{"id":34366,"date":"2019-10-31T21:57:56","date_gmt":"2019-10-31T18:57:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/benchmark-potrebleniya-tsp-dlya-istio-i-linkerd\/"},"modified":"2019-10-31T21:57:56","modified_gmt":"2019-10-31T18:57:56","slug":"benchmark-potrebleniya-tsp-dlya-istio-i-linkerd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/benchmark-potrebleniya-tsp-dlya-istio-i-linkerd","title":{"rendered":"Benchmark spot\u0159eby CPU pro Istio a Linkerd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Benchmark<\/p>\n

<\/p>\n

\u00davod<\/h2>\n

<\/p>\n

ITGLOBAL.COM Shopify<\/a><\/noindex> zab\u00fdv\u00e1me se nasazen\u00edm Istio jako service mesh. V z\u00e1sad\u011b je v\u0161echno v po\u0159\u00e1dku, krom\u011b jedn\u00e9 v\u011bci: je to drah\u00e9<\/strong>.<\/p>\n

<\/p>\n

V publikovan\u00fdch benchmark\u016f<\/a><\/noindex> pro Istio se uv\u00e1d\u00ed:<\/p>\n

<\/p>\n

S Istio 1.1 proxy spot\u0159ebov\u00e1v\u00e1 p\u0159ibli\u017en\u011b 0,6 vCPU (virtu\u00e1ln\u00edho j\u00e1dra) na 1000 po\u017eadavk\u016f za sekundu.<\/p><\/blockquote>\n

Pro prvn\u00ed region v service mesh (po 2 proxy na ka\u017ed\u00e9 stran\u011b spojen\u00ed) budeme m\u00edt 1200 jader pouze pro proxy, na z\u00e1klad\u011b jednoho milionu po\u017eadavk\u016f za sekundu. Podle kalkula\u010dky n\u00e1klad\u016f od Google to vych\u00e1z\u00ed p\u0159ibli\u017en\u011b 40 $\/m\u011bs\u00edc\/j\u00e1dro pro konfiguraci n1-standard-64<\/code>, co\u017e znamen\u00e1, \u017ee tento region n\u00e1s bude st\u00e1t v\u00edce ne\u017e 50 tis\u00edc dolar\u016f m\u011bs\u00ed\u010dn\u011b za 1 milion po\u017eadavk\u016f za sekundu.<\/p>\n

<\/p>\n

Ivan Sim (Ivan Sim<\/a><\/noindex>) viditeln\u011b porovnal<\/a><\/noindex> latence service mesh v minul\u00e9m roce a sl\u00edbil tot\u00e9\u017e pro pam\u011b\u0165 a procesor, ale nedopadlo to:<\/p>\n

<\/p>\n

Zd\u00e1 se, \u017ee values-istio-test.yaml v\u00fdrazn\u011b zvy\u0161uje po\u017eadavky na procesor. Pokud jsem v\u0161e spr\u00e1vn\u011b spo\u010d\u00edtal, pot\u0159ebuji p\u0159ibli\u017en\u011b 24 procesorov\u00fdch jader pro ovl\u00e1dac\u00ed panel a 0,5 CPU pro ka\u017ed\u00fd proxy. Tolik nem\u00e1m. Znovu provedu testy, kdy\u017e mi p\u0159id\u011bl\u00ed v\u00edce zdroj\u016f.<\/p><\/blockquote>\n

Cht\u011bl jsem se s\u00e1m p\u0159esv\u011bd\u010dit, jak jsou ukazatele Istio podobn\u00e9 jin\u00e9mu open-source service mesh: Linkerd<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Instalace service mesh<\/h3>\n

<\/p>\n

Nejd\u0159\u00edve jsem nainstaloval v clusteru SuperGloo<\/a><\/noindex>:<\/p>\n

