{"id":32766,"date":"2019-10-31T21:48:48","date_gmt":"2019-10-31T18:48:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1\/"},"modified":"2019-10-31T21:48:48","modified_gmt":"2019-10-31T18:48:48","slug":"kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","title":{"rendered":"Jak spustit Istio pomoc\u00ed Kubernetes v produkci. \u010c\u00e1st 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Co to je Istio<\/a><\/noindex>? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u043e\u0445\u043e\u0434\u044b \u0438\u0437 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0415\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0434\u0430\u0432\u0430\u0442\u044c policy \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043f\u043e\u0445\u043e\u0434\u043e\u0432 \u043c\u0435\u0436\u0434\u0443 \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438. \u041d\u0430\u043a\u043e\u043d\u0435\u0446, \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0432\u0441\u044e \u043a\u0430\u0440\u0442\u0443 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438 \u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u043c\u0435\u0442\u0440\u0438\u043a \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.<\/p>\n

O mechanismu fungov\u00e1n\u00ed si m\u016f\u017eete p\u0159e\u010d\u00edst na ofici\u00e1ln\u00ed dokumentaci<\/a><\/noindex>. Istio je opravdu siln\u00fd n\u00e1stroj, kter\u00fd \u0159e\u0161\u00ed mnoho \u00fakol\u016f a probl\u00e9m\u016f. V tomto \u010dl\u00e1nku bych cht\u011bl odpov\u011bd\u011bt na hlavn\u00ed ot\u00e1zky, kter\u00e9 obvykle vyvst\u00e1vaj\u00ed na za\u010d\u00e1tku pr\u00e1ce s Istio. Pom\u016f\u017ee v\u00e1m to rychleji se s n\u00edm sezn\u00e1mit.<\/p>\n

\"Jak
\n<\/a><\/noindex><\/p>\n

Princip pr\u00e1ce<\/h3>\n

\nIstio se skl\u00e1d\u00e1 ze dvou hlavn\u00edch z\u00f3n \u2014 control plane a data plane. Control plane obsahuje hlavn\u00ed komponenty, kter\u00e9 zaji\u0161\u0165uj\u00ed spr\u00e1vnou funk\u010dnost ostatn\u00edch. V aktu\u00e1ln\u00ed verzi (1.0) m\u00e1 control plane t\u0159i hlavn\u00ed komponenty: Pilot, Mixer a Citadel. Citadel nebudeme zmi\u0148ovat, slou\u017e\u00ed pro generaci certifik\u00e1t\u016f k zaji\u0161t\u011bn\u00ed fungov\u00e1n\u00ed vz\u00e1jemn\u00e9ho TLS mezi slu\u017ebami. Poj\u010fme se pod\u00edvat podrobn\u011bji na strukturu a \u00fa\u010del Pilot a Mixer.<\/p>\n

\"Jak
\n
\nPilot je hlavn\u00ed kontroln\u00ed komponenta, kter\u00e1 \u0161\u00ed\u0159\u00ed v\u0161echny informace o tom, co m\u00e1me v clusteru \u2013 slu\u017eby, jejich endpointy a pravidla routov\u00e1n\u00ed (nap\u0159\u00edklad pravidla pro Canary deployment nebo pravidla circuit breaker).<\/p>\n

Mixer je voliteln\u00e1 komponenta control plane, kter\u00e1 poskytuje mo\u017enosti sb\u011bru metrik, log\u016f a jak\u00fdchkoli informac\u00ed o s\u00ed\u0165ov\u00e9 interakci. Tak\u00e9 sleduje dodr\u017eov\u00e1n\u00ed pravidel Policy a dodr\u017eov\u00e1n\u00ed rate limit\u016f.<\/p>\n

Data plane je realizov\u00e1no pomoc\u00ed sidecar kontajner\u016f-proxy. V\u00fdchoz\u00ed konfigurac\u00ed je v\u00fdkonn\u00fd proxy server envoy<\/a><\/noindex>. M\u016f\u017ee b\u00fdt nahrazen jinou implementac\u00ed, nap\u0159\u00edklad nginx (nginmesh).<\/p>\n

Aby Istio fungovalo zcela transparentn\u011b pro aplikace, existuje syst\u00e9m automatick\u00e9ho injekce. Posledn\u00ed implementace je vhodn\u00e1 pro verze Kubernetes 1.9+ (mutational admission webhook). Pro verze Kubernetes 1.7 a 1.8 existuje mo\u017enost pou\u017e\u00edt Initializer.<\/p>\n

