{"id":37030,"date":"2019-10-31T22:15:23","date_gmt":"2019-10-31T19:15:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/servisnaya-set-ploskost-dannyh-i-ploskosti-upravleniya-service-mesh-data-plane-vs-control-plane\/"},"modified":"2019-10-31T22:15:23","modified_gmt":"2019-10-31T19:15:23","slug":"servisnaya-set-ploskost-dannyh-i-ploskosti-upravleniya-service-mesh-data-plane-vs-control-plane","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/servisnaya-set-ploskost-dannyh-i-ploskosti-upravleniya-service-mesh-data-plane-vs-control-plane","title":{"rendered":"Slu\u017eebn\u00ed s\u00ed\u0165, \u201eDatov\u00e1 rovina\u201c a \u201eRovina \u0159\u00edzen\u00ed\u201c (Service mesh data plane vs. control plane)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Ahoj, Habr! P\u0159edstavuji v\u00e1m p\u0159eklad \u010dl\u00e1nku <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.envoyproxy.io\/service-mesh-data-plane-vs-control-plane-2774e720f7fc\">\u201eData plane a control plane v s\u00edti slu\u017eeb\u201c<\/a><\/noindex> autora <b>Matt Klein<\/b>.<\/p>\n<p><img decoding=\"async\" alt=\"Slu\u017eebn\u00ed s\u00ed\u0165, \u201eDatov\u00e1 rovina\u201c a \u201eRovina \u0159\u00edzen\u00ed\u201c (Service mesh data plane vs. control plane)\" src=\"\/wp-content\/uploads\/2019\/08\/487456689eb832f9e3845966cb0d85d4.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTentokr\u00e1t jsem \u201echt\u011bl a p\u0159elo\u017eil\u201c popis obou komponent s\u00edt\u00ed slu\u017eeb, data plane a control plane. Tento popis mi p\u0159i\u0161el nejjasn\u011bj\u0161\u00ed a nejzaj\u00edmav\u011bj\u0161\u00ed, a co je nejd\u016fle\u017eit\u011bj\u0161\u00ed, vede k pochopen\u00ed \u201ePot\u0159ebujeme to v\u016fbec?\u201c.<\/p>\n<p>Vzhledem k tomu, \u017ee my\u0161lenka \u201eS\u00edt\u011b slu\u017eeb (Service mesh)\u201c se st\u00e1v\u00e1 st\u00e1le popul\u00e1rn\u011bj\u0161\u00ed v posledn\u00edch dvou letech (p\u016fvodn\u00ed \u010dl\u00e1nek z 10. \u0159\u00edjna 2017), a po\u010det \u00fa\u010dastn\u00edk\u016f v tomto prostoru vzrostl, vid\u011bl jsem \u00fam\u011brn\u00fd r\u016fst zmatku v technick\u00e9 komunit\u011b ohledn\u011b toho, jak porovn\u00e1vat a proti sob\u011b postavit r\u016fzn\u00e1 \u0159e\u0161en\u00ed.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nNejl\u00e9pe tuto situaci popsat n\u00e1sleduj\u00edc\u00edmi s\u00e9riemi tweet\u016f, kter\u00e9 jsem napsal v \u010dervenci:<\/p>\n<blockquote><p>Zmatek v s\u00edti slu\u017eeb (service mesh) \u010d. 1: Linkerd ~ = Nginx ~ = Haproxy ~ = Envoy. \u017d\u00e1dn\u00fd z nich nen\u00ed rovn\u00fd Istio. Istio je n\u011bco zcela jin\u00e9ho. 1 \/<\/p><\/blockquote>\n<blockquote><p>Prvn\u00ed jsou prost\u011b datov\u00e9 plochy (data planes). Samy o sob\u011b nic ned\u011blaj\u00ed. Mus\u00ed b\u00fdt konfigurov\u00e1ny na n\u011bco v\u011bt\u0161\u00edho. 2 \/<\/p><\/blockquote>\n<blockquote><p>Istio je p\u0159\u00edkladem \u0159\u00eddic\u00ed plochy (control plane), kter\u00e1 spojuje jednotliv\u00e9 \u010d\u00e1sti dohromady. To je jin\u00e1 vrstva. \/konec<\/p><\/blockquote>\n<p>V p\u0159edchoz\u00edch tweetech je zm\u00edn\u011bno n\u011bkolik r\u016fzn\u00fdch projekt\u016f (Linkerd, NGINX, HAProxy, Envoy a Istio), ale co je d\u016fle\u017eit\u011bj\u0161\u00ed, uv\u00e1d\u011bj\u00ed