🥇 Hekenga mai i Nginx ki Envoy Proxy

Kia ora, Habr! Ka kawea atu e ahau ki a koutou he whakamaoritanga o te panui: Hekenga mai i Nginx ki Envoy Proxy.

Ko te Envoy he tūmau takawaenga tohatoha nui-mahi (i tuhia ki te C ++) i hangaia mo nga ratonga takitahi me nga tono, he pahi korero me te "rererangi raraunga ao" i hangaia mo nga hoahoanga microservice "mesh mesh" nui. I te wa e hanga ana, ko nga otinga ki nga raru i puta mai i te wa o te whakawhanaketanga o nga kaitoro penei i te NGINX, HAProxy, nga taputapu taputapu me nga taurite kawenga kapua i whakaarohia. Ka mahi te Envoy i te taha o ia tono me te tango i te whatunga hei whakarato i nga mahi noa ahakoa he aha te turanga. Ina rere nga waka ratonga katoa i roto i tetahi hanganga i roto i te kupenga Envoy, ka ngawari ki te tiro i nga waahi raru me te rite tonu o te tirohanga, te whakakoi i nga mahi katoa, me te taapiri i nga mahi matua ki tetahi waahi motuhake.

Ngā āhuatanga

Te hoahoanga-waho-tukatuka: ko te karere he kaimau-a-tinana, he tino mahi nui e tango ana i te iti o te RAM. Ka mahi tahi me tetahi reo tono, angamahi ranei.
Tautoko http/2 me te grpc: kei te karere he http/2 me te tautoko grpc tuatahi mo nga hononga taumai me nga hononga putaatu. He takawaenga maramara tenei mai i te http/1.1 ki te http/2.
Te Whakataunga Uta Ake: ka tautokohia e te karere nga ahuatanga o te whakaea i te utaina o mua, tae atu ki te whakahoki aunoa, te pakaru o nga mekameka, te aukati i te reeti o te ao, te tono whakamarumaru, te whakataurite kawenga rohe, aha atu.
API Whakahaere Whirihoranga: Ka whakaratohia e te karere he API pakari mo te whakahaere hihiri i to whirihoranga.
Te Tirohanga: Te tirohanga hohonu o te waka L7, te tautoko taketake mo te tohatoha tohatoha me te maataki o mongodb, dynamodb me te maha atu o nga tono.

Hipanga 1 - Tauira NGINX Config

Ka whakamahia e tenei tuhinga tetahi konae i hangaia motuhake nginx.conf, i runga i te tauira katoa mai i NGINX Wiki. Ka taea e koe te tiro i te whirihoranga i roto i te ētita ma te whakatuwhera nginx.conf

whirihora puna nginx

user  www www;
pid /var/run/nginx.pid;
worker_processes  2;

events {
  worker_connections   2000;
}

http {
  gzip on;
  gzip_min_length  1100;
  gzip_buffers     4 8k;
  gzip_types       text/plain;

  log_format main      '$remote_addr - $remote_user [$time_local]  '
    '"$request" $status $bytes_sent '
    '"$http_referer" "$http_user_agent" '
    '"$gzip_ratio"';

  log_format download  '$remote_addr - $remote_user [$time_local]  '
    '"$request" $status $bytes_sent '
    '"$http_referer" "$http_user_agent" '
    '"$http_range" "$sent_http_content_range"';

  upstream targetCluster {
    172.18.0.3:80;
    172.18.0.4:80;
  }

  server {
    listen        8080;
    server_name   one.example.com  www.one.example.com;

    access_log   /var/log/nginx.access_log  main;
    error_log  /var/log/nginx.error_log  info;

    location / {
      proxy_pass         http://targetCluster/;
      proxy_redirect     off;

      proxy_set_header   Host             $host;
      proxy_set_header   X-Real-IP        $remote_addr;
    }
  }
}

Ko nga whirihoranga NGINX e toru nga waahanga matua:

Te whirihora i te tūmau NGINX, te hanganga rangitaki me te mahinga Gzip. Ka tautuhia tenei i te ao katoa i nga keehi katoa.
Te whirihora i te NGINX ki te whakaae ki nga tono ki te kaihautu one.example.com i runga i te tauranga 8080.
Te whakarite i te waahi whainga, me pehea te whakahaere waka mo nga waahanga rereke o te URL.

