🥇Performance Orchestra

Sichingakhale cholakwika kunena kuti anthu abwino kwambiri
kupeza chimwemwe kudzera m'masautso.
Ludwig van Beethoven

Ndine Sergey, ndimagwira ntchito ku Yandex.Money mu gulu lofufuza ntchito. Ndikufuna ndikuuzeni chiyambi cha nkhani ya njira yathu yogwiritsira ntchito orchestration - momwe tidasankhira zida ndi zomwe tidaziganizira. Zochitika zonse kuchokera m'nkhaniyi zikuchitika mu nthawi yeniyeni, kotero inu, owerenga okondedwa, mukutsatira chitukuko cha zochitikazo pafupifupi moyo.

Chifukwa chiyani timafunikira kondakitala pagulu lathu?

Kondakitala ndi ndani? Kuchokera ku fr. diriger - kuyang'anira, kutsogolera, kutsogolera - mu dziko la nyimbo - uyu ndi munthu yemwe ali mtsogoleri wa maphunziro ndi machitidwe a nyimbo zonse. Kwa ife, malowa amakhala ndi orchestration ndi automation systems.

Udindo wawo suli wosiyana ndi udindo wa wotsogolera nyimbo - amafunikira kuthandiza gulu, kutsogolera ndi kukonza sewero lake.

Monga lamulo, gulu limakhala ndi mphamvu zina - tiyeni tiwatchule ma seva - momwe amachitira ntchito zawo.

Njira yopezera ndi kugwiritsa ntchito ma seva awa ndi osiyanasiyana. Zitsanzo zingapo:

Gululo limapanga pempho, mwachitsanzo, ku gulu la ntchito, kuti awapatse zipangizo ndi magawo ena.
Gulu la opareshoni limawapatsa kuchuluka komwe kumafunikira - mtambo kapena chitsulo chopanda kanthu - ndikulonjeza kuti azisunga bwino malinga ndi SLA. Kukonzekera kumapangidwanso ndi gulu la ntchito.
Gululo limalandira kokha mtambo kapena zitsulo zopanda kanthu kuchokera ku gulu la ntchito, ndikuzikonza palokha.
Gululo palokha "limagula" zothandizira ndikuzisunga / kuziyika mopanda malire.

Gulu lathu limagwiritsa ntchito ma seva omwe amafunika kuthandizidwa - kukonzanso OS, kukhazikitsa mapaketi atsopano, ndi zina zambiri.

Kwa ife tokha, tawagawa m'magulu awiri akuluakulu:

gulu la tanki,
gulu lautumiki.

Gulu la akasinja lili ndi makamu omwe ali ndi Yandex.Tank.

Gulu lautumiki limaphatikizapo chilichonse chokhudzana ndi kukonza - awa ndi mautumiki osiyanasiyana kuti athandizire kutulutsa, kupanga malipoti okhazikika, ndi zina zambiri.

Panthawi ina, zonsezi zinakhala zovuta kuyendetsa pamanja, ndipo tinaganiza zongosintha ndondomeko yonseyi, kuyambira pa "kutsitsa" ma seva ndikutha ndi chitukuko, kumasulidwa ndi kukhazikitsidwa kwa ntchito yathu yamkati.

Kodi nchifukwa ninji wotsogolera akufunika, ngakhale okhestra yokhayo imatha kuimba?

Poyamba, tidadziwa bwino Ansible ndikuyamba "kutsanulira" ma seva athu opanda zitsulo kuti tisakhale odalira owongolera dongosolo - aliyense amapambana pano, timapeza luso latsopano ndikumasula oyang'anira ntchito zina zomwe amakhala nazo nthawi zonse popanda ife. . Timayesetsa kupititsa patsogolo luso lathu komanso kudziyimira pawokha kwamagulu momwe tingathere.

Pakampani, ntchito ndi Ansible idakonzedwa ndikuyendetsedwa kwa nthawi yayitali, kotero tidaphatikizira yankho lathu mosavuta munjira iyi.

Pakadali pano, dziwe la alendo lili ndi maudindo atatu Ansible:

gawo loyamba kukhazikitsa OS,
yachiwiri imayendetsa zoikamo zoyambira kwa wolandirayo, chilolezo cha LDAP, mwachitsanzo,
ndipo wachitatu amayika Yandex.Tank ndi zodalira zokhudzana nazo mu chidebe cha docker.

