{"id":32766,"date":"2019-10-31T21:48:48","date_gmt":"2019-10-31T18:48:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1\/"},"modified":"2019-10-31T21:48:48","modified_gmt":"2019-10-31T18:48:48","slug":"kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","title":{"rendered":"Ako spusti\u0165 Istio s vyu\u017eit\u00edm Kubernetes v produkcii. \u010cas\u0165 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u010co je to Istio<\/a><\/noindex>? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u043e\u0445\u043e\u0434\u044b \u0438\u0437 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0415\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0434\u0430\u0432\u0430\u0442\u044c policy \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043f\u043e\u0445\u043e\u0434\u043e\u0432 \u043c\u0435\u0436\u0434\u0443 \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438. \u041d\u0430\u043a\u043e\u043d\u0435\u0446, \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0432\u0441\u044e \u043a\u0430\u0440\u0442\u0443 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438 \u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u043c\u0435\u0442\u0440\u0438\u043a \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.<\/p>\n

O mechanizme fungovania si m\u00f4\u017eete pre\u010d\u00edta\u0165 v ofici\u00e1lnej dokument\u00e1cii<\/a><\/noindex>. Istio je naozaj mocn\u00fd n\u00e1stroj, ktor\u00fd dok\u00e1\u017ee vyrie\u0161i\u0165 mno\u017estvo \u00faloh a probl\u00e9mov. V tomto \u010dl\u00e1nku by som chcel odpoveda\u0165 na z\u00e1kladn\u00e9 ot\u00e1zky, ktor\u00e9 sa zvy\u010dajne objavuj\u00fa na za\u010diatku pr\u00e1ce s Istio. Pom\u00f4\u017ee v\u00e1m to r\u00fdchlej\u0161ie sa zorientova\u0165.<\/p>\n

\"Ako
\n<\/a><\/noindex><\/p>\n

Princ\u00edp fungovania<\/h3>\n

\nIstio sa sklad\u00e1 z dvoch hlavn\u00fdch z\u00f3n - control plane a data plane. Control plane obsahuje hlavn\u00e9 komponenty, ktor\u00e9 zabezpe\u010duj\u00fa spr\u00e1vnu \u010dinnos\u0165 \u010fal\u0161\u00edch. V aktu\u00e1lnej verzii (1.0) m\u00e1 control plane tri hlavn\u00e9 komponenty: Pilot, Mixer, Citadel. Citadel nebudeme rozobera\u0165, je potrebn\u00fd na generovanie certifik\u00e1tov na zabezpe\u010denie vz\u00e1jomn\u00e9ho TLS medzi slu\u017ebami. Po\u010fme sa podrobnej\u0161ie pozrie\u0165 na \u0161trukt\u00faru a \u00fa\u010del Pilot a Mixer.<\/p>\n

\"Ako
\n
\nPilot je hlavn\u00fd spr\u00e1vcovsk\u00fd komponent, ktor\u00fd \u0161\u00edri v\u0161etky inform\u00e1cie o tom, \u010do m\u00e1me v klastre \u2013 slu\u017eby, ich koncov\u00e9 body a routing pravidl\u00e1 (napr\u00edklad pravidl\u00e1 pre Canary deployment alebo pravidl\u00e1 circuit breaker).<\/p>\n

Mixer je volite\u013en\u00fd komponent control plane, ktor\u00fd pon\u00faka mo\u017enos\u0165 zberu metrik, logov a ak\u00fdchko\u013evek inform\u00e1ci\u00ed o sie\u0165ovej interakcii. Rovnako monitoruje dodr\u017eiavanie pravidiel Policy a dodr\u017eiavanie limitov po\u010dtu po\u017eiadaviek.<\/p>\n

Data plane je implementovan\u00fd pomocou sidecar kontajnerov-proxy. Predvolen\u00fdm proxy-serverom je v\u00fdkonn\u00fd proxy server envoy<\/a><\/noindex>. M\u00f4\u017ee by\u0165 nahraden\u00fd inou implement\u00e1ciou, napr\u00edklad nginx (nginmesh).<\/p>\n

