{"id":32766,"date":"2019-10-31T21:48:48","date_gmt":"2019-10-31T18:48:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1\/"},"modified":"2019-10-31T21:48:48","modified_gmt":"2019-10-31T18:48:48","slug":"kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","title":{"rendered":"How to launch Istio using Kubernetes in production. Part 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>What is <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\">Istio<\/a><\/noindex>? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u043e\u0445\u043e\u0434\u044b \u0438\u0437 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0415\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0434\u0430\u0432\u0430\u0442\u044c policy \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043f\u043e\u0445\u043e\u0434\u043e\u0432 \u043c\u0435\u0436\u0434\u0443 \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438. \u041d\u0430\u043a\u043e\u043d\u0435\u0446, \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0432\u0441\u044e \u043a\u0430\u0440\u0442\u0443 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438 \u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u043c\u0435\u0442\u0440\u0438\u043a \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.<\/p>\n<p>You can read about the mechanism of action in <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/docs\/concepts\/\">the official documentation.<\/a><\/noindex>. Istio is indeed a powerful tool that addresses numerous tasks and challenges. In this article, I want to answer the main questions that typically arise when starting to work with Istio. This will help you get familiar with it more quickly.<\/p>\n<p><img decoding=\"async\" alt=\"How to launch Istio using Kubernetes in production. Part 1\" src=\"\/wp-content\/uploads\/2019\/04\/7ab676ec42cacafc97099d5af9f6332a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Operating principle<\/h3>\n<p>\nIstio consists of two main zones \u2014 the control plane and the data plane. The control plane includes the essential components that ensure the proper functioning of the others. In the current version (1.0), the control plane has three main components: Pilot, Mixer, and Citadel. We will not discuss Citadel as it is needed for generating certificates to ensure mutual TLS operation between services. Let's take a closer look at the structure and purpose of Pilot and Mixer.<\/p>\n<p><img decoding=\"async\" alt=\"How to launch Istio using Kubernetes in production. Part 1\" src=\"\/wp-content\/uploads\/2019\/04\/1e2b76b5ec12343dee7728e505321908.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPilot is the primary management component that distributes all information about what we have in the cluster \u2013 services, their endpoints, and routing rules (for example, rules for Canary deployment or circuit breaker rules).<\/p>\n<p>Mixer is an optional control plane component that provides the ability to collect metrics, logs, and any information about network interactions. It also monitors compliance with Policy rules and enforces rate limits.<\/p>\n<p>The data plane is implemented using sidecar proxy containers. By default, it uses a powerful <noindex><a rel=\"nofollow\" href=\"https:\/\/www.envoyproxy.io\/\">proxy server envoy<\/a><\/noindex>. It can be replaced with another implementation, such as nginx (nginmesh).<\/p>\n<p>To ensure that Istio operates completely transparently for applications, there is an automatic injection system. The latest implementation is suitable for Kubernetes versions 1.9+ (mutational admission webhook). For Kubernetes versions 1.7 and 1.8, it is possible to use Initializer.<\/p>\n<p>Sidecar containers connect to Pilot via the GRPC protocol, which allows for optimizing the push model of changes occurring in the cluster. GRPC has been used in Envoy since version 1.6, and in Istio, it has been used since version 0.8, represented as pilot-agent \u2014 a Golang wrapper around Envoy that configures the startup parameters.<\/p>\n<p>Pilot and Mixer are completely stateless components, keeping all state in memory. Their configuration is defined in the form of Kubernetes Custom Resources, which are stored in etcd. <br \/>\nThe Istio agent receives the Pilot address and opens a GRPC stream to it. <\/p>\n<p>As I mentioned, Istio implements all functionality completely transparently for applications. Let's understand how. The algorithm is as follows:<\/p>\n<ol>\n<li>We deploy a new version of the service.<\/li>\n<li>Depending on the sidecar injection approach, the istio-init container and istio-agent container (envoy) are added during the configuration application stage, or they may already be manually inserted into the Kubernetes Pod entity description.<\/li>\n<li>The istio-init container is a script that applies iptables rules for the pod. There are two options for configuring traffic wrapping in the istio-agent container: using iptables redirect rules, or <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/kristrev\/tproxy-example\/blob\/master\/tproxy_example.c\">TPROXY<\/a><\/noindex>. At the time of writing, the default approach uses redirect rules. The istio-init allows for configuring which specific traffic should be intercepted and directed to the istio-agent. For example, to intercept all incoming and outgoing traffic, parameters must be set <code>-i<\/code> and <code>-b<\/code> to <code>*<\/code>. Specific ports to be intercepted can be indicated. To avoid intercepting a certain subnet, it can be specified using the flag <code>-x<\/code>.