三、Envoy的管理接口

因语雀和CSDN MarkDown格式有区别，导入到CSDN时可能会有格式显示问题，请查看原文链接：
https://www.yuque.com/dycloud/pss8ys

一、管理接口 admin

1.1 管理接口介绍

Envoy内建了一个管理服务（administration server），它支持查询和修改操作，甚至有可能暴露私有数据（例如统计数据、集群名称和证书信息等），因此非常有必要精心编排其访问控制机制以避免非授权访问；

Envoy 的管理接口是一个基于 HTTP/JSON 的 API，提供对代理实例的实时监控和控制能力。该接口默认监听地址为 <font style="color:rgb(251, 71, 135);">0.0.0.0:9901</font>，可通过配置修改。

核心功能

• 实时监控：获取性能指标
• 动态配置：热更新部分配置
• 运行时控制：调整运行时参数
• 诊断工具：进行健康检查和状态分析

admin:
  access_log: [] # 访问日志协议的相关配置，通常需要指定日志过滤器及日志配置等；
  access_log_path: ... # 管理接口的访问日志文件路径，无须记录访问日志时使用/dev/null；
  profile_path: ... # cpu profiler的输出路径，默认为/var/log/envoy/envoy.prof；
  address: # 监听的套接字；
    socket_address: 
      protocol: ...
      address: ...
      port_value: ...

下面是一个简单的配置实例

admin:
  access_log_path: /tmp/admin_access.log
  address:
    socket_address: { address: 0.0.0.0, port_value: 9901 }
# 提示：此处 仅为出于方便测试的目的，才设定其监听于对外通信的任意IP地址；安全起见，应该使用127.0.0.1；

1.2 为 Envoy 添加管理接口

envoy.yaml

admin:
  profile_path: /tmp/envoy.prof
  access_log_path: /tmp/admin_access.log
  address:
    socket_address:
       address: 0.0.0.0
       port_value: 9901

static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address: { address: 0.0.0.0, port_value: 8080 }
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          codec_type: AUTO
          route_config:
            name: local_route
            virtual_hosts:
            - name: web_service_1
              domains: ["*.nice.io", "nice.io"]
              routes:
              - match: { prefix: "/" }
                route: { cluster: local_cluster }
            - name: web_service_2
              domains: ["*.dujie.com",“dujie.com"]
              routes:
              - match: { prefix: "/" }
                redirect:
                  host_redirect: "www.nice.io"
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  clusters:
  - name: local_cluster
    connect_timeout: 0.25s
    type: STATIC
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: local_cluster
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address: { address: 172.31.2.11, port_value: 8080 }
        - endpoint:
            address:
              socket_address: { address: 172.31.2.12, port_value: 8080 }

docker-compose

version: '3.3'

services:
  envoy:
    image: envoyproxy/envoy:v1.35.0
    volumes:
    - ./envoy.yaml:/etc/envoy/envoy.yaml
    environment:
      - ENVOY_UID=0
      - ENVOY_GID=0
    privileged: true
    networks:
      envoymesh:
        ipv4_address: 172.31.5.2
        aliases:
        - front-proxy
    depends_on:
    - webserver01
    - webserver02

  webserver01:
    image: harbor.test.com/nginx-app:v1.0
    environment:
      - PORT=8080
    hostname: webserver01
    networks:
      envoymesh:
        ipv4_address: 172.31.5.11
        aliases:
        - webserver01

  webserver02:
    image: harbor.test.com/nginx-app:v1.0
    environment:
      - PORT=8080
    hostname: webserver02
    networks:
      envoymesh:
        ipv4_address: 172.31.5.12
        aliases:
        - webserver02

networks:
  envoymesh:
    driver: bridge
    ipam:
      config:
        - subnet: 172.31.5.0/24

测试

[root@VM_24_47_tlinux /usr/local/src]# curl 172.31.5.2:9901/ready
LIVE
[root@VM_24_47_tlinux /usr/local/src]# curl 172.31.5.2:9901/listeners
listener_0::0.0.0.0:8080
[root@VM_24_47_tlinux /usr/local/src]# curl -s  172.31.5.2:9901/config_dump  |head -n 20
{
 "configs": [
  {
   "@type": "type.googleapis.com/envoy.admin.v3.BootstrapConfigDump",
   "bootstrap": {
    "node": {
     "user_agent_name": "envoy",
     "user_agent_build_version": {
      "version": {
       "major_number": 1,
       "minor_number": 35
      },
      "metadata": {
       "revision.sha": "84305a6cb64bd55aaf606bdd53de7cd6080427a1",
       "build.type": "RELEASE",
       "ssl.version": "BoringSSL",
       "revision.status": "Clean"
      }
     },
     "extensions": [

