{"id":31173,"date":"2019-10-31T21:39:53","date_gmt":"2019-10-31T18:39:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/obzor-i-sravnenie-kontrollerov-ingress-dlya-kubernetes\/"},"modified":"2019-10-31T21:39:53","modified_gmt":"2019-10-31T18:39:53","slug":"obzor-i-sravnenie-kontrollerov-ingress-dlya-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/obzor-i-sravnenie-kontrollerov-ingress-dlya-kubernetes","title":{"rendered":"Prezentare general\u0103 \u0219i compara\u021bie a controlerelor Ingress pentru Kubernetes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Prezentare general\u0103 \u0219i compara\u021bie a controlerelor Ingress pentru Kubernetes\" src=\"\/wp-content\/uploads\/2019\/04\/3e6d3882a8f5a96a257fab4daaa230f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAtunci c\u00e2nd lans\u0103m un cluster Kubernetes pentru o aplica\u021bie specific\u0103, trebuie s\u0103 \u00een\u021belegem ce cerin\u021be are aplica\u021bia, afacerea \u0219i dezvoltatorii. Cu aceste informa\u021bii, putem \u00eencepe luarea unei decizii arhitecturale \u0219i, \u00een special, alegerea unui anumit Ingress Controller, dintre care exist\u0103 deja o mul\u021bime. Pentru a avea o imagine de ansamblu de baz\u0103 asupra op\u021biunilor disponibile, f\u0103r\u0103 a fi necesar s\u0103 studiem o mul\u021bime de articole\/documenta\u021bie etc., am preg\u0103tit aceast\u0103 revizuire, incluz\u00e2nd principalele (ready for production) Ingress Controllers.<\/p>\n<p>Sper\u0103m c\u0103 va ajuta colegii \u00een alegerea solu\u021biei arhitecturale \u2014 cel pu\u021bin, va fi un punct de plecare pentru a ob\u021bine informa\u021bii mai detaliate \u0219i experimente practice. \u00cen prealabil, am studiat alte materiale similare disponibile pe internet \u0219i, spre surprinderea noastr\u0103, nu am g\u0103sit niciun fel de revizuire complet\u0103, \u0219i mai ales \u2014 structurat\u0103. A\u0219adar, hai s\u0103 complet\u0103m aceast\u0103 lacun\u0103!<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Criterii<\/h2>\n<p>\nPentru a putea face o compara\u021bie \u0219i a ob\u021bine un rezultat util, trebuie s\u0103 \u00een\u021belegem nu doar domeniul tematic, ci \u0219i s\u0103 avem o list\u0103 specific\u0103 de criterii care s\u0103 ghideze direc\u021bia cercet\u0103rii. F\u0103r\u0103 a pretinde c\u0103 analiz\u0103m toate cazurile posibile de utilizare a Ingress\/Kubernetes, ne-am str\u0103duit s\u0103 eviden\u021biem cele mai comune cerin\u021be pentru controlere \u2014 fi\u021bi preg\u0103ti\u021bi c\u0103 specificul \u0219i detaliile vor trebui studiate separat.<\/p>\n<p>Dar voi \u00eencepe cu caracteristicile care au devenit at\u00e2t de familiari, \u00eenc\u00e2t sunt implementate \u00een toate solu\u021biile \u0219i nu sunt discutate:<\/p>\n<ul>\n<li> descoperirea dinamic\u0103 a serviciilor (service discovery);<\/li>\n<li> terminarea SSL;<\/li>\n<li> lucrul cu websocket-uri.<\/li>\n<\/ul>\n<p>\nAcum, s\u0103 discut\u0103m despre punctele de compara\u021bie:<\/p>\n<h3>Protocolele suportate<\/h3>\n<p>\nUnul dintre criteriile fundamentale pentru alegerea. Software-ul dvs. poate func\u021biona nu conform standardului HTTP sau poate necesita s\u0103 func\u021bioneze pe mai multe protocoale simultan. Dac\u0103 cazul dvs. este neobi\u0219nuit, asigura\u021bi-v\u0103 c\u0103 lua\u021bi \u00een considerare acest factor, pentru a nu fi nevoit s\u0103 reconfigura\u021bi clusterul ulterior. Lista protocoalelor suportate de toate controlerele variaz\u0103.