┌─────────────────────────────────────────────────────────────┐
│                    Control Plane (istiod)                    │
│  ┌─────────────┐  ┌──────────────┐  ┌───────────────────┐  │
│  │  Pilot      │  │  Citadel     │  │  Galley           │  │
│  │(트래픽 규칙) │  │(인증서 관리)  │  │(설정 검증/배포)   │  │
│  └──────┬──────┘  └──────┬───────┘  └───────────────────┘  │
│         │ xDS API         │ 인증서                           │
└─────────┼─────────────────┼──────────────────────────────────┘
          │                 │
┌─────────┼─────────────────┼──────────────────────────────────┐
│         │   Data Plane     │                                  │
│  Pod A  │                 │  Pod B                            │
│  ┌──────▼──────────────┐  │  ┌──────────────────────────┐   │
│  │  [App Container]    │  │  │  [App Container]          │   │
│  │  ← 포트 8080        │  │  │  ← 포트 8080              │   │
│  │─────────────────────│  │  │──────────────────────────│   │
│  │  [istio-proxy]      │──┼─▶│  [istio-proxy]           │   │
│  │  Envoy :15001/:15006│  └  │  Envoy :15001/:15006     │   │
│  │  mTLS + 메트릭 수집  │     │  mTLS + 메트릭 수집       │   │
│  └──────────────────── ┘     └──────────────────────────┘   │
│  (iptables가 모든 트래픽을 Envoy로 리다이렉트)                │
└─────────────────────────────────────────────────────────────┘

# 네임스페이스에 자동 인젝션 활성화
kubectl label namespace production istio-injection=enabled

# 기존 Pod에 적용하려면 재배포 필요
kubectl rollout restart deployment -n production

# 사이드카 주입 확인
kubectl get pod -n production -o yaml | grep -c "istio-proxy"
# 숫자가 Pod 수와 일치해야 함

# PERMISSIVE 모드: mTLS와 평문 트래픽 모두 허용 (기본값, 마이그레이션 단계)
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: PERMISSIVE

# STRICT 모드: mTLS 인증서 없는 트래픽은 거부
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT

# 적용
kubectl apply -f peer-auth-strict.yaml

# mTLS 상태 확인
istioctl x check-inject -n production
istioctl authn tls-check payment.production.svc.cluster.local

# 출력 예시:
# HOST:PORT                                    STATUS     SERVER     CLIENT
# payment.production.svc.cluster.local:8080   OK         STRICT     STRICT

# mTLS를 클라이언트 측에서도 강제
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: payment-mtls
  namespace: production
spec:
  host: payment.production.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL     # Istio 발급 인증서로 mTLS
  connectionPool:
    tcp:
      maxConnections: 100
    http:
      h2UpgradePolicy: UPGRADE
  outlierDetection:          # 서킷브레이커
    consecutiveErrors: 5
    interval: 30s
    baseEjectionTime: 30s
    maxEjectionPercent: 50

kubectl apply -f destination-rule.yaml

# DestinationRule 적용 확인
kubectl get destinationrule -n production
istioctl proxy-config cluster payment-7d9b4c8f6-xkp2n.production | grep payment

# 1. 두 버전의 Deployment 준비
# v1 Deployment (기존)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-v1
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: payment
      version: v1
  template:
    metadata:
      labels:
        app: payment
        version: v1        # 버전 레이블 필수
    spec:
      containers:
        - name: payment
          image: payment:1.0.0
          ports:
            - containerPort: 8080
---
# v2 Deployment (신규)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-v2
  namespace: production
spec:
  replicas: 1              # 처음엔 적게
  selector:
    matchLabels:
      app: payment
      version: v2
  template:
    metadata:
      labels:
        app: payment
        version: v2
    spec:
      containers:
        - name: payment
          image: payment:2.0.0
          ports:
            - containerPort: 8080

# 2. DestinationRule로 v1/v2 subset 정의
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: payment-dr
  namespace: production
spec:
  host: payment           # Service 이름
  subsets:
    - name: v1
      labels:
        version: v1       # 이 레이블을 가진 Pod를 v1 subset으로 그룹화
    - name: v2
      labels:
        version: v2
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

# 3. VirtualService로 트래픽 분배 (처음: v1 90% / v2 10%)
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: payment-vs
  namespace: production
spec:
  hosts:
    - payment             # Service 이름과 일치
  http:
    - route:
        - destination:
            host: payment
            subset: v1
          weight: 90      # v1으로 90%
        - destination:
            host: payment
            subset: v2
          weight: 10      # v2으로 10%
      timeout: 5s         # 타임아웃 설정
      retries:
        attempts: 3
        perTryTimeout: 2s
        retryOn: gateway-error,connect-failure,retriable-4xx

# 적용
kubectl apply -f destination-rule.yaml
kubectl apply -f virtual-service.yaml

# 트래픽 분배 확인 (부하 테스트)
for i in $(seq 1 100); do
  kubectl exec -n production \
    $(kubectl get pod -n production -l app=frontend -o name | head -1) \
    -- curl -s http://payment:8080/version
done | sort | uniq -c
# 약 90개: "version: v1"
# 약 10개: "version: v2"

# v2 에러율 모니터링 (Grafana 또는 istioctl)
istioctl dashboard kiali   # Kiali 트래픽 시각화 대시보드

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: payment-vs
  namespace: production
spec:
  hosts:
    - payment
  http:
    # QA 팀은 X-Canary: true 헤더로 항상 v2로 라우팅
    - match:
        - headers:
            x-canary:
              exact: "true"
      route:
        - destination:
            host: payment
            subset: v2
          weight: 100
    # 나머지는 v1
    - route:
        - destination:
            host: payment
            subset: v1
          weight: 100

# v2 테스트 (헤더 포함)
curl -H "x-canary: true" http://payment.production.svc.cluster.local/api/pay

# 단계별 트래픽 전환 스크립트
for weight in 10 25 50 75 100; do
  echo "v2 트래픽: $weight%"
  kubectl patch virtualservice payment-vs -n production \
    --type=json \
    -p="[
      {\"op\": \"replace\", \"path\": \"/spec/http/0/route/0/weight\", \"value\": $((100-weight))},
      {\"op\": \"replace\", \"path\": \"/spec/http/0/route/1/weight\", \"value\": $weight}
    ]"
  echo "에러율 모니터링 중... (5분 대기)"
  sleep 300
done