<\/li>\n<li>After the init containers have executed, the main containers are started, including pilot-agent (envoy). It connects to the already deployed Pilot via GRPC and retrieves information about all existing services and routing policies in the cluster. Based on the received data, it configures the clusters and specifies the endpoints for our applications in the Kubernetes cluster. It is also important to note that envoy dynamically configures listeners (pairs of IP, port) that it begins to listen to. Therefore, when requests enter the pod, they are redirected using iptables rules to the sidecar, and envoy can successfully process these connections and understand where to proxy the traffic next. Additionally, at this stage, information is sent to Mixer, which we will discuss later, along with sending tracing spans.<\/li>\n<\/ol>\n<p>\nAs a result, we have a whole network of envoy proxy servers that we can configure from one point (Pilot). All inbound and outbound requests go through envoy. Moreover, only TCP traffic is intercepted. This means that the Kubernetes service IP is resolved using kube-dns via UDP without any changes. After resolution, the outgoing request is intercepted and processed by envoy, which then decides to which endpoint the request should be sent (or not sent, in case of access policies or circuit breaker algorithm activation).<\/p>\n<p>Having understood Pilot, we now need to understand how Mixer works and why it is necessary. You can read the official documentation on it. <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/docs\/concepts\/policies-and-telemetry\/overview\/\">here<\/a><\/noindex>.<\/p>\n<p>In its current form, Mixer consists of two components: istio-telemetry and istio-policy (prior to version 0.8, it was a single component called istio-mixer). Each of these components represents a mixer, each responsible for its own task. Istio telemetry receives information via GRPC from sidecar containers about where requests are going and with what parameters. Istio-policy receives Check requests to verify compliance with Policy rules. Policy checks are not conducted for every request; instead, they are cached on the client (in the sidecar) for a certain period. Report checks are sent in batch requests. We will look at how to configure and what specific parameters need to be sent a bit later. <\/p>\n<p>Mixer is intended as a highly available component that ensures seamless operation in collecting and processing telemetry data. The system ultimately acts as a multi-tiered buffer. Initially, data is buffered on the sidecar containers, then on the mixer side, and finally sent to so-called mixer backends. As a result, if any component of the system fails, the buffer grows and, after the system is restored, it gets flushed. Mixer backends serve as the endpoints for sending telemetry data: statsd, newrelic, etc. You can write your own backend, which is quite simple, and we will see how to do this.<\/p>\n<p><img decoding=\"async\" alt=\"How to launch Istio using Kubernetes in production. Part 1\" src=\"\/wp-content\/uploads\/2019\/04\/e7dd11d5ee26a692e1cd213578d47700.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTo summarize, the workflow with istio-telemetry is as follows.<\/p>\n<ol>\n<li>Service 1 sends a request to Service 2.<\/li>\n<li>Upon leaving Service 1, the request is wrapped in its own sidecar.<\/li>\n<li>The Sidecar envoy monitors the request as it passes to Service 2 and prepares the necessary information.<\/li>\n<li>It then sends this information to istio-telemetry via a Report request.<\/li>\n<li>Istio-telemetry determines whether this Report needs to be sent to backends, which specific ones, and what data to send.<\/li>\n<li>Istio-telemetry sends Report data to the backend if necessary.<\/li>\n<\/ol>\n<p>\nNow let's look at how to deploy a system with Istio consisting only of the core components (Pilot and sidecar envoy).<\/p>\n<p>First, let's examine the main configuration (mesh) that Pilot reads:<\/p>\n<pre><code class=\"plaintext\">apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: istio\n  namespace: istio-system\n  labels:\n    app: istio\n    service: istio\ndata:\n  mesh: |-\n\n    # Currently not enabling tracing information sending (pilot will configure envoys in a way that sending will not occur)\n    enableTracing: false\n\n    # Currently not specifying mixer endpoints, so the sidecar containers will not send information there\n    #mixerCheckServer: istio-policy.istio-system:15004\n    #mixerReportServer: istio-telemetry.istio-system:15004\n\n    # Set the time interval for which envoy will re-query Pilot (this is for the old version of envoy proxy)\n    rdsRefreshDelay: 5s\n\n    # Default configuration for envoy sidecar\n    defaultConfig:\n      # Similar to rdsRefreshDelay\n      discoveryRefreshDelay: 5s\n\n      # Keeping default (path to envoy configuration and binary)\n      configPath: \"\/etc\/istio\/proxy\"\n      binaryPath: \"\/usr\/local\/bin\/envoy\"\n\n      # Default name of the running sidecar container (used, for example, in service names when sending tracing spans)\n      serviceCluster: istio-proxy\n\n      # Time that envoy will wait before it forcibly closes all established connections\n      drainDuration: 45s\n      parentShutdownDuration: 1m0s\n\n      # By default, REDIRECT rules of iptables are used. Can be changed to TPROXY.\n      #interceptionMode: REDIRECT\n\n      # Port on which the admin panel of each sidecar container (envoy) will run\n      proxyAdminPort: 15000\n\n      # Address to which traces will be sent via the zipkin protocol (we disabled sending at the beginning, so this field will not be used now)\n      zipkinAddress: tracing-collector.tracing:9411\n\n      # statsd address for sending envoy container metrics (disabled)\n      # statsdUdpAddress: aggregator:8126\n\n      # Disabling support for Mutual TLS option\n      controlPlaneAuthPolicy: NONE\n\n      # Address on which istio-pilot will listen to inform sidecar containers about service discovery\n      discoveryAddress: istio-pilot.istio-system:15007\n<\/code><\/pre>\n<p>\nAll main control plane components will be located in the istio-system namespace in Kubernetes.