se spole\u010dn\u00e9 pojmy datov\u00e9 plochy (data plane), s\u00edt\u011b slu\u017eeb (service mesh) a \u0159\u00eddic\u00ed plochy (control plane). V tomto p\u0159\u00edsp\u011bvku ud\u011bl\u00e1m krok zp\u011bt a \u0159eknu, co mysl\u00edm pod pojmy \u201edatov\u00e1 plocha (data plane)\u201c a \u201e\u0159\u00eddic\u00ed plocha (control plane)\u201c na velmi vysok\u00e9 \u00farovni, a pot\u00e9 vysv\u011btl\u00edm, jak se tyto term\u00edny vztahuj\u00ed k projekt\u016fm zm\u00edn\u011bn\u00fdm v tweetech.<\/p>\n<h1>Co je to s\u00ed\u0165 slu\u017eeb (What is a service mesh, really)?<\/h1>\n<p>\n<img decoding=\"async\" alt=\"Slu\u017eebn\u00ed s\u00ed\u0165, \u201eDatov\u00e1 rovina\u201c a \u201eRovina \u0159\u00edzen\u00ed\u201c (Service mesh data plane vs. control plane)\" src=\"\/wp-content\/uploads\/2019\/08\/63c195aa9bcb7080f6924cecbff0fbc1.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr\u00e1zek 1: P\u0159ehled s\u00edt\u011b slu\u017eeb (Service mesh overview)<\/b><\/p>\n<p><b>Obr. 1<\/b> ilustruje koncept s\u00edt\u011b slu\u017eeb (service mesh) na nejz\u00e1kladn\u011bj\u0161\u00ed \u00farovni. Existuj\u00ed \u010dty\u0159i servisn\u00ed clustry (A-D). Ka\u017ed\u00fd instance slu\u017eby je propojena s lok\u00e1ln\u00edm proxy serverem. Ve\u0161ker\u00fd s\u00ed\u0165ov\u00fd provoz (HTTP, REST, gRPC, Redis atd.) z jednotliv\u00e9 instance aplikace je sm\u011brov\u00e1n p\u0159es lok\u00e1ln\u00ed proxy server do odpov\u00eddaj\u00edc\u00edch vn\u011bj\u0161\u00edch servisn\u00edch cluster\u016f. T\u00edm p\u00e1dem instance aplikace nev\u00ed o cel\u00e9 s\u00edti a zn\u00e1 pouze sv\u016fj lok\u00e1ln\u00ed proxy. Ve skute\u010dnosti je s\u00ed\u0165 distribuovan\u00e9ho syst\u00e9mu odstran\u011bna od slu\u017eby.<\/p>\n<h1>Datov\u00e1 plocha (Data plane)<\/h1>\n<p>\nV s\u00edti slu\u017eeb (service mesh) vykon\u00e1v\u00e1 lok\u00e1ln\u00ed proxy server pro aplikaci n\u00e1sleduj\u00edc\u00ed \u00fakoly:<\/p>\n<ul>\n<li> <b>Objevov\u00e1n\u00ed slu\u017eeb (Service discovery)<\/b>. Jak\u00e9 slu\u017eby\/aplikace jsou dostupn\u00e9 pro va\u0161i aplikaci?<\/li>\n<li><b>Kontrola zdravotn\u00edho stavu (Health checking)<\/b>. Jsou instance slu\u017eeb vr\u00e1cen\u00e9 objeven\u00edm slu\u017eeb (service discovery) funk\u010dn\u00ed a p\u0159ipraven\u00e9 p\u0159ij\u00edmat s\u00ed\u0165ov\u00fd provoz? To m\u016f\u017ee zahrnovat jak aktivn\u00ed (nap\u0159. kontrolu odpov\u011bdi \/ healthcheck), tak pasivn\u00ed (nap\u0159. pou\u017eit\u00ed 3 po sob\u011b jdouc\u00edch 5xx chyb jako indikace nezdrav\u00e9ho stavu slu\u017eby) kontroly zdravotn\u00edho stavu. <\/li>\n<li><b>Sm\u011brov\u00e1n\u00ed (Routing)<\/b>Kdy\u017e obdr\u017e\u00edte od REST slu\u017eby po\u017eadavek na &#171;\\\/foo&#187;, do kter\u00e9ho servisn\u00edho clusteru by m\u011bl b\u00fdt po\u017eadavek odesl\u00e1n? <\/li>\n<li> <b>Zat\u00ed\u017een\u00ed vyrovn\u00e1v\u00e1n\u00ed (Load balancing)<\/b>. Pot\u00e9, co byl b\u011bhem sm\u011brov\u00e1n\u00ed vybr\u00e1n cluster slu\u017eby, do kter\u00e9 instance slu\u017eby by m\u011bl b\u00fdt dotaz odesl\u00e1n? S jak\u00fdm \u010dasov\u00fdm limitem? S jak\u00fdmi nastaven\u00edmi p\u0159eru\u0161en\u00ed obvodu (circuit breaking)? Pokud dotaz sel\u017ee, m\u011bl by b\u00fdt zopakov\u00e1n?