Tiyeni tipitirire ku ntchito zomwe timagwiritsa ntchito mu timu.

Pantchito zathu, timagwiritsa ntchito Kotlin ndi Python mofanana, ndi Golang pang'ono. Kuti tigwirizanitse chitukuko ndi kutumiza ntchito zathu, tidaganiza zoziyika muzotengera za Docker. Izi zimakupatsani ufulu wosankha chilankhulo cha pulogalamu ndipo nthawi yomweyo imawongolera mawonekedwe amtundu woperekera pulogalamu yanu.

Cholemba chaching'ono chokhudza ipv6 ku Docker

Ntchito zina zomwe timakumana nazo zimangopezeka kudzera pa ipv6, chifukwa chake tidayenera kudziwa momwe tingapangire ipv6 pazotengera.

Malinga ndi zolemba za ipv6 patsamba lovomerezeka la Docker, ipv6 imathandizidwa ndikuwonjezera magawo ku daemon.json:

{
  "ipv6": true,
  "fixed-cidr-v6": "2001:db8:1::/64"
}

Pankhaniyi, woperekayo ayenera kutulutsa ipv6 subnet, yomwe mudzalembetse fixed-cidr-v6.
Komabe, tidasankha njira ina - ipv6 NAT, ndichifukwa chake:

Tsopano docker sungagwiritse ntchito ndi ipv6.
Kukhala ndi ma adilesi osinthika padziko lonse lapansi pachidebe chilichonse kumatanthauza kuti madoko onse (ngakhale osasindikizidwa) amapezeka kwa aliyense pokhapokha kusefa kwina kukuchitika.
Userland proxy yofalitsa madoko, iptables okha ipv4.

ipv6 NAT ndi chotengera cha docker, yomwe imayang'anira malamulo mu ip6tables ndikuwasintha powonjezera chidebe chatsopano.

Kuti yankho ili ligwire ntchito moyenera, kunali koyenera kupanga njira zina zingapo. Onetsetsani kuti mwayambitsa ip6table_nat pa dongosolo. Kukhalapo kwa module yoyikidwa pa dongosolo sikutsimikizira kuti gawoli lidzalowetsedwa mu kernel poyambira. Tidakumana ndi izi titalandira cholakwika ichi poyendetsa chidebe chokhala ndi NAT pagulu latsopano:

2019/01/22 14:59:54 running [/sbin/ip6tables -t filter -N DOCKER --wait]: exit status 3: modprobe: can't change directory to '/lib/modules': No such file or directory
ip6tables v1.6.2: can't initialize ip6tables table `filter': Table does not exist (do you need to insmod?)

Vutoli linathetsedwa pambuyo powonjezera kuyambika ku gawo la Ansible pogwiritsa ntchito modprobe module ndikuyiyika pakuyambitsa kwa OS pogwiritsa ntchito lineinfile:

- name: Add ip6table_nat module
 modprobe:
   name: ip6table_nat
   state: present
- name: Add ip6table_nat to boot
 lineinfile:
   path: /etc/modules
   line: 'ip6table_nat'

M'malo mwake, pamakhala malo abwino nkhani, yomwe ikufotokoza mwachidule komanso momveka bwino ubwino ndi kuipa kwa njira imodzi kapena ina yogwiritsira ntchito ipv6 mu docker.

Koma tiyeni tibwerere ku funso lathu lomwe tinafunsidwa poyamba:
Kodi nchifukwa ninji wotsogolera akufunika, ngakhale okhestra yokhayo imatha kuimba?

Tsopano aliyense akuganiza momwe angasewere mu timu yathu:

njira ya "kutsanulira" ma seva apangidwa,
chitukuko ndi kutumizidwa kwa ntchito ndizogwirizana.

Funso lomveka limabuka: momwe tingatumizire, kusintha, ndi kuwongolera ntchito zathu muzotengera za Docker moyenera komanso mokhazikika momwe tingathere?

