# bazel 编译示例
--define=grpc_no_ares=true 
--define=openssl_version=3.0 
--config=udp_proxy 
--config=quic 
--strip=always

# 信令平面：HTTP/2 + gRPC，强一致性、低并发
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: signaling-vsvc
spec:
  hosts: ["signaling.svc.cluster.local"]
  http:
  - match:
    - headers:
        x-meeting-type:
          exact: "large"   # 大型会议走专用池
    route:
    - destination:
        host: signaling-large.svc.cluster.local
      weight: 100
    retries:
      attempts: 2
      perTryTimeout: 500ms
      retryOn: "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes"
    timeout: 3s

# 媒体平面：UDP/QUIC，高并发、弱网对抗
apiVersion: networking.istio.io/v1beta1
kind: EnvoyFilter
metadata:
  name: media-udp-loadbalancer
spec:
  workloadSelector:
    labels:
      app: media-proxy
  configPatches:
  - applyTo: CLUSTER
    match:
      cluster:
        service: media-sfu.svc.cluster.local
    patch:
      operation: MERGE
      value:
        lb_policy: LEAST_REQUEST
        least_request_lb_config:
          choice_count: 2
        health_checks:
        - timeout: 1s
          interval: 5s
          unhealthy_threshold: 2
          healthy_threshold: 1
          udp_health_check:
            payload:
              text: "HEALTHCHECKn"

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: sfu-destination
spec:
  host: media-sfu.svc.cluster.local
  trafficPolicy:
    connectionPool:
      udp:
        maxRequestsPerConnection: 1000   # 单连接最大并发流
    outlierDetection:
      consecutive5xxErrors: 3
      interval: 10s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
      minHealthPercent: 30
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: sfu-rate-limit
spec:
  selector:
    matchLabels:
      app: media-sfu
  action: CUSTOM
  provider:
    name: envoy.filters.http.local_ratelimit
  rules:
  - when:
    - key: request.headers["x-meeting-id"]
      values: ["*"]
    custom:
      descriptor:
        key: "meeting_bucket"
        value: "per_meeting"
      rateLimit:
        unit: MINUTE
        requestsPerUnit: 12000   # 单会议每分钟最大信令交互数

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: media-sfu-canary
spec:
  hosts: ["media-sfu.svc.cluster.local"]
  http:
  - match:
    - queryParams:
        codec:
          exact: "av1"
    route:
    - destination:
        host: media-sfu-canary.svc.cluster.local
        subset: v2-av1
      weight: 100
  - route:
    - destination:
        host: media-sfu.svc.cluster.local
        subset: stable
      weight: 100

graph LR
  Client[Client] -->|Signal: TraceID=abc| GW[Edge Gateway]
  GW -->|Signal: TraceID=abc| SIG[Signaling]
  SIG -->|Create Meeting: meeting_id=M123| SFU[SFU Cluster]
  Client -->|Media: meeting_id=M123| SFU
  SFU -->|WASM Aggregate| OTEL[OTel Collector]
  OTEL -->|Trace + Metrics| Tempo[Tempo/Jaeger]

# bootstrap.yaml 片段
runtime:
  layer_values:
  - name: "envoy.runtime.features"
    static_layer:
      envoy.reloadable_features.enable_dispatcher_stats: true
      envoy.reloadable_features.enable_udp_proxy_drain: true
      envoy.reloadable_features.quic_disable_receive_timestamps: false # 开启 QUIC 接收时间戳用于 RTT 估算
      envoy.reloadable_features.use_io_uring_for_listener: true # Linux 5.10+ 开启 io_uring
      envoy.reloadable_features.allow_unknown_fields_in_proto3: false # 安全加固
---
# 资源限制与并发模型
concurrency: 4  # 绑定 4 物理核，避免超线程抖动
cpu_quota: 380000  # cfs_quota_us，留 200ms 给系统/日志采集
memory_limit_mb: 512  # 硬性内存上限，防 OOM Kill

# 资源估算脚本 (estimate_resources.py)
def estimate_mem(cpu_cores, max_concurrent_streams, protocol='udp'):
    base = 35  # MB, Envoy 基础内存
    per_stream = 0.8 if protocol == 'udp' else 1.2  # KB/流
    buffer = 50  # MB, 缓冲区
    return base + (max_concurrent_streams * per_stream / 1024) + buffer

def estimate_cpu(pps, avg_pkt_size):
    # 经验公式：每百万包/秒 ≈ 0.8 核 (含内核态)
    return (pps / 1_000_000) * 0.8 * (avg_pkt_size / 500)

# .gitlab-ci.yml
resource_gate:
  script:
    - python estimate_resources.py --input deployment.yaml --threshold 1.2
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

graph TB
  subgraph Control_Plane [全球控制平面]
    ISTIOD_PRIMARY[(Istiod Primary<br/>Region: cn-hangzhou)]
    ISTIOD_SECONDARY_1[(Istiod Remote<br/>Region: cn-beijing)]
    ISTIOD_SECONDARY_2[(Istiod Remote<br/>Region: ap-singapore)]
  end

  subgraph Data_Plane_CN [华东/华北数据平面]
    GW_CN[Edge Gateway<br/>Envoy + WASM]
    SFU_CN[SFU Cluster<br/>Sidecar]
  end

  subgraph Data_Plane_SG [新加坡数据平面]
    GW_SG[Edge Gateway]
    SFU_SF[SFU Cluster]
  end

