Istio Gateway 部署方式深度分析

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: istio-ingressgateway
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
  template:
    spec:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      nodeSelector:
        node-role: gateway  # 限定在特定节点
      tolerations:
      - key: node-role
        value: gateway
        effect: NoSchedule
      containers:
      - name: istio-proxy
        ports:
        - containerPort: 80
        - containerPort: 443

apiVersion: v1
kind: Service
metadata:
  name: istio-ingressgateway
spec:
  type: NodePort
  externalTrafficPolicy: Local
  ports:
  - port: 80
    targetPort: 80
    nodePort: 30080
  selector:
    app: istio-ingressgateway

spec:
  terminationGracePeriodSeconds: 60  # 总超时时间
  containers:
  - name: istio-proxy
    lifecycle:
      preStop:
        exec:
          command:
          - /bin/sh
          - -c
          - |
            # 1. 进入 DRAIN 模式（仍接受请求，但健康检查返回 503）
            curl -sf -X POST http://localhost:15000/drain_listeners?inboundonly || true
            # 2. 等待 CLB 健康检查失败并摘除节点（期间请求仍正常处理）
            sleep 15
            # 3. 等待现有连接处理完成
            sleep 5

GOAWAY 帧作用：
- 告诉客户端不要在当前连接发送新请求
- 客户端会新建连接发送后续请求
- 现有 stream 继续处理直到完成

# Envoy Bootstrap 配置
admin:
  access_log_path: /dev/null
  address:
    socket_address:
      address: 0.0.0.0
      port_value: 15000
# drain_timeout 控制 GOAWAY 后等待多久强制关闭
# 默认 600s (10分钟)

spec:
  # 对于有长连接的场景，需要更长的优雅终止时间
  terminationGracePeriodSeconds: 300  # 5 分钟
  
  containers:
  - name: istio-proxy
    lifecycle:
      preStop:
        exec:
          command:
          - /bin/sh
          - -c
          - |
            # drain_listeners 会触发 GOAWAY
            curl -sf -X POST http://localhost:15000/drain_listeners?inboundonly || true
            # 等待 CLB 摘除
            sleep 15
            # 给长连接更多时间完成
            # Envoy 默认 drain_timeout=600s，这里等待 4 分钟
            sleep 240

terminationGracePeriodSeconds >= preStop sleep + 连接排空时间

对于长连接场景：
- HTTP/2: terminationGracePeriod >= 15s + drain_timeout(默认600s)
- WebSocket: 根据业务可接受的断连时间设置

// WebSocket 客户端示例
const ws = new WebSocket('wss://gateway.example.com/ws');

ws.onclose = function(event) {
  console.log('Connection closed, reconnecting...');
  setTimeout(() => {
    // 重新建立连接
    connect();
  }, 1000);
};

apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-ingressgateway
spec:
  template:
    spec:
      terminationGracePeriodSeconds: 120
      containers:
      - name: istio-proxy
        env:
        - name: NODE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: SLB_ID
          value: "lb-xxxxxxxxxx"
        - name: REGION
          value: "cn-hangzhou"
        volumeMounts:
        - name: aliyun-credentials
          mountPath: /root/.aliyun
          readOnly: true
        lifecycle:
          preStop:
            exec:
              command:
              - /bin/sh
              - -c
              - |
                #!/bin/bash
                set -e
                
                # 1. 获取本机在 SLB 中的后端服务器 ID
                BACKEND_ID=$(aliyun slb DescribeLoadBalancerAttribute \
                  --RegionId $REGION \
                  --LoadBalancerId $SLB_ID \
                  --output cols=BackendServers.BackendServer[].ServerId \
                  | grep -w $NODE_IP | awk '{print $1}')
                
                if [ -n "$BACKEND_ID" ]; then
                  # 2. 设置权重为 0，立即停止新流量
                  echo "Setting backend $BACKEND_ID weight to 0..."
                  aliyun slb SetBackendServers \
                    --RegionId $REGION \
                    --LoadBalancerId $SLB_ID \
                    --BackendServers "[{\"ServerId\":\"$BACKEND_ID\",\"Weight\":0}]"
                  
