{"id":37636,"date":"2019-10-31T22:18:44","date_gmt":"2019-10-31T19:18:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/sozdayom-kubernetes-platformu-v-pinterest\/"},"modified":"2019-10-31T22:18:44","modified_gmt":"2019-10-31T19:18:44","slug":"sozdayom-kubernetes-platformu-v-pinterest","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sozdayom-kubernetes-platformu-v-pinterest","title":{"rendered":"Vytv\u00e1\u0159\u00edme kubernetes-platformu v Pinterestu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>B\u011bhem sv\u00e9ho fungov\u00e1n\u00ed vytvo\u0159ilo 300 milion\u016f u\u017eivatel\u016f Pinterestu v\u00edce ne\u017e 200 miliard pin\u016f na v\u00edce ne\u017e 4 miliard\u00e1ch n\u00e1st\u011bnek. Aby se postaral o tuto arm\u00e1du u\u017eivatel\u016f a rozs\u00e1hlou datab\u00e1zi obsahu, port\u00e1l vyvinul tis\u00edce slu\u017eeb, po\u010d\u00ednaje mikroslu\u017ebami, kter\u00e9 zvl\u00e1dne n\u011bkolik CPU, a kon\u010de obrovsk\u00fdmi monolity, kter\u00e9 b\u011b\u017e\u00ed na cel\u00e9m parku virtu\u00e1ln\u00edch stroj\u016f. A nyn\u00ed nastal okam\u017eik, kdy se spole\u010dnost zam\u011b\u0159ila na k8s. Co tedy \u201ekostka\u201c zaujala \u201ePinterest\u201c? O tom se dozv\u00edte v na\u0161em p\u0159ekladu \u010derstv\u00e9ho \u010dl\u00e1nku z <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/pinterest-engineering\">blogu Pinterest engineering<\/a><\/noindex>.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Vytv\u00e1\u0159\u00edme kubernetes-platformu v Pinterestu\" src=\"\/wp-content\/uploads\/2019\/08\/71719121d8d0ed8e284b471c3bcb7328.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTak\u017ee stovky milion\u016f u\u017eivatel\u016f a stovky miliard pin\u016f. Abychom se postarali o tuto arm\u00e1du u\u017eivatel\u016f a rozs\u00e1hlou datab\u00e1zi obsahu, vyvinuli jsme tis\u00edce slu\u017eeb, po\u010d\u00ednaje mikroslu\u017ebami, kter\u00e9 zvl\u00e1dne n\u011bkolik CPU, a kon\u010de obrovsk\u00fdmi monolity, kter\u00e9 b\u011b\u017e\u00ed na cel\u00e9m parku virtu\u00e1ln\u00edch stroj\u016f. Krom\u011b toho m\u00e1me r\u016fzn\u00e9 frameworky, kter\u00e9 tak\u00e9 mohou vy\u017eadovat prost\u0159edky CPU, pam\u011bti nebo p\u0159\u00edstup k I\/O operac\u00edm.<\/p>\n<p>P\u0159i podpo\u0159e tohoto zoo n\u00e1stroj\u016f \u010del\u00ed v\u00fdvojov\u00fd t\u00fdm \u0159ad\u011b probl\u00e9m\u016f:<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<ul>\n<li>In\u017een\u00fd\u0159i nemaj\u00ed jednotn\u00fd zp\u016fsob, jak spustit pracovn\u00ed prost\u0159ed\u00ed. Stateless slu\u017eby, Stateful slu\u017eby a projekty ve f\u00e1zi aktivn\u00edho v\u00fdvoje jsou zalo\u017eeny na zcela odli\u0161n\u00fdch technologick\u00fdch steac\u00edch. To vedlo ke vzniku cel\u00e9ho \u0161kol\u00edc\u00edho kurzu pro in\u017een\u00fdry a tak\u00e9 v\u00e1\u017en\u011b zkomplikuje pr\u00e1ci na\u0161eho infrastrukturn\u00edho t\u00fdmu.<\/li>\n<li>V\u00fdvoj\u00e1\u0159i, kte\u0159\u00ed maj\u00ed k dispozici vlastn\u00ed park virtu\u00e1ln\u00edch stroj\u016f, vytv\u00e1\u0159ej\u00ed obrovsk\u00e9 zat\u00ed\u017een\u00ed pro intern\u00ed administr\u00e1tory. V d\u016fsledku toho tak jednoduch\u00e9 operace, jako je aktualizace OS nebo AMI, trvaj\u00ed t\u00fddny a m\u011bs\u00edce. To vede k r\u016fstu z\u00e1t\u011b\u017ee v, na pohled, naprosto b\u011b\u017en\u00fdch situac\u00edch.