<\/p>\n<h3>Software-ul de baz\u0103<\/h3>\n<p>\nExist\u0103 mai multe variante de aplica\u021bii pe care se bazeaz\u0103 controlerul. Cele mai populare sunt nginx, traefik, haproxy, envoy. \u00cen general, acesta poate s\u0103 nu influen\u021beze foarte mult modul \u00een care este acceptat \u0219i transmis traficul, \u00eens\u0103 \u00eentotdeauna este util s\u0103 cunoa\u0219tem nuan\u021bele \u0219i caracteristicile poten\u021biale ale ceea ce se afl\u0103 \u201esub capot\u0103\u201d.<\/p>\n<h3>Rutarea traficului<\/h3>\n<p>\nPe baza a ce putem lua decizii cu privire la direc\u021bionarea traficului c\u0103tre un anumit serviciu? De obicei, este vorba despre host \u0219i path, dar pot exista \u0219i op\u021biuni suplimentare.<\/p>\n<h3>Spa\u021biul de nume \u00een cadrul cluster-ului<\/h3>\n<p>\nSpa\u021biul de nume (namespace) este o oportunitate de a \u00eemp\u0103r\u021bi logic resursele \u00een Kubernetes (de exemplu, \u00een stagiu, produc\u021bie etc.). Exist\u0103 controlere Ingress care trebuie instalate separat \u00een fiecare namespace (\u0219i atunci pot direc\u021biona traficul <i>doar<\/i> \u00een pod-urile acestui spa\u021biu). Exist\u0103, \u00eens\u0103, \u0219i altele (c\u00e2teva din ele), care func\u021bioneaz\u0103 la nivel global pentru \u00eentregul cluster \u2014 \u00een ele, traficul este direc\u021bionat c\u0103tre orice pod din cluster, indiferent de spa\u021biul de nume.<\/p>\n<h3>Probe pentru upstream-uri<\/h3>\n<p>\nCum se asigur\u0103 direc\u021bionarea traficului c\u0103tre instan\u021bele s\u0103n\u0103toase ale aplica\u021biei \u0219i serviciilor? Exist\u0103 op\u021biuni cu verific\u0103ri active \u0219i passive, \u00eencerc\u0103ri repetate (retries), circuit breakers <i>(pentru mai multe detalii, consulta\u021bi de exemplu, \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/438426\/\">articolul despre Istio<\/a><\/noindex>)<\/i>, implement\u0103ri proprii ale verific\u0103rilor de st\u0103ri (custom health checks) etc. Acesta este un parametru foarte important, dac\u0103 ave\u021bi cerin\u021be ridicate pentru disponibilitate \u0219i pentru eliminarea oportun\u0103 a serviciilor defecte din balansare.<\/p>\n<h3>Algoritmii de balansare<\/h3>\n<p>\nAici exist\u0103 o mul\u021bime de op\u021biuni: de la cele tradi\u021bionale <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Round-robin_DNS\">round-robin<\/a><\/noindex> la cele exotice, cum ar fi <noindex><a rel=\"nofollow\" href=\"http:\/\/www.loadbalancer.org\/blog\/load-balancing-windows-terminal-server-haproxy-and-rdp-cookies\/\">rdp-cookie<\/a><\/noindex>, precum \u0219i anumite op\u021biuni precum <noindex><a rel=\"nofollow\" href=\"https:\/\/access.redhat.com\/solutions\/900933\">sticky sessions<\/a><\/noindex>.<\/p>\n<h3>Autentificare<\/h3>\n<p>\nCe scheme de autorizare sunt suportate de controler? Basic, digest, oauth, external-auth \u2014 cred c\u0103 aceste op\u021biuni ar trebui s\u0103 fie familiare. Acesta este un criteriu important, dac\u0103 sunt folosite multe medii pentru dezvoltatori (\u0219i\/sau pur \u0219i simplu medii \u00eenchise), accesibile prin intermediul Ingress. <\/p>\n<h3>Distribu\u021bia traficului<\/h3>\n<p>\nSuport\u0103 controlerul astfel de mecanisme frecvent utilizate pentru distribuirea traficului, cum ar fi implement\u0103rile canar (canary), testarea A\/B, oglindirea traficului (mirroring\/shadowing)? Aceasta este o tem\u0103 cu adev\u0103rat delicat\u0103 pentru aplica\u021biile care necesit\u0103 o gestionare precis\u0103 \u0219i delicat\u0103 a traficului pentru testare productiv\u0103, depanarea erorilor de produs \u00een condi\u021bii de siguran\u021b\u0103 (sau cu pierderi minime), analiza traficului etc.