{"id":80076,"date":"2020-05-03T01:42:34","date_gmt":"2020-05-02T23:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/proektirovanie-kubernetes-klasterov-skolko-ih-dolzhno-byt"},"modified":"2020-05-03T01:42:34","modified_gmt":"2020-05-02T23:42:34","slug":"proektirovanie-kubernetes-klasterov-skolko-ih-dolzhno-byt","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/proektirovanie-kubernetes-klasterov-skolko-ih-dolzhno-byt","title":{"rendered":"N\u00e1vrh Kubernetes klastra: ko\u013eko ich m\u00e1 by\u0165?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i><b>Pozn. prekl.<\/b>: tento materi\u00e1l z vzdel\u00e1vacieho projektu <noindex><a rel=\"nofollow\" href=\"https:\/\/learnk8s.io\/\">learnk8s<\/a><\/noindex> \u2014 odpove\u010f na be\u017en\u00fa ot\u00e1zku pri navrhovan\u00ed infra\u0161trukt\u00fary zalo\u017eenej na Kubernetes. D\u00fafame, \u017ee dostato\u010dne podrobn\u00e9 opisy v\u00fdhod a nev\u00fdhod ka\u017ed\u00e9ho z variantov pom\u00f4\u017eu pri optim\u00e1lnom rozhodovan\u00ed aj pre v\u00e1\u0161 projekt.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"N\u00e1vrh Kubernetes klastra: ko\u013eko ich m\u00e1 by\u0165?\" src=\"\/wp-content\/uploads\/2020\/05\/d3cc3b7e686e39032b1f02f3e8b6c46c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>TL;DR<\/b>: rovnak\u00e1 sada pracovn\u00fdch z\u00e1\u0165a\u017e\u00ed m\u00f4\u017ee by\u0165 spusten\u00e1 na nieko\u013ek\u00fdch ve\u013ek\u00fdch klastroch (na ka\u017ed\u00fd klaster bude pripada\u0165 ve\u013ek\u00fd po\u010det workloads) alebo na viacer\u00fdch mal\u00fdch (s mal\u00fdm po\u010dtom z\u00e1\u0165a\u017eov\u00fdch \u00faloh v ka\u017edom klastri).<\/p>\n<p>Ni\u017e\u0161ie je uveden\u00e1 tabu\u013eka, v ktorej s\u00fa hodnoten\u00e9 v\u00fdhody a nev\u00fdhody ka\u017ed\u00e9ho pr\u00edstupu:<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p><img decoding=\"async\" alt=\"N\u00e1vrh Kubernetes klastra: ko\u013eko ich m\u00e1 by\u0165?\" src=\"\/wp-content\/uploads\/2020\/05\/ab5b5fefc97c3befddbaeb0791f8a90d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPri pou\u017e\u00edvan\u00ed Kubernetes ako platformy pre prev\u00e1dzku aplik\u00e1ci\u00ed sa \u010dasto objavuj\u00fa nieko\u013eko z\u00e1kladn\u00fdch ot\u00e1zok o jemnostiach nastavenia clustrov:<\/p>\n<ul>\n<li> <i>Ak\u00fd po\u010det clustrov pou\u017ei\u0165?<\/i><\/li>\n<li> <i>Ak\u00e9 ve\u013ek\u00e9 by mali by\u0165?<\/i><\/li>\n<li> <i>\u010co by mal ka\u017ed\u00fd cluster obsahova\u0165?<\/i><\/li>\n<\/ul>\n<p>\nV tomto \u010dl\u00e1nku sa pok\u00fasim odpoveda\u0165 na v\u0161etky tieto ot\u00e1zky, analyzuj\u00fac v\u00fdhody a nev\u00fdhody ka\u017ed\u00e9ho pr\u00edstupu.<\/p>\n<h2>Formul\u00e1cia ot\u00e1zky<\/h2>\n<p>\nAko vytvorite\u013e softv\u00e9ru pravdepodobne s\u00fa\u010dasne vyv\u00edjate a prev\u00e1dzkujete mno\u017estvo aplik\u00e1ci\u00ed.