<\/li>\n<li>Obt\u00ed\u017enosti s vytv\u00e1\u0159en\u00edm glob\u00e1ln\u00edch n\u00e1stroj\u016f pro spr\u00e1vu infrastruktury nad ji\u017e existuj\u00edc\u00edmi \u0159e\u0161en\u00edmi. Situaci komplikuje tak\u00e9 to, \u017ee naj\u00edt vlastn\u00edky virtu\u00e1ln\u00edch stroj\u016f nen\u00ed snadn\u00e9. To znamen\u00e1, \u017ee nev\u00edme, zda m\u016f\u017eeme bezpe\u010dn\u011b uvolnit tyto kapacity pro pr\u00e1ci v jin\u00fdch oblastech na\u0161\u00ed infrastruktury.<\/li>\n<\/ul>\n<p>\nOrkesta\u010dn\u00ed syst\u00e9my kontejner\u016f jsou zp\u016fsob, jak sjednotit spr\u00e1vu pracovn\u00edho zat\u00ed\u017een\u00ed. Otev\u00edraj\u00ed v\u00e1m cestu k urychlen\u00ed v\u00fdvoje a usnad\u0148uj\u00ed spr\u00e1vu infrastruktury, proto\u017ee v\u0161echny zdroje zapojen\u00e9 do projektu jsou spravov\u00e1ny jedn\u00edm centralizovan\u00fdm syst\u00e9mem.<\/p>\n<p><img decoding=\"async\" alt=\"Vytv\u00e1\u0159\u00edme kubernetes-platformu v Pinterestu\" src=\"\/wp-content\/uploads\/2019\/08\/8ce586ab31e593c99310ae2bf2a7bafb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Obr\u00e1zek 1: Priority infrastruktury (spolehlivost, v\u00fdkonnost v\u00fdvoj\u00e1\u0159\u016f a efektivita).<\/i><\/p>\n<p>T\u00fdm Cloud Management Platform ve firm\u011b Pinterest se sezn\u00e1mil s K8s v roce 2017. Do prvn\u00ed poloviny roku 2017 jsme zdokumentovali v\u011bt\u0161inu na\u0161ich v\u00fdrobn\u00edch kapacit, v\u010detn\u011b API a v\u0161ech na\u0161ich <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/server\/\"   title=\"webov\u00fdch server\u016f.\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"1189\">webov\u00fdch server\u016f.<\/a>Pot\u00e9 jsme provedli d\u016fkladn\u00e9 hodnocen\u00ed r\u016fzn\u00fdch syst\u00e9m\u016f pro orkestraci kontejnerov\u00fdch \u0159e\u0161en\u00ed, vytv\u00e1\u0159en\u00ed klastr\u016f a pr\u00e1ci s nimi. Na konci roku 2017 jsme se rozhodli vyu\u017e\u00edt Kubernetes. Byl dostate\u010dn\u011b flexibiln\u00ed a \u0161iroce podporov\u00e1n komunitou v\u00fdvoj\u00e1\u0159\u016f.<\/p>\n<p>V sou\u010dasn\u00e9 dob\u011b jsme vytvo\u0159ili vlastn\u00ed n\u00e1stroje pro po\u010d\u00e1te\u010dn\u00ed na\u010d\u00edt\u00e1n\u00ed klastru na z\u00e1klad\u011b Kops a p\u0159evedli jsme na Kubernetes existuj\u00edc\u00ed komponenty infrastruktury \u2013 jako jsou s\u00ed\u0165, bezpe\u010dnost, metriky, veden\u00ed z\u00e1znam\u016f, spr\u00e1va identity a provoz. Tak\u00e9 jsme implementovali syst\u00e9m modelov\u00e1n\u00ed pracovn\u00edch zat\u00ed\u017een\u00ed pro n\u00e1\u0161 zdroj, jeho\u017e slo\u017eitost je skryta p\u0159ed v\u00fdvoj\u00e1\u0159i. Nyn\u00ed se soust\u0159ed\u00edme na zaji\u0161t\u011bn\u00ed stability klastru, jeho \u0161k\u00e1lov\u00e1n\u00ed a p\u0159ipojen\u00ed nov\u00fdch klient\u016f.<\/p>\n<h4>Kubernetes: cesta Pinterestu<\/h4>\n<p>\nZa\u010d\u00e1tek pr\u00e1ce s Kubernetes na \u00farovni Pinterestu jako platformy, kter\u00e1 bude milov\u00e1na na\u0161imi in\u017een\u00fdry, p\u0159inesl \u0159adu obt\u00ed\u017e\u00ed.