Kaore nga whirihoranga katoa e pa ki te Takawaenga Envoy, a kaore koe e hiahia ki te whirihora i etahi tautuhinga. Kei a Envoy Proxy e wha nga momo matua, e tautoko ana i nga hanganga matua e tukuna ana e NGINX. Ko te matua:

Kai whakarongo: Ka whakatauhia me pehea te whakaae a Envoy Proxy i nga tono taumai. I tenei wa ka tautokohia e Envoy Proxy nga kaiwhakarongo-a-TCP anake. Kia tau te hononga, ka tukuna ki te huinga whiriwhiringa hei tukatuka.
Tātari: He waahanga enei o te hoahoanga paipa e taea ai te tukatuka i nga raraunga taumai me te puta. Kei roto i tenei mahinga nga whiriwhiringa penei i a Gzip, e kopiri ana i nga raraunga i mua i te tuku ki te kiritaki.
Pouara: Ka tukuna e ratou nga waka ki te waahi e hiahiatia ana, kua tautuhia hei tautau.
Rōpū: Ka tautuhia e ratou te mutunga mo nga waka me nga tawhā whirihoranga.

Ka whakamahia e matou enei waahanga e wha hei hanga i tetahi whirihoranga Envoy Proxy kia rite ki tetahi whirihoranga NGINX motuhake. Ko te whainga a Envoy ko te mahi tahi me nga API me te whirihoranga hihiri. I roto i tenei take, ka whakamahia e te whirihoranga turanga nga tautuhinga pateko, maataki-waehere mai i NGINX.

Hipanga 2 - Whirihoranga NGINX

Ko te wahi tuatahi nginx.conf ka tautuhi etahi NGINX o roto e tika ana kia whirihora.

Hononga Kaimahi

Ko te whirihoranga i raro nei ka whakatau i te maha o nga tukanga kaimahi me nga hononga. E tohu ana tenei me pehea te utu a NGINX ki te whakatutuki i te tono.

worker_processes  2;

events {
  worker_connections   2000;
}

Ka whakahaerehia e Envoy Proxy nga rerenga mahi me nga hononga ki nga huarahi rereke.

Ka hangaia e Envoy he miro kaimahi mo ia miro taputapu i roto i te punaha. Ka mahia e ia miro kaimahi he takahanga kore-aukati hei kawenga

Te whakarongo ki ia kaiwhakarongo
Te whakaae ki nga hononga hou
Te hanga huinga whiriwhiringa mo tetahi hononga
Tukatia nga mahi I/O katoa i te wa e ora ana te hononga.

Ko nga tukatuka hononga katoa ka whakahaerehia katoa i roto i te miro kaimahi, tae atu ki nga whanonga whakamua.

Mo ia miro kaimahi i te Envoy, he puna hono. Na ko nga puna hononga HTTP/2 anake ka whakatuu kotahi hononga mo ia kaihautu o waho i te wa kotahi, mena e wha nga miro kaimahi ka wha nga hononga HTTP/2 mo ia kaihautu o waho i roto i te ahua pumau. Ma te pupuri i nga mea katoa i roto i te miro kaimahi kotahi, tata katoa ka taea te tuhi me te kore e aukati, me te mea he miro kotahi. Mena ka tohatohahia nga miro kaimahi nui atu i te mea e tika ana, ka raru pea te maharahara, te hanga i te maha o nga hononga mangere, me te whakaiti i te maha o nga wa ka hoki mai nga hononga ki te puna.

Mo etahi atu korero haere mai blog Takawaenga karere.

Whirihoranga HTTP

Ko te paraka whirihoranga NGINX e whai ake nei e tautuhi ana i nga tautuhinga HTTP penei:

He aha nga momo mime e tautokohia ana
Nga Waahi Taunoa
Whirihoranga Gzip

Ka taea e koe te whakarite i enei waahanga ma te whakamahi i nga whiriwhiringa i te Envoy Proxy, ka korerohia e tatou i muri mai.

Hipanga 3 - Whirihoranga Tūmau

I roto i te poraka whirihoranga HTTP, ka tohua e te whirihoranga NGINX ki te whakarongo ki te tauranga 8080 me te whakautu ki nga tono taumai mo nga rohe. one.example.com и www.one.example.com.

 server {
    listen        8080;
    server_name   one.example.com  www.one.example.com;

I roto i te Envoy, kei te whakahaeretia e te hunga whakarongo.

Te hunga whakarongo karere

Ko te waahanga nui o te tiimata me te Envoy Proxy ko te tautuhi i o hunga whakarongo. Me hanga e koe he konae whirihoranga e whakaatu ana me pehea e hiahia ana koe ki te whakahaere i te tauira Envoy.