<\/p>\n

$ supergloo init\ninstalace supergloo verze 0.3.12\npou\u017eit\u00ed uri grafu https:\/\/storage.googleapis.com\/supergloo-helm\/charts\/supergloo-0.3.12.tgz\nconfigmap\/sidecar-injection-resources vytvo\u0159en\nserviceaccount\/supergloo vytvo\u0159en\nserviceaccount\/discovery vytvo\u0159en\nserviceaccount\/mesh-discovery vytvo\u0159en\nclusterrole.rbac.authorization.k8s.io\/discovery vytvo\u0159en\nclusterrole.rbac.authorization.k8s.io\/mesh-discovery vytvo\u0159en\nclusterrolebinding.rbac.authorization.k8s.io\/supergloo-role-binding vytvo\u0159en\nclusterrolebinding.rbac.authorization.k8s.io\/discovery-role-binding vytvo\u0159en\nclusterrolebinding.rbac.authorization.k8s.io\/mesh-discovery-role-binding vytvo\u0159en\ndeployment.extensions\/supergloo vytvo\u0159en\ndeployment.extensions\/discovery vytvo\u0159en\ndeployment.extensions\/mesh-discovery vytvo\u0159en\ninstalace \u00fasp\u011b\u0161n\u00e1!<\/code><\/pre>\n
<\/p>\n
Pou\u017eil jsem SuperGloo, proto\u017ee v\u00fdrazn\u011b zjednodu\u0161uje po\u010d\u00e1te\u010dn\u00ed nasazen\u00ed service mesh. T\u00e9m\u011b\u0159 jsem nemusel nic d\u011blat. V produkci SuperGloo nepou\u017e\u00edv\u00e1me, ale pro takov\u00fd \u00fakol je ide\u00e1ln\u00ed. Musel jsem pou\u017e\u00edt doslova p\u00e1r p\u0159\u00edkaz\u016f na ka\u017edou service mesh. Pou\u017eil jsem dva clustry pro izolaci \u2014 jeden pro Istio a jeden pro Linkerd.<\/p>\n
<\/p>\n
Experiment byl proveden na Google Kubernetes Engine. Pou\u017eil jsem Kubernetes 1.12.7-gke.7<\/code> a pool uzl\u016f n1-standard-4<\/code> s automatick\u00fdm \u0161k\u00e1lov\u00e1n\u00edm uzl\u016f (minim\u00e1ln\u011b 4, maxim\u00e1ln\u011b 16).<\/p>\n
<\/p>\n
Pot\u00e9 jsem nainstaloval ob\u011b service mesh z p\u0159\u00edkazov\u00e9 \u0159\u00e1dky.<\/p>\n
<\/p>\n
Nejd\u0159\u00edve Linkerd:<\/p>\n
<\/p>\n
$ supergloo install linkerd --name linkerd\n+---------+--------------+---------+---------------------------+\n| INSTALL |     TYPE     | STATUS  |          DETAILS          |\n+---------+--------------+---------+---------------------------+\n| linkerd | Linkerd Mesh | Pending | enabled: true             |\n|         |              |         | version: stable-2.3.0     |\n|         |              |         | namespace: linkerd        |\n|         |              |         | mtls enabled: true        |\n|         |              |         | auto inject enabled: true |\n+---------+--------------+---------+---------------------------+<\/code><\/pre>\n
<\/p>\n
Pot\u00e9 Istio:<\/p>\n
<\/p>\n
$ supergloo install istio --name istio --installation-namespace istio-system --mtls=true --auto-inject=true\n+---------+------------+---------+---------------------------+\n| INSTALL |    TYPE    | STATUS  |          DETAILS          |\n+---------+------------+---------+---------------------------+\n| istio   | Istio Mesh | Pending | enabled: true             |\n|         |            |         | version: 1.0.6            |\n|         |            |         | namespace: istio-system   |\n|         |            |         | mtls enabled: true        |\n|         |            |         | auto inject enabled: true |\n|         |            |         | grafana enabled: true     |\n|         |            |         | prometheus enabled: true  |\n|         |            |         | jaeger enabled: true      |\n+---------+------------+---------+---------------------------+<\/code><\/pre>\n
<\/p>\n
Crash-loop trval n\u011bkolik minut, a pak se panely ovl\u00e1d\u00e1n\u00ed stabilizovaly.<\/p>\n
<\/p>\n
(Pozn\u00e1mka. SuperGloo zat\u00edm podporuje pouze Istio 1.0.x. Experimentoval jsem s Istio 1.1.3, ale \u017e\u00e1dn\u00e9 podstatn\u00e9 rozd\u00edly jsem nezaznamenal.)<\/em><\/p>\n
<\/p>\n