                  echo "Weight set to 0, waiting for connections to drain..."
                fi
                
                # 3. 通知 Envoy 进入 drain 模式
                curl -sf -X POST http://localhost:15000/drain_listeners?inboundonly || true
                
                # 4. 等待现有连接完成（权重为 0 后无新连接，只需等排空）
                sleep 60
                
                echo "Drain complete, exiting..."
      volumes:
      - name: aliyun-credentials
        secret:
          secretName: aliyun-credentials

apiVersion: v1
kind: Secret
metadata:
  name: aliyun-credentials
type: Opaque
stringData:
  config.json: |
    {
      "current": "default",
      "profiles": {
        "default": {
          "mode": "AK",
          "access_key_id": "LTAI5txxxxxxxxxx",
          "access_key_secret": "xxxxxxxxxxxxxxxxxx",
          "region_id": "cn-hangzhou"
        }
      }
    }

# preStop 脚本核心逻辑
# 使用 tccli 或 API 调用

# 修改后端权重
tccli clb ModifyTargetWeight \
  --LoadBalancerId lb-xxxxxxxx \
  --ListenerId lbl-xxxxxxxx \
  --Targets '[{"InstanceId":"ins-xxxxxx","Port":80,"Weight":0}]'

const FinalizerName = "clb.example.com/weight-controller"

func (r *Reconciler) Reconcile(ctx context.Context, req reconcile.Request) (reconcile.Result, error) {
    pod := &corev1.Pod{}
    if err := r.Get(ctx, req.NamespacedName, pod); err != nil {
        return reconcile.Result{}, client.IgnoreNotFound(err)
    }

    // Pod 正在删除
    if !pod.DeletionTimestamp.IsZero() {
        return r.handleTerminating(ctx, pod)
    }
    // Pod 正常运行
    return r.handleRunning(ctx, pod)
}

func (r *Reconciler) handleRunning(ctx context.Context, pod *corev1.Pod) (reconcile.Result, error) {
    // 确保有 Finalizer
    if !controllerutil.ContainsFinalizer(pod, FinalizerName) {
        controllerutil.AddFinalizer(pod, FinalizerName)
        return reconcile.Result{}, r.Update(ctx, pod)
    }

    // 根据 Ready 状态设置权重
    if isPodReady(pod) {
        r.CLBClient.SetWeight(pod.Status.PodIP, 100)
    } else {
        r.CLBClient.SetWeight(pod.Status.PodIP, 0)
    }
    return reconcile.Result{}, nil
}

func (r *Reconciler) handleTerminating(ctx context.Context, pod *corev1.Pod) (reconcile.Result, error) {
    if !controllerutil.ContainsFinalizer(pod, FinalizerName) {
        return reconcile.Result{}, nil
    }

    // 1. 设置权重为 0
    r.CLBClient.SetWeight(pod.Status.PodIP, 0)

    // 2. 检查是否已等待足够时间
    drainStart := getDrainAnnotation(pod)
    if drainStart.IsZero() {
        setDrainAnnotation(ctx, r.Client, pod)
        return reconcile.Result{RequeueAfter: 3 * time.Second}, nil
    }
    if time.Since(drainStart) < 3*time.Second {
        return reconcile.Result{RequeueAfter: 3 * time.Second}, nil
    }

    // 3. 移除 Finalizer，允许删除
    // 长连接等待交给 preStop 处理，这里只等 CLB 生效
    controllerutil.RemoveFinalizer(pod, FinalizerName)
    return reconcile.Result{}, r.Update(ctx, pod)
}

spec:
  terminationGracePeriodSeconds: 330  # 300 + 30 缓冲
  containers:
  - name: istio-proxy
    lifecycle:
      preStop:
        exec:
          command:
          - /bin/sh
          - -c
          - |
            # 1. 触发 Envoy drain（停止接收新请求）
            pilot-agent request POST drain_listeners
            
            # 2. 等待长连接排空
            # Finalizer 已经把 CLB 权重设为 0，不会有新连接
            # 这里只需要等已有连接处理完
            sleep 300

Finalizer：快进快出（2-3s）→ 只负责摘 CLB 流量
preStop：慢慢等（300s）→ 负责排空长连接

spec:
  terminationGracePeriodSeconds: 300  # 给长连接足够时间
  containers:
  - name: istio-proxy
    lifecycle:
      preStop:
        exec:
          command:
          - /bin/sh
          - -c
          - |
            # 1. 主动摘除 CLB 流量（可选，需要云 API）
            # set_clb_weight_zero.sh || true
            