<\/li>\n<li> <b>Autentizace a autorizace (Authentication and authorization)<\/b>. M\u016f\u017ee b\u00fdt volaj\u00edc\u00ed slu\u017eba pro p\u0159\u00edchoz\u00ed dotazy kryptograficky identifikov\u00e1na\/autorizov\u00e1na pomoc\u00ed mTLS nebo jin\u00e9ho mechanismu? Pokud je identifikov\u00e1na\/autorizov\u00e1na, je j\u00ed povoleno volat po\u017eadovanou operaci (endpoint) ve slu\u017eb\u011b nebo by m\u011bla b\u00fdt vr\u00e1cena neautentizovan\u00e1 odpov\u011b\u010f?<\/li>\n<li> <b>Pozorovatelnost (Observability)<\/b>. Pro ka\u017ed\u00fd dotaz by m\u011bly b\u00fdt generov\u00e1ny podrobn\u00e9 statistiky, protokoly a \u00fadaje o distribuovan\u00e9m sledov\u00e1n\u00ed, aby oper\u00e1to\u0159i mohli porozum\u011bt distribuovan\u00e9mu toku provozu a probl\u00e9m\u016fm s lad\u011bn\u00edm, jak se objevuj\u00ed.<\/li>\n<\/ul>\n<p>\nZa v\u0161echny p\u0159edchoz\u00ed body v servisn\u00ed s\u00edti (service mesh) odpov\u00edd\u00e1 datov\u00e1 plocha (data plane). V podstat\u011b, lok\u00e1ln\u00ed proxy pro slu\u017ebu (sidecar) a je datovou plochou (data plane). Jin\u00fdmi slovy, datov\u00e1 plocha (data plane) odpov\u00edd\u00e1 za podm\u00ednkovou transkripci, p\u0159enos a pozorov\u00e1n\u00ed ka\u017ed\u00e9ho s\u00ed\u0165ov\u00e9ho bal\u00ed\u010dku, kter\u00fd je odes\u00edl\u00e1n do slu\u017eby nebo z n\u00ed.<\/p>\n<h1>\u0158\u00edd\u00edc\u00ed plocha (The control plane)<\/h1>\n<p>\nS\u00ed\u0165ov\u00e1 abstrakce, kterou zaji\u0161\u0165uje lok\u00e1ln\u00ed proxy v datov\u00e9 rovin\u011b (data plane), je kouzeln\u00e1 (?). Jak ale proxy server skute\u010dn\u011b zjist\u00ed trasu &#171;\\\/foo&#187; k slu\u017eb\u011b B? Jak mohou b\u00fdt data o objevov\u00e1n\u00ed slu\u017eeb (service discovery), kter\u00e1 jsou napl\u0148ov\u00e1na proxy po\u017eadavky, vyu\u017eita? Jak jsou nastaveny parametry vyva\u017eov\u00e1n\u00ed z\u00e1t\u011b\u017ee, \u010dasov\u00e9ho limitu (timeout), p\u0159eru\u0161en\u00ed okruhu (circuit breaking), atd.? Jak se prov\u00e1d\u00ed nasazen\u00ed aplikace pomoc\u00ed modr\u00e9\/zelen\u00e9 (blue\/green) metody nebo metody postupn\u00e9ho p\u0159esm\u011brov\u00e1n\u00ed provozu? Kdo nastavuje parametry obecn\u00e9 autentizace a autorizace?<\/p>\n<p>V\u0161echny v\u00fd\u0161e uveden\u00e9 body spadaj\u00ed pod kontroln\u00ed rovinu (control plane) servisn\u00ed s\u00edt\u011b (service mesh). <i>Kontroln\u00ed rovina (control plane) bere soubor izolovan\u00fdch proxy-<a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/server\/\"   title=\"servery\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"1348\">servery<\/a> bez stavu a p\u0159etv\u00e1\u0159\u00ed je na distribuovan\u00fd syst\u00e9m<\/i>.<\/p>\n<p>Mysl\u00edm si, \u017ee d\u016fvod, pro\u010d mnoho technik\u016f pova\u017euje odd\u011blen\u00e9 pojmy datov\u00e9 roviny (data plane) a kontroln\u00ed roviny (control plane) za matouc\u00ed, je v tom, \u017ee v\u011bt\u0161ina lid\u00ed je obezn\u00e1mena s datovou rovinou, zat\u00edmco kontroln\u00ed rovina je pro n\u011b ciz\u00ed\/nezn\u00e1m\u00e1. Dlouho pracujeme s fyzick\u00fdmi s\u00ed\u0165ov\u00fdmi routery a p\u0159ep\u00edna\u010di. Ch\u00e1peme, \u017ee pakety\/po\u017eadavky musej\u00ed j\u00edt z bodu A do bodu B a co m\u016f\u017eeme pou\u017e\u00edt k tomu hardwaru a softwaru. Nov\u00e1 generace softwarov\u00fdch proxy je prost\u011b m\u00f3dn\u00ed verz\u00ed n\u00e1stroj\u016f, kter\u00e9 jsme pou\u017e\u00edvali ji\u017e dlouhou dobu.