{"id":32766,"date":"2019-10-31T21:48:48","date_gmt":"2019-10-31T18:48:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1\/"},"modified":"2019-10-31T21:48:48","modified_gmt":"2019-10-31T18:48:48","slug":"kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","title":{"rendered":"Kuidas k\u00e4ivitada Istio, kasutades Kubernetesit tootmises. Osa 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mis see on Istio<\/a><\/noindex>? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u043e\u0445\u043e\u0434\u044b \u0438\u0437 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0415\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0434\u0430\u0432\u0430\u0442\u044c policy \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043f\u043e\u0445\u043e\u0434\u043e\u0432 \u043c\u0435\u0436\u0434\u0443 \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438. \u041d\u0430\u043a\u043e\u043d\u0435\u0446, \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0432\u0441\u044e \u043a\u0430\u0440\u0442\u0443 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438 \u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u043c\u0435\u0442\u0440\u0438\u043a \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.<\/p>\n

Mehhanismi kohta saab lugeda ametlikus dokumentatsioonis<\/a><\/noindex>. Istio on t\u00f5eliselt v\u00f5imas t\u00f6\u00f6riist, mis v\u00f5imaldab lahendada palju \u00fclesandeid ja probleeme. Selles artiklis soovin vastata peamistele k\u00fcsimustele, mis tavaliselt tekivad Istio kasutamise alguses. See aitab teil sellega kiiremini tutvuda.<\/p>\n

\"Kuidas
\n<\/a><\/noindex><\/p>\n

T\u00f6\u00f6printsiip<\/h3>\n

\nIstio koosneb kahest p\u00f5hiviaalast \u2014 control plane ja data plane. Control plane sisaldab p\u00f5hikomponente, mis tagavad teiste korrektse t\u00f6\u00f6. Praeguses versioonis (1.0) on control plane'il kolm peamist komponenti: Pilot, Mixer, Citadel. Citadel'i me ei k\u00e4sitle, see on vajalik sertifikaatide genereerimiseks, et tagada mutual TLS t\u00f6\u00f6de korrektne k\u00e4itamine teenuste vahel. Vaatame l\u00e4hemalt Piloti ja Mixeri struktuuri ja eesm\u00e4rke.<\/p>\n

\"Kuidas
\n
\nPilot on peamine juhtimiskomponent, mis levitab kogu teabe selle kohta, mis meil klastris on \u2013 teenused, nende endpoint'id ja routeerimise reeglid (n\u00e4iteks Canary deploymenti v\u00f5i circuit breaker'i reeglid).<\/p>\n

Mixer on valikuline control plane komponent, mis pakub v\u00f5imalust koguda m\u00f5\u00f5dikuid, logisid ja igasugust teavet v\u00f5rgusuhete kohta. Samuti j\u00e4lgib see poliitikareeglite j\u00e4rgimist ja kiiruspiiranguid.<\/p>\n

Data plane'i rakendatakse sidecar konteinerite-prokside abil. Vaikimisi kasutatakse v\u00f5imsat proksiserverit envoy<\/a><\/noindex>. Selle v\u00f5ib asendada muude teostustega, n\u00e4iteks nginx (nginmesh).<\/p>\n

Kuna Istio peab t\u00f6\u00f6tama rakendustele t\u00e4iesti l\u00e4bipaistvalt, on olemas automaatne injectimise s\u00fcsteem. Viimane teostus sobib Kubernetes'i versioonidele 1.9+ (mutational admission webhook). Kubernetes'i versioonidele 1.7, 1.8 on olemas v\u00f5imalus kasutada Initializer'i.<\/p>\n

Sidecar konteinerid \u00fchenduvad Pilotiga GRPC protokolli kaudu, mis v\u00f5imaldab optimeerida muudatuste edastamise mudelit klastris. GRPC hakati Envoy's kasutama alates versioonist 1.6, Istios kasutatakse seda alates versioonist 0.8 ja see esindab pilot-agent\u2019i \u2014 golang'i \u00fcmbritsemist envoy' \u00fcle, mis konfigureerib k\u00e4ivitamisparameetreid.<\/p>\n

