{"id":32766,"date":"2019-10-31T21:48:48","date_gmt":"2019-10-31T18:48:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1\/"},"modified":"2019-10-31T21:48:48","modified_gmt":"2019-10-31T18:48:48","slug":"kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","title":{"rendered":"Cum s\u0103 lansezi Istio folosind Kubernetes \u00een produc\u021bie. Partea 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ce este Istio<\/a><\/noindex>? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u043e\u0445\u043e\u0434\u044b \u0438\u0437 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0415\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0434\u0430\u0432\u0430\u0442\u044c policy \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043f\u043e\u0445\u043e\u0434\u043e\u0432 \u043c\u0435\u0436\u0434\u0443 \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438. \u041d\u0430\u043a\u043e\u043d\u0435\u0446, \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0432\u0441\u044e \u043a\u0430\u0440\u0442\u0443 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438 \u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u043c\u0435\u0442\u0440\u0438\u043a \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.<\/p>\n

Pute\u021bi citi despre mecanismul de func\u021bionare \u00een documenta\u021bia oficial\u0103<\/a><\/noindex>. Istio este, \u00eentr-adev\u0103r, un instrument puternic care permite rezolvarea multor sarcini \u0219i probleme. \u00cen acest articol, a\u0219 dori s\u0103 r\u0103spund la \u00eentreb\u0103rile principale care apar de obicei la \u00eenceputul lucrului cu Istio. Acest lucru v\u0103 va ajuta s\u0103 v\u0103 familiariza\u021bi mai repede cu el.<\/p>\n

\"Cum
\n<\/a><\/noindex><\/p>\n

Principiul de func\u021bionare<\/h3>\n

\nIstio este compus din dou\u0103 zone principale - control plane \u0219i data plane. Control plane con\u021bine componentele principale care asigur\u0103 func\u021bionarea corect\u0103 a celorlalte. \u00cen versiunea curent\u0103 (1.0), control plane are trei componente principale: Pilot, Mixer, Citadel. Nu vom discuta despre Citadel, care este necesar pentru generarea certificatelor pentru a asigura func\u021bionarea mutual TLS \u00eentre servicii. S\u0103 ne uit\u0103m mai detaliat la structura \u0219i scopul lui Pilot \u0219i Mixer.<\/p>\n

\"Cum
\n
\nPilot este componenta principal\u0103 de control care r\u0103sp\u00e2nde\u0219te informa\u021biile despre ce avem \u00een cluster - servicii, endpoint-uri \u0219i reguli de routing (de exemplu, reguli pentru Canary deployment sau reguli circuit breaker).<\/p>\n

Mixer este o component\u0103 op\u021bional\u0103 a control plane care ofer\u0103 posibilitatea de a colecta metrici, jurnale \u0219i orice informa\u021bie despre interac\u021biunile \u00een re\u021bea. De asemenea, monitorizeaz\u0103 conformitatea regulilor Policy \u0219i respectarea limitelor de rat\u0103.<\/p>\n

Data plane este implementat cu ajutorul containerelor sidecar proxy. \u00cen mod implicit, se folose\u0219te un puternic proxy-server envoy<\/a><\/noindex>. Acesta poate fi \u00eenlocuit cu o alt\u0103 implementare, de exemplu nginx (nginmesh).<\/p>\n

Pentru ca Istio s\u0103 func\u021bioneze complet transparent pentru aplica\u021bii, exist\u0103 un sistem de injectare automat\u0103. Ultima realizare se potrive\u0219te cu versiunile Kubernetes 1.9+ (mutational admission webhook). Pentru versiunile Kubernetes 1.7, 1.8 exist\u0103 posibilitatea de a folosi Initializer.<\/p>\n

Containerele sidecar se conecteaz\u0103 la Pilot prin protocolul GRPC, care permite optimizarea modelului de push al modific\u0103rilor care au loc \u00een cluster. GRPC a \u00eenceput s\u0103 fie folosit \u00een Envoy \u00eencep\u00e2nd cu versiunea 1.6, iar \u00een Istio este utilizat din versiunea 0.8 \u0219i este reprezentat de pilot-agent - un wrapper Golang peste envoy, care configureaz\u0103 parametrii de lansare.<\/p>\n