<\/p>\n<p><img decoding=\"async\" alt=\"Slu\u017eebn\u00ed s\u00ed\u0165, \u201eDatov\u00e1 rovina\u201c a \u201eRovina \u0159\u00edzen\u00ed\u201c (Service mesh data plane vs. control plane)\" src=\"\/wp-content\/uploads\/2019\/08\/1b512802777cbf1853c5c4f7f2f81d99.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr\u00e1zek 2: Lidsk\u00e1 kontroln\u00ed rovina (Human control plane)<\/b><\/p>\n<p>P\u0159esto jsme ji\u017e dlouho pou\u017e\u00edvali kontroln\u00ed roviny (control plane), i kdy\u017e v\u011bt\u0161ina s\u00ed\u0165ov\u00fdch oper\u00e1tor\u016f nemus\u00ed tuto \u010d\u00e1st syst\u00e9mu spojovat s \u017e\u00e1dnou technologickou komponentou. D\u016fvod je jednoduch\u00fd:<br \/>\n<b>V\u011bt\u0161ina dnes pou\u017e\u00edvan\u00fdch kontroln\u00edch rovin (control plane) jsou\u2026 my<\/b>.<\/p>\n<p>Na <b>na obr\u00e1zku 2<\/b> Zobrazeno je to, co naz\u00fdv\u00e1m \u201eLidsk\u00e1 \u0159\u00eddic\u00ed rovina (Human control plane)\u201c. V tomto typu nasazen\u00ed, kter\u00e9 se st\u00e1le velmi \u010dasto vyskytuje, \u010dlov\u011bk-oper\u00e1tor, pravd\u011bpodobn\u011b podr\u00e1\u017ed\u011bn\u00fd, vytv\u00e1\u0159\u00ed statick\u00e9 konfigurace - potenci\u00e1ln\u011b pomoc\u00ed skript\u016f - a nasazuje je pomoc\u00ed n\u011bjak\u00e9ho speci\u00e1ln\u00edho procesu na v\u0161echny proxy servery. Pot\u00e9 proxy za\u010dnou pou\u017e\u00edvat tuto konfiguraci a p\u0159istupuj\u00ed k zpracov\u00e1n\u00ed datov\u00e9 roviny (data plane) pomoc\u00ed aktualizovan\u00fdch nastaven\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Slu\u017eebn\u00ed s\u00ed\u0165, \u201eDatov\u00e1 rovina\u201c a \u201eRovina \u0159\u00edzen\u00ed\u201c (Service mesh data plane vs. control plane)\" src=\"\/wp-content\/uploads\/2019\/08\/6b12429611475e0fc4dfa9f980704e16.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr\u00e1zek 3: Roz\u0161\u00ed\u0159en\u00e1 \u0159\u00eddic\u00ed rovina servisn\u00ed s\u00edt\u011b (Advanced service mesh control plane)<\/b><\/p>\n<p>Na <b>na obr\u00e1zku 3<\/b> je zobrazena \u201eroz\u0161\u00ed\u0159en\u00e1\u201c \u0159\u00eddic\u00ed rovina (control plane) servisn\u00ed s\u00edt\u011b (service mesh). Skl\u00e1d\u00e1 se z n\u00e1sleduj\u00edc\u00edch \u010d\u00e1st\u00ed:<\/p>\n<ul>\n<li> <b>\u010clov\u011bk (The human)<\/b>: Po\u0159\u00e1d je tu \u010dlov\u011bk (doufejme, m\u00e9n\u011b roz\u010dilen\u00fd), kter\u00fd p\u0159ij\u00edm\u00e1 rozhodnut\u00ed na vysok\u00e9 \u00farovni t\u00fdkaj\u00edc\u00ed se cel\u00e9ho syst\u00e9mu.<\/li>\n<li><b>U\u017eivatelsk\u00e9 rozhran\u00ed \u0159\u00eddic\u00ed roviny (Control plane UI)<\/b>: \u010clov\u011bk interaguje s n\u011bjak\u00fdm typem u\u017eivatelsk\u00e9ho rozhran\u00ed pro \u0159\u00edzen\u00ed syst\u00e9mu. M\u016f\u017ee to b\u00fdt webov\u00fd port\u00e1l, p\u0159\u00edkazov\u00e1 \u0159\u00e1dka (CLI) nebo n\u011bjak\u00e9 jin\u00e9 rozhran\u00ed. Pomoc\u00ed u\u017eivatelsk\u00e9ho rozhran\u00ed m\u00e1 oper\u00e1tor p\u0159\u00edstup k takov\u00fdm glob\u00e1ln\u00edm parametr\u016fm konfigurace syst\u00e9mu, jako