1
apiVersion: networking.k8s.io/v1
2
kind: Ingress
3
metadata:
4
  name: api-route
5
  annotations:
6
    # 全局限流：1000 QPS
7
    higress.io/limit-rps: "1000"
8
    # 突发流量：允许 2000（令牌桶）
9
    higress.io/limit-burst-multiplier: "2"
10
spec:
11
  ingressClassName: higress
12
  rules:
13
    - host: api.example.com
14
      http:
15
        paths:
16
          - path: /api
17
            pathType: Prefix
18
            backend:
19
              service:
20
                name: api-service
21
                port:
22
                  number: 8080

1
metadata:
2
  annotations:
3
    # 按 Header 限流（每个用户独立配额）
4
    higress.io/limit-by-header: "X-User-ID"
5
    higress.io/limit-rps: "100"
6

7
    # 按 IP 限流
8
    higress.io/limit-by-ip: "true"
9
    higress.io/limit-rps: "50"
10

11
    # 按路径限流（不同 API 不同配额）
12
    higress.io/limit-by-path: "true"

1
# ConfigMap 配置全局集群限流
2
apiVersion: v1
3
kind: ConfigMap
4
metadata:
5
  name: higress-config
6
  namespace: higress-system
7
data:
8
  higress: |
9
    rateLimit:
10
      redis:
11
        service: redis.redis.svc.cluster.local
12
        port: 6379
13
        timeout: 1000
14
        database: 0
15
      # 默认限流规则
16
      rules:
17
        - name: global-limit
18
          limit: 10000        # 10000 QPS
19
          limitByKey: "header:X-User-ID"

1
metadata:
2
  annotations:
3
    higress.io/limit-rps: "100"
4
    higress.io/limit-rejected-code: "429"
5
    higress.io/limit-rejected-body: '{"error":"Too Many Requests","retryAfter":60}'
6
    higress.io/limit-rejected-header: "Retry-After:60"

1
状态机：
2
┌─────────┐  失败率 > 阈值  ┌─────────┐
3
│ CLOSED  │ ─────────────→ │  OPEN   │
4
│（正常）  │                │（熔断）  │
5
└─────────┘                └─────────┘
6
     ↑                          │
7
     │    探测成功               │ 超时后
8
     │  ←─────────────────────  ▼
9
     │                    ┌─────────┐
10
     └─────────────────── │ HALF-   │
11
                          │ OPEN    │
12
                          │（探测）  │
13
                          └─────────┘

1
apiVersion: networking.k8s.io/v1
2
kind: Ingress
3
metadata:
4
  name: api-route
5
  annotations:
6
    # 熔断：连续 5 次 5xx 后熔断
7
    higress.io/circuit-breaker-consecutive-5xx: "5"
8
    # 熔断时长：30s
9
    higress.io/circuit-breaker-sleep-window: "30s"
10
    # 最小请求数（避免误判）
11
    higress.io/circuit-breaker-min-request-volume: "20"
12
    # 错误率阈值（50%）
13
    higress.io/circuit-breaker-error-percent: "50"
14
spec:
15
  ingressClassName: higress
16
  rules:
17
    - host: api.example.com
18
      http:
19
        paths:
20
          - path: /api
21
            backend:
22
              service:
23
                name: api-service
24
                port:
25
                  number: 8080

1
metadata:
2
  annotations:
3
    higress.io/circuit-breaker-consecutive-5xx: "5"
4
    # 熔断时返回自定义响应
5
    higress.io/circuit-breaker-fallback-code: "503"
6
    higress.io/circuit-breaker-fallback-body: '{"error":"Service Unavailable","message":"Circuit breaker open"}'
7
    # 或降级到备用服务
8
    higress.io/circuit-breaker-fallback-service: "backup-service.default.svc.cluster.local:8080"

1
metadata:
2
  annotations:
3
    # 重试次数
4
    higress.io/retry-count: "3"
5
    # 重试超时
6
    higress.io/retry-timeout: "10s"
7
    # 重试条件
8
    higress.io/retry-on: "5xx,reset,connect-failure,retriable-4xx"
9
    # 重试间隔（指数退避）
10
    higress.io/retry-back-off-base-interval-ms: "100"
11
    higress.io/retry-back-off-max-interval-ms: "1000"

1
# POST 请求默认不重试（幂等性考虑）
2
# 如需强制重试：
3
metadata:
4
  annotations:
5
    higress.io/retry-count: "3"
6
    higress.io/retry-on: "5xx"
7
    higress.io/retry-non-idempotent: "true"   # 允许非幂等请求重试

1
metadata:
2
  annotations:
3
    # 连接超时（TCP 握手）
4
    higress.io/connect-timeout: "5s"
5
    # 请求超时（完整请求）
6
    higress.io/request-timeout: "30s"
7
    # 上游响应超时（等待首字节）
8
    higress.io/upstream-response-timeout: "10s"
9
    # 空闲超时（Keep-Alive）
10
    higress.io/idle-timeout: "60s"

1
客户端 ←─── request-timeout ───→ Higress ←─── upstream-response-timeout ───→ 上游服务
2
                                     ↑
3
                              connect-timeout
4
                              （TCP 握手）