<\/p>\n<p>Okrem toho sa mno\u017estvo exempl\u00e1rov t\u00fdchto aplik\u00e1ci\u00ed ur\u010dite sp\u00fa\u0161\u0165a v r\u00f4znych prostrediach \u2014 napr\u00edklad to m\u00f4\u017eu by\u0165 <i>dev<\/i>, <i>test<\/i> a <i>produkcia<\/i>.<\/p>\n<p>V\u00fdsledkom je cel\u00e1 matica aplik\u00e1ci\u00ed a prostred\u00ed:<\/p>\n<p><img decoding=\"async\" alt=\"N\u00e1vrh Kubernetes klastra: ko\u013eko ich m\u00e1 by\u0165?\" src=\"\/wp-content\/uploads\/2020\/05\/f2a811fa82e1e433463ba25d29f837e6.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Aplik\u00e1cie a prostredia<\/i><\/p>\n<p>V uvedenom pr\u00edklade s\u00fa zobrazen\u00e9 3 aplik\u00e1cie a 3 prostredia, \u010do v kone\u010dnom d\u00f4sledku d\u00e1va 9 mo\u017en\u00fdch variantov.<\/p>\n<p>Ka\u017ed\u00fd exempl\u00e1r aplik\u00e1cie predstavuje samostatn\u00fa deployment jednotku, s ktorou sa d\u00e1 pracova\u0165 nez\u00e1visle od ostatn\u00fdch.<\/p>\n<p><i>V\u0161imnite si, \u017ee <b>exempl\u00e1r aplik\u00e1cie<\/b> m\u00f4\u017ee pozost\u00e1va\u0165 z mno\u017estva <b>komponentov<\/b>, ako s\u00fa frontend, backend, datab\u00e1za at\u010f. V pr\u00edpade mikroslu\u017eobnej aplik\u00e1cie bude exempl\u00e1r zah\u0155\u0148a\u0165 v\u0161etky mikroslu\u017eby.<\/i><\/p>\n<p>Ako v\u00fdsledok maj\u00fa pou\u017e\u00edvatelia Kubernetes nieko\u013eko ot\u00e1zok:<\/p>\n<ul>\n<li> Je rozumn\u00e9 umiestni\u0165 v\u0161etky exempl\u00e1re aplik\u00e1cie do jedn\u00e9ho clustra?<\/li>\n<li> Malo by sa zaklada\u0165 samostatn\u00fd cluster pre ka\u017ed\u00fd exempl\u00e1r aplik\u00e1cie?<\/li>\n<li> Alebo mo\u017eno by sa mala vyu\u017ei\u0165 kombin\u00e1cia vy\u0161\u0161ie uveden\u00fdch pr\u00edstupov?<\/li>\n<\/ul>\n<p>\nV\u0161etky tieto varianty s\u00fa celkom \u017eivotaschopn\u00e9, preto\u017ee Kubernetes je flexibiln\u00fd syst\u00e9m, ktor\u00fd neobmedzuje pou\u017e\u00edvate\u013ea v mo\u017enostiach.<\/p>\n<p>Tu je nieko\u013eko mo\u017en\u00fdch pr\u00edstupov:<\/p>\n<ul>\n<li> jeden ve\u013ek\u00fd spolo\u010dn\u00fd cluster;<\/li>\n<li> mno\u017estvo mal\u00fdch \u0161pecializovan\u00fdch klastrov;<\/li>\n<li> jeden klaster pre ka\u017ed\u00fa aplik\u00e1ciu;<\/li>\n<li> jeden klaster pre ka\u017ed\u00e9 prostredie.<\/li>\n<\/ul>\n<p>\nAko je zn\u00e1zornen\u00e9 ni\u017e\u0161ie, prv\u00e9 dva pr\u00edstupy s\u00fa na opa\u010dn\u00fdch koncoch \u0161k\u00e1ly mo\u017enost\u00ed:<\/p>\n<p><img decoding=\"async\" alt=\"N\u00e1vrh Kubernetes klastra: ko\u013eko ich m\u00e1 by\u0165?\" src=\"\/wp-content\/uploads\/2020\/05\/99b8fd0d1e4173705e7996cf8ccb6eec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Od nieko\u013ek\u00fdch ve\u013ek\u00fdch klastrov (v\u013eavo) po mno\u017estvo mal\u00fdch (vpravo)<\/i><\/p>\n<p><i>Vo v\u0161eobecnosti sa pova\u017euje, \u017ee jeden klaster je \u201ev\u00e4\u010d\u0161\u00ed\u201c ako in\u00fd, ak m\u00e1 v\u00e4\u010d\u0161\u00ed s\u00fa\u010det uzlov a pod&#8217;ov. Napr\u00edklad, klaster s 10 uzlami a 100 pod&#8217;ami je v\u00e4\u010d\u0161\u00ed ako klaster s 1 uzlom a 10 pod&#8217;ami.