<\/p>\n<h3>Abonament pl\u0103tit<\/h3>\n<p>\nExist\u0103 o variant\u0103 pl\u0103tit\u0103 a controller-ului, cu func\u021bionalit\u0103\u021bi extinse \u0219i\/sau suport tehnic?<\/p>\n<h3>Interfa\u021b\u0103 grafic\u0103 (Web UI)<\/h3>\n<p>\nExist\u0103 vreo interfa\u021b\u0103 grafic\u0103 pentru gestionarea configura\u021biei controller-ului? \u00cen principal pentru \u201econvenien\u021b\u0103\u201d \u0219i\/sau pentru cei care trebuie s\u0103 fac\u0103 modific\u0103ri \u00een configura\u021bia Ingress-ului, dar a lucra cu \u0219abloane \u201ebrute\u201d este incomod. Poate fi util\u0103 \u00een cazul \u00een care dezvoltatorii doresc s\u0103 experimenteze cu traficul \u00een timpul rul\u0103rii.<\/p>\n<h3>Validarea JWT<\/h3>\n<p>\nDisponibilitatea unei verific\u0103ri \u00eencorporate a token-urilor web JSON pentru autorizarea \u0219i validarea utilizatorului aplica\u021biei finale.<\/p>\n<h3>Capabilit\u0103\u021bi de personalizare a configura\u021biei<\/h3>\n<p>\nExtensibilitate a \u0219abloanelor \u00een sensul c\u0103 exist\u0103 mecanisme care permit ad\u0103ugarea propriilor directive \u0219i flaguri \u00een \u0219abloanele standard de configura\u021bie.<\/p>\n<h3>Mecanisme de baz\u0103 de protec\u021bie \u00eempotriva DDOS<\/h3>\n<p>\nAlgoritmi simpli de limitare a ratei sau variante mai complexe de filtrare a traficului pe baza adreselor, listelor albe, \u021b\u0103rilor etc.<\/p>\n<h3>Urm\u0103rirea cererilor<\/h3>\n<p>\nCapabilit\u0103\u021bi de observare, urm\u0103rire \u0219i depanare a cererilor de la Ingress-uri c\u0103tre servicii\/pod-uri specifice, \u0219i ideal \u2014 \u0219i \u00eentre servicii\/pod-uri de asemenea.<\/p>\n<h3>WAF<\/h3>\n<p>\nAsisten\u021b\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Web_application_firewall\">firewall aplica\u021bional<\/a><\/noindex>.<\/p>\n<h2>Controlele Ingress<\/h2>\n<p>\nLista controlelor a fost formulat\u0103 pe baza <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/ingress-controllers\/#additional-controllers\">documenta\u021biei oficiale Kubernetes<\/a><\/noindex> \u0219i <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.google.com\/spreadsheets\/d\/16bxRgpO1H_Bn-5xVZ1WrR_I-0A-GOI6egmhvqqLMOmg\/edit\">acestei tabele<\/a><\/noindex>. Unele dintre ele au fost excluse din revizuire din cauza specificit\u0103\u021bii sau a rarit\u0103\u021bii (stadiul incipient de dezvoltare). Cele r\u0103mase sunt analizate mai jos. Vom \u00eencepe cu o descriere general\u0103 a solu\u021biilor \u0219i vom continua cu un tabel rezumat.<\/p>\n<h3>Ingress de la Kubernetes<\/h3>\n<p>\n<i>Site: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/kubernetes\/ingress-nginx\">github.com\/kubernetes\/ingress-nginx<\/a><\/noindex><\/i><br \/>\n<i>Licen\u021b\u0103: Apache 2.0<\/i><\/p>\n<p>Acesta este controller-ul oficial pentru Kubernetes, dezvoltat de comunitate. A\u0219a cum sugereaz\u0103 numele, este bazat pe nginx \u0219i \u00eembog\u0103\u021bit cu un set divers de plugin-uri Lua, utilizate pentru a implementa func\u021bionalit\u0103\u021bi suplimentare. Datorit\u0103 popularit\u0103\u021bii nginx-ului \u0219i modific\u0103rilor minime efectuate asupra acestuia, utilizarea ca firewall poate fi cea mai simpl\u0103 \u0219i clar\u0103 pentru un inginer mediu (cu experien\u021b\u0103 \u00een web).