jsou:\n<ul>\n<li>Spr\u00e1va nasazen\u00ed, blue\/green a\/nebo postupn\u00e9 p\u0159esm\u011brov\u00e1n\u00ed provozu <\/li>\n<li>Parametry autentizace a autorizace <\/li>\n<li>Specifikace sm\u011brovac\u00ed tabulky, nap\u0159\u00edklad, kdy\u017e aplikace A \u017e\u00e1d\u00e1 o informace o &#171;\\\/foo&#187;, co se d\u011bje <\/li>\n<li>Nastaven\u00ed vyrovn\u00e1va\u010de z\u00e1t\u011b\u017ee, nap\u0159\u00edklad \u010dasov\u00e9 limity (timeouts), opakov\u00e1n\u00ed pokus\u016f (retries), parametry p\u0159eru\u0161en\u00ed \u0159et\u011bzce (circuit breaking) atd. <\/li>\n<\/ul>\n<\/li>\n<li> <b>Pl\u00e1nova\u010d pracovn\u00edho zat\u00ed\u017een\u00ed (Workload scheduler)<\/b>: Slu\u017eby jsou spu\u0161t\u011bny v infrastruktu\u0159e prost\u0159ednictv\u00edm syst\u00e9mu pl\u00e1nov\u00e1n\u00ed\/orkestrace ur\u010dit\u00e9ho typu, nap\u0159\u00edklad Kubernetes nebo Nomad. Pl\u00e1nova\u010d je zodpov\u011bdn\u00fd za spu\u0161t\u011bn\u00ed slu\u017eby spolu s jej\u00edm lok\u00e1ln\u00edm proxy serverem.<\/li>\n<li> <b>Objevov\u00e1n\u00ed slu\u017eeb (Service discovery)<\/b>. Kdy\u017e pl\u00e1nova\u010d spou\u0161t\u00ed a zastavuje instance slu\u017eby, informuje o stavu dostupnosti syst\u00e9mu objevov\u00e1n\u00ed slu\u017eeb.<\/li>\n<li> <b>API konfigurace lok\u00e1ln\u00edho proxy serveru (Sidecar proxy configuration APIs) <\/b>: M\u00edstn\u00ed proxy servery dynamicky z\u00edsk\u00e1vaj\u00ed stav z r\u016fzn\u00fdch komponent syst\u00e9mu podle modelu \u201ekone\u010dn\u00e9 shody\u201c (eventually consistent) bez \u00fa\u010dasti oper\u00e1tora. Cel\u00fd syst\u00e9m, skl\u00e1daj\u00edc\u00ed se ze v\u0161ech aktu\u00e1ln\u011b spu\u0161t\u011bn\u00fdch instanc\u00ed slu\u017eeb a m\u00edstn\u00edch proxy server\u016f, se nakonec spojuje do jedn\u00e9 ekosyst\u00e9my. API univerz\u00e1ln\u00ed datov\u00e9 roviny (data plane) v Envoy je jedn\u00edm z p\u0159\u00edklad\u016f toho, jak to funguje v praxi.<\/li>\n<\/ul>\n<p>\nV z\u00e1sad\u011b je c\u00edlem \u0159\u00edd\u00edc\u00ed roviny (control plane) stanovit pravidla, kter\u00e1 budou nakonec p\u0159ijata datovou rovinou (data plane). Pokro\u010dilej\u0161\u00ed \u0159\u00edd\u00edc\u00ed roviny (control plane) odstran\u00ed od oper\u00e1tora v\u00edce detail\u016f n\u011bkter\u00fdch syst\u00e9m\u016f a budou vy\u017eadovat m\u00e9n\u011b ru\u010dn\u00edho \u0159\u00edzen\u00ed, pokud budou fungovat spr\u00e1vn\u011b!..<\/p>\n<h1>Datov\u00e1 rovina a \u0159\u00edd\u00edc\u00ed rovina. Souhrn (Data plane vs. control plane summary)<\/h1>\n<p><\/p>\n<ul>\n<li> <b>Datov\u00e1 rovina servisn\u00ed s\u00edt\u011b (Service mesh data plane)<\/b>: zasahuje do ka\u017ed\u00e9ho paketu \/ po\u017eadavku v syst\u00e9mu. Odpov\u00edd\u00e1 za objevov\u00e1n\u00ed aplikac\u00ed \/ slu\u017eeb, kontrolu dostupnosti, sm\u011brov\u00e1n\u00ed, vyva\u017eov\u00e1n\u00ed z\u00e1t\u011b\u017ee, autentizaci \/ autorizaci a pozorovatelnost.<\/li>\n<li> <b>\u0158\u00edd\u00edc\u00ed rovina servisn\u00ed s\u00edt\u011b (Service mesh control plane)<\/b>: poskytuje pravidla a konfiguraci pro v\u0161echny funguj\u00edc\u00ed datov\u00e9 roviny v r\u00e1mci servisn\u00ed s\u00edt\u011b. Nezasahuje do \u017e\u00e1dn\u00fdch paket\u016f \/ po\u017eadavk\u016f v syst\u00e9mu. \u0158\u00edd\u00edc\u00ed rovina transformuje v\u0161echny datov\u00e9 roviny na distribuovan\u00fd syst\u00e9m.