┌─────────────┐     ┌──────────────────────────────────────┐
│  Client SDK │────▶│  Ingress Gateway (Envoy)               │
└─────────────┘     │  - TLS 终结 / 认证鉴权                 │
                    │  - 按 RoomID 一致性哈希路由到信令集群   │
                    └──────────────┬─────────────────────────┘
                                   │ mTLS
                    ┌──────────────▼─────────────────────────┐
                    │  Signaling Service (Sidecar Envoy)     │
                    │  - 故障注入: 延迟/中止/限流              │
                    │  - 镜像流量 → Canary Signaling v2       │
                    └──────────────┬─────────────────────────┘
                                   │ gRPC / WebSocket
         ┌─────────────────────────┼─────────────────────────┐
         ▼                         ▼                         ▼
┌───────────────┐         ┌───────────────┐         ┌───────────────┐
│ Media Server  │         │ Media Server  │         │ Media Server  │
│   Cluster A   │         │   Cluster B   │         │  Canary v2    │
│ (Primary)     │◀─镜像──▶│ (Shadow)      │         │ (Mirror)      │
└───────────────┘         └───────────────┘         └───────────────┘

# signaling-mirror.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: signaling-service
  namespace: meeting-prod
spec:
  hosts:
  - signaling.meeting.svc.cluster.local
  http:
  - match:
    - headers:
        x-canary-candidate:
          exact: "true"   # 仅镜像打标流量，避免全量复制压垮 Canary
    route:
    - destination:
        host: signaling.meeting.svc.cluster.local
        subset: stable
      weight: 100
    mirror:
      destination:
        host: signaling-canary.meeting.svc.cluster.local
        subset: canary
      weight: 100        # 镜像权重 100% = 全量复制
    mirrorPercentage:
      value: 10.0        # 仅镜像 10% 流量，降低 Canary 压力

-- mirror-tag.lua
function envoy_on_request(request_handle)
  if request_handle:headers():get("x-envoy-mirror") == "true" then
    request_handle:headers():add("x-shadow-request", "true")
    request_handle:headers():add("x-idempotency-key", "shadow-" .. math.random(1e9))
  end
end

# signaling-fault-injection.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: signaling-fault-injection
  namespace: meeting-prod
spec:
  hosts:
  - signaling.meeting.svc.cluster.local
  http:
  - match:
    - headers:
        x-chaos-test:
          exact: "enabled"   # 仅对打标流量注入故障
    fault:
      delay:
        percentage:
          value: 30.0        # 30% 请求注入延迟
        fixedDelay: 500ms    # 固定 500ms 延迟
      abort:
        percentage:
          value: 5.0         # 5% 请求直接中止
        httpStatus: 503      # 返回 503 模拟服务不可用
    route:
    - destination:
        host: signaling.meeting.svc.cluster.local
        subset: stable
      weight: 100

# telemetry.yaml
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: mesh-default
  namespace: istio-system
spec:
  tracing:
  - providers:
    - name: tempo
    randomSamplingPercentage: 10.0
    customTags:
      shadow:
        literal:
          value: "{{ request.headers.x-shadow-request || 'false' }}"

graph LR
    A[提交镜像验证 PR] --> B{镜像指标达标?}
    B -- 是 --> C[创建灰度发布 PR<br/>weight: 5%]
    B -- 否 --> D[阻断合并、反馈研发]
    C --> E{灰度 30 分钟无异常?}
    E -- 是 --> F[全量发布]
    E -- 否 --> G[一键回滚、复盘]