<\/p>\n<h3>Ingress de la NGINX Inc<\/h3>\n<p>\n<i>Site: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nginxinc\/kubernetes-ingress\">github.com\/nginxinc\/kubernetes-ingress<\/a><\/noindex><\/i><br \/>\n<i>Licen\u021b\u0103: Apache 2.0<\/i><\/p>\n<p>Produs oficial al dezvoltatorilor nginx. Are o versiune pl\u0103tit\u0103, bazat\u0103 pe <noindex><a rel=\"nofollow\" href=\"https:\/\/www.nginx.com\/products\/nginx\/\">NGINX Plus<\/a><\/noindex>. Ideea principal\u0103 este un nivel ridicat de stabilitate, compatibilitate constant\u0103, absen\u021ba unor module externe \u0219i viteza crescut\u0103 declarat\u0103 (comparativ cu controllerul oficial), ob\u021binut\u0103 prin renun\u021barea la Lua. <\/p>\n<p>Versiunea gratuit\u0103 este semnificativ limitat\u0103, inclusiv \u00een compara\u021bie cu controllerul oficial (din cauza absen\u021bei acelora\u0219i module Lua). Cea pl\u0103tit\u0103, pe de alt\u0103 parte, are o gam\u0103 destul de larg\u0103 de func\u021bionalit\u0103\u021bi suplimentare: metrici \u00een timp real, validare JWT, verific\u0103ri active de s\u0103n\u0103tate \u0219i altele. Un avantaj important fa\u021b\u0103 de NGINX Ingress este suportul complet pentru traficul TCP\/UDP (inclusiv \u00een versiunea community!). Minusul este <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nginxinc\/kubernetes-ingress\/issues\/464\">absen\u021ba<\/a><\/noindex> func\u021biilor de distribu\u021bie a traficului, ceea ce, totu\u0219i, \u201eare prioritate maxim\u0103 pentru dezvoltatori\u201d, dar necesit\u0103 timp pentru implementare.<\/p>\n<h3>Kong Ingress<\/h3>\n<p>\n<i>Site: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Kong\/kubernetes-ingress-controller\">github.com\/Kong\/kubernetes-ingress-controller<\/a><\/noindex><\/i><br \/>\n<i>Licen\u021b\u0103: Apache 2.0<\/i><\/p>\n<p>Produs dezvoltat de compania Kong Inc. \u00een dou\u0103 variante: comercial\u0103 \u0219i gratuit\u0103. Se bazeaz\u0103 pe nginx, a c\u0103rui capacitate este extins\u0103 cu un num\u0103r mare de module Lua.<\/p>\n<p>Ini\u021bial a fost orientat spre procesarea \u0219i rutarea cererilor API, adic\u0103 ca API Gateway, dar \u00een prezent s-a transformat \u00eentr-un controller Ingress complet. Principalele avantaje: numeroase module suplimentare (inclusiv de la dezvoltatori ter\u021bi), care sunt u\u0219or de instalat \u0219i configurat \u0219i cu ajutorul c\u0103rora se realizeaz\u0103 o gam\u0103 larg\u0103 de func\u021bionalit\u0103\u021bi adi\u021bionale. Totu\u0219i, func\u021biile \u00eencorporate ofer\u0103 deja multe op\u021biuni. Configurarea func\u021bion\u0103rii se face prin resurse CRD.<\/p>\n<p>O caracteristic\u0103 important\u0103 a produsului este c\u0103 func\u021bioneaz\u0103 \u00een cadrul unui singur contur (\u00een loc de cross-namespaced), ceea ce este o tem\u0103 controversat\u0103: pentru unii poate p\u0103rea o neajuns (de la a crea entit\u0103\u021bi pentru fiecare contur), iar pentru al\u021bii \u2014 o func\u021bionalitate (un<i>mare<\/i>nivel mai mare de izolare, deoarece, dac\u0103 un controller este compromis, problema este limitat\u0103 la un singur contur).