            # 2. Envoy drain（HTTP/2 会发 GOAWAY）
            curl -sf -X POST http://localhost:15000/drain_listeners?inboundonly || true
            
            # 3. 等待
            # - 如果用了 CLB 权重：不需要等健康检查，可以更快进入排空
            # - 如果没用 CLB 权重：需要等健康检查失败（15s）
            sleep 15
            
            # 4. 给长连接排空时间
            # - HTTP/2: GOAWAY 后客户端会新建连接，现有 stream 继续
            # - WebSocket: 只能等待或超时
            sleep 240

CLB -> Node:30080 -> kube-proxy -> Pod1(drain) 或 Pod2(健康)
                                   ↑
                                   随机选择，可能选到 drain 的 Pod

spec:
  hostNetwork: true
  affinity:
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchLabels:
            app: istio-ingressgateway
        topologyKey: kubernetes.io/hostname

apiVersion: v1
kind: Service
spec:
  type: NodePort
  externalTrafficPolicy: Local
  ports:
  - port: 80
    nodePort: 30080

preStop sleep 时间 >= CLB 检查间隔 × 不健康阈值 + 缓冲时间
                   >= 5s × 2 + 5s = 15s

apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-ingressgateway
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0  # 确保始终有足够副本
  template:
    spec:
      terminationGracePeriodSeconds: 60
      containers:
      - name: istio-proxy
        ports:
        - containerPort: 8080
          name: http2
        - containerPort: 8443
          name: https
        - containerPort: 15021
          name: status-port
        
        # 就绪探针：控制流量是否进入
        readinessProbe:
          httpGet:
            path: /healthz/ready
            port: 15021
          initialDelaySeconds: 1
          periodSeconds: 2
          failureThreshold: 30
        
        # 存活探针：控制 Pod 是否重启
        livenessProbe:
          httpGet:
            path: /healthz/ready
            port: 15021
          initialDelaySeconds: 10
          periodSeconds: 10
          failureThreshold: 3
        
        lifecycle:
          preStop:
            exec:
              command:
              - /bin/sh
              - -c
              - |
                # 进入 DRAIN 模式，拒绝新连接
                curl -sf -X POST http://localhost:15000/drain_listeners?inboundonly || true
                # 等待 CLB 摘除（健康检查间隔5s × 不健康阈值2 + 缓冲5s）
                sleep 15
                # 等待现有请求处理完成
                sleep 5
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: istio-ingressgateway
spec:
  minAvailable: 2  # 至少保持 2 个可用
  selector:
    matchLabels:
      app: istio-ingressgateway

# 使用 wrk 持续压测
wrk -t4 -c100 -d300s http://gateway.example.com/api/health

# 同时触发滚动更新
kubectl rollout restart deployment/istio-ingressgateway

# 观察是否有错误请求

# 查看 Pod 终止日志
kubectl logs -f <pod-name> -c istio-proxy --previous

# 应该看到：
# - drain_listeners 执行
# - 等待期间无新连接
# - 正常退出

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: my-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway  # 关键：label selector
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*.example.com"

# 旧 Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-ingressgateway
spec:
  template:
    metadata:
      labels:
        app: istio-ingressgateway
        istio: ingressgateway  # 关键 label
---
# 新 DaemonSet
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: istio-ingressgateway-ds
spec:
  template:
    metadata:
      labels:
        app: istio-ingressgateway-ds
        istio: ingressgateway  # 相同的 label

# 查看 Deployment Pod 的路由
istioctl proxy-config routes deploy/istio-ingressgateway -n istio-system

# 查看 DaemonSet Pod 的路由
istioctl proxy-config routes ds/istio-ingressgateway-ds -n istio-system

# 两者应该相同

# 不推荐：需要维护两套 Gateway
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: gateway-old
spec:
  selector:
    version: old
---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: gateway-new
spec:
  selector:
    version: new

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: custom-header-filter
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: istio-ingressgateway  # 注意：这个 label！
  configPatches:
  - applyTo: HTTP_FILTER
    # ...