// src/lib.rs
use proxy_wasm::traits::*;
use proxy_wasm::types::*;
use sdp::Session; // 依赖 sdp-rs crate

proxy_wasm::main! {{
    proxy_wasm::set_log_level(LogLevel::Trace);
    proxy_wasm::set_root_context(|_| -> Box<dyn RootContext> { Box::new(SdpRouterRoot) });
}}

struct SdpRouterRoot;
impl RootContext for SdpRouterRoot {
    fn create_http_context(&self, _: u32) -> Option<Box<dyn HttpContext>> {
        Some(Box::new(SdpRouterContext))
    }
    fn get_type(&self) -> Option<String> { Some("sdp_affinity_router".into()) }
}

struct SdpRouterContext;
impl HttpContext for SdpRouterContext {
    fn on_http_request_body(&mut self, _: usize, _: bool) -> Action {
        // 1. 获取 Body (假设 Content-Type: application/sdp)
        let body = self.get_http_request_body(0, self.get_http_request_body_size().unwrap_or(0));
        if let Some(bytes) = body {
            if let Ok(sdp_str) = std::str::from_utf8(&bytes) {
                // 2. 解析 SDP 提取业务标签
                if let Ok(session) = sdp_str.parse::<Session>() {
                    for media in session.media_descriptions {
                        // 示例：从 a=fmtp 或 a=mid 提取 floor_id
                        for attr in media.attributes {
                            if attr.key == "floor_id" {
                                let floor_id = attr.value.unwrap_or_default();
                                // 3. 查询本地缓存/外部服务获取目标可用区
                                let target_zone = self.resolve_zone_by_floor(&floor_id);
                                // 4. 设置路由 Header，Envoy 原生路由规则匹配该 Header 转发
                                self.add_http_request_header("x-destination-subzone", &target_zone);
                                break;
                            }
                        }
                    }
                }
            }
        }
        Action::Continue
    }
}

impl SdpRouterContext {
    fn resolve_zone_by_floor(&self, floor_id: &str) -> String {
        // 实际生产建议：从 Shared Data (Envoy SDS/ADS) 或本地 LRU 缓存读取
        // 此处简化演示
        format!("zone-{}", floor_id.chars().next().unwrap_or('a'))
    }
}

# wasm-sdp-router.yaml
apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: sdp-affinity-router
  namespace: meeting-prod
spec:
  selector:
    matchLabels:
      app: signaling-gateway  # 仅挂载到信令网关 Sidecar
  url: oci://harbor.mycorp.com/wasm/sdp-router:v1.2.3  # OCI 镜像分发
  sha256: "abcdef123456..."  # 校验和，保证供应链安全
  phase: AUTHZ_BEFORE       # 在授权前执行，确保路由 Header 生效
  priority: 100
  pluginConfig:
    cache_ttl_seconds: 300
    fallback_zone: "zone-default"

# dr-signaling-multi-cluster.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: signaling-dr
  namespace: meeting-prod
spec:
  host: signaling.meeting.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      localityLbSetting:
        enabled: true
        # 权重分配：本 Zone 80%，同 Region 其他 Zone 15%，跨 Region 5%
        distribute:
        - from: "region/*/zone/*"
          to:
            "region/*/zone/*": 80
            "region/*/*": 15
            "*/*/*": 5
        failover:
        - from: "region/cn-hangzhou/zone/*"
          to: "region/cn-shanghai/*"  # 杭州全挂时切上海
    connectionPool:
      tcp:
        maxConnections: 10000
      http:
        h2UpgradePolicy: UPGRADE
        http2MaxRequests: 1000
        maxRequestsPerConnection: 100
    outlierDetection:
      consecutive5xxErrors: 3
      interval: 10s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
      minHealthPercent: 30  # Zone 级熔断保护
  subsets:
  - name: stable
    labels:
      version: stable
  - name: canary
    labels:
      version: canary

# udp-media-proxy.yaml (Envoy 原生配置片段，通过 EnvoyFilter 下发)
static_resources:
  listeners:
  - name: udp_media_inbound
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 50000  # 媒体信令协商后的动态端口范围需预留
        protocol: UDP
    listener_filters:
    - name: envoy.filters.udp_listener.udp_proxy
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig
        stat_prefix: media_rtp
        matcher:
          on_no_match:
            action:
              name: route
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.Route
                cluster: media_server_cluster
        # 故障注入配置 (需 Envoy 1.26+)
        socket_options:
        - description: "Inject 1% packet loss"
          level: 0  # SOL_SOCKET
          name: 20  # SO_DROP_PACKETS (Linux 5.12+ 内核支持)
          int_value: 10000  # 万分之一，约 0.01% (内核级丢包，性能最优)
          state: STATE_PREBIND
        # 应用层故障注入 (延迟/乱序) 需配合 WASM 扩展实现
  clusters:
  - name: media_server_cluster
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: media_server_cluster
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: media-server-headless.meeting.svc.cluster.local
                port_value: 50000