Sidecar kontejnery se spojuj\u00ed s Pilotem prost\u0159ednictv\u00edm protokolu GRPC, kter\u00fd umo\u017e\u0148uje optimalizaci modelu pushov\u00e1n\u00ed zm\u011bn, kter\u00e9 se v clusterech odehr\u00e1vaj\u00ed. GRPC se za\u010dalo pou\u017e\u00edvat v Envoy od verze 1.6, v Istio se pou\u017e\u00edv\u00e1 od verze 0.8 a p\u0159edstavuje pilot-agent \u2014 ob\u00e1lku v golangu nad envoy, kter\u00e1 konfiguruje parametry spu\u0161t\u011bn\u00ed.<\/p>\n

Pilot a Mixer jsou zcela stateless komponenty, v\u0161echna data uchov\u00e1vaj\u00ed v pam\u011bti. Konfigurace pro n\u011b je zad\u00e1v\u00e1na ve form\u011b Kubernetes Custom Resources, kter\u00e9 se ukl\u00e1daj\u00ed do etcd.
\nIstio-agent z\u00edsk\u00e1v\u00e1 adresu Pilota a otev\u00edr\u00e1 GRPC stream k n\u011bmu. <\/p>\n

Jak jsem ji\u017e uvedl, Istio realizuje ve\u0161kerou funk\u010dnost zcela transparentn\u011b pro aplikace. Poj\u010fme se pod\u00edvat, jak. Algoritmus je n\u00e1sleduj\u00edc\u00ed:<\/p>\n

    \n
  1. Deployujeme novou verzi slu\u017eby.<\/li>\n
  2. V z\u00e1vislosti na p\u0159\u00edstupu k injektov\u00e1n\u00ed kontejneru sidecar jsou b\u011bhem aplikace konfigurace p\u0159id\u00e1ny kontejner istio-init a kontejner istio-agent (envoy), nebo mohou b\u00fdt ji\u017e ru\u010dn\u011b vlo\u017eeny do popisu entity Pod v Kubernetes.<\/li>\n
  3. Kontejner istio-init p\u0159edstavuje skript, kter\u00fd aplikuje pravidla iptables pro pod. Existuj\u00ed dv\u011b mo\u017enosti pro nastaven\u00ed obalov\u00e1n\u00ed provozu do kontejneru istio-agent: pou\u017e\u00edt pravidla p\u0159esm\u011brov\u00e1n\u00ed iptables, nebo TPROXY<\/a><\/noindex>. K okam\u017eiku psan\u00ed \u010dl\u00e1nku je ve v\u00fdchoz\u00edm nastaven\u00ed pou\u017e\u00edv\u00e1n p\u0159\u00edstup s pravidly p\u0159esm\u011brov\u00e1n\u00ed. V istio-init je mo\u017en\u00e9 nastavit, jak\u00fd konkr\u00e9tn\u00ed provoz m\u00e1 b\u00fdt odchyt\u00e1v\u00e1n a sm\u011brov\u00e1n do istio-agent. Nap\u0159\u00edklad, aby bylo mo\u017en\u00e9 odchytit cel\u00fd p\u0159\u00edchoz\u00ed a odchoz\u00ed provoz, je pot\u0159eba nastavit parametry -i<\/code> a -b<\/code> na hodnotu *<\/code>. M\u016f\u017eete tak\u00e9 specifikovat konkr\u00e9tn\u00ed porty, kter\u00e9 by m\u011bly b\u00fdt odchyt\u00e1v\u00e1ny. Pokud nechcete odchyt\u00e1vat ur\u010ditou pods\u00ed\u0165, m\u016f\u017eete ji uv\u00e9st pomoc\u00ed p\u0159\u00edznaku -x<\/code>.<\/li>\n
  4. Po vykon\u00e1n\u00ed init kontejner\u016f se spou\u0161t\u00ed hlavn\u00ed kontejnery, v\u010detn\u011b pilot-agent (envoy). Ten se p\u0159ipojuje k ji\u017e nasazen\u00e9mu Pilotovi p\u0159es GRPC a z\u00edsk\u00e1v\u00e1 informace o v\u0161ech existuj\u00edc\u00edch slu\u017eb\u00e1ch a pravidlech sm\u011brov\u00e1n\u00ed v clusterech. Na z\u00e1klad\u011b t\u011bchto \u00fadaj\u016f konfiguruje clustery a zapisuje do nich p\u0159\u00edmo endpointy na\u0161ich aplikac\u00ed v Kubernetes clusteru. Je tak\u00e9 d\u016fle\u017eit\u00e9 poznamenat, \u017ee envoy dynamicky nastavuje listenery (p\u00e1ry IP, port), kter\u00e9 za\u010dne naslouchat. Proto, kdy\u017e po\u017eadavky vstupuj\u00ed do podu, jsou p\u0159esm\u011brov\u00e1ny pomoc\u00ed pravidel p\u0159esm\u011brov\u00e1n\u00ed iptables do sidecaru, envoy je ji\u017e \u00fasp\u011b\u0161n\u011b schopen zpracov\u00e1vat tato spojen\u00ed a ch\u00e1pat, kam je t\u0159eba d\u00e1le sm\u011brovat provoz. Tak\u00e9 v t\u00e9to f\u00e1zi doch\u00e1z\u00ed k odesl\u00e1n\u00ed informac\u00ed do Mixera, kter\u00fd probereme pozd\u011bji, a k odesl\u00e1n\u00ed tracing span\u016f.<\/li>\n<\/ol>\n