Aby Istio fungoval \u00faplne transparentne pre aplik\u00e1cie, existuje syst\u00e9m automatick\u00e9ho injektovania. Posledn\u00e1 implement\u00e1cia vyhovuje verzi\u00e1m Kubernetes 1.9+ (mutational admission webhook). Pre verzie Kubernetes 1.7 a 1.8 je mo\u017en\u00e9 pou\u017ei\u0165 Initializer.<\/p>\n

Sidecar kontajnery sa sp\u00e1jaj\u00fa s Pilotom prostredn\u00edctvom protokolu GRPC, ktor\u00fd umo\u017e\u0148uje optimaliz\u00e1ciu modelu pushovania zmien prebiehaj\u00facich v klastre. GRPC sa za\u010dal pou\u017e\u00edva\u0165 v Envoy od verzie 1.6, v Istio sa pou\u017e\u00edva od verzie 0.8 a predstavuje pilot-agent \u2014 obal na golang nad envoy, ktor\u00fd konfiguruje sp\u00fa\u0161\u0165acie parametre.<\/p>\n

Pilot a Mixer s\u00fa \u00faplne stateless komponenty, v\u0161etko stavov\u00e9 inform\u00e1cie uchov\u00e1vaj\u00fa v pam\u00e4ti. Konfigur\u00e1cia pre nich sa ur\u010duje vo forme Kubernetes Custom Resources, ktor\u00e9 sa ukladaj\u00fa v etcd.
\nIstio-agent z\u00edska adresu Pilota a otvor\u00ed GRPC stream k nemu. <\/p>\n

Ako som u\u017e povedal, Istio realizuje v\u0161etku funkcionalitu \u00faplne transparentne pre aplik\u00e1cie. Pozrime sa, ako. Algoritmus je nasleduj\u00faci:<\/p>\n

    \n
  1. Nasad\u00edme nov\u00fa verziu slu\u017eby.<\/li>\n
  2. V z\u00e1vislosti od pr\u00edstupu injectingu sa na f\u00e1ze uplatnenia konfigur\u00e1cie prid\u00e1vaj\u00fa istio-init kontajner a istio-agent kontajner (envoy), alebo m\u00f4\u017eu by\u0165 u\u017e manu\u00e1lne vlo\u017een\u00e9 do popisu Pod entity Kubernetes.<\/li>\n
  3. istio-init kontajner predstavuje skript, ktor\u00fd aplikuje pravidl\u00e1 iptables pre pod. Existuj\u00fa dva varianty nastavenia obalovania trafficu do istio-agent kontajnera: pou\u017e\u00edva\u0165 redirect pravidl\u00e1 iptables, alebo TPROXY<\/a><\/noindex>. V \u010dase p\u00edsania \u010dl\u00e1nku sa predvolene pou\u017e\u00edva pr\u00edstup s redirect pravidlami. V istio-init je mo\u017enos\u0165 nastavi\u0165, ak\u00fd konkr\u00e9tny traffic je potrebn\u00e9 zachyti\u0165 a nasmerova\u0165 do istio-agent. Napr\u00edklad, ak chcete zachyti\u0165 cel\u00fd prich\u00e1dzaj\u00faci a cel\u00fd odch\u00e1dzaj\u00faci traffic, je potrebn\u00e9 nastavi\u0165 parametre -i<\/code> a -b<\/code> na hodnotu *<\/code>. M\u00f4\u017eete uvies\u0165 konkr\u00e9tne porty, ktor\u00e9 je potrebn\u00e9 zachyti\u0165. Aby ste nezachyt\u00e1vali ur\u010dit\u00fa podsiete, m\u00f4\u017eete ju uvies\u0165 pomocou pr\u00edznaku -x<\/code>.<\/li>\n
  4. Po vykonan\u00ed init kontajnerov sa spustia hlavn\u00e9, vr\u00e1tane pilot-agent (envoy). Ten sa pripoj\u00ed k u\u017e nasaden\u00e9mu Pilot cez GRPC a z\u00edskava inform\u00e1cie o v\u0161etk\u00fdch existuj\u00facich slu\u017eb\u00e1ch a routing politik\u00e1ch v klastri. Na z\u00e1klade z\u00edskan\u00fdch \u00fadajov konfiguruje clustery a zapisuje im priamo endpointy na\u0161ich aplik\u00e1ci\u00ed v Kubernetes klastri. Tie\u017e je potrebn\u00e9 poznamena\u0165 d\u00f4le\u017eit\u00fd moment: envoy dynamicky konfiguruje listeners (p\u00e1ry IP, port), ktor\u00e9 za\u010d\u00edna po\u010d\u00fava\u0165. Preto, ke\u010f sa po\u017eiadavky dostan\u00fa do podu, s\u00fa preposielan\u00e9 pomocou redirect iptables pravidiel do sidecar, envoy u\u017e \u00faspe\u0161ne m\u00f4\u017ee spracov\u00e1va\u0165 tieto spojenia a ch\u00e1pa\u0165, kam je potrebn\u00e9 \u010falej proxy trafik. Taktie\u017e v tomto \u0161t\u00e1diu doch\u00e1dza k odoslaniu inform\u00e1ci\u00ed do Mixeru, ktor\u00fd presk\u00famame nesk\u00f4r, a k odoslaniu sledovania spanov.<\/li>\n<\/ol>\n