Ko te snippet i raro nei ka hanga he kaiwhakarongo hou ka herea ki te tauranga 8080. Ko te whirihoranga e whakaatu ana ki a Envoy Proxy ko nga tauranga e tika ana kia herea mo nga tono taumai.

Ka whakamahia e Envoy Proxy te tohu YAML mo tana whirihoranga. Mo te kupu whakataki ki tenei tohu, tirohia konei hono.

Copy to Editorstatic_resources:
  listeners:
  - name: listener_0
    address:
      socket_address: { address: 0.0.0.0, port_value: 8080 }

Kaore he take ki te tautuhi server_name, i te mea ka whakahaerea e nga whiriwhiringa Takawaenga Envoy tenei.

Hipanga 4 - Whirihoranga Tauwāhi

Ina tae mai he tono ki roto i te NGINX, ka whakatauhia e te poraka waahi me pehea te tukatuka me te waahi ki te huarahi i nga waka. I te wahanga e whai ake nei, ka whakawhitia nga waka katoa ki te pae ki te awa whakarunga (te tuhipoka a te kaiwhakamaori: te nuinga o te awa ko te tuumau tono) kahui kua whakaingoatia. TargetCluster. Ka tautuhia e te kahui whakarunga nga pona hei tukatuka i te tono. Ka matapakihia e tatou tenei i te waahanga e whai ake nei.

location / {
    proxy_pass         http://targetCluster/;
    proxy_redirect     off;

    proxy_set_header   Host             $host;
    proxy_set_header   X-Real-IP        $remote_addr;
}

I te Envoy, ka mahia e nga Tatari tenei.

Tātari karere

Mo te whirihoranga pateko, ka whakatauhia e nga tātari me pehea te tukatuka i nga tono taumai. I tenei take ka tautuhia e matou nga whiriwhiringa e rite ana ingoa_tūmau i te taahiraa o mua. Ina tae mai nga tono taumai e rite ana ki etahi rohe me etahi huarahi, ka tukuna nga waka ki te tautau. He rite tenei ki te NGINX whirihoranga raro-runga.

Copy to Editor    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        config:
          codec_type: auto
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: backend
              domains:
                - "one.example.com"
                - "www.one.example.com"
              routes:
              - match:
                  prefix: "/"
                route:
                  cluster: targetCluster
          http_filters:
          - name: envoy.router

ingoa karere.http_connection_manager he tātari hanga-i roto i te Envoy Proxy. Ko etahi atu whiriwhiringa kei roto Redis, Mongo, TCP. Ka kitea e koe te rarangi katoa i tuhinga.

Mo te roanga atu o nga korero mo etahi atu kaupapa here whakataurite, tirohia Tuhinga Tono.

Hipanga 5 - Takawaenga me te Whirihoranga Whakarunga

I roto i te NGINX, ka tautuhia e te whirihoranga whakarunga he huinga o nga kaitoro whainga hei whakahaere i nga waka. I tenei keehi, e rua nga roopu kua tohua.

  upstream targetCluster {
    172.18.0.3:80;
    172.18.0.4:80;
  }

I roto i te Envoy, kei te whakahaerehia tenei e nga tautau.

Huinga Karere

Ko te ahua o runga ka kiia he tautau. I tenei keehi, kua tautuhia nga kaihautu ka mahi i nga waka. Ko te huarahi e uru atu ai nga kaihautu, penei i nga wa ota, kua tautuhia hei whirihoranga huinga. Ma tenei ka kaha ake te mana whakahaere mo nga ahuatanga penei i te roanga me te whakataurite kawenga.

Copy to Editor  clusters:
  - name: targetCluster
    connect_timeout: 0.25s
    type: STRICT_DNS
    dns_lookup_family: V4_ONLY
    lb_policy: ROUND_ROBIN
    hosts: [
      { socket_address: { address: 172.18.0.3, port_value: 80 }},
      { socket_address: { address: 172.18.0.4, port_value: 80 }}
    ]

Ina whakamahi ana i te kitenga ratonga STRICT_DNS Ka whakatauhia e te Envoy nga whaainga DNS kua tohua. Ko ia wahitau IP kua whakahokia mai i te hua DNS ka kiia he kaihautu marama i te kahui whakarunga. Ko te tikanga, ki te whakahokia mai e te tono nga wahitau IP e rua, ka whakaaro a Envoy e rua nga kaihautu kei roto i te tautau, a me taurite te kawenga e rua. Mena ka tangohia tetahi kaihautu mai i te hua, ka kii a Envoy kua kore e noho, ka toia mai nga waka mai i nga puna hononga o naianei.