<\/i><\/p>\n<p>No, po\u010fme za\u010da\u0165!<\/p>\n<h2>1. Jeden ve\u013ek\u00fd spolo\u010dn\u00fd klaster<\/h2>\n<p>\nPrv\u00fd variant \u2014 umiestni\u0165 v\u0161etky pracovn\u00e9 za\u0165a\u017eenia do jedn\u00e9ho klastera:<\/p>\n<p><img decoding=\"async\" alt=\"N\u00e1vrh Kubernetes klastra: ko\u013eko ich m\u00e1 by\u0165?\" src=\"\/wp-content\/uploads\/2020\/05\/283fc3c3f5ccb40a157ccff600628114.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Jeden ve\u013ek\u00fd klaster<\/i><\/p>\n<p>V r\u00e1mci tohto pr\u00edstupu sa klaster pou\u017e\u00edva ako univerz\u00e1lna <b>infrastrukt\u00farna platforma<\/b> \u2014 v\u0161etko potrebn\u00e9 jednoducho rozba\u013eujete v existuj\u00facom klasteri Kubernetes.<\/p>\n<p><i><noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/overview\/working-with-objects\/namespaces\/\">Namespace&#8217;y<\/a><\/noindex> Kubernetes umo\u017e\u0148uje logicky oddeli\u0165 \u010dasti klastera jednu od druhej, tak\u017ee pre ka\u017ed\u00fd in\u0161tanciu aplik\u00e1cie m\u00f4\u017eete vyu\u017ei\u0165 svoje vlastn\u00e9 meno priestoru.<\/i><\/p>\n<p><i>Po\u010fme sa pozrie\u0165 na plusy a m\u00ednusy tohto pr\u00edstupu.<\/i><\/p>\n<h3>+ Efekt\u00edvne vyu\u017e\u00edvanie zdrojov<\/h3>\n<p>\nV pr\u00edpade jedin\u00e9ho klastera bude potrebn\u00e1 len jedna k\u00f3pia v\u0161etk\u00fdch zdrojov potrebn\u00fdch na spustenie a spr\u00e1vu klastera Kubernetes.<\/p>\n<p>Napr\u00edklad, to plat\u00ed pre hlavn\u00e9 uzly. Zvy\u010dajne na ka\u017ed\u00fd klaster Kubernetes pripad\u00e1 3 hlavn\u00e9 uzly, tak\u017ee pre jeden jedin\u00fd klaster ich po\u010det ost\u00e1va rovnak\u00fd (pre porovnanie, 10 klastrov bude potrebova\u0165 30 hlavn\u00fdch uzlov).<\/p>\n<p>Uveden\u00e1 nuansa sa t\u00fdka aj in\u00fdch slu\u017eieb, ktor\u00e9 funguj\u00fa v r\u00e1mci cel\u00e9ho klastera, ako s\u00fa vyrovn\u00e1va\u010de za\u0165a\u017eenia, kontrol\u00e9ry Ingress, autentifika\u010dn\u00e9, logovacie a monitorovacie syst\u00e9my.<\/p>\n<p>V jednom klasteri je mo\u017en\u00e9 vyu\u017ei\u0165 v\u0161etky tieto slu\u017eby okam\u017eite pre v\u0161etky pracovn\u00e9 za\u0165a\u017eenia (nie je potrebn\u00e9 vytv\u00e1ra\u0165 ich k\u00f3pie, ako je to v pr\u00edpade viacer\u00fdch klastrov).<\/p>\n<h3>+ Lacnos\u0165<\/h3>\n<p>\nAko d\u00f4sledok uveden\u00e9ho, men\u0161\u00ed po\u010det klastrov obvykle vych\u00e1dza lacnej\u0161ie, preto\u017ee ch\u00fdbaj\u00fa n\u00e1klady na nadbyto\u010dn\u00e9 zdroje.<\/p>\n<p>To plat\u00ed najm\u00e4 pre hlavn\u00e9 uzly, ktor\u00e9 m\u00f4\u017eu st\u00e1\u0165 zna\u010dn\u00e9 peniaze, bez oh\u013eadu na to, ako s\u00fa umiestnen\u00e9 (on-premises alebo v cloude).