<\/p>\n<p>Jako velk\u00e1 spole\u010dnost jsme investovali zna\u010dn\u00e9 prost\u0159edky do infrastrukturn\u00edch n\u00e1stroj\u016f. P\u0159\u00edkladem mohou b\u00fdt bezpe\u010dnostn\u00ed n\u00e1stroje, kter\u00e9 zpracov\u00e1vaj\u00ed certifik\u00e1ty a distribuuj\u00ed kl\u00ed\u010de, komponenty pro \u0159\u00edzen\u00ed provozu, syst\u00e9my pro objevov\u00e1n\u00ed slu\u017eeb, komponenty pro viditelnost a vys\u00edl\u00e1n\u00ed z\u00e1znam\u016f a metrik. To v\u0161e bylo shrom\u00e1\u017ed\u011bno nikoliv n\u00e1hodou: pro\u0161li jsme norm\u00e1ln\u00ed cestou pokus\u016f a omyl\u016f, a proto jsme cht\u011bli integrovat v\u0161echny tyto prvky do nov\u00e9 infrastruktury na Kubernetes, m\u00edsto abychom znovu vynal\u00e9zali star\u00fd bicykl na nov\u00e9 platform\u011b. Tento p\u0159\u00edstup v z\u00e1sad\u011b usnadnil migraci, proto\u017ee ve\u0161ker\u00e1 podpora aplikac\u00ed ji\u017e existovala a nebylo ji t\u0159eba vytv\u00e1\u0159et od nuly.<\/p>\n<p>Na druhou stranu, model\u016f pro p\u0159edpov\u00edd\u00e1n\u00ed z\u00e1t\u011b\u017ee v samotn\u00e9m Kubernetes (nap\u0159\u00edklad nasazen\u00ed, \u00falohy a Daemon sety) nen\u00ed dostatek pro n\u00e1\u0161 projekt. Tyto probl\u00e9my s pou\u017eitelnost\u00ed p\u0159edstavuj\u00ed obrovsk\u00e9 p\u0159ek\u00e1\u017eky na cest\u011b k p\u0159echodu na Kubernetes. Nap\u0159\u00edklad jsme sly\u0161eli, jak si v\u00fdvoj\u00e1\u0159i slu\u017eeb st\u011b\u017euj\u00ed na nedostatek nebo nespr\u00e1vn\u00e9 nastaven\u00ed vstupu. Tak\u00e9 jsme se setkali s nespr\u00e1vn\u00fdm pou\u017eit\u00edm templater\u016f, kdy se vytv\u00e1\u0159elo stovky kopi\u00ed se stejn\u00fdmi specifikacemi a \u00falohami, co\u017e vedlo k hrozn\u00fdm probl\u00e9m\u016fm s lad\u011bn\u00edm.<\/p>\n<p>Bylo tak\u00e9 velmi obt\u00ed\u017en\u00e9 udr\u017eovat r\u016fzn\u00e9 verze ve stejn\u00e9m clusteru. P\u0159edstavte si slo\u017eitost z\u00e1kaznick\u00e9 podpory, kdy\u017e mus\u00edte pracovat najednou s mnoha verzemi jednoho a t\u00e9ho\u017e b\u011bhov\u00e9ho prost\u0159ed\u00ed, se v\u0161emi jejich probl\u00e9my, chybami a aktualizacemi.<\/p>\n<h4>U\u017eivatelsk\u00e9 zdroje a controllery Pinterestu<\/h4>\n<p>\nAbychom na\u0161im in\u017een\u00fdr\u016fm usnadnili proces zav\u00e1d\u011bn\u00ed Kubernetes a zjednodu\u0161ili infrastrukturu a urychlili jej\u00ed chod, vyvinuli jsme na\u0161e vlastn\u00ed definice u\u017eivatelsk\u00fdch zdroj\u016f (CRD).<\/p>\n<p>CRD poskytuj\u00ed n\u00e1sleduj\u00edc\u00ed funk\u010dn\u00ed mo\u017enosti:<\/p>\n<ol>\n<li>Slou\u010den\u00ed r\u016fzn\u00fdch nativn\u00edch zdroj\u016f Kubernetes, aby pracovaly jako jednotn\u00e1 z\u00e1t\u011b\u017e. Nap\u0159\u00edklad zdroj PinterestService zahrnuje nasazen\u00ed, vstupn\u00ed slu\u017ebu a konfigura\u010dn\u00ed mapu. To umo\u017e\u0148uje v\u00fdvoj\u00e1\u0159\u016fm nezab\u00fdvat se nastaven\u00edm DNS.<\/li>\n<li>Zaveden\u00ed pot\u0159ebn\u00e9 podpory aplikac\u00ed. U\u017eivatelsk\u00fd mus\u00ed soust\u0159edit pouze na specifikaci kontejneru podle sv\u00e9 obchodn\u00ed logiky, zat\u00edmco controller CRD zav\u00e1d\u00ed v\u0161echny pot\u0159ebn\u00e9 init kontejnery, prom\u011bnn\u00e9 prost\u0159ed\u00ed a specifikace pod. To zaji\u0161\u0165uje zcela jinou \u00farove\u0148 pohodl\u00ed pro v\u00fdvoj\u00e1\u0159e.