云原生微服务治理实战：基于 Istio + Envoy 的流量染色与全链路灰度发布

外部请求 → IngressGateway (Envoy) 
  → 通过 EnvoyFilter 判断请求头（如 X-Gray-Tag） 
  → 若缺失，则根据用户 ID / IP 动态生成灰度标签，注入到 x-request-id 的 Baggage 中
  → VirtualService 匹配 header 中的 gray: enabled，路由到灰度版本 subset
  → 下游服务调用时，通过 OpenTelemetry 的 Context Propagation 自动传递 Baggage
  → 每个服务节点的 Envoy 根据 baggage 中的 gray 键值，再次执行路由选择

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: ingress-gray-lua
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: envoy.filters.http.router
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.lua
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
          inlineCode: |
            function envoy_on_request(request_handle)
              local headers = request_handle:headers()
              local gray_tag = headers:get("X-Gray-Tag")
              if gray_tag == nil or gray_tag == "" then
                local user_id = headers:get("X-User-ID")
                if user_id == nil then
                  user_id = "anonymous"
                end
                -- 基于用户ID哈希决定灰度概率（10%）
                local hash = 0
                for i = 1, #user_id do
                  hash = hash * 31 + string.byte(user_id, i)
                end
                if math.abs(hash) % 10 == 0 then  -- 10% 灰度
                  headers:add("X-Gray-Tag", "enabled")
                  headers:add("baggage-gray", "enabled")  -- OpenTelemetry baggage
                  request_handle:logInfo("Gray traffic enabled for user: " .. user_id)
                else
                  headers:add("X-Gray-Tag", "disabled")
                  headers:add("baggage-gray", "disabled")
                end
              end
              -- 保证下游链路追踪上下文携带 baggage
              -- 注：如果已存在 baggage 头，则追加；此处简化处理
            end

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: demo-service
spec:
  host: demo-service
  subsets:
  - name: v1
    labels:
      version: stable
  - name: v2
    labels:
      version: canary
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demo-service-vs
spec:
  hosts:
  - demo-service
  http:
  - match:
    - headers:
        baggage:
          exact: "gray=enabled"
    route:
    - destination:
        host: demo-service
        subset: v2
      weight: 100
  - route:
    - destination:
        host: demo-service
        subset: v1
      weight: 100

package middleware

import (
    "context"
    "github.com/gin-gonic/gin"
    "go.opentelemetry.io/otel/baggage"
    "go.opentelemetry.io/otel/propagation"
)

func BaggagePropagation() gin.HandlerFunc {
    return func(c *gin.Context) {
        // 从请求头提取 Baggage
        propagator := propagation.NewCompositeTextMapPropagator(
            propagation.TraceContext{},
            propagation.Baggage{},
        )
        ctx := propagator.Extract(c.Request.Context(), propagation.HeaderCarrier(c.Request.Header))
        
        // 将 Baggage 存入 Gin Context，便于业务逻辑读取
        c.Set("otelContext", ctx)
        
        // 在响应头中注入（可选）
        propagator.Inject(ctx, propagation.HeaderCarrier(c.Writer.Header()))
        
        c.Next()
    }
}

package client

import (
    "context"
    "go.opentelemetry.io/otel/baggage"
    "go.opentelemetry.io/otel/propagation"
    "net/http"
)

func CallDownstream(ctx context.Context, url string) error {
    req, _ := http.NewRequestWithContext(ctx, "GET", url, nil)
    propagator := propagation.NewCompositeTextMapPropagator(
        propagation.TraceContext{},
        propagation.Baggage{},
    )
    propagator.Inject(ctx, propagation.HeaderCarrier(req.Header))
    
    client := &http.Client{}
    _, err := client.Do(req)
    return err
}

func HandleOrder(c *gin.Context) {
    ctxVal, _ := c.Get("otelContext")
    ctx := ctxVal.(context.Context)
    bag := baggage.FromContext(ctx)
    grayVal := bag.Member("gray").Value()
    if grayVal == "enabled" {
        // 使用灰度数据库连接、缓存Key后缀等
        log.Printf("[GRAY] processing order with gray logic")
    }
    // ...
}

receivers:
  otlp:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317
processors:
  attributes:
    actions:
      - key: gray.tag
        from_context: baggage.gray
        action: upsert
  batch:
    timeout: 1s
exporters:
  tempo:
    endpoint: tempo:4317
    tls:
      insecure: true
service:
  pipelines:
    traces:
      receivers: [otlp]
      processors: [attributes, batch]
      exporters: [tempo]

apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: gray-ratio
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  url: oci://registry.example.com/gray-ratio:v1.0
  phase: AUTHN
  pluginConfig:
    redis_addr: "redis-service:6379"
    default_ratio: 0.1