<\/p>\n<p>Niektor\u00e9 spravovan\u00e9 slu\u017eby Kubernetes, ako s\u00fa <noindex><a rel=\"nofollow\" href=\"https:\/\/cloud.google.com\/kubernetes-engine\">Google Kubernetes Engine (GKE)<\/a><\/noindex> alebo <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/aks\/\">Azure Kubernetes Service (AKS)<\/a><\/noindex>, poskytuj\u00fa bezplatn\u00fa spr\u00e1vu vrstvy. V tomto pr\u00edpade nie je ot\u00e1zka n\u00e1kladov tak\u00e1 naliehav\u00e1.<\/p>\n<p>Existuj\u00fa aj spravovan\u00e9 slu\u017eby, ktor\u00e9 \u00fa\u010dtuj\u00fa pevn\u00fa sumu za fungovanie ka\u017ed\u00e9ho klastra Kubernetes (napr\u00edklad, <noindex><a rel=\"nofollow\" href=\"https:\/\/aws.amazon.com\/eks\/\">Amazon Elastic Kubernetes Service, EKS<\/a><\/noindex>).<\/p>\n<h3>+ Efekt\u00edvna spr\u00e1va<\/h3>\n<p>\nSpravova\u0165 jeden klaster je jednoduch\u0161ie, ako spravova\u0165 viacero.<\/p>\n<p>Spr\u00e1va m\u00f4\u017ee zah\u0155\u0148a\u0165 nasleduj\u00face \u00falohy:<\/p>\n<ul>\n<li> aktualiz\u00e1cia verzie Kubernetes;<\/li>\n<li> nastavenie CI\/CD pipeline;<\/li>\n<li> in\u0161tal\u00e1cia CNI pluginu;<\/li>\n<li> nastavenie autentifika\u010dn\u00e9ho syst\u00e9mu pre pou\u017e\u00edvate\u013eov;<\/li>\n<li> in\u0161tal\u00e1cia pr\u00edstupov\u00e9ho kontrol\u00e9ra;<\/li>\n<\/ul>\n<p>\na mnoho \u010fal\u0161\u00edch\u2026<\/p>\n<p>V pr\u00edpade jedn\u00e9ho klastra sa tomu v\u0161etk\u00e9mu treba venova\u0165 len raz.<\/p>\n<p>Pri viacer\u00fdch klastra bude potrebn\u00e9 tieto oper\u00e1cie opakova\u0165 viackr\u00e1t, \u010do pravdepodobne bude vy\u017eadova\u0165 nejak\u00fa automatiz\u00e1ciu procesov a n\u00e1strojov na zabezpe\u010denie systematickosti a jednotnosti procesu.<\/p>\n<p><i>A teraz nieko\u013eko slov o nev\u00fdhod\u00e1ch.<\/i><\/p>\n<h3>\u2212 Jedin\u00fd bod zlyhania<\/h3>\n<p>\nV pr\u00edpade zlyhania <i>jedin\u00e9ho<\/i> klastra okam\u017eite prestan\u00fa fungova\u0165 <i>v\u0161etky<\/i> pracovn\u00e9 z\u00e1\u0165a\u017ee!<\/p>\n<p>Existuje mno\u017estvo scen\u00e1rov, kedy sa m\u00f4\u017ee nie\u010do pokazi\u0165:<\/p>\n<ul>\n<li> aktualiz\u00e1cia Kubernetes m\u00f4\u017ee sp\u00f4sobi\u0165 neo\u010dak\u00e1van\u00e9 ved\u013eaj\u0161ie \u00fa\u010dinky;<\/li>\n<li> komponenty klastra (napr\u00edklad, CNI plugin) prestan\u00fa fungova\u0165 tak, ako sa o\u010dak\u00e1valo;<\/li>\n<li> jeden z komponentov klastra je nespr\u00e1vne nakonfigurovan\u00fd;<\/li>\n<li> zlyhanie v z\u00e1kladnej infra\u0161trukt\u00fare.<\/li>\n<\/ul>\n<p>\nJeden tak\u00fd incident m\u00f4\u017ee v\u00e1\u017ene po\u0161kodi\u0165 v\u0161etky pracovn\u00e9 z\u00e1\u0165a\u017ee umiestnen\u00e9 v spolo\u010dnom klastri.<\/p>\n<h3>\u2212 Nedostatok pr\u00edsnej izol\u00e1cie<\/h3>\n<p>\nPr\u00e1ca v spolo\u010dnom klastri znamen\u00e1, \u017ee aplik\u00e1cie zdie\u013eaj\u00fa hardv\u00e9r, sie\u0165ov\u00e9 mo\u017enosti a opera\u010dn\u00fd syst\u00e9m na uzloch klastra.