<\/li>\n<li>Controllery CRD tak\u00e9 spravuj\u00ed \u017eivotn\u00ed cyklus vlastn\u00edch zdroj\u016f a zvy\u0161uj\u00ed dostupnost lad\u011bn\u00ed. To zahrnuje slad\u011bn\u00ed po\u017eadovan\u00fdch a skute\u010dn\u00fdch specifikac\u00ed, aktualizaci stavu CRD a veden\u00ed log\u016f ud\u00e1lost\u00ed a nejen to. Bez CRD by byli v\u00fdvoj\u00e1\u0159i nuceni spravovat nespo\u010detn\u00fd mno\u017estv\u00ed zdroj\u016f, co\u017e by pouze zvy\u0161ovalo pravd\u011bpodobnost chyby. <\/li>\n<\/ol>\n<p>\nZde je p\u0159\u00edklad PinterestService a vnit\u0159n\u00edho zdroje, kter\u00fd spravuje n\u00e1\u0161 controller:<\/p>\n<p><img decoding=\"async\" alt=\"Vytv\u00e1\u0159\u00edme kubernetes-platformu v Pinterestu\" src=\"\/wp-content\/uploads\/2019\/08\/5f76107d023d18f535447a13d41404fa.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nJak bylo uvedeno v\u00fd\u0161e, pro podporu u\u017eivatelsk\u00e9ho kontejneru je nutn\u00e9 integraci do n\u011bj zahrnout kontejner inicializace a n\u011bkolik dopl\u0148k\u016f pro zaji\u0161t\u011bn\u00ed bezpe\u010dnosti, viditelnosti a zpracov\u00e1n\u00ed s\u00ed\u0165ov\u00e9ho provozu. Krom\u011b toho jsme vytvo\u0159ili \u0161ablony konfigurace map a implementovali podporu PVC \u0161ablon pro d\u00e1vkov\u00e1 zad\u00e1n\u00ed, stejn\u011b jako sledov\u00e1n\u00ed mnoha prom\u011bnn\u00fdch prost\u0159ed\u00ed pro sledov\u00e1n\u00ed identifikace, vyu\u017eit\u00ed prost\u0159edk\u016f a shroma\u017e\u010fov\u00e1n\u00ed \"odpadk\u016f\".<\/p>\n<p>T\u011b\u017eko si p\u0159edstavit, \u017ee by v\u00fdvoj\u00e1\u0159i cht\u011bli tyto konfigura\u010dn\u00ed soubory ps\u00e1t ru\u010dn\u011b bez podpory CRD, ani\u017e bychom zmi\u0148ovali dal\u0161\u00ed \u00fadr\u017ebu a lad\u011bn\u00ed konfigurac\u00ed.<\/p>\n<h4>Workflow nasazen\u00ed aplikac\u00ed<\/h4>\n<p>\n<img decoding=\"async\" alt=\"Vytv\u00e1\u0159\u00edme kubernetes-platformu v Pinterestu\" src=\"\/wp-content\/uploads\/2019\/08\/08c953d5cf32244733cf4193c1b304bc.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa v\u00fd\u0161e uveden\u00e9m obr\u00e1zku je zn\u00e1zorn\u011bno, jak nasadit vlastn\u00ed zdroj Pinterest v Kubernetes clusteru:<\/p>\n<ol>\n<li>V\u00fdvoj\u00e1\u0159i komunikuj\u00ed s na\u0161\u00edm Kubernetes clusterem prost\u0159ednictv\u00edm CLI a u\u017eivatelsk\u00e9ho rozhran\u00ed.<\/li>\n<li>N\u00e1stroje CLI \/ UI extrahuj\u00ed YAML konfigura\u010dn\u00ed soubory pracovn\u00edho procesu a dal\u0161\u00ed vlastnosti sestaven\u00ed (stejn\u00fd identifik\u00e1tor verze) z Artifactory, po \u010dem\u017e je odes\u00edlaj\u00ed do Slu\u017eby pod\u00e1v\u00e1n\u00ed \u00faloh. Tento krok zaji\u0161\u0165uje, \u017ee do clusteru budou nasazeny pouze funk\u010dn\u00ed verze. <\/li>\n<li>JSS funguje jako br\u00e1na pro r\u016fzn\u00e9 platformy, v\u010detn\u011b Kubernetes. Zde prob\u00edh\u00e1 autentizace u\u017eivatele, vyd\u00e1v\u00e1n\u00ed kv\u00f3t a \u010d\u00e1ste\u010dn\u00e1 kontrola konfigurace na\u0161eho CRD.<\/li>\n<li>Po kontrole CRD na stran\u011b JSS jsou informace odesl\u00e1ny na API platformy k8s.