<\/p>\n<p>At a minimum, we need to deploy only Pilot. For this, we will use <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/istio\/istio\/blob\/release-1.0\/install\/kubernetes\/helm\/istio\/charts\/pilot\/templates\/deployment.yaml\">this configuration.<\/a><\/noindex><\/p>\n<p>And we will manually configure injecting the sidecar container.<\/p>\n<p>Init container:<\/p>\n<pre><code class=\"plaintext\">initContainers:\n - name: istio-init\n   args:\n   - -p\n   - \"15001\"\n   - -u\n   - \"1337\"\n   - -m\n   - REDIRECT\n   - -i\n   - '*'\n   - -b\n   - '*'\n   - -d\n   - \"\"\n   image: istio\/proxy_init:1.0.0\n   imagePullPolicy: IfNotPresent\n   resources:\n     limits:\n       memory: 128Mi\n   securityContext:\n     capabilities:\n       add:\n       - NET_ADMIN\n<\/code><\/pre>\n<p>\nAnd the sidecar:<\/p>\n<pre><code class=\"plaintext\">       name: istio-proxy\n       args:\n         - \"bash\"\n         - \"-c\"\n         - |\n           exec \/usr\/local\/bin\/pilot-agent proxy sidecar \n           --configPath \n           \/etc\/istio\/proxy \n           --binaryPath \n           \/usr\/local\/bin\/envoy \n           --serviceCluster \n           service-name \n           --drainDuration \n           45s \n           --parentShutdownDuration \n           1m0s \n           --discoveryAddress \n           istio-pilot.istio-system:15007 \n           --discoveryRefreshDelay \n           1s \n           --connectTimeout \n           10s \n           --proxyAdminPort \n           \"15000\" \n           --controlPlaneAuthPolicy \n           NONE\n         env:\n         - name: POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: POD_NAMESPACE\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.namespace\n         - name: INSTANCE_IP\n           valueFrom:\n             fieldRef:\n               fieldPath: status.podIP\n         - name: ISTIO_META_POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: ISTIO_META_INTERCEPTION_MODE\n           value: REDIRECT\n         image: istio\/proxyv2:1.0.0\n         imagePullPolicy: IfNotPresent\n         resources:\n           requests:\n             cpu: 100m\n             memory: 128Mi\n           limits:\n             memory: 2048Mi\n         securityContext:\n           privileged: false\n           readOnlyRootFilesystem: true\n           runAsUser: 1337\n         volumeMounts:\n         - mountPath: \/etc\/istio\/proxy\n           name: istio-envoy\n<\/code><\/pre>\n<p>\nTo ensure everything runs successfully, you need to create a ServiceAccount, ClusterRole, ClusterRoleBinding, and CRD for Pilot, the descriptions of which can be found. <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/istio\/istio\/tree\/release-1.0\/install\/kubernetes\/helm\/istio\/charts\/pilot\/templates\">here<\/a><\/noindex>. <\/p>\n<p>As a result, the service into which we inject the sidecar with envoy should start successfully, retrieve all discovery from the pilot, and handle requests.<\/p>\n<p>It is important to understand that all control plane components are stateless applications and can be horizontally scaled without issues. All data is stored in etcd as custom Kubernetes resource definitions.<\/p>\n<p>Istio also (currently in experimental mode) has the capability to run outside the cluster and the ability to view and share service discovery between multiple Kubernetes clusters. More details can be found here. <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/docs\/setup\/kubernetes\/multicluster-install\/\">here<\/a><\/noindex>.<\/p>\n<p>When installing multi-cluster, consider the following limitations:<\/p>\n<ol>\n<li>Pod CIDR and Service CIDR must be unique across all clusters and should not overlap.<\/li>\n<li>All Pod CIDR must be reachable from any Pod CIDR between clusters.<\/li>\n<li>All Kubernetes API servers must be accessible to each other.<\/li>\n<\/ol>\n<p>\nThese are the initial pieces of information that will help you get started with Istio. However, there are many more nuances. For example, features of routing external traffic (out of the cluster), approaches to debugging sidecars, profiling, configuring mixer and writing a custom mixer backend, setting up tracing mechanisms and how it works with envoy.<br \/>\nWe will cover all of this in upcoming publications. Feel free to ask your questions, and I will do my best to address them.<br \/>\n<br \/>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/avito\/blog\/419319\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Istio, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Kubernetes \u0432 production. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:48:48+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:48:48+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47How to deploy Istio using Kubernetes in production. Part 1 | ProHoster","description":"What is Istio? It is a so-called service mesh technology that adds an abstraction layer over the network.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Istio, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Kubernetes \u0432 production. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:description":"\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:48:48+00:00","article:modified_time":"2019-10-31T18:48:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 12:27:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:53:24","updated":"2026-01-21 12:27:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/32766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=32766"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/32766\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/24545"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=32766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=32766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=32766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}