Pilot ja Mixer on t\u00e4iesti stateless komponendid, k\u00f5ik olek on m\u00e4lus. Nende konfiguratsioon m\u00e4\u00e4ratakse Kubernetes'i Custom Resources'i kujul, mis salvestatakse etcd's.
\nIstio-agent saab Pilot'i aadressi ja avab sellele GRPC voogu. <\/p>\n

Nagu juba \u00f6eldud, rakendab Istio kogu funktsionaalsuse rakendustele t\u00e4iesti l\u00e4bipaistvalt. Vaatame, kuidas. Algoritm on j\u00e4rgmine:<\/p>\n

    \n
  1. Paigaldame teenuse uue versiooni.<\/li>\n
  2. S\u00f5ltuvalt sidecar konteineri injectimise l\u00e4henemisest lisatakse konfigureerimise rakendamise etapis istio-init konteiner ja istio-agent konteiner (envoy), v\u00f5i need v\u00f5ivad juba manualt olla Kubernetese Pod'i kirjelduse sisse pandud.<\/li>\n
  3. istio-init konteiner on skript, mis rakendab iptables reeglid poodi. On kaks v\u00f5imalust liikluse suunamise seadistamiseks istio-agent konteineri, kasutades iptables'i suunamisreegleid, v\u00f5i TPROXY<\/a><\/noindex>. K\u00e4esoleva artikli kirjutamise ajal kasutatakse vaikimisi suunamisreeglite l\u00e4henemist. istio-init'is on v\u00f5imalus m\u00e4\u00e4rata, millist liiklust tuleb tabada ja suunata istio-agent'i. N\u00e4iteks, et tabada kogu sissetulev ja v\u00e4ljaminev liiklus, tuleb seada parameetrid -i<\/code> ja -b<\/code> v\u00e4\u00e4rtuse *<\/code>. V\u00f5ib m\u00e4\u00e4rata konkreetseid porte, mida tuleb tabada. Et mitte t\u00f5kestada teatud allv\u00f5rku, v\u00f5ib selle m\u00e4\u00e4rata lipuga -x<\/code>.<\/li>\n
  4. . P\u00e4rast init konteinerite teostamist alustatakse p\u00f5hikonteinerite, sealhulgas pilot-agent'i (envoy) k\u00e4ivitamist. See \u00fchendub juba juurutatud Pilotiga GRPC kaudu ja saab teavet k\u00f5igi olemasolevate teenuste ja routeerimise poliitikate kohta klastris. Saadud andmete p\u00f5hjal konfigureerib see klastrid ja m\u00e4\u00e4rab meie rakenduste endpoint'id Kubernetes'i klastris. Samuti tuleb m\u00e4rkida oluline punkt: envoy konfigureerib d\u00fcnaamiliselt kuuldud kuulajaid (IP, port) paarides, mida ta hakkab kuulama. Seega, kui p\u00e4ringud siseneb poodi, suunatakse need iptables'i reeglite abil sidecar'i, envoy suudab juba edukalt neid \u00fchendusi t\u00f6\u00f6delda ja m\u00f5ista, kuhu liiklus edastada. Samuti toimub sel etapil teabe saatmine Mixer'ile, mida vaatame hiljem, ja j\u00e4lgimise span'ide saatmine.<\/li>\n<\/ol>\n

    \nL\u00f5pptulemusena saame terve v\u00f5rgustiku envoy proksiserveritest, mida saame \u00fchest punktist (Pilot) seadistada. K\u00f5ik sissetulevad ja v\u00e4ljaminevad p\u00e4ringud l\u00e4bivad envoy. Samuti tabatakse ainult TCP liiklus. See t\u00e4hendab, et Kubernetes'i teenuse IP lahendatakse kube-dnsiga UDP kaudu muutmata. Seej\u00e4rel toimub juba p\u00e4rast lahendust p\u00e4ringu sissetuleku tabamine ja t\u00f6\u00f6tlemine envoy poolt, mis juba otsustab, kuhu endpoint'ile p\u00e4ring saata (v\u00f5i mitte saata, juhul kui on juurutatud juurdep\u00e4\u00e4supoliitika v\u00f5i circuit breaker algoritmi t\u00f6\u00f6tamine).<\/p>\n