# 查找所有 EnvoyFilter 及其 selector
kubectl get envoyfilter -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.workloadSelector.labels}{"\n"}{end}'

# 查找所有 AuthorizationPolicy 及其 selector
kubectl get authorizationpolicy -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.selector.matchLabels}{"\n"}{end}'

# 查找所有 Sidecar 资源
kubectl get sidecar -A -o yaml | grep -A5 workloadSelector

# Deployment
metadata:
  labels:
    app: istio-ingressgateway       # EnvoyFilter 可能用这个
    istio: ingressgateway           # Gateway 用这个
    version: v1                     # 可选，用于区分
    
# DaemonSet - 保持关键 label 相同
metadata:
  labels:
    app: istio-ingressgateway       # 与 Deployment 相同
    istio: ingressgateway           # 与 Deployment 相同
    version: v2                     # 可选，用于区分

#!/bin/bash
# check-istio-selectors.sh

echo "=== 检查 Gateway selector ==="
kubectl get gateway -A -o jsonpath='{range .items[*]}{.metadata.name}: {.spec.selector}{"\n"}{end}'

echo "=== 检查 EnvoyFilter workloadSelector ==="
kubectl get envoyfilter -A -o jsonpath='{range .items[*]}{.metadata.name}: {.spec.workloadSelector.labels}{"\n"}{end}'

echo "=== 检查 AuthorizationPolicy selector ==="
kubectl get authorizationpolicy -A -o jsonpath='{range .items[*]}{.metadata.name}: {.spec.selector.matchLabels}{"\n"}{end}'

echo "=== 检查 Sidecar workloadSelector ==="
kubectl get sidecar -A -o jsonpath='{range .items[*]}{.metadata.name}: {.spec.workloadSelector.labels}{"\n"}{end}'

echo "=== 检查 RequestAuthentication selector ==="
kubectl get requestauthentication -A -o jsonpath='{range .items[*]}{.metadata.name}: {.spec.selector.matchLabels}{"\n"}{end}'

echo "=== 检查 PeerAuthentication selector ==="
kubectl get peerauthentication -A -o jsonpath='{range .items[*]}{.metadata.name}: {.spec.selector.matchLabels}{"\n"}{end}'

# 导出 Deployment Pod 的配置
istioctl proxy-config all deploy/istio-ingressgateway -n istio-system -o json > old-config.json

# 导出 DaemonSet Pod 的配置
istioctl proxy-config all ds/istio-ingressgateway-ds -n istio-system -o json > new-config.json

# 对比差异
diff old-config.json new-config.json

# DaemonSet 使用与 Deployment 相同的所有 label
labels:
  app: istio-ingressgateway  # 保持一致
  istio: ingressgateway

# 修改 EnvoyFilter 使用更通用的 label
spec:
  workloadSelector:
    labels:
      istio: ingressgateway  # 而不是 app: xxx

# 暂不支持，EnvoyFilter 只支持精确匹配
# 但可以创建多个 EnvoyFilter 分别匹配

# Gateway - 使用 app label
spec:
  selector:
    app: istio-ingressgateway

# Deployment - 使用两个 label
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
      istio: ingressgateway

# EnvoyFilter 1 (traffic-tagger) - 无 workloadSelector，使用 context 匹配
spec:
  configPatches:
  - match:
      context: GATEWAY  # 匹配所有 Gateway 类型的 Envoy
    # ...

# EnvoyFilter 2 (response-add-header) - 使用 istio label
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  # ...

# EnvoyFilter 3 (add-user-agent) - 无 workloadSelector
spec:
  configPatches:
  - match:
      context: GATEWAY
    # ...

spec:
  configPatches:
  - match:
      context: GATEWAY  # 这个才是真正的匹配条件

# 新 DaemonSet 必须同时有这两个 label
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: istio-ingressgateway-ds
spec:
  template:
    metadata:
      labels:
        app: istio-ingressgateway     # Gateway 需要
        istio: ingressgateway         # EnvoyFilter 2 需要

# 1. 检查 Gateway selector
kubectl get gateway istio-ingressgateway -n istio-gateways -o jsonpath='{.spec.selector}'
# 输出: {"app":"istio-ingressgateway"}

# 2. 检查所有 EnvoyFilter 的 workloadSelector
kubectl get envoyfilter -n istio-gateways -o custom-columns=\
NAME:.metadata.name,\
SELECTOR:.spec.workloadSelector.labels