<\/p>\n<p>V istom zmysle s\u00fa dva kontajnery s dvoma r\u00f4znymi aplik\u00e1ciami be\u017eiacimi na tom istom uzle podobn\u00e9 dvom procesom be\u017eiacim na tom istom stroji s rovnak\u00fdm jadrom OS.<\/p>\n<p><i>Linuxov\u00e9 kontajnery poskytuj\u00fa ur\u010dit\u00fa formu izol\u00e1cie, ale t\u00e1 nie je tak\u00e1 siln\u00e1 ako t\u00e1, ktor\u00fa poskytuj\u00fa napr\u00edklad virtu\u00e1lne stroje. V podstate je proces v kontajneri rovnak\u00fd proces, ktor\u00fd be\u017e\u00ed v opera\u010dnom syst\u00e9me hostite\u013ea.<\/i><\/p>\n<p>To m\u00f4\u017ee predstavova\u0165 probl\u00e9m z h\u013eadiska bezpe\u010dnosti: tak\u00e1to organiz\u00e1cia teoreticky umo\u017e\u0148uje nes\u00favisiacim aplik\u00e1ci\u00e1m interagova\u0165 navz\u00e1jom (\u00famyselne alebo n\u00e1hodne).<\/p>\n<p>Okrem toho v\u0161etky pracovn\u00e9 z\u00e1\u0165a\u017ee v clustre Kubernetes zdie\u013eaj\u00fa niektor\u00e9 spolo\u010dn\u00e9 klastrov\u00e9 slu\u017eby, ako napr\u00edklad <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/dns-pod-service\/\">DNS<\/a><\/noindex> \u2014 to umo\u017e\u0148uje aplik\u00e1ci\u00e1m nach\u00e1dza\u0165 Service&#8217;y in\u00fdch aplik\u00e1ci\u00ed v klastri.<\/p>\n<p><i>V\u0161etky vy\u0161\u0161ie uveden\u00e9 body m\u00f4\u017eu ma\u0165 r\u00f4znu hodnotu v z\u00e1vislosti od po\u017eiadaviek kladen\u00fdch na bezpe\u010dnos\u0165 aplik\u00e1ci\u00ed.<\/i><\/p>\n<p>Kubernetes poskytuje r\u00f4zne n\u00e1stroje na prevenciu probl\u00e9mov v syst\u00e9me bezpe\u010dnosti, ako s\u00fa <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/policy\/pod-security-policy\/\">PodSecurityPolicies<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/network-policies\/\">NetworkPolicies<\/a><\/noindex>. Na ich spr\u00e1vne nastavenie je v\u0161ak potrebn\u00e1 ur\u010dit\u00e1 odborn\u00e1 znalos\u0165, navy\u0161e nie s\u00fa schopn\u00e9 \u00faplne zakry\u0165 v\u0161etky medzery v bezpe\u010dnosti.<\/p>\n<p>Je d\u00f4le\u017eit\u00e9 v\u017edy pam\u00e4ta\u0165 na to, \u017ee Kubernetes bol p\u00f4vodne navrhnut\u00fd na <i>spolo\u010dn\u00e9 pou\u017e\u00edvanie<\/i>, nie na <i>izol\u00e1ciu a bezpe\u010dnos\u0165<\/i>.<\/p>\n<h3>\u2212 Absencia pr\u00edsnej multi-tenancy<\/h3>\n<p>\nVzh\u013eadom na mno\u017estvo spolo\u010dn\u00fdch zdrojov v clustri Kubernetes existuje mnoho sp\u00f4sobov, ktor\u00fdmi si r\u00f4zne aplik\u00e1cie m\u00f4\u017eu \"st\u00fapi\u0165 na p\u00e4ty\".<\/p>\n<p>Napr\u00edklad, aplik\u00e1cia m\u00f4\u017ee monopolizova\u0165 nejak\u00fd spolo\u010dn\u00fd zdroj (ako procesor alebo pam\u00e4\u0165) a odoprie\u0165 ostatn\u00fdm aplik\u00e1ci\u00e1m pracuj\u00facim na tom istom uzle pr\u00edstup k nemu.<\/p>\n<p>Kubernetes poskytuje r\u00f4zne mechanizmy kontroly tohto spr\u00e1vania, ako s\u00fa <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/configuration\/manage-compute-resources-container\/\">po\u017eiadavky na zdroje a limity<\/a><\/noindex> <i>(pozri tie\u017e \u010dl\u00e1nok \"<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/489668\/\"> CPU limity a agres\u00edvne throttling v Kubernetes <\/a><\/noindex>\u201c \u2014 pozn. prekl.)