Pilot \u0219i Mixer sunt componente complet stateless, toat\u0103 starea fiind p\u0103strat\u0103 \u00een memorie. Configurarea pentru acestea este definit\u0103 sub form\u0103 de Kubernetes Custom Resources, care sunt salvate \u00een etcd.
\nIstio-agent prime\u0219te adresa Pilot \u0219i deschide un stream GRPC c\u0103tre acesta. <\/p>\n

A\u0219a cum am men\u021bionat, Istio implementeaz\u0103 toat\u0103 func\u021bionalitatea complet transparent pentru aplica\u021bii. S\u0103 vedem cum. Algoritmul este urm\u0103torul:<\/p>\n

    \n
  1. Deploim o nou\u0103 versiune a serviciului.<\/li>\n
  2. \u00cen func\u021bie de abordarea inject\u0103rii, containerul istio-init \u0219i containerul istio-agent (envoy) sunt ad\u0103ugate \u00een etapa de aplicare a configura\u021biei, sau pot fi deja inserate manual \u00een descrierea entit\u0103\u021bii Pod din Kubernetes.<\/li>\n
  3. Containerul istio-init este un script care aplic\u0103 regulile iptables pentru pod. Exist\u0103 dou\u0103 variante pentru configurarea \u00eendoirii traficului \u00een containerul istio-agent: utilizarea regulilor de redirect iptables, sau TPROXY<\/a><\/noindex>. La momentul redact\u0103rii acestui articol, abordarea implicit\u0103 folosit\u0103 este cea cu reguli de redirect. \u00cen istio-init exist\u0103 op\u021biunea de a configura ce tip de trafic trebuie interceptat \u0219i direc\u021bionat c\u0103tre istio-agent. De exemplu, pentru a intercepta tot traficul de intrare \u0219i cel de ie\u0219ire, trebuie s\u0103 seta\u021bi parametrii -i<\/code> \u0219i -b<\/code> to the value *<\/code>. Pot fi specificate porturi anume care trebuie interceptate. Pentru a nu intercepta o anumit\u0103 subre\u021bea, aceasta poate fi specificat\u0103 prin intermediul unui flag -x<\/code>.<\/li>\n
  4. Dup\u0103 executarea containerelor init, sunt lansate containerele principale, inclusiv pilot-agent (envoy). Acesta se conecteaz\u0103 la Pilot-ul deja desf\u0103\u0219urat prin GRPC \u0219i prime\u0219te informa\u021bii despre toate serviciile existente \u0219i politicile de routing din cluster. Pe baza datelor primite, acesta configureaz\u0103 cluster-urile \u0219i define\u0219te direct endpoint-urile aplica\u021biilor noastre din cluster-ul Kubernetes. De asemenea, este important de men\u021bionat un aspect crucial: envoy configureaz\u0103 dinamic listener-ele (perechi IP, port) pe care \u00eencepe s\u0103 le asculte. Prin urmare, atunci c\u00e2nd solicitatri intr\u0103 \u00een pod, acestea sunt redirec\u021bionate prin regulile de redirect iptables c\u0103tre sidecar, iar envoy poate d\u00e9j\u00e0 s\u0103 proceseze aceste conexiuni \u0219i s\u0103 \u00een\u021beleag\u0103 c\u0103tre ce trebuie s\u0103 proxizeze ulterior traficul. Tot \u00een aceast\u0103 etap\u0103 se trimite informa\u021bia c\u0103tre Mixer, pe care o vom analiza ulterior, \u0219i se transmit spans de tracing.<\/li>\n<\/ol>\n

    \n\u00cen final, ob\u021binem o re\u021bea \u00eentreag\u0103 de servere proxy envoy, pe care le putem configura dintr-un singur punct (Pilot). Toate solicit\u0103rile inbound \u0219i outbound trec prin envoy. \u00cen plus, doar traficul TCP este interceptat. Asta \u00eenseamn\u0103 c\u0103 IP-ul serviciului Kubernetes este rezolvat prin kube-dns prin UDP f\u0103r\u0103 a fi modificat. Apoi, dup\u0103 rezolvare, se face interceptarea solicit\u0103rii de ie\u0219ire \u0219i procesarea de c\u0103tre envoy, care decide pe ce endpoint trebuie trimis\u0103 solicitarea (sau s\u0103 nu fie trimis\u0103, \u00een cazul politicilor de acces sau activarea algoritmului circuit breaker).<\/p>\n