# 示例输出:
# NAME                           SELECTOR
# traffic-tagger-envoy-filter    <none>           ← context 匹配
# response-add-header-trace-id   {"istio":"ingressgateway"}  ← label 匹配
# add-user-agent-gateway         <none>           ← context 匹配

# 3. 检查新 DaemonSet Pod 是否满足所有条件
kubectl get pods -n istio-gateways -l app=istio-ingressgateway,istio=ingressgateway

#!/bin/bash
# verify-envoyfilter.sh

NAMESPACE="istio-gateways"
OLD_POD=$(kubectl get pods -n $NAMESPACE -l app=istio-ingressgateway -o jsonpath='{.items[0].metadata.name}')
NEW_POD=$(kubectl get pods -n $NAMESPACE -l app=istio-ingressgateway-ds -o jsonpath='{.items[0].metadata.name}')

echo "=== 对比 Listener 配置 ==="
diff <(istioctl proxy-config listeners $OLD_POD -n $NAMESPACE -o json | jq -S .) \
     <(istioctl proxy-config listeners $NEW_POD -n $NAMESPACE -o json | jq -S .)

echo "=== 对比 Route 配置 ==="
diff <(istioctl proxy-config routes $OLD_POD -n $NAMESPACE -o json | jq -S .) \
     <(istioctl proxy-config routes $NEW_POD -n $NAMESPACE -o json | jq -S .)

echo "=== 检查特定 EnvoyFilter 是否生效 ==="
# 检查 lua filter 是否存在
istioctl proxy-config listeners $NEW_POD -n $NAMESPACE -o json | \
    grep -q "envoy.filters.http.lua" && echo "Lua filter: OK" || echo "Lua filter: MISSING!"

# 检查 wasm filter 是否存在
istioctl proxy-config listeners $NEW_POD -n $NAMESPACE -o json | \
    grep -q "traffic_tagger" && echo "WASM filter: OK" || echo "WASM filter: MISSING!"

# ❌ 错误：两个 Workload selector 完全相同会冲突！
# Deployment
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
      istio: ingressgateway

# DaemonSet - 同样的 selector
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
      istio: ingressgateway

# ✅ Deployment - 使用 version=v1 区分
apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-ingressgateway
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
      istio: ingressgateway
      version: v1  # 区分用
  template:
    metadata:
      labels:
        app: istio-ingressgateway     # Istio 用
        istio: ingressgateway         # Istio 用
        version: v1                   # Kubernetes Workload 区分用

---
# ✅ DaemonSet - 使用 version=v2 区分
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: istio-ingressgateway-ds
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
      istio: ingressgateway
      version: v2  # 区分用
  template:
    metadata:
      labels:
        app: istio-ingressgateway     # Istio 用（相同）
        istio: ingressgateway         # Istio 用（相同）
        version: v2                   # Kubernetes Workload 区分用（不同）

# Deployment
labels:
  app: istio-ingressgateway
  istio: ingressgateway

# DaemonSet
labels:
  app: istio-ingressgateway-ds  # 不同的 app
  istio: ingressgateway         # 相同，EnvoyFilter 能匹配

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: istio-ingressgateway-ds
  namespace: istio-gateways
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
      istio: ingressgateway
      version: v2              # 关键：与 Deployment 区分
  template:
    metadata:
      labels:
        app: istio-ingressgateway     # Istio Gateway 匹配
        istio: ingressgateway         # Istio EnvoyFilter 匹配
        version: v2                   # Kubernetes 区分用
    spec:
      # ... 其他配置

# 检查 Pod 的 ownerReferences
kubectl get pods -n istio-gateways -o custom-columns=\
NAME:.metadata.name,\
OWNER:.metadata.ownerReferences[0].kind,\
OWNER_NAME:.metadata.ownerReferences[0].name

# 预期输出：
# NAME                              OWNER        OWNER_NAME
# istio-ingressgateway-xxx          ReplicaSet   istio-ingressgateway-xxx
# istio-ingressgateway-ds-yyy       DaemonSet    istio-ingressgateway-ds

# Pod 的 ownerReferences
metadata:
  ownerReferences:
  - apiVersion: apps/v1
    kind: ReplicaSet
    name: istio-ingressgateway-xxx
    uid: xxx-xxx-xxx
    controller: true      # 关键：声明这是控制器
    blockOwnerDeletion: true