<\/li>\n<li>N\u00e1\u0161 CRD kontroler sleduje ud\u00e1losti na v\u0161ech u\u017eivatelsk\u00fdch zdroj\u00edch. P\u0159ev\u00e1d\u00ed CR na nativn\u00ed k8s zdroje, p\u0159id\u00e1v\u00e1 pot\u0159ebn\u00e9 moduly, nastavuje odpov\u00eddaj\u00edc\u00ed prom\u011bnn\u00e9 prost\u0159ed\u00ed a vykon\u00e1v\u00e1 dal\u0161\u00ed podp\u016frn\u00e9 \u00fakoly, \u010d\u00edm\u017e zaji\u0161\u0165uje dostate\u010dnou infrastrukturovou podporu pro kontejnerov\u00e9 u\u017eivatelsk\u00e9 aplikace.<\/li>\n<li>Pot\u00e9 kontroler CRD p\u0159ed\u00e1v\u00e1 z\u00edskan\u00e9 \u00fadaje do API Kubernetes, aby byly zpracov\u00e1ny pl\u00e1nova\u010dem a uvedeny do provozu.<\/li>\n<\/ol>\n<p>\n<b>Pozn\u00e1mka<\/b>: Tato p\u0159edb\u011b\u017en\u00e1 pracovn\u00ed verze nasazen\u00ed byla vytvo\u0159ena pro prvn\u00ed u\u017eivatele nov\u00e9 platformy k8s. Moment\u00e1ln\u011b pracujeme na vylep\u0161en\u00ed tohoto procesu, abychom se pln\u011b integrovali s na\u0161\u00edm nov\u00fdm CI\/CD. To znamen\u00e1, \u017ee nem\u016f\u017eeme sd\u00edlet v\u0161echny informace souvisej\u00edc\u00ed s Kubernetes. T\u011b\u0161\u00edme se na mo\u017enost sd\u00edlet na\u0161e zku\u0161enosti a informovat o pokroku t\u00fdmu v t\u00e9to oblasti v na\u0161em dal\u0161\u00edm blogov\u00e9m p\u0159\u00edsp\u011bvku \u201eBudov\u00e1n\u00ed CI\/CD platformy pro Pinterest\u201c.<\/p>\n<h4>Typy speci\u00e1ln\u00edch zdroj\u016f<\/h4>\n<p>\nNa z\u00e1klad\u011b konkr\u00e9tn\u00edch pot\u0159eb Pinterestu jsme vyvinuli n\u00e1sleduj\u00edc\u00ed CRD, kter\u00e9 vyhovuj\u00ed r\u016fzn\u00fdm pracovn\u00edm tok\u016fm:<\/p>\n<ul>\n<li>PinterestService jsou dlouhodob\u011b funguj\u00edc\u00ed stateless slu\u017eby. Mnoh\u00e9 z na\u0161ich hlavn\u00edch syst\u00e9m\u016f jsou postaveny na souboru t\u011bchto slu\u017eeb.<\/li>\n<li>PinterestJobSet modeluje bal\u00ed\u010dky \u00faloh pln\u00e9ho cyklu. V Pinterestu existuje b\u011b\u017en\u00fd sc\u00e9n\u00e1\u0159, kdy n\u011bkolik \u00faloh spou\u0161t\u00ed stejn\u00e9 kontejnery paraleln\u011b, nez\u00e1visle na jin\u00fdch obdobn\u00fdch procesech.<\/li>\n<li>PinterestCronJob se \u0161iroce pou\u017e\u00edv\u00e1 ve spojen\u00ed s mal\u00fdmi periodick\u00fdmi z\u00e1t\u011b\u017eemi. Je to wrapper pro nativn\u00ed funkci cron s mechanismy podpory Pinterest, kter\u00e9 zaji\u0161\u0165uj\u00ed bezpe\u010dnost, provoz, logy a metriky.<\/li>\n<li>PinterestDaemon zahrnuje infra\u0161trukturn\u00ed Daemony. Tato rodina se st\u00e1le rozr\u016fst\u00e1, proto\u017ee p\u0159id\u00e1v\u00e1me st\u00e1le v\u00edce podpory pro na\u0161e clustery.<\/li>\n<li>PinterestTrainingJob se vztahuje na procesy Tensorflow a Pytorch, zaji\u0161\u0165uj\u00edc\u00ed stejnou \u00farove\u0148 podpory b\u011bhem provozu, jako v\u0161echny ostatn\u00ed CRD. Vzhledem k tomu, \u017ee Pinterest aktivn\u011b vyu\u017e\u00edv\u00e1 Tensorflow a dal\u0161\u00ed syst\u00e9my strojov\u00e9ho u\u010den\u00ed, m\u011blo smysl vytvo\u0159it kolem nich samostatn\u00e9 CRD.<\/li>\n<\/ul>\n<p>\nTak\u00e9 pracujeme na PinterestStatefulSet, kter\u00fd bude brzy p\u0159izp\u016fsoben pro \u00falo\u017en\u00e9 syst\u00e9my a dal\u0161\u00ed stateful syst\u00e9my.