    \nNa konci dostaneme cel\u00fa sie\u0165 envoy proxy serverov, ktor\u00e9 m\u00f4\u017eeme nastavova\u0165 z jedn\u00e9ho bodu (Pilot). V\u0161etky inbound a outbound po\u017eiadavky prech\u00e1dzaj\u00fa cez envoy. Pr\u00e1ve, zachyt\u00e1va sa iba TCP traffic. To znamen\u00e1, \u017ee Kubernetes service IP sa rie\u0161i pomocou kube-dns cez UDP bez zmien. Potom u\u017e po vyrie\u0161en\u00ed doch\u00e1dza k zachyteniu odch\u00e1dzaj\u00facej po\u017eiadavky a spracovaniu envoyom, ktor\u00fd u\u017e rozhoduje, na ktor\u00fd endpoint je potrebn\u00e9 po\u017eiadavku odosla\u0165 (alebo neodosla\u0165, v pr\u00edpade pr\u00edstupov\u00fdch polit\u00edk alebo aktiv\u00e1cie circuit breaker algoritmu).<\/p>\n

    S Pilotom sme sa vysporiadali, teraz treba pochopi\u0165, ako funguje Mixer a pre\u010do je potrebn\u00fd. Ofici\u00e1lnu dokument\u00e1ciu k nemu si m\u00f4\u017eete pre\u010d\u00edta\u0165 tu<\/a><\/noindex>.<\/p>\n

    Mixer v s\u00fa\u010dasnej podobe pozost\u00e1va z dvoch komponentov: istio-telemetry a istio-policy (do verzie 0.8 to bol jeden komponent istio-mixer). Oba predstavuj\u00fa mixer, pri\u010dom ka\u017ed\u00fd z nich pln\u00ed svoju \u00falohu. Istio telemetry prij\u00edma prostredn\u00edctvom GRPC od sidecar kontajnerov Report inform\u00e1cie o tom, kto kam ide a s ak\u00fdmi parametrami. Istio-policy prij\u00edma Check po\u017eiadavky na overenie splnenia pravidiel politiky. Kontroly politiky sa samozrejme nevykon\u00e1vaj\u00fa na ka\u017ed\u00fa po\u017eiadavku, ale ukladaj\u00fa sa na strane klienta (v sidecar) na ur\u010dit\u00fd \u010das. Report kontroly sa odosielaj\u00fa d\u00e1vkov\u00fdmi po\u017eiadavkami. Ako nastavi\u0165 a ak\u00e9 presn\u00e9 parametre je potrebn\u00e9 odosiela\u0165, si uk\u00e1\u017eeme nesk\u00f4r. <\/p>\n