// pkg/controller/replicaset/replica_set.go

func (rsc *ReplicaSetController) syncReplicaSet(key string) error {
    // 1. 获取 ReplicaSet
    rs, err := rsc.rsLister.ReplicaSets(namespace).Get(name)
    
    // 2. 获取所有匹配 selector 的 Pod
    allPods, err := rsc.podLister.Pods(rs.Namespace).List(labels.Everything())
    
    // 3. 过滤：只处理被自己"控制"的 Pod
    filteredPods := controller.FilterActivePods(allPods)
    filteredPods, err = rsc.claimPods(rs, selector, filteredPods)
    
    // claimPods 内部逻辑：
    // - 如果 Pod 没有 controllerRef，尝试 adopt（领养）
    // - 如果 Pod 有其他 controllerRef，跳过
    // - 如果 Pod 的 controllerRef 指向自己，保留
}

// pkg/controller/controller_ref_manager.go

func (m *PodControllerRefManager) ClaimPods(pods []*v1.Pod) ([]*v1.Pod, error) {
    var claimed []*v1.Pod
    for _, pod := range pods {
        ok, err := m.ClaimObject(pod, ...)
        if ok {
            claimed = append(claimed, pod)
        }
    }
    return claimed, nil
}

func (m *BaseControllerRefManager) ClaimObject(obj metav1.Object, ...) (bool, error) {
    controllerRef := metav1.GetControllerOf(obj)
    
    if controllerRef != nil {
        // Pod 已经有 controller
        if controllerRef.UID != m.Controller.GetUID() {
            // 不是自己的 Pod，跳过
            return false, nil
        }
        // 是自己的 Pod
        return true, nil
    }
    
    // Pod 没有 controller，尝试领养
    if m.CanAdopt() {
        // 添加 ownerReference
        return true, m.AdoptObject(obj)
    }
    return false, nil
}

// pkg/controller/daemon/daemon_controller.go

func (dsc *DaemonSetsController) syncDaemonSet(key string) error {
    ds, err := dsc.dsLister.DaemonSets(namespace).Get(name)
    
    // 获取所有匹配的 Pod
    daemonPods, err := dsc.getDaemonPods(ds)
    
    // getDaemonPods 内部也会调用 ClaimPods
    // 只会返回 controllerRef 指向自己的 Pod
}

// 两个控制器都会尝试 Adopt
if m.CanAdopt() {
    return true, m.AdoptObject(obj)  // 谁先执行谁领养
}

W0101 00:00:00.000000  1 replica_set.go:xxx] 
Found orphan pod istio-ingressgateway-xxx with matching selector, 
but it has a different controller reference

# 1. 检查是否有孤儿 Pod
kubectl get pods -n istio-gateways -l app=istio-ingressgateway \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.ownerReferences[*].controller}{"\n"}{end}'

# 2. 检查控制器日志是否有告警
kubectl logs -n kube-system -l component=kube-controller-manager | grep -i "orphan\|adopt"

# 3. 检查 selector 是否有区分
kubectl get deployment,daemonset -n istio-gateways -o custom-columns=\
NAME:.metadata.name,\
SELECTOR:.spec.selector.matchLabels

// 关键保护代码
if controllerRef.UID != m.Controller.GetUID() {
    return false, nil  // 不是自己的，不处理
}

# 创建 Deployment（3 副本）
kubectl apply -f deployment.yaml
# → 创建 3 个 Pod，controllerRef 指向 ReplicaSet

# 创建 DaemonSet（相同 selector）
kubectl apply -f daemonset.yaml
# → 在每个节点创建 1 个 Pod，controllerRef 指向 DaemonSet

# 结果：
# - Deployment 管理 3 个 Pod
# - DaemonSet 管理 N 个 Pod（N=节点数）
# - 互不干扰（因为 controllerRef 不同）

# 共享的 label（Istio 用）
labels:
  istio: ingressgateway

# 区分的 label（Kubernetes Workload 用）
labels:
  version: v1  # 或 workload: deployment / workload: daemonset

# 原始状态
# Pod: app=istio-ingressgateway, istio=ingressgateway
# ReplicaSet selector: app=istio-ingressgateway, istio=ingressgateway