<\/i>, <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/policy\/resource-quotas\/\">ResourceQuotas<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/policy\/limit-range\/\">LimitRanges<\/a><\/noindex>. Av\u0161ak ako v pr\u00edpade bezpe\u010dnosti, aj ich nastavenie je dos\u0165 zlo\u017eit\u00e9 a nie s\u00fa schopn\u00e9 zabr\u00e1ni\u0165 v\u0161etk\u00fdm neo\u010dak\u00e1van\u00fdm ved\u013eaj\u0161\u00edm efektom.<\/p>\n<h3>\u2212 Ve\u013ek\u00e9 mno\u017estvo pou\u017e\u00edvate\u013eov<\/h3>\n<p>\nV pr\u00edpade jedin\u00e9ho clustra je potrebn\u00e9 spr\u00edstupni\u0165 ho mnoh\u00fdm \u013eu\u010fom. A \u010d\u00edm je ich po\u010det v\u00e4\u010d\u0161\u00ed, t\u00fdm je vy\u0161\u0161ie riziko, \u017ee nie\u010do \"pokazia\".<\/p>\n<p>Vn\u00fatri clustra je mo\u017en\u00e9 kontrolova\u0165, kto a \u010do m\u00f4\u017ee robi\u0165 pomocou <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/rbac\/\">riadenia pr\u00edstupu na z\u00e1klade rol\u00ed (RBAC)<\/a><\/noindex> <i>(pozri \u010dl\u00e1nok \"<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/470503\/\"> Pou\u017e\u00edvatelia a autoriz\u00e1cia RBAC v Kubernetes <\/a><\/noindex>\u201c \u2014 pozn. prekl.)<\/i>. Av\u0161ak to nezabr\u00e1ni pou\u017e\u00edvate\u013eom \"pokazi\u0165\" nie\u010do vo svojej z\u00f3ne zodpovednosti.<\/p>\n<h3>\u2212 Klustre nem\u00f4\u017eu r\u00e1s\u0165 do nekone\u010dna<\/h3>\n<p>\nKlaster, ktor\u00fd sa pou\u017e\u00edva pre v\u0161etky pracovn\u00e9 z\u00e1\u0165a\u017ee, bude pravdepodobne ve\u013emi ve\u013ek\u00fd (po\u010det uzlov a pod&#8217;ov).<\/p>\n<p>Ale tu nast\u00e1va in\u00fd probl\u00e9m: klustre v Kubernetes nem\u00f4\u017eu r\u00e1s\u0165 do nekone\u010dna.<\/p>\n<p>Existuje teoretick\u00fd limit na ve\u013ekos\u0165 clustra. V Kubernetes je to pribli\u017ene <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/setup\/best-practices\/cluster-large\/\">5000 uzlov, 150 tis\u00edc pod&#8217;ov a 300 tis\u00edc kontajnerov<\/a><\/noindex>.<\/p>\n<p>Av\u0161ak v skuto\u010dnom \u017eivote m\u00f4\u017eu probl\u00e9my za\u010da\u0165 ove\u013ea sk\u00f4r \u2014 napr\u00edklad u\u017e pri <noindex><a rel=\"nofollow\" href=\"https:\/\/events19.lfasiallc.com\/wp-content\/uploads\/2017\/11\/BoF_-Not-One-Size-Fits-All-How-to-Size-Kubernetes-Clusters_Guang-Ya-Liu-_-Sahdev-Zala.pdf\">500 uzloch<\/a><\/noindex>.<\/p>\n<p>Ide o to, \u017ee ve\u013ek\u00e9 klastre vyv\u00edjaj\u00fa vysok\u00e9 za\u0165a\u017eenie na riadiacu vrstvu Kubernetes. In\u00fdmi slovami, na udr\u017eanie klastru v prev\u00e1dzke a efekt\u00edvne vyu\u017e\u00edvanie zdrojov je potrebn\u00e1 podrobn\u00e1 konfigur\u00e1cia.