    Mixer sa predpoklad\u00e1 ako vysoko dostupn\u00e1 zlo\u017eka, ktor\u00e1 zabezpe\u010duje plynul\u00fa prev\u00e1dzku pri zbieran\u00ed a spracovan\u00ed telemetrick\u00fdch \u00fadajov. Syst\u00e9m v kone\u010dnom d\u00f4sledku funguje ako viac\u00farov\u0148ov\u00fd buffer. \u00dadaje sa zpo\u010diatku ukladaj\u00fa na strane sidecar kontajnerov, potom na strane mixeru a n\u00e1sledne sa odosielaj\u00fa do takzvan\u00fdch mixer backendov. Nakoniec, ak niektor\u00e1 z komponentov syst\u00e9mu zlyh\u00e1, buffer sa zv\u00e4\u010d\u0161uje a po obnoven\u00ed syst\u00e9mu sa vypr\u00e1zd\u0148uje. Mixer backendy predstavuj\u00fa koncov\u00e9 body na odosielanie telemetrick\u00fdch \u00fadajov: statsd, newrelic a pod. Je mo\u017en\u00e9 nap\u00edsa\u0165 vlastn\u00fd backend, \u010do je dos\u0165 jednoduch\u00e9, a uk\u00e1\u017eeme si, ako to urobi\u0165.<\/p>\n

    \"Ako
    \n
    \nAk by sme to zhrnuli, sch\u00e9ma pr\u00e1ce s istio-telemetry je tak\u00e1to.<\/p>\n

      \n
    1. Slu\u017eba 1 posiela po\u017eiadavku na slu\u017ebu 2.<\/li>\n
    2. Pri odchode zo slu\u017eby 1 sa po\u017eiadavka zabal\u00ed do jej vlastn\u00e9ho sidecaru.<\/li>\n
    3. Sidecar envoy sleduje, ako prebieha po\u017eiadavka na slu\u017ebu 2 a pripravuje potrebn\u00e9 inform\u00e1cie.<\/li>\n
    4. N\u00e1sledne ich odosiela do istio-telemetry prostredn\u00edctvom Report po\u017eiadavky.<\/li>\n
    5. Istio-telemetry ur\u010duje, \u010di je potrebn\u00e9 odosla\u0165 tento Report do backendov, ktor\u00e9 konkr\u00e9tne a ak\u00e9 \u00fadaje je potrebn\u00e9 posla\u0165.<\/li>\n
    6. Istio-telemetry odosiela Report \u00fadaje do backendu, ak je to potrebn\u00e9.<\/li>\n<\/ol>\n

      \nTeraz sa pozrime, ako rozvin\u00fa\u0165 v syst\u00e9me Istio, ktor\u00fd sa sklad\u00e1 len z hlavn\u00fdch komponentov (Pilot a sidecar envoy).<\/p>\n

      Najprv sa pozrime na z\u00e1kladn\u00fa konfigur\u00e1ciu (mesh), ktor\u00fa \u010d\u00edta Pilot:<\/p>\n

      apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: istio\n  namespace: istio-system\n  labels:\n    app: istio\n    service: istio\ndata:\n  mesh: |-\n\n    # zatia\u013e neaktivujeme odosielanie tracing inform\u00e1ci\u00ed (pilot nastav\u00ed envoye tak, \u017ee odosielanie nebude prebieha\u0165)\n    enableTracing: false\n\n    # zatia\u013e neuv\u00e1dzame mixer endpointy, aby sidecar kontajnery neodosielali inform\u00e1cie tam\n    #mixerCheckServer: istio-policy.istio-system:15004\n    #mixerReportServer: istio-telemetry.istio-system:15004\n\n    # nastavujeme \u010dasov\u00fd interval, s ktor\u00fdm bude envoy op\u00e4tovne \u017eiada\u0165 Pilot (to je pre star\u00fa verziu envoy proxy)\n    rdsRefreshDelay: 5s\n\n    # defaultn\u00e1 konfigur\u00e1cia pre envoy sidecar\n    defaultConfig:\n      # analogicky ako rdsRefreshDelay\n      discoveryRefreshDelay: 5s\n\n      # ponech\u00e1vame predvolen\u00e9 (cesta k konfigur\u00e1cii a bin\u00e1ru envoy)\n      configPath: \"\/etc\/istio\/proxy\"\n      binaryPath: \"\/usr\/local\/bin\/envoy\"\n\n      # predvolen\u00e9 meno spusten\u00e9ho sidecar kontajnera (pou\u017e\u00edva sa, napr\u00edklad, v n\u00e1zvoch slu\u017eieb pri odosielan\u00ed tracing spanov)\n      serviceCluster: istio-proxy\n\n      # \u010das, ktor\u00fd bude \u010daka\u0165 envoy predt\u00fdm, ne\u017e n\u00fatene ukon\u010d\u00ed v\u0161etky vytvoren\u00e9 spojenia\n      drainDuration: 45s\n      parentShutdownDuration: 1m0s\n\n      # predvolene sa pou\u017e\u00edvaj\u00fa REDIRECT pravidl\u00e1 iptables. M\u00f4\u017eete zmeni\u0165 na TPROXY.\n      #interceptionMode: REDIRECT\n\n      # Port, na ktorom sa spust\u00ed admin panel ka\u017ed\u00e9ho sidecar kontajnera (envoy)\n      proxyAdminPort: 15000\n\n      # adresa, na ktor\u00fa sa bud\u00fa odosiela\u0165 trace pod\u013ea zipkin protokolu (na za\u010diatku sme odosielanie vypli, preto sa toto pole teraz nebude pou\u017e\u00edva\u0165)\n      zipkinAddress: tracing-collector.tracing:9411\n\n      # statsd adresa na odosielanie metrik envoy kontajnerov (vyp\u00edname)\n      # statsdUdpAddress: aggregator:8126\n\n      # vyp\u00edname podporu mo\u017enosti Mutual TLS\n      controlPlaneAuthPolicy: NONE\n\n      # adresa, na ktorej bude po\u010d\u00fava\u0165 istio-pilot, aby informoval o objavovan\u00ed slu\u017eieb v\u0161etky sidecar kontajnery\n      discoveryAddress: istio-pilot.istio-system:15007\n<\/code><\/pre>\n
      \nV\u0161etky hlavn\u00e9 komponenty spr\u00e1vy (control plane) umiestnime do namespacu istio-system v Kubernetes.<\/p>\n
      Minim\u00e1lne potrebujeme nasadi\u0165 iba Pilot. Na to vyu\u017eijeme tak\u00fato konfigur\u00e1ciu.<\/a><\/noindex><\/p>\n
      A manu\u00e1lne nastav\u00edme injekciu sidecar kontajnera.<\/p>\n
      Init kontajner:<\/p>\n
      initContainers:\n - name: istio-init\n   args:\n   - -p\n   - \"15001\"\n   - -u\n   - \"1337\"\n   - -m\n   - REDIRECT\n   - -i\n   - '*'\n   - -b\n   - '*'\n   - -d\n   - \"\"\n   image: istio\/proxy_init:1.0.0\n   imagePullPolicy: IfNotPresent\n   resources:\n     limits:\n       memory: 128Mi\n   securityContext:\n     capabilities:\n       add:\n       - NET_ADMIN\n<\/code><\/pre>\n
      \nA sidecar:<\/p>\n
             name: istio-proxy\n       args:\n         - \"bash\"\n         - \"-c\"\n         - |\n           exec \/usr\/local\/bin\/pilot-agent proxy sidecar \n           --configPath \n           \/etc\/istio\/proxy \n           --binaryPath \n           \/usr\/local\/bin\/envoy \n           --serviceCluster \n           service-name \n           --drainDuration \n           45s \n           --parentShutdownDuration \n           1m0s \n           --discoveryAddress \n           istio-pilot.istio-system:15007 \n           --discoveryRefreshDelay \n           1s \n           --connectTimeout \n           10s \n           --proxyAdminPort \n           \"15000\" \n           --controlPlaneAuthPolicy \n           NONE\n         env:\n         - name: POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: POD_NAMESPACE\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.namespace\n         - name: INSTANCE_IP\n           