Nastaven\u00ed automatick\u00e9ho zav\u00e1d\u011bn\u00ed Istio<\/h3>\n
<\/p>\n
Aby Istio nainstalovalo sidecar Envoy, pou\u017e\u00edv\u00e1me sidecar-injektor \u2014 MutatingAdmissionWebhook<\/code>. O tom nebudeme hovo\u0159it v tomto \u010dl\u00e1nku. \u0158eknu jen, \u017ee je to \u0159adi\u010d, kter\u00fd sleduje p\u0159\u00edstup v\u0161ech nov\u00fdch pod\u016f a dynamicky p\u0159id\u00e1v\u00e1 sidecar a initContainer, kter\u00fd se star\u00e1 o \u00fakoly iptables<\/code>.<\/p>\n
<\/p>\n
Ve spole\u010dnosti Shopify jsme napsali vlastn\u00ed \u0159adi\u010d opr\u00e1vn\u011bn\u00ed pro zav\u00e1d\u011bn\u00ed sidecar\u016f, ale v t\u00e9to anal\u00fdze jsem pou\u017eil \u0159adi\u010d dod\u00e1van\u00fd s Istio. V\u00fdchoz\u00ed \u0159adi\u010d zav\u00e1d\u00ed sidecary, kdy\u017e je v prostoru n\u00e1zv\u016f \u0161t\u00edtek istio-injection: enabled<\/code>:<\/p>\n
<\/p>\n
$ kubectl label namespace irs-client-dev istio-injection=enabled\nnamespace\/irs-client-dev labeled\n\n$ kubectl label namespace irs-server-dev istio-injection=enabled\nnamespace\/irs-server-dev labeled<\/code><\/pre>\n
<\/p>\n
Nastaven\u00ed automatick\u00e9ho zav\u00e1d\u011bn\u00ed Linkerd<\/h3>\n
<\/p>\n
Abychom nastavili zav\u00e1d\u011bn\u00ed sidecar\u016f Linkerd, pou\u017e\u00edv\u00e1me anotace (p\u0159idal jsem je ru\u010dn\u011b p\u0159es kubectl edit<\/code>):<\/p>\n
<\/p>\n
metadata:\n  annotations:\n    linkerd.io\/inject: enabled<\/code><\/pre>\n
<\/p>\n
$ k edit ns irs-server-dev \nnamespace\/irs-server-dev edited\n\n$ k get ns irs-server-dev -o yaml\napiVersion: v1\nkind: Namespace\nmetadata:\n  annotations:\n    linkerd.io\/inject: enabled\n  name: irs-server-dev\nspec:\n  finalizers:\n  - kubernetes\nstatus:\n  phase: Active<\/code><\/pre>\n
<\/p>\n
Simul\u00e1tor odolnosti Istio<\/h3>\n
<\/p>\n
Vytvo\u0159ili jsme simul\u00e1tor odolnosti Istio, abychom experimentovali s unik\u00e1tn\u00edm provozem pro Shopify. Pot\u0159ebovali jsme n\u00e1stroj, kter\u00fd by vytvo\u0159il libovolnou topologii p\u0159edstavuj\u00edc\u00ed ur\u010ditou \u010d\u00e1st grafu na\u0161ich slu\u017eeb s dynamick\u00fdm nastaven\u00edm pro modelov\u00e1n\u00ed konkr\u00e9tn\u00edch pracovn\u00edch z\u00e1t\u011b\u017e\u00ed.<\/p>\n
<\/p>\n
Infrastruktura Shopify \u010del\u00ed vysok\u00e9 z\u00e1t\u011b\u017ei b\u011bhem flash v\u00fdprodej\u016f. P\u0159itom Shopify doporu\u010duje prod\u00e1vaj\u00edc\u00edm \u010dast\u011bji organizovat takov\u00e9 v\u00fdprodeje<\/a><\/noindex>. Velc\u00ed klienti n\u011bkdy varuj\u00ed p\u0159ed pl\u00e1novan\u00fdm flash v\u00fdprodejem. Jin\u00ed je po\u0159\u00e1daj\u00ed ne\u010dekan\u011b kdykoli b\u011bhem dne a noci.<\/p>\n
<\/p>\n
Cht\u011bli jsme, aby n\u00e1\u0161 simul\u00e1tor odolnosti modeloval pracovn\u00ed postupy, kter\u00e9 odpov\u00eddaj\u00ed topologi\u00edm a pracovn\u00edm z\u00e1t\u011b\u017e\u00edm vedouc\u00edm k p\u0159et\u00ed\u017een\u00ed infrastruktury Shopify v minulosti. Hlavn\u00edm c\u00edlem pou\u017e\u00edv\u00e1n\u00ed service mesh je zajistit spolehlivost a odolnost na \u00farovni s\u00edt\u011b, a je pro n\u00e1s d\u016fle\u017eit\u00e9, aby si service mesh efektivn\u011b poradila se z\u00e1t\u011b\u017eemi, kter\u00e9 d\u0159\u00edve naru\u0161ovaly provoz slu\u017eeb.<\/p>\n
<\/p>\n
Z\u00e1kladem simul\u00e1toru odolnosti je pracovn\u00ed uzel, kter\u00fd funguje jako uzel service mesh. Pracovn\u00ed uzel lze nastavit staticky p\u0159i spu\u0161t\u011bn\u00ed nebo dynamicky prost\u0159ednictv\u00edm REST API. Pou\u017e\u00edv\u00e1me dynamick\u00e9 nastaven\u00ed pracovn\u00edch uzl\u016f k vytv\u00e1\u0159en\u00ed pracovn\u00edch postup\u016f ve form\u011b regresn\u00edch test\u016f.<\/p>\n
<\/p>\n
Zde je p\u0159\u00edklad takov\u00e9ho procesu:<\/p>\n
<\/p>\n