<\/p>\n<h3>Traefik<\/h3>\n<p>\n<i>Site: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/containous\/traefik\">github.com\/containous\/traefik<\/a><\/noindex><\/i><br \/>\n<i>Licen\u021b\u0103: MIT<\/i><\/p>\n<p>Un proxy care a fost ini\u021bial creat pentru a gestiona rutele cererilor pentru microservicii \u0219i mediul lor dinamic. De aici \u0219i multe func\u021bionalit\u0103\u021bi utile: actualizarea configura\u021biei f\u0103r\u0103 restarturi, suport pentru numeroase metode de echilibrare, interfa\u021b\u0103 web, transmiterea metricilor, suport pentru diverse protocoale, REST API, lans\u0103ri canar \u0219i multe altele. O caracteristic\u0103 pl\u0103cut\u0103 este, de asemenea, suportul nativ pentru certificate Let's Encrypt. Dezavantajul \u2014 pentru a organiza disponibilitatea ridicat\u0103 (HA), controlerul va necesita instalarea \u0219i conectarea unui stocare KV propriu.<\/p>\n<h3>HAProxy<\/h3>\n<p>\n<i>Site: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jcmoraisjr\/haproxy-ingress\">github.com\/jcmoraisjr\/haproxy-ingress<\/a><\/noindex><\/i><br \/>\n<i>Licen\u021b\u0103: Apache 2.0<\/i><\/p>\n<p>HAProxy este bine cunoscut ca proxy \u0219i echilibror de trafic. \u00cen cadrul cluster-ului Kubernetes, acesta ofer\u0103 o actualizare \"bl\u00e2nd\u0103\" a configura\u021biei (f\u0103r\u0103 pierderi de trafic), descoperire de servicii pe baza DNS, configura\u021bie dinamic\u0103 prin API. Ofer\u0103 personalizarea complet\u0103 a \u0219ablonului de configurare prin \u00eenlocuirea CM-ului, precum \u0219i posibilitatea de a utiliza \u00een el func\u021biile bibliotecii Sprig. \u00cen general, accentul principal al solu\u021biei este pus pe viteza mare de func\u021bionare, optimizare \u0219i eficien\u021b\u0103 \u00een consumul de resurse. Avantajul controlerului \u2014 suportul pentru un num\u0103r record de metode de echilibrare.<\/p>\n<h3>Voyager<\/h3>\n<p>\n<i>Site: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/appscode\/voyager\">github.com\/appscode\/voyager<\/a><\/noindex><\/i><br \/>\n<i>Licen\u021b\u0103: Apache 2.0<\/i><\/p>\n<p>Controller-ul bazat pe HAProxy, care se pozi\u021bioneaz\u0103 ca o solu\u021bie universal\u0103, ce ofer\u0103 o gam\u0103 larg\u0103 de func\u021bii pe o mul\u021bime de furnizori. Ofer\u0103 posibilitatea de a balansa traficul pe L7 \u0219i L4, iar balansarea traficului TCP L4 poate fi considerat\u0103 o caracteristic\u0103 cheie a solu\u021biei.<\/p>\n<h3>Contour<\/h3>\n<p>\n<i>Site: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/heptio\/contour\">github.com\/heptio\/contour<\/a><\/noindex><\/i><br \/>\n<i>Licen\u021b\u0103: Apache 2.0<\/i><\/p>\n<p>Acest\u0103 solu\u021bie se bazeaz\u0103 nu doar pe Envoy: este dezvoltat\u0103 <i>\u00een colaborare<\/i> cu autorii acestui popular proxy. O caracteristic\u0103 important\u0103 este posibilitatea de a separa gestionarea resurselor Ingress prin resursele CRD IngressRoute. Pentru organiza\u021biile cu multe echipe de dezvoltare care utilizeaz\u0103 un singur cluster, acest lucru ajut\u0103 la maximizarea securit\u0103\u021bii \u00een gestionarea traficului \u00een contururile adiacente \u0219i protejeaz\u0103 \u00eempotriva erorilor \u00een modificarea resurselor Ingress.