<\/li>\n<\/ul>\n<p><\/p>\n<h1>Aktu\u00e1ln\u00ed stav projektu (Current project landscape)<\/h1>\n<p>\nPo pochopen\u00ed v\u00fd\u0161e uveden\u00e9ho vysv\u011btlen\u00ed se pod\u00edvejme na aktu\u00e1ln\u00ed stav projektu \u201eservisn\u00ed s\u00edt\u011b (service mesh)\u201c.<\/p>\n<ul>\n<li> <b>Datov\u00e9 roviny (Data planes)<\/b>: Linkerd, NGINX, HAProxy, Envoy, Traefik<\/li>\n<li><b>\u0158\u00edd\u00edc\u00ed roviny (Control planes)<\/b>: Istio, Nelson, SmartStack <\/li>\n<\/ul>\n<p>\nM\u00edsto toho, abych se podrobn\u011b zab\u00fdval ka\u017ed\u00fdm z v\u00fd\u0161e uveden\u00fdch \u0159e\u0161en\u00ed, stru\u010dn\u011b se dotknu n\u011bkolika bod\u016f, kter\u00e9 podle m\u00e9ho n\u00e1zoru vyvol\u00e1vaj\u00ed v\u011bt\u0161inu zmatku v ekosyst\u00e9mu pr\u00e1v\u011b te\u010f.<\/p>\n<p>Na za\u010d\u00e1tku roku 2016 byl Linkerd jedn\u00edm z prvn\u00edch proxy server\u016f datov\u00e9 roviny (data plane) pro servisn\u00ed s\u00ed\u0165 (service mesh) a ud\u011blal fantastickou pr\u00e1ci p\u0159i zvy\u0161ov\u00e1n\u00ed pov\u011bdom\u00ed a pozornosti na model n\u00e1vrhu \u201eservisn\u00ed s\u00ed\u0165\u201c (service mesh). P\u0159ibli\u017en\u011b po 6 m\u011bs\u00edc\u00edch se k Linkerd p\u0159ipojil Envoy (i kdy\u017e pracoval ve Lyftu od konce roku 2015). Linkerd a Envoy jsou dva projekty, kter\u00e9 se nej\u010dast\u011bji zmi\u0148uj\u00ed p\u0159i diskusi o servisn\u00edch s\u00edt\u00edch (service mesh).<\/p>\n<p>Istio bylo ozn\u00e1meno v kv\u011btnu 2017. C\u00edle projektu Istio jsou velmi podobn\u00e9 roz\u0161\u00ed\u0159en\u00e9 \u0159\u00eddic\u00ed rovin\u011b (control plane), kter\u00e1 je zn\u00e1zorn\u011bna na <b>na obr\u00e1zku 3<\/b>. Envoy pro Istio je proxy server \u201eve v\u00fdchoz\u00edm nastaven\u00ed\u201c. T\u00edm p\u00e1dem je Istio \u0159\u00eddic\u00ed rovinou (control plane) a Envoy je datovou rovinou (data plane). V kr\u00e1tk\u00e9m \u010dase Istio vyvolalo mnoho vzru\u0161en\u00ed a jin\u00e9 datov\u00e9 roviny (data plane) za\u010daly integraci jako n\u00e1hradu za Envoy (jak Linkerd, tak NGINX demonstrovaly integraci s Istio). Skute\u010dnost, \u017ee v jedn\u00e9 \u0159\u00eddic\u00ed rovin\u011b (control plane) lze pou\u017e\u00edvat r\u016fzn\u00e9 datov\u00e9 roviny (data plane), znamen\u00e1, \u017ee \u0159\u00eddic\u00ed rovina (control plane) a datov\u00e1 rovina (data plane) nemus\u00ed b\u00fdt nutn\u011b \u00fazce spojeny. Takov\u00e9 API jako univerz\u00e1ln\u00ed API datov\u00e9 roviny (data plane) Envoy m\u016f\u017ee tvo\u0159it most mezi ob\u011bma \u010d\u00e1stmi syst\u00e9mu.<\/p>\n<p>Nelson a SmartStack d\u00e1le pom\u00e1haj\u00ed ilustrovat rozd\u011blen\u00ed \u0159\u00eddic\u00ed roviny (control plane) a datov\u00e9 roviny (data plane). Nelson pou\u017e\u00edv\u00e1 Envoy jako sv\u016fj proxy a vytv\u00e1\u0159\u00ed spolehlivou \u0159\u00eddic\u00ed rovinu (control plane) servisn\u00ed s\u00edt\u011b (service mesh) na z\u00e1klad\u011b z\u00e1sobn\u00edku HashiCorp, tj. Nomad atd. SmartStack se stal pravd\u011bpodobn\u011b prvn\u00edm z nov\u00e9 vlny servisn\u00edch s\u00edt\u00ed (service mesh). SmartStack formuje \u0159\u00eddic\u00ed rovinu (control plane) kolem HAProxy nebo NGINX a demonstruje mo\u017enost odd\u011blen\u00ed \u0159\u00eddic\u00ed roviny (control plane) servisn\u00ed s\u00edt\u011b (service mesh) a datov\u00e9 roviny (data plane).