Ngakhale kuti membala aliyense wa okhestra amadziwa mbali yake, akhoza kusokonezeka ndi kupatuka pa lingaliro loyambirira. Apa tikufika pomaliza kuti popanda wotsogolera gulu lathu la oimba silingayesere bwino ndikusewera mogwirizana. Woyendetsa ali ndi udindo pazigawo zonse za ntchitoyo, kuonetsetsa kuti chirichonse chikugwirizana ndi tempo imodzi ndi maganizo.

Momwe mungapezere kondakitala wabwino ndi ndalama zochepa?

Mutu wa orchestration wakula bwino pamsika. Koma choyamba, tiyeni tikambirane za zida zothandizira zomwe zingathandize wochititsa.

Consum - dongosolo lomwe limapereka ntchito zazikulu ziwiri:

kuzindikira utumiki,
anagawira kiyi-mtengo yosungirako.

M'gulu lathu la oimba, Consul adzakhala ndi udindo wolembetsa mautumiki ndikusunga masanjidwe awo. Pali njira ziwiri zolembetsa:

Yogwira ndi pamene ntchitoyo imadzilembera yokha pogwiritsa ntchito HTTP API;
Passive - ntchitoyo iyenera kulembedwa pamanja.

Vault ndi malo osungira omwe amalinganiza ndikugwirizanitsa kusungidwa kotetezedwa ndi kusamalira zinsinsi - mapasiwedi, satifiketi.
Nazi zabwino zomwe tidzapeza pogwiritsa ntchito chida ichi:

Malo amodzi opangira ndi kusunga zinsinsi ndikuwongolera moyo wawo pogwiritsa ntchito HTTP API.
Transit Secrets Engine - kubisa ndi kumasulira kwa data osasunga. Kutha kutumiza zidziwitso munjira yobisidwa pamayendedwe osatetezedwa.
Pezani mfundo zosavuta kuzikonza.
Kuwunika kwa mwayi wopeza zinsinsi.
Kutha kupanga CA (Certificate Authority) yanu kuti muzitha kuyang'anira ziphaso zodzisayina nokha mkati mwazomangamanga zanu.

Poganizira zofunikira zathu zonse, njira ziwiri zinali zoyenera kwa wochititsa - Kubernetes ndi Nomad.

Kubernetes

Ndi zolemba ndi mabuku angati omwe adalembedwa kale za iye (pano zoterozo, mwachitsanzo), pali malipoti omwe ndilemba mwachidule - ichi ndi chokolola chapadziko lonse chomwe chingathe kuchita pafupifupi chirichonse. Mtengo wa izi ndikuti kukhazikitsa ndi kusunga gulu pa Kubernetes sikophweka nthawi zonse.

Nomad

Chida kuchokera ku HashiCorp, kampani yomwe imadziwika ndi kazembe komanso malo otetezedwa omwe tatchulidwa pamwambapa.

Tinapeza Nomad kukhala yosavuta kukhazikitsa ndikusintha kuposa Kubernetes. Fayilo imodzi ya binary imagwira ntchito mu seva ndi kasitomala. Nthawi yomweyo, Nomad imaphimba mndandanda wonse wa ntchito zomwe tikufuna kuti ithetse: kasamalidwe kamagulu, ndandanda wachangu, thandizo la multidatacenter. Kuphatikiza apo, tikamagwiritsa ntchito a consul ndi vault, timaphatikizana kwambiri pakuwongolera ntchito zathu.

Zomwe zikuchitika pano:

ma seva okonzekera kutumiza kwa Consul,
kasinthidwe ka magulu a nomad adzalowetsedwa mu Consul, mothandizidwa ndi zomwe nomad iyenera kutumizidwa yokha,
Mofananamo, tidzakhazikitsa vault kuti tisunge zinsinsi.

Funso kwa omvera: kodi kuli koyenera kubwereka wotsogolera ntchito zoterezi kapena gulu la oimba likuchita bwino popanda iye? Tiuzeni mu ndemanga zomwe mukuganiza pa izi.

Lembetsani kubulogu yathu ndikulumikizana - posachedwa tikuuzani zomwe zidachitika kumapeto komanso ngati tidakonza gulu la nomad momwe timafunira.

Bwerani kwathu momasuka telegraph chat, komwe mungapemphe upangiri nthawi zonse, thandizani anzanu ndikungocheza za kafukufuku wa zokolola ndi zina zambiri.

Source: www.habr.com