<\/p>\n<p>De asemenea, este disponibil un set extins de metode de echilibrare (inclusiv oglindirea cererilor, relu\u0103ri automate, limitarea ratei cererilor \u0219i multe altele), monitorizare detaliat\u0103 a fluxului de trafic \u0219i a erorilor. Poate c\u0103 pentru unii este un dezavantaj semnificativ absen\u021ba suportului pentru sesiuni sticky (de\u0219i func\u021bioneaz\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/heptio\/contour\/issues\/361\">sunt deja \u00een curs de desf\u0103\u0219urare<\/a><\/noindex>).<\/p>\n<h3>Istio Ingress<\/h3>\n<p>\n<i>Site: <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/docs\/tasks\/traffic-management\/ingress\/\">istio.io\/docs\/tasks\/traffic-management\/ingress<\/a><\/noindex><\/i><br \/>\n<i>Licen\u021b\u0103: Apache 2.0<\/i><\/p>\n<p>O solu\u021bie complex\u0103 de service mesh, care nu este doar un controler Ingress, gestion\u00e2nd traficul care vine din exterior, ci \u0219i controleaz\u0103 tot traficul din cadrul cluster-ului. \u201eSub capot\u0103\u201d, ca proxy sidecar pentru fiecare serviciu, este utilizat Envoy. Practic, este un mare combinat care \u201epoate face totul\u201d, iar ideea principal\u0103 este maximizarea gestionabilit\u0103\u021bii, scalabilit\u0103\u021bii, securit\u0103\u021bii \u0219i transparen\u021bei. Cu ajutorul s\u0103u, po\u021bi configura detaliat rutarea traficului, autorizarea accesului \u00eentre servicii, balansarea, monitorizarea, lans\u0103rile canar \u0219i multe altele. Cite\u0219te mai multe despre Istio \u00een seria de articole \u201c<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/438426\/\">\u00cenapoi la microservicii cu Istio<\/a><\/noindex>\u00bb.<\/p>\n<h3>Ambassador<\/h3>\n<p>\n<i>Site: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/datawire\/ambassador\">github.com\/datawire\/ambassador<\/a><\/noindex><\/i><br \/>\n<i>Licen\u021b\u0103: Apache 2.0<\/i><\/p>\n<p>O alt\u0103 solu\u021bie bazat\u0103 pe Envoy. Are versiuni gratuite \u0219i comerciale. Este pozi\u021bionat\u0103 ca fiind \u201ecomplet nativ\u0103 pentru Kubernetes\u201d, ceea ce aduce avantajele corespunz\u0103toare (integrare str\u00e2ns\u0103 cu metodele \u0219i entit\u0103\u021bile cluster-ului K8s).<\/p>\n<h2>Tabel comparativ<\/h2>\n<p>\nA\u0219adar, culminarea articolului - acest tabel uria\u0219:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ss\/wh\/lj\/sswhljo-rjkms7nadtyewqkxrdi.png\"><img decoding=\"async\" alt=\"Prezentare general\u0103 \u0219i compara\u021bie a controlerelor Ingress pentru Kubernetes\" src=\"\/wp-content\/uploads\/2019\/04\/3a6c552df6b8b7b6a88517046fa7a275.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Este clicabil pentru a permite o vizualizare mai detaliat\u0103 \u0219i este, de asemenea, disponibil \u00een formatul <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.google.com\/spreadsheets\/d\/1xjff2AMS6QXSdh8E8ay_uNMoUa2OLIanCallvkDvAy0\/edit#gid=0\">Google Sheets<\/a><\/noindex>.<\/p>\n<h2>S\u0103 tragem concluzii<\/h2>\n<p>\nScopul articolului este de a oferi o \u00een\u021belegere mai complet\u0103 (de\u0219i nu exhaustiv\u0103!) a alegerii pe care trebuie s\u0103 o faci \u00een cazul t\u0103u specific. A\u0219a cum se \u00eent\u00e2mpl\u0103 de obicei, fiecare controler are propriile sale avantaje \u0219i dezavantaje...