    Me ei k\u00e4sitlenud Pilotit, n\u00fc\u00fcd peame aru saama, kuidas t\u00f6\u00f6tab Mixer ja miks see vajalik on. Lukeda selle kohta ametlikke dokumente saab siin<\/a><\/noindex>.<\/p>\n

    Mixer praeguses vormis koosneb kahest komponendist: istio-telemetry, istio-policy (kuni versioonini 0.8 oli see \u00fcks komponent istio-mixer). M\u00f5lemad on mixer, millest iga\u00fchel on oma \u00fclesanne. Istio telemetry v\u00f5tab GRPC kaudu sidecar konteineritelt Report'i teavet selle kohta, kuhu keegi l\u00e4heb ja milliste parameetritega. Istio-policy v\u00f5tab Check p\u00e4ringud, et kontrollida, kas poliitika reeglitele vastatakse. Poliitika kontrollimist ei tehta loomulikult iga p\u00e4ringu puhul, vaid see vahem\u00e4lu salvestatakse kliendipoolses (sidecar) teatud ajaks. Report kontrollid saadetakse partii p\u00e4ringutena. Kuidas seadistada ja millised t\u00e4pselt parameetrid saata, vaatame natuke hiljem. <\/p>\n

    Mixer on ette n\u00e4htud kui k\u00f5rgelt saadaval komponent, mis tagab katkestusteta telestatistika andmete kogumise ja t\u00f6\u00f6tlemise. L\u00f5ppkokkuv\u00f5ttes toimib s\u00fcsteem kui mitme taseme vahem\u00e4lu. Andmed vahem\u00e4lu salvestatakse esmalt sidecar konteinerite k\u00fcljel, seej\u00e4rel mixeril ja l\u00f5puks saadetakse n\u00f5nda nimetatud mixer backend'idesse. Seet\u00f5ttu, kui m\u00f5ni s\u00fcsteemi komponent katkeb, suureneb vahem\u00e4lu ja p\u00e4rast s\u00fcsteemi taastumist t\u00fchjendatakse see. Mixer backend\u2019id on l\u00f5pupunktid telemeetriateabe saatmiseks: statsd, newrelic jne. Saate kirjutada oma backend'i, see on piisavalt lihtne, ja vaatame, kuidas seda teha.<\/p>\n

    \"Kuidas
    \n
    \nKokkuv\u00f5tlikult toimib istio-telemetry j\u00e4rgmiselt.<\/p>\n

      \n
    1. Teenuse 1 saadab p\u00e4ringu teenusele 2.<\/li>\n
    2. V\u00e4ljudes teenusest 1, m\u00e4hitakse p\u00e4ring tema oma sidecar'isse.<\/li>\n
    3. Sidecar envoy j\u00e4lgib, kuidas p\u00e4ring liigub teenusesse 2 ja valmistab ette vajaliku teabe.<\/li>\n
    4. Seej\u00e4rel saadab ta selle istio-telemetry'le Report p\u00e4ringu kaudu.<\/li>\n
    5. Istio-telemetry m\u00e4\u00e4rab, kas on vaja see Report saata backend'idesse, millistesse t\u00e4pselt ja millised andmed tuleb saata.<\/li>\n
    6. Istio-telemetry saadab Report andmed backend'isse, kui see on vajalik.<\/li>\n<\/ol>\n

      \nN\u00fc\u00fcd vaatame, kuidas s\u00fcsteemi Istio rakendada, mis koosneb ainult p\u00f5hilistest komponentidest (Pilot ja sidecar envoy).<\/p>\n

