{"id":32766,"date":"2019-10-31T21:48:48","date_gmt":"2019-10-31T18:48:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1\/"},"modified":"2019-10-31T21:48:48","modified_gmt":"2019-10-31T18:48:48","slug":"kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","title":{"rendered":"Kuidas k\u00e4ivitada Istio kasutades Kubernetesit tootmises. Osa 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mis see on Istio<\/a><\/noindex>? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u043e\u0445\u043e\u0434\u044b \u0438\u0437 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0415\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0434\u0430\u0432\u0430\u0442\u044c policy \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043f\u043e\u0445\u043e\u0434\u043e\u0432 \u043c\u0435\u0436\u0434\u0443 \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438. \u041d\u0430\u043a\u043e\u043d\u0435\u0446, \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0432\u0441\u044e \u043a\u0430\u0440\u0442\u0443 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438 \u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u043c\u0435\u0442\u0440\u0438\u043a \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.<\/p>\n

Mekanismi t\u00f6\u00f6 kohta saab lugeda ametlikust dokumentatsioonist<\/a><\/noindex>. Istio on t\u00f5eliselt v\u00f5imas t\u00f6\u00f6riist, mis suudab lahendada paljusid \u00fclesandeid ja probleeme. Selles artiklis soovin vastata peamistele k\u00fcsimustele, mis tavaliselt tekivad Istio kasutamise alguses. See aitab teil sellega kiiremini toime tulla.<\/p>\n

\"Kuidas
\n<\/a><\/noindex><\/p>\n

T\u00f6\u00f6 \u043f\u0440\u0438\u043d\u0446\u0438\u043f<\/h3>\n

\nIstio koosneb kahest peamisest piirkonnast \u2014 juhtimistasandist ja andmetasandist. Juhtimistasand sisaldab endas p\u00f5hikomponente, mis tagavad teiste korrektselt t\u00f6\u00f6. Praeguses versioonis (1.0) on juhtimistasandast kolm p\u00f5hikomponenti: Pilot, Mixer, Citadel. Citadelit me ei k\u00e4sitle, see on vajalik sertifikaatide genereerimiseks, et tagada vastastikuse TLS-i toimimine teenuste vahel. Vaadakem l\u00e4hemalt Pilot'i ja Mixer'i \u00fclesehitust ja otstarvet.<\/p>\n

\"Kuidas
\n
\nPilot on peamine juhtimiskomponent, mis edastab kogu teabe selle kohta, mis meil klastris on \u2013 teenused, nende endpoint'id ja marsruutimise reeglid (nt reeglid Canary deployment'i v\u00f5i circuit breaker'i jaoks).<\/p>\n

Mixer on valikuline juhtimistasandi komponent, mis v\u00f5imaldab koguda m\u00f5\u00f5dikuid, logisid ja k\u00f5ike teavet v\u00f5rguinteraktsiooni kohta. Samuti j\u00e4lgib see poliitikareeglite t\u00e4itmist ja kiiruspiirangutest kinnipidamist.<\/p>\n

Andmetasand rakendatakse sidecar konteinerite-prokside abil. Vaikimisi kasutatakse v\u00f5imsat proksiserverit envoy<\/a><\/noindex>. Seda saab asendada muu rakendusega, n\u00e4iteks nginx (nginmesh).<\/p>\n

Et Istio t\u00f6\u00f6taks rakendustele t\u00e4iesti l\u00e4bipaistvalt, on olemas automaatse s\u00fcstimise s\u00fcsteem. Viimane rakendus sobib Kubernetes'i versioonidele 1.9+ (mutatsiooniline vastuv\u00f5tu veebirakendus). Kubernetes'i versioonide 1.7, 1.8 jaoks on v\u00f5imalik kasutada Initsialiseerijat.<\/p>\n

Sidecar konteinerid \u00fchendavad Pilot'iga GRPC protokolli kaudu, mis v\u00f5imaldab optimeerida muutuste edastamise mudelit, mis toimub klastris. GRPC hakkas olema kasutusel Envoy's alates versioonist 1.6, Istios on see kasutusel alates versioonist 0.8 ja see esindab pilot-agent'i \u2014 golang'i \u00fcmbrist envoy \u00fcle, mis konfigureerib k\u00e4ivitamisparameetreid.<\/p>\n