  ISTIOD_PRIMARY -. xDS (ADSC) .-> ISTIOD_SECONDARY_1
  ISTIOD_PRIMARY -. xDS (ADSC) .-> ISTIOD_SECONDARY_2
  ISTIOD_SECONDARY_1 --> GW_CN
  ISTIOD_SECONDARY_1 --> SFU_CN
  ISTIOD_SECONDARY_2 --> GW_SG
  ISTIOD_SECONDARY_2 --> SFU_SF

# 1. SFU 部署时打标
apiVersion: apps/v1
kind: Deployment
metadata:
  name: media-sfu
spec:
  template:
    metadata:
      annotations:
        sidecar.istio.io/userVolume: '[{"name":"topology","configMap":{"name":"node-topology"}}]'
        sidecar.istio.io/userVolumeMount: '[{"mountPath":"/etc/topology","name":"topology"}]'
    spec:
      containers:
      - name: sfu
        env:
        - name: NODE_REGION
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName  # 通过 NodeLabel 映射 Region
---
# 2. EnvoyFilter 读取本地文件/环境变量，动态匹配 EDS 端点 locality
apiVersion: networking.istio.io/v1beta1
kind: EnvoyFilter
metadata:
  name: locality-aware-routing
spec:
  workloadSelector:
    labels:
      app: edge-gateway
  configPatches:
  - applyTo: HTTP_ROUTE
    match:
      routeConfiguration:
        vhost:
          name: "inbound|http|80|signaling.svc.cluster.local"
    patch:
      operation: MERGE
      value:
        route:
          weighted_clusters:
          - name: media-sfu
            weight: 100
            metadata_match:
              filter_metadata:
                envoy.lb:
                  # 仅路由到同 Region 端点
                  region: "${NODE_REGION}"
          locality_weighted_lb_config:
            - locality:
                region: "${NODE_REGION}"
              weight: 100
            - locality:
                region: "*"
              weight: 1  # 兜底极小权重

gitops-repo/
├── clusters/
│   ├── cn-hangzhou-prod/          # 目标集群
│   │   ├── base/                  # 通用基础配置 (CRD, RBAC, Sidecar Injection)
│   │   ├── overlays/
│   │   │   ├── canary/            # 灰度专用配置
│   │   │   └── stable/            # 稳定版配置
│   │   └── kustomization.yaml
│   └── ap-singapore-prod/
├── apps/
│   ├── signaling/                 # 微服务级配置
│   │   ├── virtualservice.yaml
│   │   ├── destinationrule.yaml
│   │   └── envoyfilter/
│   │       ├── ratelimit.yaml
│   │       └── wasm-plugin.yaml
│   └── media-sfu/
├── policies/                      # 全局策略 (Security, Telemetry)
│   ├── authorization/
│   ├── peerauthentication.yaml
│   └── telemetry.yaml
└── tools/
    ├── validate.sh                # 语法/语义校验脚本
    └── diff-preview.sh            # 变更差分预览

graph LR
  A[PR 提交] --> B{Kustomize Build}
  B --> C[Kubeconform<br/>Schema 校验]
  C --> D[Istioctl Analyze<br/>语义冲突检测]
  D --> E[Envoy Config Dump<br/>Diff 对比]
  E --> F[Kind 集成测试<br/>流量回放]
  F --> G{人工 Review}
  G --> H[ArgoCD Sync<br/>Canary Namespace]
  H --> I[自动化金丝雀分析<br/>PromQL 指标判定]
  I --> J[全量推送]

# policy/deny_insecure_ingress.rego
package istio.security

deny[msg] {
  input.kind == "Gateway"
  input.spec.selector["istio"] == "ingressgateway"
  not input.spec.servers[_].tls.mode == "ISTIO_MUTUAL"
  msg := "Ingress Gateway 必须启用 mTLS (ISTIO_MUTUAL)"
}

deny[msg] {
  input.kind == "AuthorizationPolicy"
  input.spec.action == "ALLOW"
  not input.spec.rules[_].when[_].key == "request.auth.principal"
  msg := "AuthorizationPolicy 必须基于 SPIFFE ID 校验身份"
}

# CI 中集成 OPA Gatekeeper
opa eval -i gateway.yaml -d policy/ "data.istio.security.deny"

apiVersion: meeting.mesh.io/v1alpha1
kind: MeetingMeshPolicy
metadata:
  name: global-meeting-policy
spec:
  # 业务语义意图，而非技术实现
  traffic:
    localityPreference: "same-region-preferred"  # 就近优先
    crossRegionFailover: true                    # 允许跨域兜底
    codecPriority: ["av1", "h265", "vp9", "h264"]
  resilience:
    maxConcurrentStreamsPerSFU: 400
    circuitBreaker:
      trigger: "cpu>80% or packet_loss>2%"
      action: "drain_new_connections"
  observability:
    samplingRate: 0.01
    anomalySamplingRate: 1.0
    piiMasking: true
  security:
    mtls: "strict"
    tenantIsolation: true