      Alustame peamise konfiguratsiooni (mesh) vaatamisest, mida Pilot loeb:<\/p>\n

      apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: istio\n  namespace: istio-system\n  labels:\n    app: istio\n    service: istio\ndata:\n  mesh: |-\n\n    # hetkel ei l\u00fclita tracing andmete saatmist sisse (pilot seadistab envoy nii, et saatmine ei toimu)\n    enableTracing: false\n\n    # praegu ei m\u00e4\u00e4ra mixer endpoint\u2019e, et sidecar konteinerid ei saadaks andmeid sinna\n    #mixerCheckServer: istio-policy.istio-system:15004\n    #mixerReportServer: istio-telemetry.istio-system:15004\n\n    # m\u00e4\u00e4rame ajavahemiku, millega envoy k\u00fcsib Pilotilt (see on vanale versioonile envoy proxy)\n    rdsRefreshDelay: 5s\n\n    # vaikimisi konfiguratsioon envoy sidecar'ile\n    defaultConfig:\n      # samuti nagu rdsRefreshDelay\n      discoveryRefreshDelay: 5s\n\n      # j\u00e4tame vaikimisi (tee konfiguratsiooni ja binary envoy)\n      configPath: \"\/etc\/istio\/proxy\"\n      binaryPath: \"\/usr\/local\/bin\/envoy\"\n\n      # vaikimisi nimi jooksva sidecar konteineri jaoks (kasutatakse n\u00e4iteks teenuse nimedes trace'i span'ide saatmisel)\n      serviceCluster: istio-proxy\n\n      # aeg, mille jooksul envoy ootab, enne kui l\u00f5petab k\u00f5ik avatud \u00fchendused\n      drainDuration: 45s\n      parentShutdownDuration: 1m0s\n\n      # vaikimisi kasutatakse iptables'i REDIRECT reegleid. Saate muuta TPROXY'ks.\n      #interceptionMode: REDIRECT\n\n      # Port, millel t\u00f6\u00f6tab iga sidecar konteineri (envoy) admin paneel\n      proxyAdminPort: 15000\n\n      # aadress, kuhu saadetakse j\u00e4lgimisandmed zipkin protokolliga (alguses l\u00fclitasime v\u00e4lja j\u00e4lgimise, seega ei kasutata seda v\u00e4lja praegu)\n      zipkinAddress: tracing-collector.tracing:9411\n\n      # statsd aadress envoy konteinerite m\u00f5\u00f5dikute saatmiseks (v\u00e4lja l\u00fclitatud)\n      # statsdUdpAddress: aggregator:8126\n\n      # l\u00fclitame v\u00e4lja Mutual TLS toega optiooni\n      controlPlaneAuthPolicy: NONE\n\n      # aadress, kus istio-pilot kuulab, et teavitada k\u00f5iki sidecar konteinerite teenuse avastamisest\n      discoveryAddress: istio-pilot.istio-system:15007\n<\/code><\/pre>\n
      \nPaigutame k\u00f5ik p\u00f5hikomponendid (control plane) Kubernetes'e istio-system nimede ruumi.<\/p>\n
      Minimaalselt peame rakendama vaid Piloti. Selleks kasutame sellist konfiguratsiooni.<\/a><\/noindex><\/p>\n
      Ja seadistame k\u00e4sitsi sidecar konteineri s\u00fcstimise.<\/p>\n
      Init konteiner:<\/p>\n
      initContainers:\n - name: istio-init\n   args:\n   - -p\n   - \"15001\"\n   - -u\n   - \"1337\"\n   - -m\n   - REDIRECT\n   - -i\n   - '*'\n   - -b\n   - '*'\n   - -d\n   - \"\"\n   image: istio\/proxy_init:1.0.0\n   imagePullPolicy: IfNotPresent\n   resources:\n     limits:\n       memory: 128Mi\n   securityContext:\n     capabilities:\n       add:\n       - NET_ADMIN\n<\/code><\/pre>\n
      \nJa sidecar:<\/p>\n
             name: istio-proxy\n       args:\n         - \"bash\"\n         - \"-c\"\n         - |\n           exec \/usr\/local\/bin\/pilot-agent proxy sidecar \n           --configPath \n           \/etc\/istio\/proxy \n           --binaryPath \n           \/usr\/local\/bin\/envoy \n           --serviceCluster \n           service-name \n           --drainDuration \n           45s \n           --parentShutdownDuration \n           1m0s \n           --discoveryAddress \n           istio-pilot.istio-system:15007 \n           --discoveryRefreshDelay \n           1s \n           --connectTimeout \n           10s \n           --proxyAdminPort \n           \"15000\" \n           --controlPlaneAuthPolicy \n           NONE\n         env:\n         - name: POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: POD_NAMESPACE\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.namespace\n         - name: INSTANCE_IP\n           valueFrom:\n             fieldRef:\n               fieldPath: status.podIP\n         - name: ISTIO_META_POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: ISTIO_META_INTERCEPTION_MODE\n           value: REDIRECT\n         image: istio\/proxyv2:1.0.0\n         imagePullPolicy: IfNotPresent\n         resources:\n           requests:\n             cpu: 100m\n             memory: 128Mi\n           limits:\n             memory: 2048Mi\n         securityContext:\n           privileged: false\n           readOnlyRootFilesystem: true\n           runAsUser: 1337\n         volumeMounts:\n         - mountPath: \/etc\/istio\/proxy\n           name: istio-envoy\n<\/code><\/pre>\n
      \nEtte, et k\u00f5ik sujuks, tuleb luua ServiceAccount, ClusterRole, ClusterRoleBinding, CRD Piloti jaoks, nende kirjeldused on saadaval. siin<\/a><\/noindex>. <\/p>\n
      Kokkuv\u00f5ttes peab teenus, kuhu inject\u2019ime sidecar\u2019i koos envoy\u2019ga, edukalt k\u00e4ivituma, saama kogu avastamise teabest Pilodilt ja t\u00f6\u00f6tlema p\u00e4ringuid.<\/p>\n
      Oluline on m\u00f5ista, et k\u00f5ik control plane'i komponendid on olekuteta rakendused ja neid saab probleemideta horisontaalselt skaalada. K\u00f5ik andmed asuvad etcd-s kohandatud Kubernetes'i ressursi kirjeldustena.<\/p>\n
      Istio-l on ka v\u00f5imalus t\u00f6\u00f6tada klastrist v\u00e4ljas ning jagada teenuste avastamist mitme Kubernetes'i klastriga. Selle kohta v\u00f5ib lugeda rohkem. siin<\/a><\/noindex>.<\/p>\n
      Mitme klastri paigaldamisel tuleks arvesse v\u00f5tta j\u00e4rgmisi piiranguid:<\/p>\n
        \n
      1. Pod CIDR ja Service CIDR peavad olema k\u00f5igis klastrites unikaalsed ja ei tohi kattuda.<\/li>\n
      2. K\u00f5ik Pod CIDR-id peavad olema juurdep\u00e4\u00e4setavad mistahes Pod CIDR-ist klastrite vahel.<\/li>\n
      3. K\u00f5ik Kubernetes'i API serverid peavad olema omavahel kergesti juurdep\u00e4\u00e4setavad.<\/li>\n<\/ol>\n
        \nNeed on esialgsed teadmised, mis aitavad teil alustada Istio'ga. Siiski on veel palju alaealisi probleeme, nagu v\u00e4listrafi kiirus, sidecar'ide t\u00f5rkeotsing, profileerimine, mixer'i seadistamine ning kohandatud mixer backend'i kirjutamine, j\u00e4lgimismehanismi seadistamine ja selle t\u00f6\u00f6 jaoks envoy.
        \nK\u00f5ike seda k\u00e4sitleme j\u00e4rgmistes v\u00e4ljaannetes. Esitage oma k\u00fcsimused, \u00fcritan neid k\u00e4sitleda.
        \n
        Allikas:         habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
        \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kuidas k\u00e4ivitada Istio kasutades Kubernetes't tootmises. Osa 1 | ProHoster","description":"Mis on Istio? See on nn Service mesh, tehnoloogia, mis lisab v\u00f5rgu kohale abstraktsioonitaseme.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Istio, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Kubernetes \u0432 production. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:description":"\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:48:48+00:00","article:modified_time":"2019-10-31T18:48:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 12:27:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:53:24","updated":"2026-01-21 12:27:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/32766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=32766"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/32766\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/24545"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=32766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=32766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=32766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}