<\/p>\n<p>Mikroslu\u017ebov\u00e1 architektura se s\u00ed\u0165ovou slu\u017ebou (service mesh) z\u00edsk\u00e1v\u00e1 st\u00e1le v\u00edce pozornosti (spr\u00e1vn\u011b!), a st\u00e1le v\u00edce projekt\u016f a dodavatel\u016f za\u010d\u00edn\u00e1 v t\u00e9to oblasti pracovat. V pr\u016fb\u011bhu n\u011bkolika n\u00e1sleduj\u00edc\u00edch let uvid\u00edme mnoho inovac\u00ed jak v datov\u00e9 rovin\u011b (data plane), tak v \u0159\u00edd\u00edc\u00ed rovin\u011b (control plane), a tak\u00e9 dal\u0161\u00ed m\u00edsen\u00ed r\u016fzn\u00fdch komponent. Nakonec by mikroslu\u017ebov\u00e1 architektura m\u011bla b\u00fdt pro oper\u00e1tora transparentn\u011bj\u0161\u00ed a kouzeln\u011bj\u0161\u00ed (? ).<br \/>\nDouf\u00e1m, \u017ee st\u00e1le m\u00e9n\u011b a m\u00e9n\u011b podr\u00e1\u017ed\u011bn\u00e9ho.<\/p>\n<h1>Kl\u00ed\u010dov\u00e9 body (Key takeaways)<\/h1>\n<p><\/p>\n<ul>\n<li> S\u00ed\u0165ov\u00e1 slu\u017eba (service mesh) se skl\u00e1d\u00e1 ze dvou r\u016fzn\u00fdch \u010d\u00e1st\u00ed: datov\u00e9 roviny (data plane) a \u0159\u00edd\u00edc\u00ed roviny (control plane). Oba komponenty jsou povinn\u00e9, a bez nich syst\u00e9m nebude fungovat.<\/li>\n<li>V\u0161ichni zn\u00e1me \u0159\u00edd\u00edc\u00ed rovinu (control plane), a v tuto chv\u00edli m\u016f\u017eete b\u00fdt vy tou \u0159\u00edd\u00edc\u00ed rovinou (control plane)! <\/li>\n<li>V\u0161echny datov\u00e9 roviny (data plane) sout\u011b\u017e\u00ed navz\u00e1jem v funkc\u00edch, v\u00fdkonu, konfigurovatelnosti a roz\u0161i\u0159itelnosti. <\/li>\n<li> V\u0161echny \u0159\u00edd\u00edc\u00ed roviny (control plane) sout\u011b\u017e\u00ed navz\u00e1jem v funkc\u00edch, konfigurovatelnosti, roz\u0161i\u0159itelnosti a pou\u017eitelnosti.<\/li>\n<li>Jedna \u0159\u00edd\u00edc\u00ed rovina (control plane) m\u016f\u017ee obsahovat spr\u00e1vn\u00e9 abstrakce a API, aby bylo mo\u017en\u00e9 pou\u017e\u00edvat v\u00edce datov\u00fdch rovin (data plane). <\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/462699\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440! \u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e \u0432\u0430\u0448\u0435\u043c\u0443 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u0441\u0442\u0430\u0442\u044c\u0438 \u00abService mesh data plane vs control plane\u00bb \u0430\u0432\u0442\u043e\u0440\u0430 Matt Klein. \u0412 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u00ab\u0437\u0430\u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0438 \u043f\u0435\u0440\u0435\u0432\u0435\u043b\u043e\u0441\u044c\u00bb \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0431\u043e\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 service mesh, data plane \u0438 control plane. \u042d\u0442\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043c\u043d\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0441\u0430\u043c\u044b\u043c \u043f\u043e\u043d\u044f\u0442\u043d\u044b\u043c \u0438 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c, \u0430 \u0433\u043b\u0430\u0432\u043d\u043e\u0435 \u043f\u043e\u0434\u0432\u043e\u0434\u044f\u0449\u0438\u043c \u043a \u043f\u043e\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u00ab\u0410 \u043d\u0443\u0436\u043d\u043e \u043b\u0438 \u043e\u043d\u043e \u0432\u043e\u043e\u0431\u0449\u0435?