<\/p>\n<p>Ingressul clasic de la Kubernetes este bun datorit\u0103 disponibilit\u0103\u021bii \u0219i stabilit\u0103\u021bii sale, av\u00e2nd suficiente func\u021bionalit\u0103\u021bi \u2013 \u00een general, ar trebui s\u0103 fie \u201esuficient pentru majoritatea\u201d. Totu\u0219i, dac\u0103 exist\u0103 cerin\u021be mai mari pentru stabilitate, nivelul func\u021biilor \u0219i dezvoltare, ar trebui s\u0103 lua\u021bi \u00een considerare Ingress cu NGINX Plus \u0219i un abonament pl\u0103tit. Kong are un set bogat de pluginuri (\u0219i, implicit, func\u021bionalit\u0103\u021bile furnizate de acestea), iar \u00een versiunea pl\u0103tit\u0103 sunt chiar mai multe. Are capacit\u0103\u021bi extinse ca API Gateway, configurare dinamic\u0103 pe baza resurselor CRD, precum \u0219i servicii de baz\u0103 Kubernetes.<\/p>\n<p>Pentru cerin\u021be mai mari privind echilibrarea \u0219i metodele de autorizare, ar trebui s\u0103 lua\u021bi \u00een considerare Traefik \u0219i HAProxy. Acestea sunt proiecte Open Source, verificate de-a lungul anilor, foarte stabile \u0219i \u00een continu\u0103 dezvoltare. Contour a ap\u0103rut acum c\u00e2\u021biva ani, dar arat\u0103 \u00eenc\u0103 prea t\u00e2n\u0103r \u0219i are doar func\u021bionalit\u0103\u021bi de baz\u0103, ad\u0103ugate pe deasupra Envoy. Dac\u0103 exist\u0103 cerin\u021be pentru un WAF integrat \u00eenainte de aplicatie, ar trebui s\u0103 lua\u021bi \u00een considerare acela\u0219i Ingress de la Kubernetes sau HAProxy.<\/p>\n<p>Produsele cele mai bogate \u00een func\u021bii sunt cele construite pe baza Envoy, \u00een special Istio. Acesta se prezint\u0103 ca o solu\u021bie complex\u0103, care \u201epoate face tot\u201d, ceea ce, \u00eens\u0103, implic\u0103 \u0219i un prag de intrare semnificativ mai ridicat pentru configurare\/lansare\/administare, comparativ cu alte solu\u021bii.<\/p>\n<p>Ca standard, am ales \u0219i \u00eenc\u0103 folosim Ingress de la Kubernetes, care acoper\u0103 80-90% din nevoi. Este destul de fiabil, u\u0219or de configurat \u0219i extins. \u00cen general, \u00een absen\u021ba cerin\u021belor specifice, ar trebui s\u0103 fie potrivit pentru majoritatea clusterelor\/aplica\u021biilor. Alte produse universale \u0219i relativ simple care pot fi recomandate sunt Traefik \u0219i HAProxy.<\/p>\n<h2>P.S.<\/h2>\n<p>\nCiti\u021bi \u0219i \u00een blogul nostru:<\/p>\n<ul>\n<li> \u201e\u00cenapoi la microservicii \u00eempreun\u0103 cu Istio\u201d: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/438426\/\">partea 1 (introducere \u00een func\u021bionalit\u0103\u021bile de baz\u0103)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440378\/\">partea 2 (rutare, gestionarea traficului)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443668\/\">partea 3 (autentificare \u0219i autorizare)<\/a><\/noindex>;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/445596\/\">Kubernetes tips &amp; tricks: pagini de eroare personalizate \u00een NGINX Ingress<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/427745\/\">Kubernetes tips &amp; tricks: acces la medii de dezvoltare<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/447180\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 Kubernetes \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043f\u043e\u043d\u0438\u043c\u0430\u0442\u044c, \u043a\u0430\u043a\u0438\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u044d\u0442\u043e\u043c\u0443 \u0440\u0435\u0441\u0443\u0440\u0441\u0443 \u0441\u0430\u043c\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u0431\u0438\u0437\u043d\u0435\u0441 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438. \u041f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u044d\u0442\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0430\u0442\u044c \u043a \u043f\u0440\u0438\u043d\u044f\u0442\u0438\u044e \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u043e\u0433\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043a \u0432\u044b\u0431\u043e\u0440\u0443 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e Ingress-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430, \u043a\u043e\u0438\u0445 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u0443\u0436\u0435 \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e. \u0427\u0442\u043e\u0431\u044b \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0431\u0430\u0437\u043e\u0432\u043e\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0431 \u0438\u043c\u0435\u044e\u0449\u0438\u0445\u0441\u044f \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430\u0445 \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0437\u0443\u0447\u0430\u0442\u044c \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23140,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31173","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 Kubernetes \u0434\u043b\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/obzor-i-sravnenie-kontrollerov-ingress-dlya-kubernetes\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u0437\u043e\u0440 \u0438 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432 Ingress \u0434\u043b\u044f Kubernetes | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 Kubernetes \u0434\u043b\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/obzor-i-sravnenie-kontrollerov-ingress-dlya-kubernetes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:39:53+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:39:53+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Revizuirea \u0219i compararea controalelor Ingress pentru Kubernetes | ProHoster","description":"La lansarea unui cluster Kubernetes pentru.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/obzor-i-sravnenie-kontrollerov-ingress-dlya-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u0437\u043e\u0440 \u0438 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432 Ingress \u0434\u043b\u044f Kubernetes | ProHoster","og:description":"\u041f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 Kubernetes \u0434\u043b\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/obzor-i-sravnenie-kontrollerov-ingress-dlya-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:39:53+00:00","article:modified_time":"2019-10-31T18:39:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31173","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 04:53:04","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:21:32","updated":"2026-01-21 04:53:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31173","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=31173"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31173\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/23140"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=31173"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=31173"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=31173"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}