<\/p>\n<p><i>Tento probl\u00e9m je podrobne rozobran\u00fd v pr\u00edslu\u0161nom \u010dl\u00e1nku v p\u00f4vodnom blogu s n\u00e1zvom \u201e<noindex><a rel=\"nofollow\" href=\"https:\/\/learnk8s.io\/kubernetes-node-size\">Architecting Kubernetes clusters \u2014 choosing a worker node size<\/a><\/noindex>\u00bb.<\/i><\/p>\n<p><i>Ale po\u010fme sa pozrie\u0165 na opa\u010dn\u00fd pr\u00edstup: mno\u017estvo mal\u00fdch klastrov.<\/i><\/p>\n<h2>2. Mno\u017estvo mal\u00fdch, \u0161pecializovan\u00fdch klastrov<\/h2>\n<p>\nPri tomto pr\u00edstupe pou\u017e\u00edvate samostatn\u00fd klaster pre ka\u017ed\u00fd nasadzovan\u00fd prvok:<\/p>\n<p><img decoding=\"async\" alt=\"N\u00e1vrh Kubernetes klastra: ko\u013eko ich m\u00e1 by\u0165?\" src=\"\/wp-content\/uploads\/2020\/05\/2320f62d945944f2e26f07252e9b8440.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Mno\u017estvo mal\u00fdch klastrov<\/i><\/p>\n<p>Na \u00fa\u010dely tohto \u010dl\u00e1nku sa pod <i>nasadzovan\u00fdm prvkom<\/i> rozumie in\u0161tancia aplik\u00e1cie \u2014 napr\u00edklad dev-verzia jednotliv\u00e9ho aplika\u010dn\u00e9ho prvku.<\/p>\n<p>V tejto strat\u00e9gii sa Kubernetes pou\u017e\u00edva ako \u0161pecializovan\u00e9 <b>prostriedie na sp\u00fa\u0161\u0165anie<\/b> pre jednotliv\u00e9 in\u0161tancie aplik\u00e1cie.<\/p>\n<p><i>Po\u010fme sa pozrie\u0165 na plusy a m\u00ednusy tohto pr\u00edstupu.<\/i><\/p>\n<h3>+ Obmedzen\u00fd \u201er\u00e1dius v\u00fdbuchu\u201c<\/h3>\n<p>\nPri \u201eporuche\u201c klastra sa negat\u00edvne d\u00f4sledky obmedzuj\u00fa len na tie pracovn\u00e9 z\u00e1\u0165a\u017ee, ktor\u00e9 boli nasaden\u00e9 v tomto klastri. V\u0161etky ostatn\u00e9 workloads zost\u00e1vaj\u00fa nedotknut\u00e9.<\/p>\n<h3>+ Izol\u00e1cia<\/h3>\n<p>\nPracovn\u00e9 za\u0165a\u017eenia umiestnen\u00e9 v individu\u00e1lnych klastra nemaj\u00fa spolo\u010dn\u00e9 zdroje, ako s\u00fa procesor, pam\u00e4\u0165, opera\u010dn\u00fd syst\u00e9m, sie\u0165 alebo in\u00e9 slu\u017eby.<\/p>\n<p>V\u00fdsledkom je pevn\u00e1 izol\u00e1cia medzi nes\u00favisiacimi aplik\u00e1ciami, \u010do m\u00f4\u017ee poz\u00edtivne ovplyvni\u0165 ich bezpe\u010dnos\u0165.<\/p>\n<h3>+ Mal\u00fd po\u010det u\u017e\u00edvate\u013eov<\/h3>\n<p>\nVzh\u013eadom na to, \u017ee v ka\u017edom klastri je iba obmedzen\u00e1 sada pracovn\u00fdch za\u0165a\u017eenia, zni\u017euje sa po\u010det u\u017e\u00edvate\u013eov s pr\u00edstupom k nemu.<\/p>\n<p>\u010c\u00edm menej \u013eud\u00ed m\u00e1 pr\u00edstup k klastru, t\u00fdm ni\u017e\u0161ie je riziko, \u017ee nie\u010do \u201ezhavaruje\u201c.<\/p>\n<p><i>Pozrime sa na nev\u00fdhody.<\/i><\/p>\n<h3>\u2212 Neefekt\u00edvne vyu\u017e\u00edvanie zdrojov<\/h3>\n<p>\nAko u\u017e bolo spomenut\u00e9, ka\u017ed\u00e9mu klastru Kubernetes je potrebn\u00fd ur\u010dit\u00fd s\u00fabor riadiacich zdrojov: master uzly, komponenty kontrolnej vrstvy, rie\u0161enia na monitorovanie a logovanie.<\/p>\n<p>V pr\u00edpade ve\u013ek\u00e9ho po\u010dtu mal\u00fdch klastrov je potrebn\u00e9 vy\u010dleni\u0165 v\u00e4\u010d\u0161iu \u010das\u0165 zdrojov na spr\u00e1vu.