    \nNakonec z\u00edsk\u00e1me celou s\u00ed\u0165 proxy server\u016f envoy, kter\u00e9 m\u016f\u017eeme konfigurovat z jednoho m\u00edsta (Pilot). V\u0161echny p\u0159\u00edchoz\u00ed a odchoz\u00ed po\u017eadavky proch\u00e1zej\u00ed p\u0159es envoy. P\u0159itom je odchyt\u00e1v\u00e1n pouze TCP provoz. To znamen\u00e1, \u017ee Kubernetes service IP je resolvov\u00e1na pomoc\u00ed kube-dns p\u0159es UDP bez zm\u011bny. Pot\u00e9, co dojde k resolvov\u00e1n\u00ed, je proveden odchyt odchoz\u00edho po\u017eadavku a zpracov\u00e1v\u00e1 ho envoy, kter\u00fd ji\u017e rozhoduje, na kter\u00fd endpoint m\u00e1 po\u017eadavek odeslat (nebo neodeslat, v p\u0159\u00edpad\u011b p\u0159\u00edstupov\u00fdch politik nebo aktivace algoritmu circuit breaker).<\/p>\n

    S Pilotem jsme se sezn\u00e1mili, nyn\u00ed je pot\u0159eba pochopit, jak Mixer funguje a pro\u010d je pot\u0159eba. Ofici\u00e1ln\u00ed dokumentaci k n\u011bmu si m\u016f\u017eete p\u0159e\u010d\u00edst. tady<\/a><\/noindex>.<\/p>\n

    Mixer v sou\u010dasn\u00e9 podob\u011b p\u0159edstavuje dva komponenty: istio-telemetry a istio-policy (do verze 0.8 to byl jeden komponent istio-mixer). Oba p\u0159edstavuj\u00ed mixer, p\u0159i\u010dem\u017e ka\u017ed\u00fd z nich se zodpov\u00edd\u00e1 za svou \u00falohu. Istio telemetry p\u0159ij\u00edm\u00e1 p\u0159es GRPC od sidecar kontejner\u016f Report informace o tom, kdo kam jde a s jak\u00fdmi parametry. Istio-policy p\u0159ij\u00edm\u00e1 Check dotazy pro ov\u011b\u0159en\u00ed spln\u011bn\u00ed pravidel Policy. Kontroly Policy se samoz\u0159ejm\u011b neprov\u00e1d\u011bj\u00ed na ka\u017ed\u00fd dotaz, ale ukl\u00e1daj\u00ed se na klientovi (v sidecar) na ur\u010ditou dobu. Report kontroly se odes\u00edlaj\u00ed v d\u00e1vk\u00e1ch. Jak nastavit a jak\u00e9 konkr\u00e9tn\u00ed parametry je t\u0159eba pos\u00edlat, pod\u00edv\u00e1me se pozd\u011bji. <\/p>\n