# peerauthentication-strict.yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT  # 全网格强制 mTLS，禁止明文
---
# 针对外部遗留系统的宽例外 (最小化范围)
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: legacy-gateway-exception
  namespace: meeting-prod
spec:
  selector:
    matchLabels:
      app: legacy-sip-gateway
  mtls:
    mode: PERMISSIVE  # 仅允许该工作负载接受明文
  portLevelMtls:
    5060:  # SIP 信令端口
      mode: DISABLE

# authorization-meeting.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: meeting-room-access-control
  namespace: meeting-prod
spec:
  selector:
    matchLabels:
      app: media-server
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["spiffe://meeting.prod/ns/meeting-prod/sa/signaling-service"] # 仅信令服务可调度媒体
    - source:
        namespaces: ["meeting-prod"]  # 同命名空间内服务互访
    to:
    - operation:
        methods: ["INVITE", "JOIN", "LEAVE"]  # 自定义 HTTP Method 映射信令动作
        paths: ["/api/v1/rooms/*"]
    when:
    - key: request.auth.claims[tenant_id]  # JWT Claim 租户隔离
      values: ["request.headers[x-tenant-id]"] # 必须与 Header 一致，防止越权
    - key: request.auth.claims[role]
      values: ["host", "cohost", "attendee"] # 角色校验
    - key: source.labels[security.istio.io/tlsMode]
      values: ["istio"] # 强制 mTLS 来源

# sidecar-resource-profile.yaml (通过 Sidecar Injection ConfigMap 或 Pod Annotation 注入)
resources:
  requests:
    cpu: "100m"      # 空闲基线
    memory: "64Mi"
  limits:
    cpu: "800m"      # 压测 P99 CPU 使用量 * 1.5 倍冗余
    memory: "256Mi"  # 压测 P99 RSS * 1.3 倍
# 关键环境变量调优
env:
- name: CONCURRENCY   # Envoy 工作线程数，建议 = CPU Limit 核数 (向下取整)
  value: "0"          # 0 表示自动检测 CPU 核数 (受 Cgroup 限制)
- name: ENVOY_CPU_LIMIT # 显式声明 CPU 限制，供 Envoy 内部调度器使用
  value: "800000"     # 单位：微核 (800m = 800,000)
- name: BUFFER_LIMIT  # 连接缓冲区限制，防止大流量冲击 OOM
  value: "32768"      # 32KB per connection

# destinationrule-tuning.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: signaling-tuning
spec:
  host: signaling.meeting.svc.cluster.local
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 50000          # 单 Sidecar 最大下游连接数
        tcpKeepalive:
          time: 7200s                  # 2小时保活，防止 NAT/防火墙切断长连
          interval: 75s
        # 关键：启用 SO_REUSEPORT (需内核 3.9+)，多线程分发连接，解决单线程瓶颈
      http:
        h2UpgradePolicy: UPGRADE
        http2MaxRequests: 10000        # 单连接最大流数
        http2MaxFrames: 10000000       # 单连接最大帧数
        maxRequestsPerConnection: 0    # 0=无限制，长连复用
        idleTimeout: 3600s             # 空闲连接保留 1 小时
    # 协议检测优化：禁用不必要的协议自动识别，减少首包延迟
    tls:
      mode: ISTIO_MUTUAL
      # 启用 TLS 1.3 早期数据 (0-RTT) 需谨慎评估重放风险，视频会议信令通常不建议开启