ДД ояяй Tuhinga takawaenga karere.

Hipanga 6 - Takiuru Uru me nga Hapa

Ko te whirihoranga whakamutunga ko te rehitatanga. Engari ki te pana i nga raarangi hapa ki te kopae, ka mau te Envoy Proxy ki te huarahi kapua. Ko nga raarangi tono katoa he putanga ki stdout и stderr.

I te wa e tono ana nga kaiwhakamahi, ko nga raarangi uru he mea kowhiringa ka monokia ma te taunoa. Hei whakaahei i nga raarangi uru mo nga tono HTTP, whakaaheitia te whirihoranga uru_takiuru mo te kaiwhakahaere hononga HTTP. Ko te ara ka taea he taputapu penei stdout, he konae ranei kei runga i te kōpae, i runga i o hiahia.

Ko te whirihoranga e whai ake nei ka anga i nga raarangi uru katoa ki stdout (te tuhipoka a te kaiwhakamaori - me whakamahi a stdout i te karere i roto i te docker. Mena ka whakamahia me te kore he docker, katahi ka whakakapihia te /dev/stdout ki te ara ki te konae rangitaki. Tāruahia te snippet ki te waahanga whirihoranga mo te kaiwhakahaere hononga:

Copy to Clipboardaccess_log:
- name: envoy.file_access_log
  config:
    path: "/dev/stdout"

Me penei nga hua:

      - name: envoy.http_connection_manager
        config:
          codec_type: auto
          stat_prefix: ingress_http
          access_log:
          - name: envoy.file_access_log
            config:
              path: "/dev/stdout"
          route_config:

Ma te taunoa, he aho whakatakotoranga a Envoy kei roto nga korero mo te tono HTTP:

[%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"n

Ko te hua o tenei aho whakatakotoranga ko:

[2018-11-23T04:51:00.281Z] "GET / HTTP/1.1" 200 - 0 58 4 1 "-" "curl/7.47.0" "f21ebd42-6770-4aa5-88d4-e56118165a7d" "one.example.com" "172.18.0.4:80"

Ko te ihirangi putanga ka taea te whakarite ma te whakarite i te mara whakatakotoranga. Hei tauira:

access_log:
- name: envoy.file_access_log
  config:
    path: "/dev/stdout"
    format: "[%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"n"

Ka taea hoki e te raina rangitaki te whakaputa ki te whakatakotoranga JSON ma te tautuhi i te mara json_format. Hei tauira:

access_log:
- name: envoy.file_access_log
  config:
    path: "/dev/stdout"
    json_format: {"protocol": "%PROTOCOL%", "duration": "%DURATION%", "request_method": "%REQ(:METHOD)%"}

Mo etahi atu korero mo te Tikanga Rehitatanga Envoy, toro

https://www.envoyproxy.io/docs/envoy/latest/configuration/access_log#config-access-log-format-dictionaries

Ehara i te mea ko te rakaraka anake te huarahi ki te whai matauranga ki te mahi me te Envoy Proxy. Kei roto i a ia nga whaiwhainga matatau me nga inenga kaha kua whakauruhia ki roto. Ka kitea e koe etahi atu korero i te whai tuhinga na roto ranei Tuhituhi whakataki tauwhitiwhiti.

Hipanga 7 - Whakarewa

Kua heke koe i to whirihoranga mai i NGINX ki Envoy Proxy. Ko te mahi whakamutunga ko te whakarewa i tetahi tauira Envoy Proxy hei whakamatautau.

Whakahaere hei kaiwhakamahi

I te tihi o te raina whirihoranga NGINX kaiwhakamahi www www; e tohu ana ki te whakahaere i te NGINX hei kaiwhakamahi whai mana iti hei whakapai ake i te haumarutanga.

Ka mau te Envoy Proxy i te huarahi-kapua ki te whakahaere i a wai te tikanga. Ka whakahaerehia e matou te Envoy Proxy ma roto i tetahi ipu, ka taea e matou te tohu he kaiwhakamahi whai mana iti.