    Am \u00een\u021beles cum func\u021bioneaz\u0103 Pilot, acum trebuie s\u0103 \u00een\u021belegem cum func\u021bioneaz\u0103 Mixer \u0219i de ce este acesta necesar. Pute\u021bi citi documenta\u021bia oficial\u0103 despre acesta. aici<\/a><\/noindex>.<\/p>\n

    Mixer, \u00een forma actual\u0103, este compus din dou\u0103 componente: istio-telemetry \u0219i istio-policy (p\u00e2n\u0103 la versiunea 0.8, era o singur\u0103 component\u0103, istio-mixer). Ambele reprezint\u0103 un mixer, fiecare av\u00e2nd propria responsabilitate. Istio telemetry prime\u0219te informa\u021bii despre cine merge unde \u0219i cu ce parametri prin intermediul GRPC de la containerele sidecar. Istio-policy prime\u0219te cereri de verificare pentru a se asigura c\u0103 se respect\u0103 regulile Policy. Verific\u0103rile policy nu se efectueaz\u0103 pentru fiecare cerere, ci sunt stocate pe client (\u00een sidecar) pentru o perioad\u0103 determinat\u0103. Cererile de raportare sunt trimise \u00een loturi. Cum se configureaz\u0103 \u0219i ce parametrii trebuie trimi\u0219i, vom analiza pu\u021bin mai t\u00e2rziu. <\/p>\n

    Mixer este conceput ca un component cu disponibilitate \u00eenalt\u0103, care asigur\u0103 func\u021bionarea ne\u00eentrerupt\u0103 a colect\u0103rii \u0219i proces\u0103rii datelor de telemetrie. Sistemul rezult\u0103, \u00een final, ca un buffer multi-strat. Ini\u021bial, datele sunt bufferizate de partea containerelor sidecar, apoi de partea mixer-ului \u0219i, \u00een cele din urm\u0103, sunt trimise c\u0103tre a\u0219a-numitele backend-uri mixer. A\u0219adar, dac\u0103 vreo component\u0103 a sistemului cedeaz\u0103, buffer-ul cre\u0219te, iar dup\u0103 restabilirea sistemului, se gole\u0219te. Backend-urile mixer reprezint\u0103 punctele finale pentru trimiterea datelor de telemetrie: statsd, newrelic etc. Po\u021bi scrie propriul t\u0103u backend, este destul de simplu, iar noi vom vedea cum se face acest lucru.<\/p>\n

    \"Cum
    \n
    \n\u00cen concluzie, schema de lucru cu istio-telemetry este urm\u0103toarea.<\/p>\n

      \n
    1. Serviciul 1 trimite o cerere c\u0103tre serviciul 2.<\/li>\n
    2. La ie\u0219irea din serviciul 1, cererea este \u00eenf\u0103\u0219urat\u0103 \u00een sidecar-ul s\u0103u.<\/li>\n
    3. Sidecar-ul envoy urm\u0103re\u0219te cum decurge cererea c\u0103tre serviciul 2 \u0219i preg\u0103te\u0219te informa\u021biile necesare.<\/li>\n
    4. Apoi, acestea sunt trimise c\u0103tre istio-telemetry printr-o cerere de raport.<\/li>\n
    5. Istio-telemetry determin\u0103 dac\u0103 acest raport trebuie trimis c\u0103tre backend-uri, c\u0103tre care anume \u0219i ce date trebuie trimise.<\/li>\n
    6. Istio-telemetry trimite datele de raport c\u0103tre backend, dac\u0103 este necesar.<\/li>\n<\/ol>\n

      \nAcum s\u0103 vedem cum se desf\u0103\u0219oar\u0103 implementarea \u00een sistemul Istio, const\u00e2nd doar din componentele de baz\u0103 (Pilot \u0219i sidecar envoy).<\/p>\n