\u00bb. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0438\u0434\u0435\u044f \u00ab\u0421\u0435\u0440\u0432\u0438\u0441\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27757,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37030","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440!\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/servisnaya-set-ploskost-dannyh-i-ploskosti-upravleniya-service-mesh-data-plane-vs-control-plane\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0421\u0435\u0440\u0432\u0438\u0441\u043d\u0430\u044f \u0441\u0435\u0442\u044c, \u00ab\u041f\u043b\u043e\u0441\u043a\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u0438 \u00ab\u041f\u043b\u043e\u0441\u043a\u043e\u0441\u0442\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u00bb (Service mesh data plane vs. control plane) | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440!\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/servisnaya-set-ploskost-dannyh-i-ploskosti-upravleniya-service-mesh-data-plane-vs-control-plane\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:23+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:23+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00ed\u0165ov\u00e1 slu\u017eba, \u201eDatov\u00e1 rovina\u201c a \u201e\u0158\u00edd\u00edc\u00ed roviny\u201c (Service mesh data plane vs. control plane) | ProHoster","description":"Ahoj, Habr!","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/servisnaya-set-ploskost-dannyh-i-ploskosti-upravleniya-service-mesh-data-plane-vs-control-plane","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0435\u0440\u0432\u0438\u0441\u043d\u0430\u044f \u0441\u0435\u0442\u044c, \u00ab\u041f\u043b\u043e\u0441\u043a\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u0438 \u00ab\u041f\u043b\u043e\u0441\u043a\u043e\u0441\u0442\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u00bb (Service mesh data plane vs. control plane) | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442, \u0425\u0430\u0431\u0440!","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/servisnaya-set-ploskost-dannyh-i-ploskosti-upravleniya-service-mesh-data-plane-vs-control-plane","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:23+00:00","article:modified_time":"2019-10-31T19:15:23+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37030","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:07:03","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:34:25","updated":"2026-02-09 17:07:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37030","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=37030"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37030\/revisions"}],"predecessor-version":[{"id":158592,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37030\/revisions\/158592"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/27757"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=37030"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=37030"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=37030"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}