二、 管理接口 admin 路径

2.1 常用端点

admin接口内置了多个/path，不同的path可能会分别接受不同的GET或POST请求；

admin commands are:
/: Admin home page # GET
/ready：Outputs a string and error code reflecting the state of the server. # GET，返回envoy服务当前的状态；
/certs: print certs on machine # GET，列出已加载的所有TLS证书及相关的信息；
/clusters: upstream cluster status # GET，额外支持使用“GET /clusters?format=json”
/config_dump: dump current Envoy configs # GET，打印Envoy加载的各类配置信息；支持include_eds、master和resource等查询参数；
/contention: dump current Envoy mutex contention stats (if enabled) # GET，互斥跟踪
/cpuprofiler: enable/disable the CPU profiler # POST，启用或禁用cpuprofiler
/healthcheck/fail: cause the server to fail health checks # POST，强制设定HTTP健康状态检查为失败；
/healthcheck/ok: cause the server to pass health checks # POST，强制设定HTTP健康状态检查为成功；
/heapprofiler: enable/disable the heap profiler # POST，启用或禁用heapprofiler；
/help: print out list of admin commands
/hot_restart_version: print the hot restart compatibility version # GET，打印热重启相关的信息；
/listeners: print listener addresses # GET，列出所有侦听器，支持使用“GET /listeners?format=json”
/drain_listeners：Drains all listeners. # POST，驱逐所有的listener，支持使用inboundonly（仅入站侦听器）和graceful（优雅关闭）等查询参数；
/logging: query/change logging levels # POST，启用或禁用不同子组件上的不同日志记录级别
/memory: print current allocation/heap usage # POST，打印当前内在分配信息，以字节为单位；
/quitquitquit: exit the server # POST，干净退出服务器；
/reset_counters: reset all counters to zero # POST，重围所有计数器；
/tap：This endpoint is used for configuring an active tap session. # POST，用于配置活动的带标签的session；
 //reopen_logs：Triggers reopen of all access logs. Behavior is similar to SIGUSR1 handling. # POST，重新打开所有的日志，功能类似于SIGUSR1信号；
/runtime: print runtime values # GET，以json格式输出所有运行时相关值；
/runtime_modify: modify runtime values # POST /runtime_modify?key1=value1&key2=value2，添加或修改在查询参数中传递的运行时值
/server_info: print server version/status information # GET，打印当前Envoy Server的相关信息；
/stats: print server stats # 按需输出统计数据，例如GET /stats?filter=regex，另外还支持json和prometheus两种输出格式；
/stats/prometheus: print server stats in prometheusformat # 输出prometheus格式的统计信息；

常用 path

2.2 核心管理端点详解

2.2.1 <font style="color:#DF2A3F;">/stats </font>（性能指标）

关键参数：

• <font style="color:rgb(251, 71, 135);">filter</font>：指标名过滤（正则表达式）
• <font style="color:rgb(251, 71, 135);">usedonly</font>：仅显示使用过的指标
• <font style="color:rgb(251, 71, 135);">type</font>：指标类型（Counter/Gauge/Histogram）

# 获取所有以http开头的指标
[root@VM_24_47_tlinux /usr/local/src]# curl -s http://172.31.5.2:9901/stats?filter=http.*  |head -n 10
cluster.local_cluster.upstream_cx_http1_total: 0
cluster.local_cluster.upstream_cx_http2_total: 0
cluster.local_cluster.upstream_cx_http3_total: 0
cluster.local_cluster.upstream_http3_broken: 0
http.admin.downstream_cx_active: 1
http.admin.downstream_cx_delayed_close_timeout: 0
http.admin.downstream_cx_destroy: 16
http.admin.downstream_cx_destroy_active_rq: 0
http.admin.downstream_cx_destroy_local: 0
http.admin.downstream_cx_destroy_local_active_rq: 0

2.2.2 <font style="color:#DF2A3F;">/config_dump</font> （配置导出）

参数：

• <font style="color:rgb(251, 71, 135);">include_eds</font>：包含EDS配置（默认false）
• <font style="color:rgb(251, 71, 135);">resource</font>：指定资源类型（listeners/clusters等）

[root@VM_24_47_tlinux /usr/local/src]# curl -s  http://172.31.5.2:9901/config_dump |head -n 20
{
 "configs": [
  {
   "@type": "type.googleapis.com/envoy.admin.v3.BootstrapConfigDump",
   "bootstrap": {
    "node": {
     "user_agent_name": "envoy",
     "user_agent_build_version": {
      "version": {
       "major_number": 1,
       "minor_number": 35
      },
      "metadata": {
       "revision.status": "Clean",
       "build.type": "RELEASE",
       "ssl.version": "BoringSSL",
       "revision.sha": "84305a6cb64bd55aaf606bdd53de7cd6080427a1"
      }
     },
     "extensions": [

2.2.3 <font style="color:#DF2A3F;">/logging</font> （日志控制）

参数：

• <font style="color:rgb(251, 71, 135);">level</font>：日志级别（trace/debug/info/warn/error/critical）
• <font style="color:rgb(251, 71, 135);">logger</font>：指定日志组件（可选）

# 设置所有组件为debug级别
[root@VM_24_47_tlinux /usr/local/src]#curl -X POST http://localhost:9901/logging?level=debug
active loggers:
  admin: debug
  alternate_protocols_cache: debug
  aws: debug
  assert: debug
  backtrace: debug
  basic_auth: debug
  cache_filter: debug
  client: debug
  config: debug
  connection: debug
  conn_handler: debug
  compression: debug
  credential_injector: debug
  decompression: debug
  dns: debug
  dubbo: debug
  envoy_bug: debug
  ext_authz: debug
  ext_proc: debug
  rocketmq: debug
  file: debug
  ...

