调用 app2 时，必须主动 set
    req, _ := http.NewRequest("GET", "http://app2/api", nil)
    req.Header.Set("x-swimlane", swimlane)  // ← 必须！
    client.Do(req)
}

import (
    "go.opentelemetry.io/otel"
    "go.opentelemetry.io/otel/baggage"
    "go.opentelemetry.io/otel/propagation"
    "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
)

// 1. 初始化（一次性）
func init() {
    otel.SetTextMapPropagator(
        propagation.NewCompositeTextMapPropagator(
            propagation.TraceContext{},
            propagation.Baggage{},  // 启用 Baggage 传播
        ),
    )
}

// 2. HTTP Server middleware - 读取 x-swimlane 存入 Baggage
func swimlaneMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        ctx := r.Context()
        swimlane := r.Header.Get("x-swimlane")
        if swimlane != "" {
            member, _ := baggage.NewMember("swimlane", swimlane)
            bag, _ := baggage.New(member)
            ctx = baggage.ContextWithBaggage(ctx, bag)
        }
        next.ServeHTTP(w, r.WithContext(ctx))
    })
}

// 3. HTTP Client - 自动从 Baggage 添加 Header
var client = &http.Client{
    Transport: otelhttp.NewTransport(http.DefaultTransport),
}

// 4. 发请求时传 context，OTel 自动注入 baggage header
func callDownstream(ctx context.Context) {
    req, _ := http.NewRequestWithContext(ctx, "GET", "http://app2/api", nil)
    client.Do(req)  // baggage header 自动带上
}

baggage: swimlane=gray,user-id=12345,region=beijing

type swimlaneTransport struct {
    base http.RoundTripper
}

func (t *swimlaneTransport) RoundTrip(req *http.Request) (*http.Response, error) {
    // 从 Context 获取 swimlane
    if swimlane, ok := req.Context().Value("x-swimlane").(string); ok {
        req.Header.Set("x-swimlane", swimlane)
    }
    return t.base.RoundTrip(req)
}

// 使用
var client = &http.Client{
    Transport: &swimlaneTransport{base: http.DefaultTransport},
}

@Bean
public RestTemplate restTemplate() {
    RestTemplate template = new RestTemplate();
    template.getInterceptors().add((request, body, execution) -> {
        String swimlane = MDC.get("x-swimlane");
        if (swimlane != null) {
            request.getHeaders().set("x-swimlane", swimlane);
        }
        return execution.execute(request, body);
    });
    return template;
}

// Servlet Filter 读取并存入 MDC
@Bean
public Filter swimlaneFilter() {
    return (req, res, chain) -> {
        String swimlane = ((HttpServletRequest)req).getHeader("x-swimlane");
        if (swimlane != null) {
            MDC.put("x-swimlane", swimlane);
        }
        try {
            chain.doFilter(req, res);
        } finally {
            MDC.remove("x-swimlane");
        }
    };
}

import threading
import requests

_swimlane = threading.local()

class SwimlaneSession(requests.Session):
    def request(self, method, url, **kwargs):
        headers = kwargs.setdefault('headers', {})
        if hasattr(_swimlane, 'value') and _swimlane.value:
            headers['x-swimlane'] = _swimlane.value
        return super().request(method, url, **kwargs)

# Flask middleware
@app.before_request
def extract_swimlane():
    _swimlane.value = request.headers.get('x-swimlane')

# 使用
session = SwimlaneSession()
session.get('http://app2/api')  # 自动带上 x-swimlane

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: swimlane-propagation
  namespace: istio-system
spec:
  configPatches:
  # Sidecar Inbound: 存储 request-id -> swimlane 映射
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.lua
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
          inlineCode: |
            function envoy_on_request(handle)
              local swimlane = handle:headers():get("x-swimlane")
              local req_id = handle:headers():get("x-request-id")
              if swimlane and req_id then
                local cache = handle:sharedDict():get("swimlane_cache")
                if cache then
                  cache:set(req_id, swimlane, 10)  -- 10秒过期
                end
              end
            end

  # Sidecar Outbound: 从映射中恢复 swimlane
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_OUTBOUND
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.lua
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
          inlineCode: |
            function envoy_on_request(handle)
              if handle:headers():get("x-swimlane") then
                return  -- 应用已经传了，不覆盖
              end
              local req_id = handle:headers():get("x-request-id")
              if req_id then
                local cache = handle:sharedDict():get("swimlane_cache")
                if cache then
                  local swimlane = cache:get(req_id)
                  if swimlane then
                    handle:headers():add("x-swimlane", swimlane)
                  end
                end
              end
            end

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: service-b
spec:
  hosts:
  - service-b.production.svc.cluster.local
  http:
  - match:
    - headers:
        x-swimlane:
          exact: "gray"
    route:
    - destination:
        host: service-b.production.svc.cluster.local
        subset: v2  # 如果 v2 无实例，直接返回 503，不会 fallback！
  - route:
    - destination:
        host: service-b.production.svc.cluster.local
        subset: v1

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: service-b
spec:
  hosts:
  - service-b.production.svc.cluster.local
  http:
  - match:
    - headers:
        x-swimlane:
          exact: "gray"
    route:
    - destination:
        host: service-b.production.svc.cluster.local
        subset: v2
      weight: 100
    - destination:
        host: service-b.production.svc.cluster.local
        subset: v1
      weight: 0    # 权重为 0，但作为 fallback 存在
    # 注意：这种方式在 v2 完全无实例时可能仍返回 503
  - route:
    - destination:
        host: service-b.production.svc.cluster.local
        subset: v1

func callServiceB(ctx context.Context, swimlane string) (*Response, error) {
    // 首先尝试目标泳道
    resp, err := callWithHeader(ctx, "x-swimlane", swimlane)
    
    // 如果返回 503，fallback 到 production 泳道
    if err != nil || resp.StatusCode == 503 {
        if swimlane == "gray" {
            log.Warn("gray swimlane unavailable, fallback to production")
            return callWithHeader(ctx, "x-swimlane", "production")
        }
    }
    return resp, err
}

apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: service-b
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: service-b-v2
  service:
    port: 80
  analysis:
    threshold: 3           # 失败 3 次自动回滚
    metrics:
    - name: request-success-rate
      threshold: 99
    - name: request-duration
      threshold: 500