<\/p>\n<h4>Podpora b\u011bhov\u00e9ho prost\u0159ed\u00ed<\/h4>\n<p>\nKdy\u017e je modul aplikace spu\u0161t\u011bn v Kubernetes, automaticky z\u00edsk\u00e1v\u00e1 certifik\u00e1t pro vlastn\u00ed identifikaci. Tento certifik\u00e1t se pou\u017e\u00edv\u00e1 pro p\u0159\u00edstup k tajn\u00e9mu \u00falo\u017ei\u0161ti nebo pro komunikaci s jin\u00fdmi slu\u017ebami pomoc\u00ed mTLS. Mezit\u00edm konfigura\u010dn\u00ed inicializa\u010dn\u00ed procesory a Daemon na\u010dtou v\u0161echny nezbytn\u00e9 z\u00e1vislosti p\u0159ed spu\u0161t\u011bn\u00edm kontejnerov\u00e9 aplikace. Jakmile je v\u0161echno p\u0159ipraveno, sidecar pro provoz a Daemon zaregistruj\u00ed IP adresu modulu v na\u0161em Zookeeperu, aby jej klienti mohli objevit. To v\u0161e bude fungovat, proto\u017ee s\u00ed\u0165ov\u00fd modul byl nakonfigurov\u00e1n je\u0161t\u011b p\u0159ed spu\u0161t\u011bn\u00edm aplikace.<\/p>\n<p>V\u00fd\u0161e uveden\u00e9 jsou typick\u00e9 p\u0159\u00edklady podpory pracovn\u00edch z\u00e1t\u011b\u017e\u00ed b\u011bhem b\u011bhu. Pro jin\u00e9 typy pracovn\u00edch z\u00e1t\u011b\u017e\u00ed m\u016f\u017ee b\u00fdt zapot\u0159eb\u00ed pon\u011bkud odli\u0161n\u00e1 podpora, ale v\u0161echny jsou prezentov\u00e1ny ve form\u011b pod \u00farov\u0148ov\u00fdch sidecar\u016f, uzlov\u00fdch nebo Daemon\u016f na \u00farovni virtu\u00e1ln\u00edch stroj\u016f. Dohl\u00ed\u017e\u00edme na to, aby to bylo nasazeno v r\u00e1mci \u0159\u00edd\u00edc\u00ed infrastruktury a slad\u011bno mezi aplikacemi, co\u017e v\u00fdznamn\u011b sni\u017euje pracovn\u00ed z\u00e1t\u011b\u017e v oblasti technick\u00fdch prac\u00ed a z\u00e1kaznick\u00e9 podpory.<\/p>\n<h4>Testov\u00e1n\u00ed a QA<\/h4>\n<p>\nSestavili jsme end-to-end testovac\u00ed pipeline nad ji\u017e existuj\u00edc\u00ed testovac\u00ed infrastrukturou Kubernetes. Tyto testy se vztahuj\u00ed na v\u0161echny na\u0161e clustery. N\u00e1\u0161 pipeline pro\u0161el mnoha p\u0159estavbami, ne\u017e se stal sou\u010d\u00e1st\u00ed produktov\u00e9ho clusteru.<\/p>\n<p>Krom\u011b testovac\u00edch syst\u00e9m\u016f m\u00e1me syst\u00e9my monitorov\u00e1n\u00ed a upozor\u0148ov\u00e1n\u00ed, kter\u00e9 neust\u00e1le sleduj\u00ed stav komponent\u016f syst\u00e9mu, spot\u0159ebu zdroj\u016f a dal\u0161\u00ed d\u016fle\u017eit\u00e9 ukazatele, upozor\u0148uj\u00edc\u00ed n\u00e1s pouze v p\u0159\u00edpad\u011b pot\u0159eby lidsk\u00e9ho z\u00e1sahu.<\/p>\n<h4>Alternativy<\/h4>\n<p>\nZva\u017eovali jsme n\u011bkter\u00e9 alternativy vlastn\u00edch zdroj\u016f, jako jsou muta\u010dn\u00ed kontrolery p\u0159\u00edstupu a syst\u00e9my \u0161ablon. Nicm\u00e9n\u011b v\u0161echny byly prov\u00e1z\u00e1ny se z\u00e1va\u017en\u00fdmi obt\u00ed\u017eemi v provozu, tak\u017ee jsme si vybrali cestu CRD.<\/p>\n<p>Muta\u010dn\u00ed kontroler p\u0159\u00edstupu byl pou\u017eit pro zaveden\u00ed sidecar\u016f, prom\u011bnn\u00fdch prost\u0159ed\u00ed a dal\u0161\u00ed podpory b\u011bhem b\u011bhu. Nicm\u00e9n\u011b se pot\u00fdkal s r\u016fzn\u00fdmi probl\u00e9my, nap\u0159\u00edklad s propojen\u00edm zdroj\u016f a spr\u00e1vou jejich \u017eivotn\u00edho cyklu, zat\u00edmco v CRD se takov\u00e9 probl\u00e9my nevyskytuj\u00ed.