# 修改 label
kubectl label pod istio-ingressgateway-xxx app=istio-ingressgateway-orphan --overwrite

// pkg/controller/controller_ref_manager.go

func (m *PodControllerRefManager) ClaimPods(pods []*v1.Pod) ([]*v1.Pod, error) {
    var claimed []*v1.Pod
    var errlist []error

    match := func(obj metav1.Object) bool {
        return m.Selector.Matches(labels.Set(obj.GetLabels()))
    }

    for _, pod := range pods {
        ok, err := m.ClaimObject(pod, match, ...)
        if err != nil {
            errlist = append(errlist, err)
            continue
        }
        if ok {
            claimed = append(claimed, pod)
        }
    }
    return claimed, utilerrors.NewAggregate(errlist)
}

func (m *BaseControllerRefManager) ClaimObject(obj metav1.Object, match func(metav1.Object) bool, ...) (bool, error) {
    controllerRef := metav1.GetControllerOf(obj)
    
    if controllerRef != nil {
        if controllerRef.UID != m.Controller.GetUID() {
            // 不是自己的 Pod，跳过
            return false, nil
        }
        
        // 是自己的 Pod，但检查是否还匹配 selector
        if match(obj) {
            // 仍然匹配，保留
            return true, nil
        }
        
        // 关键：有 controllerRef 但不再匹配 selector
        // 执行 Release：移除 ownerReference
        if m.ReleaseFunc != nil {
            // 调用 Release
            if err := m.ReleaseFunc(obj); err != nil {
                return false, err
            }
        }
        return false, nil
    }
    
    // 无 controllerRef 的情况...
}

// pkg/controller/replicaset/replica_set.go

func (rsc *ReplicaSetController) syncReplicaSet(key string) error {
    // ...
    
    cm := controller.NewPodControllerRefManager(
        rsc.podControl,
        rs,
        selector,
        controllerKind,
        rsc.expectations,
    )
    
    // ClaimPods 会调用 ReleaseFunc
    filteredPods, err := cm.ClaimPods(pods)
    
    // filteredPods 不包含被 Release 的 Pod
    // 控制器会发现副本数不足，创建新 Pod
}

// Release 函数
func (rsc *ReplicaSetController) releaseObject(obj metav1.Object) error {
    pod := obj.(*v1.Pod)
    
    // 从 Pod 中移除 ownerReference
    err := rsc.podControl.DeletePodOrphan(pod.Namespace, pod.Name, 
        &pod.ObjectMeta.OwnerReferences)
    
    return err
}

# 1. 修改 label 前
kubectl get pod istio-ingressgateway-xxx -o yaml
# ownerReferences:
# - apiVersion: apps/v1
#   kind: ReplicaSet
#   name: istio-ingressgateway-xxx
#   controller: true      # 有 controller 标记

# 2. 修改 label
kubectl label pod istio-ingressgateway-xxx app=orphan --overwrite

# 3. 控制器处理后
kubectl get pod istio-ingressgateway-xxx -o yaml
# ownerReferences: []     # ownerReference 被移除！

# 4. 同时，新 Pod 被创建
kubectl get pods -l app=istio-ingressgateway
# NAME                              READY   STATUS    
# istio-ingressgateway-xxx          1/1     Running   # 原 Pod（现在是孤儿）
# istio-ingressgateway-yyy          1/1     Running   # 新创建的 Pod

#!/bin/bash
# test-orphan-pod.sh

NAMESPACE="istio-gateways"
POD_NAME=$(kubectl get pods -n $NAMESPACE -l app=istio-ingressgateway -o jsonpath='{.items[0].metadata.name}')

echo "=== 原始状态 ==="
kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.metadata.ownerReferences}'
echo ""

echo "=== 修改 label ==="
kubectl label pod $POD_NAME -n $NAMESPACE app=orphan --overwrite

echo "=== 等待控制器处理 ==="
sleep 5

echo "=== 检查 ownerReferences ==="
kubectl get pod $POD_NAME -n $NAMESPACE -o jsonpath='{.metadata.ownerReferences}'
echo ""
# 预期：[] 或 null

echo "=== 检查是否有新 Pod ==="
kubectl get pods -n $NAMESPACE -l app=istio-ingressgateway
# 预期：新 Pod 已创建

