Ko te aroturuki hononga ("conntrack") he mahi matua o te puranga whatunga kernel Linux. Mā tēnei ka taea e te kernel te aroturuki i ngā hononga whatunga arorau katoa, i ngā rerenga rānei, ā, mā reira ka tautuhia ngā mōkihi katoa e hanga ana i ia rerenga kia taea ai te tukatuka i ia raupapatanga.
He āhuatanga nui a Conntrack i roto i te kernel e whakamahia ana i ētahi wā taketake:
- Ka whakawhirinaki a NAT ki ngā mōhiohio mai i a conntrack kia taea ai e ia te whakahaere i ngā mōkihi katoa mai i te rere kotahi kia ōrite. Hei tauira, ina uru atu tētahi pod ki tētahi ratonga Kubernetes, ka whakamahia e te kaiwhakataurite kawenga kube-proxy te NAT hei arahi i te hokohoko ki tētahi pod motuhake i roto i te taupū. Ka tuhia e Conntrack mō tētahi hononga, me tuku ngā mōkihi katoa ki te ratonga IP ki te pod kotahi, ā, ko ngā mōkihi i whakahokia mai e te pod backend me arahi e NAT ki te pod i tīmata ai te tono.
- Ka whakawhirinaki ngā pareārai ahi āhua rite ki a Calico ki ngā mōhiohio hononga hei whakamā i ngā waka "whakautu". Mā tēnei ka taea e koe te tuhi i tētahi kaupapa here whatunga e kī ana, "Tukua taku pod kia hono atu ki tētahi wāhitau IP mamao," me te kore e hiahia ki te tuhi i tētahi kaupapa here hei whakaae mārama i ngā waka whakautu. (Ki te kore tēnei, me tāpiri e koe tētahi ture iti ake te haumaru e kī ana, "Tukua ngā mōkihi ki taku pod mai i tētahi wāhitau IP.")
Hei tāpiritanga, ka whakapai ake a conntrack i te mahi a te pūnaha (mā te whakaiti i te whakapaunga CPU me te whakaroa o te mōkihi) nā te mea ko te mōkihi tuatahi anake i roto i te rerenga
me haere mā te puranga whatunga katoa kia mōhio ai koe ki te aha e mahia ki a ia. Tirohia te pou "" kia kite i tētahi tauira o te mahi a tēnei.
Heoi anō, he iti noa iho ngā herenga o te conntrack…
Nō reira, i hea te hē o te katoa?
He rahi mōrahi ka taea te whirihora i te ripanga hononga, ā, ki te kī, ka tīmata te whakakore, te whakataka rānei i ngā hononga. He nui te wāhi wātea o te ripanga hei whakahaere i te maha o ngā tono, ā, e kore rawa tēnei e waiho hei raruraru. Heoi, he iti noa ngā āhuatanga e tika ana kia whakaarohia te whakamahi i te ripanga hononga:
- Ko te āhuatanga tino kitea ko te mea ka whakahaerehia e tō tūmau he maha rawa ngā hononga hohe e mahi tahi ana. Hei tauira, ki te whirihorahia tō ripanga hononga mō ngā tāurunga 128k, engari he nui ake i te 128k ō hononga mahi tahi, tera pea ka raru koe!
- He tauira kāore i te tino kitea: ki te whakahaerehia e tō tūmau he maha rawa ngā hononga ia hekona. Ahakoa he poto noa te roa o ngā hononga, ka aroturukihia tonutia e Linux mō tētahi wā (120 hēkona te taunoa). Hei tauira, ki te whirihorahia tō ripanga hononga mō te 128 ngā tāurunga, ā, ka ngana koe ki te whakahaere i te 1100 hononga ia hekona, ka nui ake i te rahi o te ripanga hononga, ahakoa he poto noa te roa o ngā hononga (128k / 120 hēkona = 1092 hononga/hēkona).
He maha ngā momo tono motuhake e taka ana ki roto i ēnei kāwai. Hei tāpiri, ki te mea he nui āu kaiwhakamahi kino, ka taea te whakamahi i te whakakī i te ripanga conntrack o tō tūmau ki ngā hononga tuwhera-haurua maha hei wāhanga o te whakaeke whakakore-ratonga (DOS). I ngā wā e rua, ka taea e conntrack te noho hei aukati i roto i tō pūnaha. I ētahi wā, ko te whakarerekē i ngā tawhā ripanga conntrack—te whakanui ake i te rahi, te whakaiti rānei i ngā wā mutu conntrack—tērā pea ka ranea hei whakatutuki i ō hiahia (engari ki te hē te mahi, ka raru koe). I ētahi atu wā, me karo i te conntrack mō te waka kaha.
He tauira tūturu
Hei tauira tuturu, he maha ngā tūmau memcached a tētahi kaiwhakarato SaaS nui i mahi tahi mātou me ia i runga i ngā kaihautū (ehara i te mīhini mariko), ā, e 50K+ ngā hononga poto ia hekona i taea ai e ia tūmau te whakahaere.