Pilot ja Mixer on t\u00e4ielikult staatusteta komponendid, k\u00f5ik olekud hoitakse m\u00e4lus. Nende jaoks on konfiguratsioon m\u00e4\u00e4ratud Kubernetes'i kohandatud ressurssidena, mis salvestatakse etcd'sse.
\nIstio-agent saab Pilot'i aadressi ja avab sellele GRPC voog. <\/p>\n

Nagu juba \u00fctlesin, rakendab Istio kogu funktsionaalsuse rakendustele t\u00e4ielikult l\u00e4bipaistvalt. Vaatame, kuidas. Algoritm on j\u00e4rgmine:<\/p>\n

    \n
  1. Paigaldame teenuse uue versiooni.<\/li>\n
  2. S\u00f5ltuvalt sidecar konteineri koostamise l\u00e4henemisest lisatakse istio-init konteiner ja istio-agent konteiner (envoy) konfiguratsiooni rakendamise etapis, v\u00f5i neid v\u00f5ib juba k\u00e4sitsi sisestada Kubernetes Pod'i \u00fcksuse kirjeldusse.<\/li>\n
  3. istio-init konteiner on skript, mis rakendab iptables reeglid pod'i jaoks. On kaks varianti, kuidas seadistada liikluse suunamist istio-agent konteinerisse: kasutada iptables redirect reegleid, v\u00f5i TPROXY<\/a><\/noindex>. Artikli kirjutamise hetkel kasutatakse vaikimisi l\u00e4henemist redirect reeglitega. Istio-init'is on v\u00f5imalus seadistada, millist liiklust tuleb katkestada ja suunata istio-agent'i. N\u00e4iteks, et katkestada kogu sissetulev ja v\u00e4ljaminev liiklus, tuleb seada parameetrid -i<\/code> ja -b<\/code> v\u00e4\u00e4rtuseks *<\/code>. Saate m\u00e4\u00e4rata konkreetsed pordid, mida tuleb katkestada. Et mitte katkestada teatud alamv\u00f5rku, saab seda n\u00e4idata lipu abil -x<\/code>.<\/li>\n
  4. P\u00e4rast init konteinerite t\u00e4itmist k\u00e4ivitatakse peamised konteinerid, sealhulgas pilot-agent (envoy). See \u00fchendub juba juurutatud Pilotiga GRPC kaudu ja saab teavet k\u00f5igi olemasolevate teenuste ja routing poliitikate kohta klasstri sees. Saadud andmete p\u00f5hjal konfigureerib see klastreid ja m\u00e4\u00e4rab neile otsesed endpoint'id meie rakenduste jaoks Kubernetes klasstris. Samuti on oluline m\u00e4rkida, et envoy konfigureerib d\u00fcnaamiliselt listeners (paarid IP, port), mida ta hakkab kuulama. Seet\u00f5ttu, kui p\u00e4ringud sisenevad pod'i, suunatakse need iptables redirect reeglite abil sidecar'isse, envoy suudab juba edukalt need \u00fchendused t\u00f6\u00f6delda ja m\u00f5ista, kuhu liiklus edasi suunata. Samuti toimub sel etapil teabe edastamine Mixer'ile, mida k\u00e4sitleme hiljem, ja j\u00e4lgimise span'ide edastamine.<\/li>\n<\/ol>\n

    \nL\u00f5puks saame terve v\u00f5rgu envoy proksi-servereid, mida saame seadistada \u00fchest kohast (Pilot). K\u00f5ik inbound ja outbound p\u00e4ringud l\u00e4bivad envoy. Samuti katkestatakse ainult TCP liiklus. See t\u00e4hendab, et Kubernetes teenuse IP lahendatakse kube-dns abil UDP kaudu ilma muutmisteta. Seej\u00e4rel toimub p\u00e4rast lahendamist v\u00e4ljamineva p\u00e4ringu katkestamine ja t\u00f6\u00f6tlemine envoy poolt, kes juba otsustab, millisele endpoint'ile p\u00e4ring edastada (v\u00f5i mitte edastada, juurdep\u00e4\u00e4supoliitikate v\u00f5i circuit breaker algoritmi aktiveerimise korral).<\/p>\n