<\/p>\n<p><b>Pozn\u00e1mka:<\/b> Syst\u00e9my \u0161ablon, jako jsou diagramy Helm, jsou tak\u00e9 \u0161iroce pou\u017e\u00edv\u00e1ny pro nasazen\u00ed aplikac\u00ed se podobn\u00fdmi konfiguracemi. Na\u0161e pracovn\u00ed aplikace jsou v\u0161ak p\u0159\u00edli\u0161 rozmanit\u00e9 na to, abychom je mohli spravovat pomoc\u00ed \u0161ablon. B\u011bhem kontinu\u00e1ln\u00edho nasazen\u00ed s pou\u017eit\u00edm \u0161ablon tak\u00e9 vznik\u00e1 p\u0159\u00edli\u0161 mnoho chyb.<\/p>\n<h4>Nadch\u00e1zej\u00edc\u00ed pr\u00e1ce<\/h4>\n<p>\nV sou\u010dasnosti se vyrovn\u00e1v\u00e1me se sm\u00ed\u0161en\u00fdm zat\u00ed\u017een\u00edm na v\u0161ech na\u0161ich clusterech. Abychom podpo\u0159ili takov\u00e9to procesy r\u016fzn\u00fdch typ\u016f a velikost\u00ed, pracujeme v n\u00e1sleduj\u00edc\u00edch oblastech:<\/p>\n<ul>\n<li>Soubor cluster\u016f rozm\u00edst\u00ed velk\u00e9 aplikace mezi r\u016fzn\u00e9 clustry za \u00fa\u010delem zaji\u0161t\u011bn\u00ed \u0161k\u00e1lovatelnosti a stability.<\/li>\n<li>Zaji\u0161t\u011bn\u00ed stability, \u0161k\u00e1lovatelnosti a viditelnosti clustru pro vytvo\u0159en\u00ed spojen\u00ed mezi aplikac\u00ed a jej\u00edm SLA.<\/li>\n<li>Spr\u00e1va zdroj\u016f a kv\u00f3t, aby mezi sebou aplikace nekolidovaly, a aby byl m\u011b\u0159\u00edtko clustru \u0159\u00edzeno z na\u0161\u00ed strany.<\/li>\n<li>Nov\u00e1 platforma CI\/CD pro podporu a nasazen\u00ed aplikac\u00ed v Kubernetes.<\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/itsumma\/blog\/465487\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0417\u0430 \u0433\u043e\u0434\u044b \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f Pinterest 300 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 200 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u043f\u0438\u043d\u043e\u0432 \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 4 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u0434\u043e\u0441\u043e\u043a. \u0427\u0442\u043e\u0431\u044b \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0430\u0440\u043c\u0438\u044e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u043e\u0431\u0448\u0438\u0440\u043d\u0443\u044e \u043a\u043e\u043d\u0442\u0435\u043d\u0442-\u0431\u0430\u0437\u0443, \u043f\u043e\u0440\u0442\u0430\u043b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0442\u044b\u0441\u044f\u0447\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u043e\u0442 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043c\u043e\u0436\u0435\u0442 \u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c\u0441\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e CPU, \u0438 \u0437\u0430\u043a\u0430\u043d\u0447\u0438\u0432\u0430\u044f \u0433\u0438\u0433\u0430\u043d\u0442\u0441\u043a\u0438\u043c\u0438 \u043c\u043e\u043d\u043e\u043b\u0438\u0442\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u0440\u0443\u0442\u044f\u0442\u0441\u044f \u043d\u0430 \u0446\u0435\u043b\u043e\u043c \u043f\u0430\u0440\u043a\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d. \u0418 \u0432\u043e\u0442 \u043d\u0430\u0441\u0442\u0443\u043f\u0438\u043b \u043c\u043e\u043c\u0435\u043d\u0442, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28249,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37636","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0417\u0430 \u0433\u043e\u0434\u044b \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f Pinterest 300 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 200 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u043f\u0438\u043d\u043e\u0432 \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 4 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u0434\u043e\u0441\u043e\u043a.