# 仅设置HTTP连接管理器日志
[root@VM_24_47_tlinux /usr/local/src]# curl -X POST http://172.31.5.2:9901/logging?http=info

2.2.4 <font style="color:#DF2A3F;">/clusters</font> （获取已配置集群）

列出所有已配置的集群，包括每个集群中发现的所有上游主机以及每个主机的统计信息；支持输出为json格式；

• 集群管理器信息：“version_info string”，无CDS时，则显示为“version_info::static”
• 集群相关的信息：断路器、异常点检测和用于表示是否通过CDS添加的标识“add_via_api”

每个主机的统计信息：包括总连接数、活动连接数、总请求数和主机的健康状态等；不健康的原因通常有以下三种

• <font style="color:rgb(226,140,157);"></font><font style="color:rgb(0,0,0);">failed_active_hc</font>：未通过主动健康状态检测；
• <font style="color:rgb(226,140,157);"></font><font style="color:rgb(0,0,0);">failed_eds_health</font>：被EDS标记为不健康；
• <font style="color:rgb(226,140,157);"></font><font style="color:rgb(0,0,0);">failed_outlier_check</font>：未通过异常检测机制的检查；

[root@VM_24_47_tlinux /usr/local/src]# curl -X GET  http://172.31.5.2:9901/clusters
local_cluster::observability_name::local_cluster
local_cluster::default_priority::max_connections::1024
local_cluster::default_priority::max_pending_requests::1024
local_cluster::default_priority::max_requests::1024
local_cluster::default_priority::max_retries::3
local_cluster::high_priority::max_connections::1024
local_cluster::high_priority::max_pending_requests::1024
local_cluster::high_priority::max_requests::1024
local_cluster::high_priority::max_retries::3
local_cluster::added_via_api::false
local_cluster::172.31.2.11:8080::cx_active::0
local_cluster::172.31.2.11:8080::cx_connect_fail::0
local_cluster::172.31.2.11:8080::cx_total::0
local_cluster::172.31.2.11:8080::rq_active::0
local_cluster::172.31.2.11:8080::rq_error::0
local_cluster::172.31.2.11:8080::rq_success::0
local_cluster::172.31.2.11:8080::rq_timeout::0
local_cluster::172.31.2.11:8080::rq_total::0
local_cluster::172.31.2.11:8080::hostname::
local_cluster::172.31.2.11:8080::health_flags::healthy
local_cluster::172.31.2.11:8080::weight::1
local_cluster::172.31.2.11:8080::region::
local_cluster::172.31.2.11:8080::zone::
local_cluster::172.31.2.11:8080::sub_zone::
local_cluster::172.31.2.11:8080::canary::false
local_cluster::172.31.2.11:8080::priority::0
local_cluster::172.31.2.11:8080::success_rate::-1
local_cluster::172.31.2.11:8080::local_origin_success_rate::-1
local_cluster::172.31.2.12:8080::cx_active::0
local_cluster::172.31.2.12:8080::cx_connect_fail::0
local_cluster::172.31.2.12:8080::cx_total::0
local_cluster::172.31.2.12:8080::rq_active::0
local_cluster::172.31.2.12:8080::rq_error::0
local_cluster::172.31.2.12:8080::rq_success::0
local_cluster::172.31.2.12:8080::rq_timeout::0
local_cluster::172.31.2.12:8080::rq_total::0
local_cluster::172.31.2.12:8080::hostname::
local_cluster::172.31.2.12:8080::health_flags::healthy
local_cluster::172.31.2.12:8080::weight::1
local_cluster::172.31.2.12:8080::region::
local_cluster::172.31.2.12:8080::zone::
local_cluster::172.31.2.12:8080::sub_zone::
local_cluster::172.31.2.12:8080::canary::false
local_cluster::172.31.2.12:8080::priority::0
local_cluster::172.31.2.12:8080::success_rate::-1
local_cluster::172.31.2.12:8080::local_origin_success_rate::-1

2.2.5 <font style="color:#DF2A3F;">/ready </font>（获取 Server 是否就绪）

获取Server就绪与否的状态，LIVE状态为200，否则为503；

[root@VM_24_47_tlinux /usr/local/src]# curl -X GET  http://172.31.5.2:9901/ready
LIVE