    Oleme Pilotiga tutvunud, n\u00fc\u00fcd on vaja aru saada, kuidas Mixer t\u00f6\u00f6tab ja miks seda vaja on. Ametlikku dokumentatsiooni saab lugeda siit<\/a><\/noindex>.<\/p>\n

    Mixer hetkel koosneb kahest komponendist: istio-telemetry ja istio-policy (enne versiooni 0.8 oli see \u00fcks komponent istio-mixer). M\u00f5lemad on mixer, millest iga\u00fchel on oma \u00fclesanne. Istio telemetry v\u00f5tab GRPC kaudu sidecar konteineritelt Report teavet selle kohta, kuhu keegi l\u00e4heb ja milliste parameetritega. Istio-policy v\u00f5tab vastu Check p\u00e4ringud poliitikareeglite t\u00e4itmise kontrollimiseks. Poliitika kontrollid ei toimu iga p\u00e4ringu puhul, vaid need vahem\u00e4lustatakse kliendis (sidecar) teatud ajaks. Report kontrollid saadetakse hulgip\u00e4ringutena. Kuidas seadistada ja milliseid t\u00e4pseid parameetreid saata vaatame veidi hiljem. <\/p>\n

    Mixer on kavandatud kui k\u00f5rge k\u00e4ttesaadavusega komponent, mis tagab katkestusteta t\u00f6\u00f6 telemeetria andmete kogumisel ja t\u00f6\u00f6tlemisel. S\u00fcsteem kujuneb l\u00f5ppkokkuv\u00f5ttes mitmekihiliseks puhviks. Alguses andmed puhverdatakse sidecar konteinerite k\u00fcljes, seej\u00e4rel mixeris ja saadetakse siis nn mixer back-end'idele. L\u00f5ppkokkuv\u00f5ttes, kui m\u00f5ni s\u00fcsteemi komponent eba\u00f5nnestub, suureneb puhver ja p\u00e4rast s\u00fcsteemi taastumist kustutatakse see. Mixer back-end'id on telemeetria andmete saatmiskohad: statsd, newrelic jne. V\u00f5ib kirjutada oma back-end'i, see on piisavalt lihtne, ja me vaatame, kuidas seda teha.<\/p>\n

    \"Kuidas
    \n
    \nKokkuv\u00f5ttes on istio-telemetry t\u00f6\u00f6 skeem j\u00e4rgmine.<\/p>\n

      \n
    1. Teenuse 1 saadab p\u00e4ringu teenusele 2.<\/li>\n
    2. Teenusest 1 lahkudes pakendatakse p\u00e4ring selle enda sidecar'i.<\/li>\n
    3. Sidecar envoy j\u00e4lgib, kuidas p\u00e4ring teenusesse 2 l\u00e4bib ja valmistab ette vajaliku teabe.<\/li>\n
    4. Seej\u00e4rel saadab ta selle istio-telemetry'ile Report p\u00e4ringuga.<\/li>\n
    5. Istio-telemetry m\u00e4\u00e4rab, kas see Report saata back-end'idele, millistele ning millised andmed edastada.<\/li>\n
    6. Istio-telemetry saadab Report andmed back-end'ile, kui see on vajalik.<\/li>\n<\/ol>\n

      \nN\u00fc\u00fcd vaatame, kuidas m\u00e4\u00e4rata s\u00fcsteemi Istio, mis koosneb ainult p\u00f5hikomponentidest (Pilot ja sidecar envoy).<\/p>\n