      Pentru \u00eenceput, s\u0103 examin\u0103m configura\u021bia principal\u0103 (mesh) pe care o cite\u0219te Pilot:<\/p>\n

      apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: istio\n  namespace: istio-system\n  labels:\n    app: istio\n    service: istio\ndata:\n  mesh: |-\n\n    # momentan nu activ\u0103m trimiterea informa\u021biilor de tracing (pilotul va configura envoy astfel \u00eenc\u00e2t trimiterea s\u0103 nu aib\u0103 loc)\n    enableTracing: false\n\n    # deocamdat\u0103 nu specific\u0103m endpoint-urile mixer, astfel \u00eenc\u00e2t containerele sidecar s\u0103 nu trimit\u0103 informa\u021bii c\u0103tre ele\n    #mixerCheckServer: istio-policy.istio-system:15004\n    #mixerReportServer: istio-telemetry.istio-system:15004\n\n    # stabilim un interval de timp cu care envoy va interoga Pilot (acesta este pentru vechea versiune a envoy proxy)\n    rdsRefreshDelay: 5s\n\n    # configura\u021bia implicit\u0103 pentru envoy sidecar\n    defaultConfig:\n      # similar cu rdsRefreshDelay\n      discoveryRefreshDelay: 5s\n\n      # l\u0103s\u0103m la valorile implicite (calea c\u0103tre configura\u021bie \u0219i binarul envoy)\n      configPath: \"\\\/etc\\\/istio\\\/proxy\"\n      binaryPath: \"\\\/usr\\\/local\\\/bin\\\/envoy\"\n\n      # numele implicit al containerului sidecar pornit (utilizat, de exemplu, \u00een numele serviciului la trimiterea span-urilor de tracing)\n      serviceCluster: istio-proxy\n\n      # timpul pe care \u00eel va a\u0219tepta envoy \u00eenainte de a \u00eenchide for\u021bat toate conexiunile deschise\n      drainDuration: 45s\n      parentShutdownDuration: 1m0s\n\n      # \u00een mod implicit se folosesc regulile REDIRECT iptables. Poate fi schimbat pe TPROXY.\n      #interceptionMode: REDIRECT\n\n      # Portul pe care va fi pornit\u0103 panoul administrativ pentru fiecare container sidecar (envoy)\n      proxyAdminPort: 15000\n\n      # adresa la care vor fi trimise trace-urile prin protocolul zipkin (la \u00eenceput am dezactivat trimiterea \u00een sine, deci acest c\u00e2mp nu va fi folosit \u00een prezent)\n      zipkinAddress: tracing-collector.tracing:9411\n\n      # adresa statsd pentru trimiterea metrilor containerelor envoy (dezactivat\u0103)\n      # statsdUdpAddress: aggregator:8126\n\n      # dezactiv\u0103m suportul pentru op\u021biunea Mutual TLS\n      controlPlaneAuthPolicy: NONE\n\n      # adresa pe care va asculta istio-pilot pentru a informa toate containerele sidecar despre descoperirea serviciilor\n      discoveryAddress: istio-pilot.istio-system:15007\n<\/code><\/pre>\n
      \nToate componentele principale de control (control plane) vor fi plasate \u00een namespace-ul istio-system \u00een Kubernetes.<\/p>\n
      Minim, trebuie s\u0103 desf\u0103\u0219ur\u0103m doar Pilot. Pentru aceasta vom folosi aceast\u0103 configura\u021bie.<\/a><\/noindex><\/p>\n
      \u0218i vom configura manual injectarea containerului sidecar.<\/p>\n
      Containerul de ini\u021bializare:<\/p>\n
      initContainers:\n - name: istio-init\n   args:\n   - -p\n   - \"15001\"\n   - -u\n   - \"1337\"\n   - -m\n   - REDIRECT\n   - -i\n   - '*'\n   - -b\n   - '*'\n   - -d\n   - \"\"\n   image: istio\\\/proxy_init:1.0.0\n   imagePullPolicy: IfNotPresent\n   resources:\n     limits:\n       memory: 128Mi\n   securityContext:\n     capabilities:\n       add:\n       - NET_ADMIN\n<\/code><\/pre>\n
      \n\u0218i sidecar-ul:<\/p>\n
             name: istio-proxy\n       args:\n         - \"bash\"\n         - \"-c\"\n         - |\n           exec \/usr\/local\/bin\/pilot-agent proxy sidecar \n           --configPath \n           \/etc\/istio\/proxy \n           --binaryPath \n           \/usr\/local\/bin\/envoy \n           --serviceCluster \n           service-name \n           --drainDuration \n           45s \n           --parentShutdownDuration \n           1m0s \n           --discoveryAddress \n           istio-pilot.istio-system:15007 \n           --discoveryRefreshDelay \n           1s \n           --connectTimeout \n           10s \n           --proxyAdminPort \n           \"15000\" \n           --controlPlaneAuthPolicy \n           NONE\n         env:\n         - name: POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: POD_NAMESPACE\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.namespace\n         - name: INSTANCE_IP\n           valueFrom:\n             fieldRef:\n               fieldPath: status.podIP\n         - name: ISTIO_META_POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: ISTIO_META_INTERCEPTION_MODE\n           value: REDIRECT\n         image: istio\/proxyv2:1.0.0\n         imagePullPolicy: IfNotPresent\n         resources:\n           requests:\n             cpu: 100m\n             memory: 128Mi\n           limits:\n             memory: 2048Mi\n         securityContext:\n           privileged: false\n           readOnlyRootFilesystem: true\n           runAsUser: 1337\n         volumeMounts:\n         - mountPath: \/etc\/istio\/proxy\n           name: istio-envoy\n<\/code><\/pre>\n
      \nPentru ca totul s\u0103 func\u021bioneze cu succes, trebuie s\u0103 crea\u021bi un ServiceAccount, ClusterRole, ClusterRoleBinding \u0219i CRD pentru Pilot, descrierile c\u0103rora pot fi g\u0103site aici<\/a><\/noindex>. <\/p>\n
      \u00cen cele din urm\u0103, serviciul \u00een care inject\u0103m sidecar cu envoy trebuie s\u0103 se lanceze cu succes, s\u0103 primeasc\u0103 toate informa\u021biile de descoperire de la pilot \u0219i s\u0103 proceseze cererile.<\/p>\n
      Este important s\u0103 \u00een\u021belegem c\u0103 toate componentele control plane sunt aplica\u021bii stateless \u0219i pot fi scalate orizontal f\u0103r\u0103 probleme. Toate datele sunt stocate \u00een etcd sub form\u0103 de descrieri personalizate ale resurselor Kubernetes.<\/p>\n
      De asemenea, Istio (deocamdat\u0103 experimental) are posibilitatea de a func\u021biona \u00een afara cluster-ului \u0219i de a vizualiza \u0219i \u00eemp\u0103rt\u0103\u0219i descoperirea serviciului \u00eentre mai multe clustere Kubernetes. Mai multe informa\u021bii pot fi citite aici aici<\/a><\/noindex>.<\/p>\n
      C\u00e2nd configura\u021bi o instalare multicluaster, trebuie s\u0103 lua\u021bi \u00een considerare urm\u0103toarele limit\u0103ri:<\/p>\n
        \n
      1. CIDR-ul Pod \u0219i CIDR-ul Serviciilor trebuie s\u0103 fie unice \u00een toate clusterele \u0219i nu trebuie s\u0103 se suprapun\u0103.<\/li>\n
      2. Toate CIDR-urile Pod trebuie s\u0103 fie accesibile din orice CIDR Pod \u00eentre clustere.<\/li>\n
      3. Toate serverele API Kubernetes trebuie s\u0103 fie accesibile \u00eentre ele.<\/li>\n<\/ol>\n
        \nAcestea sunt informa\u021biile ini\u021biale care v\u0103 vor ajuta s\u0103 \u00eencepe\u021bi lucrul cu Istio. Cu toate acestea, exist\u0103 multe capcane. De exemplu, specificit\u0103\u021bile rut\u0103rii traficului extern (\u00een afara cluster-ului), abord\u0103rile pentru depanarea sidecar-urilor, profilarea, configurarea mixerului \u0219i scrierea unui backend mixer personalizat, configurarea mecanismului de trasare \u0219i modul s\u0103u de func\u021bionare cu envoy.
        \nToate acestea le vom analiza \u00een publica\u021biile urm\u0103toare. Adresa\u021bi-v\u0103 \u00eentreb\u0103rile dvs., voi \u00eencerca s\u0103 le clarific.
        \n
        Sursa:         habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
        \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cum s\u0103 rula\u021bi Istio folosind Kubernetes \u00een produc\u021bie. Partea 1 | ProHoster","description":"Ce este Istio? Este un a\u0219a-numit Service mesh, o tehnologie care adaug\u0103 un nivel de abstractizare peste re\u021bea.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Istio, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Kubernetes \u0432 production. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:description":"\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:48:48+00:00","article:modified_time":"2019-10-31T18:48:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 12:27:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:53:24","updated":"2026-01-21 12:27:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/32766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=32766"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/32766\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/24545"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=32766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=32766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=32766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}