valueFrom:\n             fieldRef:\n               fieldPath: status.podIP\n         - name: ISTIO_META_POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: ISTIO_META_INTERCEPTION_MODE\n           value: REDIRECT\n         image: istio\/proxyv2:1.0.0\n         imagePullPolicy: IfNotPresent\n         resources:\n           requests:\n             cpu: 100m\n             memory: 128Mi\n           limits:\n             memory: 2048Mi\n         securityContext:\n           privileged: false\n           readOnlyRootFilesystem: true\n           runAsUser: 1337\n         volumeMounts:\n         - mountPath: \/etc\/istio\/proxy\n           name: istio-envoy\n<\/code><\/pre>\n
      \nAby sa v\u0161etko \u00faspe\u0161ne spustilo, je potrebn\u00e9 vytvori\u0165 ServiceAccount, ClusterRole, ClusterRoleBinding a CRD pre Pilot, ktor\u00fdch popisy n\u00e1jdete. tu<\/a><\/noindex>. <\/p>\n
      Slu\u017eba, do ktorej injektujeme sidecar s envoy, by mala \u00faspe\u0161ne nabehn\u00fa\u0165, z\u00edska\u0165 cel\u00fd discovery z pilota a spracov\u00e1va\u0165 po\u017eiadavky.<\/p>\n
      Je d\u00f4le\u017eit\u00e9 pochopi\u0165, \u017ee v\u0161etky komponenty control plane s\u00fa aplik\u00e1cie bez stavu a je mo\u017en\u00e9 ich bez probl\u00e9mov horizont\u00e1lne \u0161k\u00e1lova\u0165. V\u0161etky \u00fadaje s\u00fa ulo\u017een\u00e9 v etcd vo forme prisp\u00f4soben\u00fdch popisov zdrojov Kubernetes.<\/p>\n
      Istio (zatia\u013e experiment\u00e1lne) tie\u017e umo\u017e\u0148uje spustenie mimo klaster a zdie\u013eanie slu\u017eby discovery medzi viacer\u00fdmi Kubernetes klastrami. Viac inform\u00e1ci\u00ed si m\u00f4\u017eete pre\u010d\u00edta\u0165. tu<\/a><\/noindex>.<\/p>\n
      Pri multi-klastrovom nasaden\u00ed je potrebn\u00e9 zoh\u013eadni\u0165 nasleduj\u00face obmedzenia:<\/p>\n
        \n
      1. Pod CIDR a Service CIDR musia by\u0165 jedine\u010dn\u00e9 vo v\u0161etk\u00fdch klastroch a nesm\u00fa sa prekry\u0165.<\/li>\n
      2. V\u0161etky Pod CIDR musia by\u0165 pr\u00edstupn\u00e9 z ak\u00fdchko\u013evek Pod CIDR medzi klastrami.<\/li>\n
      3. V\u0161etky Kubernetes API servery musia by\u0165 navz\u00e1jom pr\u00edstupn\u00e9.<\/li>\n<\/ol>\n
        \nToto s\u00fa z\u00e1kladn\u00e9 inform\u00e1cie, ktor\u00e9 v\u00e1m pom\u00f4\u017eu za\u010da\u0165 pracova\u0165 s Istio. Existuje v\u0161ak e\u0161te mno\u017estvo \u00faskal\u00ed. Napr\u00edklad, \u0161pecifik\u00e1 routovania vonkaj\u0161ieho prenosu (mimo klaster), pr\u00edstupy k laden\u00ed sidecar-ov, profilovanie, konfigur\u00e1cia mixer a p\u00edsanie vlastn\u00e9ho mixer backendu, nastavenie sledovacieho mechanizmu a jeho fungovanie pomocou envoy.
        \nV\u0161etko toto si podrobne prejdeme v nasleduj\u00facich publik\u00e1ci\u00e1ch. Kl\u00e1dite va\u0161e ot\u00e1zky, pok\u00fasim sa ich objasni\u0165.
        \n
        Zdroj:         habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
        \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ako spusti\u0165 Istio pomocou Kubernetes v produkcii. \u010cas\u0165 1 | ProHoster","description":"\u010co je Istio? Je to takzvan\u00fd Service mesh, technol\u00f3gia, ktor\u00e1 prid\u00e1va \u00farove\u0148 abstrakcie nad sie\u0165ou.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Istio, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Kubernetes \u0432 production. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:description":"\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:48:48+00:00","article:modified_time":"2019-10-31T18:48:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 12:27:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:53:24","updated":"2026-01-21 12:27:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/32766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=32766"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/32766\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/24545"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=32766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=32766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=32766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}