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sozdayom-kubernetes-platformu-v-pinterest\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0421\u043e\u0437\u0434\u0430\u0451\u043c kubernetes-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0432 Pinterest | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0417\u0430 \u0433\u043e\u0434\u044b \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f Pinterest 300 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 200 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u043f\u0438\u043d\u043e\u0432 \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 4 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u0434\u043e\u0441\u043e\u043a.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sozdayom-kubernetes-platformu-v-pinterest\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:18:44+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:18:44+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vytv\u00e1\u0159\u00edme kubernetes platformu v Pinterestu | ProHoster","description":"B\u011bhem let existence Pinterestu vytvo\u0159ilo 300 milion\u016f u\u017eivatel\u016f slu\u017eby v\u00edce ne\u017e 200 miliard pin\u016f na v\u00edce ne\u017e 4 miliard\u00e1ch tabul\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sozdayom-kubernetes-platformu-v-pinterest","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043e\u0437\u0434\u0430\u0451\u043c kubernetes-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0432 Pinterest | ProHoster","og:description":"\u0417\u0430 \u0433\u043e\u0434\u044b \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f Pinterest 300 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 200 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u043f\u0438\u043d\u043e\u0432 \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 4 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u0434\u043e\u0441\u043e\u043a.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sozdayom-kubernetes-platformu-v-pinterest","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:18:44+00:00","article:modified_time":"2019-10-31T19:18:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37636","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 15:30:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:23:06","updated":"2026-02-09 15:30:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=37636"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37636\/revisions"}],"predecessor-version":[{"id":158433,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37636\/revisions\/158433"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/28249"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=37636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=37636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=37636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}