1
# 稳定版本（90%）
2
apiVersion: networking.k8s.io/v1
3
kind: Ingress
4
metadata:
5
  name: api-stable
6
spec:
7
  ingressClassName: higress
8
  rules:
9
    - host: api.example.com
10
      http:
11
        paths:
12
          - path: /api
13
            backend:
14
              service:
15
                name: api-stable
16
                port: { number: 8080 }
17

18
---
19
# 灰度版本（10%）
20
apiVersion: networking.k8s.io/v1
21
kind: Ingress
22
metadata:
23
  name: api-canary
24
  annotations:
25
    higress.io/canary: "true"
26
    higress.io/canary-weight: "10"
27
spec:
28
  ingressClassName: higress
29
  rules:
30
    - host: api.example.com
31
      http:
32
        paths:
33
          - path: /api
34
            backend:
35
              service:
36
                name: api-canary
37
                port: { number: 8080 }

1
# 只有 X-Env: canary 的请求才到灰度版本
2
apiVersion: networking.k8s.io/v1
3
kind: Ingress
4
metadata:
5
  name: api-canary-header
6
  annotations:
7
    higress.io/canary: "true"
8
    higress.io/canary-by-header: "X-Env"
9
    higress.io/canary-by-header-value: "canary"
10
spec:
11
  ingressClassName: higress
12
  rules:
13
    - host: api.example.com
14
      http:
15
        paths:
16
          - path: /api
17
            backend:
18
              service:
19
                name: api-canary
20
                port: { number: 8080 }

1
metadata:
2
  annotations:
3
    higress.io/canary: "true"
4
    higress.io/canary-by-cookie: "gray_user"
5
    # Cookie gray_user=always → 灰度
6
    # Cookie gray_user=never → 稳定版
7
    # 无 Cookie → 按权重分配

1
1. 部署灰度版本（api-canary）
2
2. 创建 Canary Ingress（权重 5%）
3
3. 观察监控（错误率、延迟、业务指标）
4
4. 逐步增加权重：5% → 20% → 50% → 100%
5
5. 全量后删除稳定版，重命名灰度版为稳定版
6
6. 清理 Canary Ingress

1
┌─────────────┐         ┌─────────────┐
2
│   Blue      │         │   Green     │
3
│  (当前生产)  │         │  (新版本)   │
4
│  v1.0       │         │  v2.0       │
5
└─────────────┘         └─────────────┘
6
       ↑                       ↑
7
       │    切换 Ingress       │
8
       └───────────────────────┘
9

10
切换瞬间完成，回滚也只需切回 Blue

1
# 初始：Blue 环境
2
apiVersion: networking.k8s.io/v1
3
kind: Ingress
4
metadata:
5
  name: api-blue
6
spec:
7
  ingressClassName: higress
8
  rules:
9
    - host: api.example.com
10
      http:
11
        paths:
12
          - path: /api
13
            backend:
14
              service:
15
                name: api-blue
16
                port: { number: 8080 }
17

18
---
19
# 部署 Green 环境后，切换 Ingress
20
apiVersion: networking.k8s.io/v1
21
kind: Ingress
22
metadata:
23
  name: api-green    # 新名称
24
spec:
25
  ingressClassName: higress
26
  rules:
27
    - host: api.example.com
28
      http:
29
        paths:
30
          - path: /api
31
            backend:
32
              service:
33
                name: api-green    # 切换到 Green
34
                port: { number: 8080 }
35

36
# 删除旧的 Blue Ingress
37
kubectl delete ingress api-blue

1
apiVersion: networking.k8s.io/v1
2
kind: Ingress
3
metadata:
4
  name: api-route
5
  annotations:
6
    # 镜像 10% 流量到测试服务
7
    higress.io/mirror-service: "api-test.default.svc.cluster.local:8080"
8
    higress.io/mirror-percent: "10"
9
spec:
10
  ingressClassName: higress
11
  rules:
12
    - host: api.example.com
13
      http:
14
        paths:
15
          - path: /api
16
            backend:
17
              service:
18
                name: api-prod
19
                port: { number: 8080 }

1
apiVersion: networking.k8s.io/v1
2
kind: Ingress
3
metadata:
4
  name: api-gateway
5
  annotations:
6
    # 限流
7
    higress.io/limit-rps: "1000"
8
    higress.io/limit-by-ip: "true"
9
    higress.io/limit-rejected-code: "429"
10

11
    # 熔断
12
    higress.io/circuit-breaker-consecutive-5xx: "5"
13
    higress.io/circuit-breaker-sleep-window: "30s"
14
    higress.io/circuit-breaker-error-percent: "50"
15

16
    # 重试
17
    higress.io/retry-count: "3"
18
    higress.io/retry-timeout: "10s"
19
    higress.io/retry-on: "5xx,reset,connect-failure"
20

21
    # 超时
22
    higress.io/connect-timeout: "5s"
23
    higress.io/request-timeout: "30s"
24
spec:
25
  ingressClassName: higress
26
  rules:
27
    - host: api.example.com
28
      http:
29
        paths:
30
          - path: /api
31
            pathType: Prefix
32
            backend:
33
              service:
34
                name: api-service
35
                port:
36
                  number: 8080