      Esiteks vaatame p\u00f5hikonfiguratsiooni (mesh), mille Pilot loeb:<\/p>\n

      apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: istio\n  namespace: istio-system\n  labels:\n    app: istio\n    service: istio\ndata:\n  mesh: |-\n\n    # praegu ei l\u00fclita j\u00e4lgimise teavet saatmist sisse (pilot seadistab envoyd nii, et saatmine ei toimu)\n    enableTracing: false\n\n    # praegu ei m\u00e4\u00e4ra mixer endpoint'e, et sidecar konteinerid ei saadaks teavet sinna\n    #mixerCheckServer: istio-policy.istio-system:15004\n    #mixerReportServer: istio-telemetry.istio-system:15004\n\n    # m\u00e4\u00e4rame ajavahemiku, mille jooksul envoy k\u00fcsib Piloti k\u00e4est uuesti (see kehtib vana versiooni envoy proxy kohta)\n    rdsRefreshDelay: 5s\n\n    # vaikimisi konfiguratsioon envoy sidecar'i jaoks\n    defaultConfig:\n      # samamoodi nagu rdsRefreshDelay\n      discoveryRefreshDelay: 5s\n\n      # j\u00e4tame vaikimisi (tee konfiguratsiooni ja binary envoy'i jaoks)\n      configPath: \"\/etc\/istio\/proxy\"\n      binaryPath: \"\/usr\/local\/bin\/envoy\"\n\n      # vaikimisi nimi k\u00e4ivitatud sidecar konteinerile (kasutatakse n\u00e4iteks teenuse nimedes, kui saadame j\u00e4lgimise span'e)\n      serviceCluster: istio-proxy\n\n      # aeg, mille jooksul envoy ootab, enne kui ta sunnib l\u00f5petama k\u00f5ik avatud \u00fchendused\n      drainDuration: 45s\n      parentShutdownDuration: 1m0s\n\n      # vaikimisi kasutatakse REDIRECT iptables reegleid. Saame muuta TPROXY-ks.\n      #interceptionMode: REDIRECT\n\n      # Port, millel k\u00e4ivitatakse iga sidecar konteineri (envoy) haldusteenus\n      proxyAdminPort: 15000\n\n      # aadress, kuhu saadetakse j\u00e4lgimised zipkin protokolli j\u00e4rgi (alguses l\u00fclitasime saatmise v\u00e4lja, seega see v\u00e4li ei kasutata praegu)\n      zipkinAddress: tracing-collector.tracing:9411\n\n      # statsd aadress envoy konteinerite m\u00f5\u00f5dikute saatmiseks (l\u00fclitame v\u00e4lja)\n      # statsdUdpAddress: aggregator:8126\n\n      # l\u00fclitame v\u00e4lja Mutual TLS toe\n      controlPlaneAuthPolicy: NONE\n\n      # aadress, kus istio-pilot kuulab, et edastada teenuse avastamise teavet k\u00f5igile sidecar konteineritele\n      discoveryAddress: istio-pilot.istio-system:15007\n<\/code><\/pre>\n
      \nK\u00f5ik p\u00f5hikomponendid (control plane) paigutame namespace'i istio-system Kuberneteses.<\/p>\n
      Minimaalselt peame k\u00e4ivitama ainult Piloti. Selleks kasutame sellist konfiguratsiooni.<\/a><\/noindex><\/p>\n
      Ja seadistame k\u00e4sitsi sidecar konteineri sisestamise.<\/p>\n
      Algus konteiner:<\/p>\n
      initContainers:\n - name: istio-init\n   args:\n   - -p\n   - \"15001\"\n   - -u\n   - \"1337\"\n   - -m\n   - REDIRECT\n   - -i\n   - '*'\n   - -b\n   - '*'\n   - -d\n   - \"\"\n   image: istio\/proxy_init:1.0.0\n   imagePullPolicy: IfNotPresent\n   resources:\n     limits:\n       memory: 128Mi\n   securityContext:\n     capabilities:\n       add:\n       - NET_ADMIN\n<\/code><\/pre>\n
      \nJa sidecar:<\/p>\n
             nimi: istio-proxy\n       args:\n         - \"bash\"\n         - \"-c\"\n         - |\n           exec \/usr\/local\/bin\/pilot-agent proxy sidecar \n           --configPath \n           \/etc\/istio\/proxy \n           --binaryPath \n           \/usr\/local\/bin\/envoy \n           --serviceCluster \n           teenus-nimi \n           --drainDuration \n           45s \n           --parentShutdownDuration \n           1m0s \n           --discoveryAddress \n           istio-pilot.istio-system:15007 \n           --discoveryRefreshDelay \n           1s \n           --connectTimeout \n           10s \n           --proxyAdminPort \n           \"15000\" \n           --controlPlaneAuthPolicy \n           NONE\n         env:\n         - name: POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: POD_NAMESPACE\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.namespace\n         - name: INSTANCE_IP\n           valueFrom:\n             fieldRef:\n               fieldPath: status.podIP\n         - name: ISTIO_META_POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: ISTIO_META_INTERCEPTION_MODE\n           value: REDIRECT\n         image: istio\/proxyv2:1.0.0\n         imagePullPolicy: IfNotPresent\n         resources:\n           requests:\n             cpu: 100m\n             memory: 128Mi\n           limits:\n             memory: 2048Mi\n         securityContext:\n           privileged: false\n           readOnlyRootFilesystem: true\n           runAsUser: 1337\n         volumeMounts:\n         - mountPath: \/etc\/istio\/proxy\n           name: istio-envoy\n<\/code><\/pre>\n
      \nSelleks, et k\u00f5ik sujuks, tuleb luua ServiceAccount, ClusterRole, ClusterRoleBinding ja CRD Pilot jaoks, mille kirjeldused on kergesti leitavad siit<\/a><\/noindex>. <\/p>\n
      L\u00f5puks peab teenus, kuhu me inject\u2019ime sidecar koos envoy\u2019ga, edukalt k\u00e4ivituma, saama kogu discovery\u2019st piloodi kaudu ja t\u00f6\u00f6tlema p\u00e4ringuid.<\/p>\n
      Oluline on m\u00f5ista, et k\u00f5ik control plane\u2019i komponendid on stateless rakendused ja neid saab probleemideta horisontaalselt skaleerida. K\u00f5ik andmed asuvad etcd-s kohandatud Kubernetes'i ressursikirjelduste kujul.<\/p>\n
      Lisaks on Istio (praegu veel katsetusfaasis) v\u00f5imalus t\u00f6\u00f6tada v\u00e4ljaspool klastri ja jagada teenuse avastust mitme Kubernetes'i klastre vahel. Rohkem teavet selle kohta on saadaval siit<\/a><\/noindex>.<\/p>\n
      Mitme klastri installatsiooni puhul tuleb arvesse v\u00f5tta j\u00e4rgmisi piiranguid:<\/p>\n
        \n
      1. Pod CIDR ja Service CIDR peavad olema unikaalsed k\u00f5ikides klastrites ja ei tohi kattuda.<\/li>\n
      2. K\u00f5ik Pod CIDR-id peavad olema juurdep\u00e4\u00e4setavad \u00fcksk\u00f5ik millisest Pod CIDR-ist klastrite vahel.<\/li>\n
      3. K\u00f5ik Kubernetes API serverid peavad olema \u00fcksteisega juurdep\u00e4\u00e4setavad.<\/li>\n<\/ol>\n
        \nNeed on algsed teadmised, mis aitavad teil alustada Istio kasutamist. Siiski on veel palju peeneid aspekte. N\u00e4iteks v\u00e4lise liikluse marsruutimise erip\u00e4rad (v\u00e4ljas poole klastrit), sidecar\u2019ide t\u00f5rkeotsingu l\u00e4henemisviisid, profileerimine, mixeri seadistamine ja kohandatud mixeri taustteenuse loomine, j\u00e4lgimismekanismi seadistamine ja selle toimimine envoy kaudu.
        \nK\u00f5ik seda k\u00e4sitleme j\u00e4rgmistes publikatsioonides. Esitage oma k\u00fcsimused, p\u00fc\u00fcan need selgeks teha.
        \n
        Allikas:         habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
        \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kuidas k\u00e4ivitada Istio kasutades Kubernetes'i tootmises. Osa 1 | ProHoster","description":"Mis on Istio? See on nn teenuste v\u00f5rk, tehnoloogia, mis lisab v\u00f5rgu kohale abstraktsioonitaseme.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Istio, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Kubernetes \u0432 production. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:description":"\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:48:48+00:00","article:modified_time":"2019-10-31T18:48:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 12:27:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:53:24","updated":"2026-01-21 12:27:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/32766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=32766"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/32766\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/24545"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=32766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=32766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=32766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}