Whakarewa i te Takawaenga Karere

Ko te whakahau i raro nei ka whakahaere i te Envoy Proxy i roto i te ipu Docker i runga i te kaihautu. Ko tenei whakahau ka hoatu ki a Envoy te kaha ki te whakarongo mo nga tono taumai i runga i te tauranga 80. Heoi, i te mea kua tohua i roto i te whirihoranga kaiwhakarongo, ka whakarongo a Envoy Proxy mo nga waka taumai i runga i te tauranga 8080. Ma tenei ka taea e te tukanga te whakahaere hei kaiwhakamahi iti.

docker run --name proxy1 -p 80:8080 --user 1000:1000 -v /root/envoy.yaml:/etc/envoy/envoy.yaml envoyproxy/envoy

Te whakamātautau

Ma te mahi takawaenga, ka taea te mahi me te tukatuka i nga whakamatautau. Ko te whakahau cURL e whai ake nei ka tukuna he tono me te pane kaihautu kua tautuhia i roto i te whirihoranga takawaenga.

curl -H "Host: one.example.com" localhost -i

Ko te tono HTTP ka puta he hapa 503. Ko tenei na te mea karekau nga hononga whakarunga e mahi ana, kaore i te waatea. No reira, karekau he waahi mo te Envoy Proxy mo te tono. Ko te whakahau e whai ake nei ka tiimata te raupapa o nga ratonga HTTP e rite ana ki te whirihoranga kua tautuhia mo Envoy.

docker run -d katacoda/docker-http-server; docker run -d katacoda/docker-http-server;

Ma nga ratonga e waatea ana, ka taea e Envoy te takawaenga i nga waka ki tona haerenga.

curl -H "Host: one.example.com" localhost -i

Me kite koe i tetahi whakautu e tohu ana ko wai te ipu Docker i tukatuka te tono. I roto i nga raarangi Envoy Proxy me kite ano koe i tetahi putanga aho uru.

Ētahi atu pane Whakautu HTTP

Ka kite koe i etahi atu pane HTTP i roto i nga pane whakautu o te tono tuturu. Ka whakaatu te pane i te wa i whakapaua e te kaihautu whakarunga ki te tukatuka i te tono. Whakaatuhia i roto i nga haumano. Ka whai hua tenei ki te hiahia te kiritaki ki te whakatau i te wa ratonga ka whakaritea ki te torohūtanga whatunga.

x-envoy-upstream-service-time: 0
server: envoy

Whiriwhiringa whakamutunga

static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address: { address: 0.0.0.0, port_value: 8080 }
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        config:
          codec_type: auto
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: backend
              domains:
                - "one.example.com"
                - "www.one.example.com"
              routes:
              - match:
                  prefix: "/"
                route:
                  cluster: targetCluster
          http_filters:
          - name: envoy.router
          clusters:
  - name: targetCluster
    connect_timeout: 0.25s
    type: STRICT_DNS
    dns_lookup_family: V4_ONLY
    lb_policy: ROUND_ROBIN
    hosts: [
      { socket_address: { address: 172.18.0.3, port_value: 80 }},
      { socket_address: { address: 172.18.0.4, port_value: 80 }}
    ]

admin:
  access_log_path: /tmp/admin_access.log
  address:
    socket_address: { address: 0.0.0.0, port_value: 9090 }

He korero taapiri mai i te kaiwhakamaori

Ka kitea nga tohutohu mo te whakaurunga Envoy Proxy i runga i te paetukutuku https://www.getenvoy.io/

Ma te taunoa, karekau he whirihora ratonga a te rpm.

Tāpirihia te whirihora ratonga systemd /etc/systemd/system/envoy.service:

[Unit]
Description=Envoy Proxy
Documentation=https://www.envoyproxy.io/
After=network-online.target
Requires=envoy-auth-server.service
Wants=nginx.service

[Service]
User=root
Restart=on-failure
ExecStart=/usr/bin/envoy --config-path /etc/envoy/config.yaml
[Install]
WantedBy=multi-user.target

Me hanga e koe he whaiaronga /etc/envoy/ ka waiho te config.yaml config ki reira.

He korerorero waea ma te whakamahi i te takawaenga karere: https://t.me/envoyproxy_ru

Karekau te Envoy Proxy e tautoko i te tuku i nga ihirangi pateko. No reira, ko wai ka ahei te pooti mo te ahuatanga: https://github.com/envoyproxy/envoy/issues/378

Ko nga kaiwhakamahi kua rehita anake ka uru ki te rangahau. Waitohu maitēnā.

I akiakihia koe e tenei panui ki te whakauru me te whakamatautau i te takawaenga karere?

ae
kahore

75 nga kaiwhakamahi i pooti. 18 nga kaiwhakamahi i aukati.

Source: will.com

Hekenga mai i Nginx ki Envoy Proxy