echo "=== 孤儿 Pod 仍在运行 ==="
kubectl get pod $POD_NAME -n $NAMESPACE
# 预期：Running

# 1. 将问题 Pod 从 ReplicaSet 中"摘除"
kubectl label pod problem-pod-xxx app=isolated --overwrite

# 2. 控制器会：
#    - 移除该 Pod 的 ownerReference
#    - 创建新 Pod 补充副本数

# 3. 问题 Pod 继续运行，可以用于调试
kubectl exec -it problem-pod-xxx -- /bin/bash

# 4. 调试完成后手动删除
kubectl delete pod problem-pod-xxx

# 修改 DaemonSet Pod 的 label
kubectl label pod ds-pod-xxx app=orphan --overwrite

# 结果：
# - 原 Pod 变成孤儿
# - DaemonSet 发现该节点没有符合条件的 Pod
# - 在同一节点创建新 Pod
# - 可能因端口冲突失败（如果用 hostNetwork）

# DaemonSet + hostNetwork
# 原 Pod 仍占用 80 端口
# 新 Pod 尝试绑定 80 端口 → 失败

Events:
  Type     Reason     Age   From               Message
  ----     ------     ----  ----               -------
  Warning  Failed     1s    kubelet            Error: failed to start container
                                               "bind: address already in use"

# 1. 部署新的 DaemonSet（使用不同的 Service 名称或端口）
kubectl apply -f gateway-daemonset.yaml

# 2. 等待所有 Pod Ready
kubectl rollout status daemonset/istio-ingressgateway-new

# 3. 在 CLB 添加新节点（DaemonSet 所在节点）
# 此时新旧 Gateway 同时接收流量

# 4. 验证新 Gateway 工作正常
curl -H "Host: test.example.com" http://<new-gateway-ip>/health

# 5. 在 CLB 设置旧节点权重为 0
# 等待现有连接排空（观察旧 Pod 的连接数）

# 6. 在 CLB 移除旧节点

# 7. 删除旧 Deployment
kubectl delete deployment istio-ingressgateway-old

#!/bin/bash
# 灰度切换脚本

OLD_WEIGHT=100
NEW_WEIGHT=0
STEP=10
INTERVAL=60  # 每步等待时间（秒）

while [ $OLD_WEIGHT -gt 0 ]; do
    echo "Setting weights: old=$OLD_WEIGHT, new=$NEW_WEIGHT"
    
    # 调用云厂商 API 设置权重
    # aliyun slb SetBackendServers ...
    
    # 检查错误率
    ERROR_RATE=$(get_error_rate)
    if [ "$ERROR_RATE" -gt 1 ]; then
        echo "Error rate too high, rolling back!"
        # 回滚逻辑
        exit 1
    fi
    
    OLD_WEIGHT=$((OLD_WEIGHT - STEP))
    NEW_WEIGHT=$((NEW_WEIGHT + STEP))
    
    sleep $INTERVAL
done

echo "Migration complete!"

# 不推荐！可能导致流量中断
kubectl delete deployment istio-ingressgateway
kubectl apply -f gateway-daemonset.yaml

# 1. 先扩容 Deployment，确保每个节点有 Pod
kubectl scale deployment istio-ingressgateway --replicas=<node-count>

# 2. 部署 DaemonSet（先不删除 Deployment）
kubectl apply -f gateway-daemonset.yaml

# 3. 等待 DaemonSet Ready
kubectl rollout status daemonset/istio-ingressgateway-ds

# 4. 此时会有端口冲突（如果用 HostNetwork）
# 需要新旧使用不同端口，或者 DaemonSet 使用 nodeSelector 选择新节点

# 5. CLB 切换后，删除旧 Deployment
kubectl delete deployment istio-ingressgateway

# 新 DaemonSet 只部署到新节点
nodeSelector:
  gateway-version: v2

# 旧 Deployment 的 Pod 会被调度到旧节点
affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
      - matchExpressions:
        - key: gateway-version
          operator: NotIn
          values: ["v2"]

# 新 Gateway 使用 8080/8443
ports:
- containerPort: 8080
  hostPort: 8080
- containerPort: 8443
  hostPort: 8443

# CLB 先指向新端口，再切换