# sidecar-scope.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: signaling-sidecar-scope
  namespace: meeting-prod
spec:
  workloadSelector:
    labels:
      app: signaling-service
  egress:
  - hosts:
    - "./*"                    # 当前命名空间所有服务
    - "istio-system/*"         # 系统服务 (DNS, Pilot)
    - "monitoring/prometheus"  # 监控采集
    - "logging/loki"           # 日志采集
  ingress:
  - port:
      number: 8080
      protocol: HTTP
    defaultEndpoint: 127.0.0.1

gitops-mesh/
├── base/                    # 通用基础配置 (集群无关)
│   ├── crds/                # CRD 定义 (WasPlugin, Telemetry 等)
│   ├── policies/            # 通用安全策略 (默认拒绝, mTLS STRICT)
│   ├── telemetry/           # 统一观测配置
│   └── kustomization.yaml
├── overlays/
│   ├── prod-cn-hangzhou/    # 杭州生产环境覆盖
│   │   ├── kustomization.yaml
│   │   ├── replica-count.yaml
│   │   ├── locality-lb.yaml
│   │   └── wasm-plugins/    # 仅该 Region 启用的插件
│   ├── prod-cn-shanghai/    # 上海生产环境覆盖
│   └── staging/             # 预发环境 (故障注入常态化开启)
├── apps/                    # 业务应用专属网格配置 (由业务团队维护 PR)
│   ├── signaling/
│   │   ├── virtualservice.yaml
│   │   ├── destinationrule.yaml
│   │   └── authorizationpolicy.yaml
│   └── media-gateway/
└── tools/
    ├── validate.sh          # 本地校验脚本 (istioctl analyze, kubeconform)
    └── test/                # 网格配置单元测试 (OPA Rego 策略测试)

graph TD
    A[开发提交 PR 修改 apps/signaling/virtualservice.yaml] --> B{CI Pipeline}
    B --> C[语法校验: kubeconform + yamllint]
    C --> D[语义校验: istioctl analyze -f <changed_files> --all-namespaces]
    D --> E[单元测试: OPA Rego 测试路由规则/授权策略逻辑]
    E --> F[集成测试: Kind 集群部署 Canary 版本 + 流量镜像验证]
    F --> G[Code Review: 架构师/SRE 双人审核]
    G --> H[合并主干 -> ArgoCD 自动同步]
    H --> I[金丝雀发布: 先同步 Staging -> 观测 30min -> 同步 Prod Region A -> Region B]
    I --> J[自动化回滚触发器: 关键指标异常 (错误率>1%/P99延迟>2s) -> ArgoCD Rollback]

# test/rego/virtualservice_test.rego
package istio.test

import future.keywords.in

# 测试：信令服务镜像流量必须携带 x-shadow-request 头
test_mirror_has_shadow_header {
    vs := input.virtualservices["signaling-service"]
    mirror := vs.spec.http[_].mirror
    mirror.destination.host == "signaling-canary.meeting.svc.cluster.local"
    # 断言：Lua/WASM 插件已注入该 Header (通过 EnvoyFilter 验证)
    input.envoyfilters[_].config_patches[_].value.lua_script contains "x-shadow-request"
}

# 测试：故障注入仅对 x-chaos-test=enabled 生效
test_fault_injection_guarded {
    vs := input.virtualservices["signaling-fault-injection"]
    match := vs.spec.http[_].match[_]
    match.headers["x-chaos-test"].exact == "enabled"
    vs.spec.http[_].fault != null
}

# chaos-network-delay.yaml (ChaosMesh)
apiVersion: chaos-mesh.org/v1alpha1
kind: NetworkChaos
metadata:
  name: signaling-cross-zone-delay
  namespace: meeting-prod
spec:
  action: delay
  mode: one  # 随机选一个 Pod 注入
  selector:
    namespaces:
      - meeting-prod
    labelSelectors:
      app: signaling-service
      topology.kubernetes.io/zone: cn-hangzhou-a  # 仅注入某 AZ
  delay:
    latency: "200ms"
    correlation: "25"      # 25% 相关性
    jitter: "50ms"         # 抖动
  duration: "300s"         # 持续 5 分钟
  scheduler:
    cron: "@every 1h"      # 定时演练 (可选)