I whakamātau rātou i te whirihoranga conntrack, i whakanui ake i te rahi o ngā ripanga, i whakaiti hoki i te wā aroturuki, engari kāore i pono te whirihoranga, i tino piki ake te whakapaunga RAM, he raruraru tēnei (neke atu i te GB!), ā, he poto rawa ngā hononga, kāore i puta i a conntrack ōna painga mahi noa (te whakaiti i te whakapaunga CPU, te whakaroa rānei o te mōkihi).
Hei huarahi kē atu, i tahuri rātou ki a Calico. Mā ngā kaupapa here whatunga a Calico ka taea e rātou te karo i a Conntrack mō ētahi momo waka (mā te whakamahi i te kōwhiringa kaupapa here doNotTrack). Nā tēnei i whiwhi rātou i te taumata mahi e hiahiatia ana me te haumarutanga tāpiri i whakaratohia e Calico.
Kia pēhea te roa hei karo i te hononga?
- Ko ngā kaupapa here whatunga "Kaua e Aroturuki" me ōrite te tikanga. Mō tētahi kaiwhakarato SaaS, i whakahaerehia ā rātou tono i roto i tētahi rohe tiaki, nō reira ka taea e rātou te whakamahi i tētahi kaupapa here whatunga hei whakamā i ngā waka mai i ētahi atu tono motuhake i whakaaetia kia uru atu ki te memcached.
- Kāore te kaupapa here kaua-e-aroturuki e whai whakaaro ki te ahunga hononga. Nō reira, ki te taumanutia tētahi tūmau memcached, ka taea e ia te ngana ki te hono atu ki tētahi kiritaki memcached mēnā e whakamahi ana i te tauranga pūtake tika. Heoi, ki te mea kua tautuhia tika e koe te kaupapa here whatunga mō ō kiritaki memcached, ka whakakahoretia tonutia ēnei nganatanga hononga i te taha kiritaki.
- Ka whakamahia te kaupapa here kaua-e-aroturuki ki ia kete, he rerekē ki ngā kaupapa here paerewa, e whakamahia ana ki te kete tuatahi anake i roto i te rerenga. Ka taea e tēnei te whakanui ake i te whakamahinga CPU mō ia kete, nā te mea me whakamahi te kaupapa here ki ia kete. Heoi, mō ngā hononga poto te roa, ka whakakorengia tēnei utu nui e te whakaiti i te whakamahinga rauemi o te aroturuki hononga. Hei tauira, i roto i te take o tētahi kaiwhakarato SaaS, he iti rawa te maha o ngā kete mō ia hononga, nō reira he tika te whakamahinga CPU tāpiri o te whakamahi kaupapa here ki ia kete.
Me tīmata tātou ki te whakamātautau
I whakahaerehia e mātou te whakamātautau i runga i tētahi pod tūmau memcached kotahi me ngā pod kiritaki memcached maha e rere ana i runga i ngā pona mamao, ā, ka taea e mātou te whakahaere i te maha o ngā hononga ia hekona. E 8 ngā matua o te tūmau e manaaki ana i te pod tūmau memcached me ngā tāurunga 512k i roto i te ripanga hononga (te rahi ripanga taunoa mō te kaihautū).
I ine mātou i te rerekētanga mahi i waenga i: te kore kaupapa here whatunga; he kaupapa here Calico noa; me te kaupapa here kaua-aroturuki Calico.
Mō te whakamātautau tuatahi, i whakatakotoria e mātou te maha o ngā hononga ki te 4.000 ia hekona kia taea ai e mātou te arotahi ki te rerekētanga o te whakapaunga CPU. Kāore he rerekētanga nui i waenga i te kaupapa here kore-kaua-aroturuki me te kaupapa here paerewa, engari ko te pikinga o te whakapaunga CPU mā te 20% pea.
I te whakamātautau tuarua, i whakarewahia e mātou te maha o ngā hononga ka taea e ā mātou kiritaki te whakaputa, ā, i inehia te maha mōrahi o ngā hononga ia hekona ka taea e tā mātou tūmau memcached te whakahaere. E ai ki te whakaaro, i eke ngā take "kāore he kaupapa here" me te "kaupapa here noa" ki te rohe hononga neke atu i te 4,000 hononga ia hekona (512k / 120s = 4,369 hononga/s). Mā te kaupapa here kaua-e-aroturuki, i tukuna e ā mātou kiritaki te 60,000 hononga ia hekona me te kore he raruraru. E tino mohio ana mātou kua taea e mātou te whakanui ake i tēnei tau mā te hono atu i ētahi atu kiritaki, engari ki tā mātou he nui ēnei tau hei whakaatu i te kaupapa o tēnei tuhinga!
mutunga
He āhuatanga nui a Conntrack i roto i te kernel. He pai tana mahi. He maha ngā wā ka whakamahia e ngā wāhanga matua o te pūnaha. Heoi, i ētahi wā, ko te utu nui i puta mai i a Conntrack he nui ake i ōna painga noa. I tēnei wā, ka taea te whakamahi i ngā kaupapa here whatunga Calico hei whakakore i a Conntrack me te whakarei ake i te haumarutanga whatunga. Mō ngā atu waka katoa, ka noho tonu a Conntrack hei hoa mōu!
Panuihia etahi atu tuhinga i runga i ta maatau blog:
Source: will.com