    Mixer je navr\u017een jako vysoce dostupn\u00e1 komponenta, kter\u00e1 zaji\u0161tuje nep\u0159etr\u017eitou pr\u00e1ci p\u0159i sb\u011bru a zpracov\u00e1n\u00ed telemetry dat. Syst\u00e9m tak funguje jako v\u00edcestup\u0148ov\u00fd buffer. Nejprve se data ukl\u00e1daj\u00ed na stran\u011b sidecar kontejner\u016f, pot\u00e9 na stran\u011b mixer a pot\u00e9 se odes\u00edlaj\u00ed do tzv. mixer backend\u016f. Pokud n\u011bjak\u00e1 komponenta syst\u00e9mu sel\u017ee, buffer se zv\u011bt\u0161uje a po obnoven\u00ed syst\u00e9mu se vypr\u00e1zdn\u00ed. Mixer backendy p\u0159edstavuj\u00ed koncov\u00e9 body pro odes\u00edl\u00e1n\u00ed dat o telemetrii: statsd, newrelic atd. Lze napsat vlastn\u00ed backend, co\u017e je pom\u011brn\u011b jednoduch\u00e9, a my se pod\u00edv\u00e1me, jak na to.<\/p>\n

    \"Jak
    \n
    \nPokud shrneme, sch\u00e9ma pr\u00e1ce s istio-telemetry je n\u00e1sleduj\u00edc\u00ed.<\/p>\n

      \n
    1. Slu\u017eba 1 pos\u00edl\u00e1 dotaz do slu\u017eby 2.<\/li>\n
    2. P\u0159i opu\u0161t\u011bn\u00ed slu\u017eby 1 je dotaz zabalen do jeho vlastn\u00edho sidecaru.<\/li>\n
    3. Sidecar envoy sleduje, jak dotaz proch\u00e1z\u00ed do slu\u017eby 2, a p\u0159ipravuje pot\u0159ebn\u00e9 informace.<\/li>\n
    4. Pot\u00e9 je odes\u00edl\u00e1 do istio-telemetry pomoc\u00ed Report po\u017eadavku.<\/li>\n
    5. Istio-telemetry ur\u010duje, zda je t\u0159eba tento Report odeslat do backend\u016f, do kter\u00fdch a jak\u00e1 data je t\u0159eba pos\u00edlat.<\/li>\n
    6. Istio-telemetry odes\u00edl\u00e1 Report data do backendu, pokud je to nutn\u00e9.<\/li>\n<\/ol>\n

      \nNyn\u00ed se pod\u00edvejme, jak nasadit syst\u00e9m Istio, slo\u017een\u00fd pouze z hlavn\u00edch komponent (Pilot a sidecar envoy).<\/p>\n

      Nejprve se pod\u00edv\u00e1me na hlavn\u00ed konfiguraci (mesh), kterou Pilot \u010dte:<\/p>\n

      apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: istio\n  namespace: istio-system\n  labels:\n    app: istio\n    service: istio\ndata:\n  mesh: |-\n\n    # prozat\u00edm nezap\u00edn\u00e1me odes\u00edl\u00e1n\u00ed tracing informac\u00ed (pilot nastav\u00ed envoye tak, \u017ee odes\u00edl\u00e1n\u00ed nebude prob\u00edhat)\n    enableTracing: false\n\n    # prozat\u00edm neuv\u00e1d\u00edme mixer endpointy, aby sidecar kontejnery nepos\u00edlaly informace tam\n    #mixerCheckServer: istio-policy.istio-system:15004\n    #mixerReportServer: istio-telemetry.istio-system:15004\n\n    # nastavujeme \u010dasov\u00fd interval, s kter\u00fdm bude envoy op\u011btovn\u011b dotazovat Pilota (to je pro starou verzi envoy proxy)\n    rdsRefreshDelay: 5s\n\n    # v\u00fdchoz\u00ed konfigurace pro envoy sidecar\n    defaultConfig:\n      # analogicky jako rdsRefreshDelay\n      discoveryRefreshDelay: 5s\n\n      # ponech\u00e1v\u00e1me podle defaultu (cesta k konfiguraci a bin\u00e1rn\u00edmu souboru envoy)\n      configPath: \"\/etc\/istio\/proxy\"\n      binaryPath: \"\/usr\/local\/bin\/envoy\"\n\n      # v\u00fdchoz\u00ed n\u00e1zev spu\u0161t\u011bn\u00e9ho sidecar kontejneru (pou\u017e\u00edv\u00e1 se nap\u0159\u00edklad v n\u00e1zvech slu\u017eeb p\u0159i odes\u00edl\u00e1n\u00ed tracing span\u016f)\n      serviceCluster: istio-proxy\n\n      # \u010das, kter\u00fd bude envoy \u010dekat p\u0159ed t\u00edm, ne\u017e n\u00e1siln\u011b ukon\u010d\u00ed v\u0161echna nav\u00e1zan\u00e1 spojen\u00ed\n      drainDuration: 45s\n      parentShutdownDuration: 1m0s\n\n      # podle defaultu se pou\u017e\u00edvaj\u00ed pravidla REDIRECT iptables. M\u016f\u017eete zm\u011bnit na TPROXY.\n      #interceptionMode: REDIRECT\n\n      # Port, na kter\u00e9m bude spu\u0161t\u011bna administr\u00e1torsk\u00e1 panel pro ka\u017ed\u00fd sidecar kontejner (envoy)\n      proxyAdminPort: 15000\n\n      # adresa, na kterou budou odes\u00edl\u00e1ny trace podle zipkin protokolu (na za\u010d\u00e1tku jsme odes\u00edl\u00e1n\u00ed vypnuli, tak\u017ee toto pole nyn\u00ed nebude pou\u017e\u00edv\u00e1no)\n      zipkinAddress: tracing-collector.tracing:9411\n\n      # statsd adresa pro odes\u00edl\u00e1n\u00ed metrik envoy kontejner\u016f (vyp\u00edn\u00e1me)\n      # statsdUdpAddress: aggregator:8126\n\n      # vyp\u00edn\u00e1me podporu mo\u017enosti Mutual TLS\n      controlPlaneAuthPolicy: NONE\n\n      # adresa, na kter\u00e9 bude poslouchat istio-pilot, aby mohl informovat v\u0161echny sidecar kontejnery o objevov\u00e1n\u00ed slu\u017eeb\n      discoveryAddress: istio-pilot.istio-system:15007\n<\/code><\/pre>\n
      \nV\u0161echny hlavn\u00ed komponenty \u0159\u00edd\u00edc\u00edho prostoru (control plane) um\u00edst\u00edme do namespace istio-system v Kubernetes.<\/p>\n
      Minim\u00e1ln\u011b pot\u0159ebujeme nasadit pouze Pilota. K tomu vyu\u017eijeme takovou konfiguraci.<\/a><\/noindex><\/p>\n
      A nastav\u00edme ru\u010dn\u011b injecting sidecar kontejneru.<\/p>\n
      Init container:<\/p>\n
      initContainers:\n - name: istio-init\n   args:\n   - -p\n   - \"15001\"\n   - -u\n   - \"1337\"\n   - -m\n   - REDIRECT\n   - -i\n   - '*'\n   - -b\n   - '*'\n   - -d\n   - \"\"\n   image: istio\/proxy_init:1.0.0\n   imagePullPolicy: IfNotPresent\n   resources:\n     limits:\n       memory: 128Mi\n   securityContext:\n     capabilities:\n       add:\n       - NET_ADMIN\n<\/code><\/pre>\n
      \nA sidecar:<\/p>\n
             n\u00e1zev: istio-proxy\n       args:\n         - \"bash\"\n         - \"-c\"\n         - |\n           exec \/usr\/local\/bin\/pilot-agent proxy sidecar \n           --configPath \n           \/etc\/istio\/proxy \n           --binaryPath \n           \/usr\/local\/bin\/envoy \n           --serviceCluster \n           service-name \n           --drainDuration \n           45s \n           --parentShutdownDuration \n           1m0s \n           --discoveryAddress \n           istio-pilot.istio-system:15007 \n           --discoveryRefreshDelay \n           1s \n           --connectTimeout \n           10s \n           --proxyAdminPort \n           \"15000\" \n           --controlPlaneAuthPolicy \n           NONE\n         env:\n         - name: POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: POD_NAMESPACE\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.namespace\n         - name: INSTANCE_IP\n           valueFrom:\n             fieldRef:\n               fieldPath: status.podIP\n         - name: ISTIO_META_POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: ISTIO_META_INTERCEPTION_MODE\n           value: REDIRECT\n         image: istio\/proxyv2:1.0.0\n         imagePullPolicy: IfNotPresent\n         resources:\n           requests:\n             cpu: 100m\n             memory: 128Mi\n           limits:\n             memory: 2048Mi\n         securityContext:\n           privileged: false\n           readOnlyRootFilesystem: true\n           runAsUser: 1337\n         volumeMounts:\n         - mountPath: \/etc\/istio\/proxy\n           name: istio-envoy\n<\/code><\/pre>\n
      \nAby se v\u0161e \u00fasp\u011b\u0161n\u011b spustilo, je nutn\u00e9 vytvo\u0159it ServiceAccount, ClusterRole, ClusterRoleBinding a CRD pro Pilot, jejich\u017e popisy lze nal\u00e9zt. tady<\/a><\/noindex>. <\/p>\n
      V d\u016fsledku toho by slu\u017eba, do kter\u00e9 injikujeme sidecar s envoy, m\u011bla \u00fasp\u011b\u0161n\u011b b\u011b\u017eet, z\u00edskat v\u0161echny informace o objevech z pilota a zpracov\u00e1vat po\u017eadavky.<\/p>\n
      Je d\u016fle\u017eit\u00e9 pochopit, \u017ee v\u0161echny komponenty control plane jsou stateless aplikace a mohou b\u00fdt bez probl\u00e9m\u016f horizont\u00e1ln\u011b \u0161k\u00e1lov\u00e1ny. V\u0161echna data jsou ulo\u017eena v etcd ve form\u011b vlastn\u00edch popis\u016f zdroj\u016f Kubernetes.<\/p>\n
      Istio tak\u00e9 (zat\u00edm experiment\u00e1ln\u011b) umo\u017e\u0148uje spu\u0161t\u011bn\u00ed mimo cluster a mo\u017enost sledovat a sd\u00edlet objevov\u00e1n\u00ed slu\u017eeb mezi n\u011bkolika Kubernetes clustery. Podrobnosti si m\u016f\u017eete p\u0159e\u010d\u00edst. tady<\/a><\/noindex>.<\/p>\n
      P\u0159i v\u00edcero clustrov\u00e9 instalaci je t\u0159eba vz\u00edt v \u00favahu n\u00e1sleduj\u00edc\u00ed omezen\u00ed:<\/p>\n
        \n
      1. Pod CIDR a Service CIDR mus\u00ed b\u00fdt jedine\u010dn\u00e9 pro v\u0161echny clustery a nesm\u00ed se p\u0159ekr\u00fdvat.<\/li>\n
      2. V\u0161echny Pod CIDR mus\u00ed b\u00fdt p\u0159\u00edstupn\u00e9 z jak\u00fdchkoliv Pod CIDR mezi clustery.<\/li>\n
      3. V\u0161echny servery API Kubernetes mus\u00ed b\u00fdt navz\u00e1jem p\u0159\u00edstupn\u00e9.<\/li>\n<\/ol>\n
        \nTo jsou z\u00e1kladn\u00ed informace, kter\u00e9 v\u00e1m pomohou za\u010d\u00edt pracovat s Istio. Existuje v\u0161ak je\u0161t\u011b \u0159ada probl\u00e9m\u016f, nap\u0159\u00edklad detaily sm\u011brov\u00e1n\u00ed extern\u00edho provozu (ven z clusteru), p\u0159\u00edstupy k lad\u011bn\u00ed sidecar, profilov\u00e1n\u00ed, nastaven\u00ed mixeru a psan\u00ed vlastn\u00edho backendu mixeru, nastaven\u00ed mechanismu sledov\u00e1n\u00ed a jeho pr\u00e1ce pomoc\u00ed envoy.
        \nTo v\u0161e prozkoum\u00e1me v n\u00e1sleduj\u00edc\u00edch publikac\u00edch. Ptej se na sv\u00e9 ot\u00e1zky, pokus\u00edm se je osv\u011btlit.
        \n
        Zdroj:         habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
        \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Jak spustit Istio pomoc\u00ed Kubernetes v produkci. \u010c\u00e1st 1 | ProHoster","description":"Co je to Istio? To je takzvan\u00e1 Service mesh, technologie, kter\u00e1 p\u0159id\u00e1v\u00e1 \u00farove\u0148 abstrakce nad s\u00edt\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Istio, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Kubernetes \u0432 production. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:description":"\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:48:48+00:00","article:modified_time":"2019-10-31T18:48:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 12:27:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:53:24","updated":"2026-01-21 12:27:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/32766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=32766"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/32766\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/24545"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=32766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=32766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=32766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}