<\/p>\n<h3>\u2212 N\u00e1kladnos\u0165<\/h3>\n<p>\nNeefekt\u00edvne vyu\u017e\u00edvanie zdrojov automaticky prin\u00e1\u0161a vysok\u00e9 n\u00e1klady.<\/p>\n<p>Napr\u00edklad, existencia 30 master uzlov namiesto troch pri tej istej v\u00fdpo\u010dtovej sile nepochybne ovplyvn\u00ed n\u00e1klady.<\/p>\n<h3>\u2212 Zlo\u017eitosti spr\u00e1vy<\/h3>\n<p>\nSpravova\u0165 mno\u017estvo Kubernetes klastrov je ove\u013ea zlo\u017eitej\u0161ie ako pracova\u0165 s jedn\u00fdm.<\/p>\n<p>Napr\u00edklad, bude potrebn\u00e9 nastavi\u0165 autentifik\u00e1ciu a autoriz\u00e1ciu pre ka\u017ed\u00fd klaster. Aktualiz\u00e1ciu verzie Kubernetes bude tie\u017e potrebn\u00e9 vykona\u0165 nieko\u013ekokr\u00e1t.<\/p>\n<p>Pravdepodobne bude potrebn\u00e9 aplikova\u0165 automatiz\u00e1ciu na zv\u00fd\u0161enie \u00fa\u010dinnosti v\u0161etk\u00fdch t\u00fdchto \u00faloh.<\/p>\n<p><i>Teraz sa pozrime na menej extr\u00e9mne scen\u00e1re.<\/i><\/p>\n<h2>3. Jeden klaster pre ka\u017ed\u00fa aplik\u00e1ciu<\/h2>\n<p>\nV r\u00e1mci tohto pr\u00edstupu vytv\u00e1rate samostatn\u00fd klaster pre v\u0161etky in\u0161tancie konkr\u00e9tnej aplik\u00e1cie:<\/p>\n<p><img decoding=\"async\" alt=\"N\u00e1vrh Kubernetes klastra: ko\u013eko ich m\u00e1 by\u0165?\" src=\"\/wp-content\/uploads\/2020\/05\/238ee74d4e4dc42b7daeadc1ce484905.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Klaster pre aplik\u00e1ciu<\/i><\/p>\n<p>Tento pr\u00edstup mo\u017eno pova\u017eova\u0165 za generaliz\u00e1ciu princ\u00edpu \u201e<b>samostatn\u00fd klaster pre t\u00edm<\/b>\u201c, preto\u017ee zvy\u010dajne t\u00edm in\u017einierov vyv\u00edja jednu alebo nieko\u013eko aplik\u00e1ci\u00ed.<\/p>\n<p><i>Po\u010fme sa pozrie\u0165 na plusy a m\u00ednusy tohto pr\u00edstupu.<\/i><\/p>\n<h3>+ Klaster mo\u017eno prisp\u00f4sobi\u0165 aplik\u00e1cii<\/h3>\n<p>\nAk m\u00e1 aplik\u00e1cia \u0161peci\u00e1lne po\u017eiadavky, m\u00f4\u017eu by\u0165 implementovan\u00e9 v klastri, pri\u010dom sa in\u00e9 klastre net\u00fdkaj\u00fa.<\/p>\n<p>Tieto potreby m\u00f4\u017eu zah\u0155\u0148a\u0165 worker&#8217;y s GPU, ur\u010dit\u00e9 CNI pluginy, service mesh alebo nejak\u00fa in\u00fa slu\u017ebu.<\/p>\n<p>Ka\u017ed\u00fd klaster m\u00f4\u017ee by\u0165 prisp\u00f4soben\u00fd pod\u013ea aplik\u00e1cie, ktor\u00e1 v \u0148om be\u017e\u00ed, aby obsahoval iba to, \u010do je potrebn\u00e9.<\/p>\n<h3>\u2212 R\u00f4zne prostredia v jednom klastri<\/h3>\n<p>\nNev\u00fdhodou tohto pr\u00edstupu je, \u017ee in\u0161tancie aplik\u00e1ci\u00ed z r\u00f4znych prostred\u00ed koexistuj\u00fa v jednom klastri.<\/p>\n<p>Napr\u00edklad, produk\u010dn\u00e1 verzia aplik\u00e1cie be\u017e\u00ed v tom istom klastri ako verzia pre v\u00fdvoj. To tie\u017e znamen\u00e1, \u017ee v\u00fdvoj\u00e1ri pracuj\u00fa v tom istom klastri, v ktorom je nasaden\u00e1 produk\u010dn\u00e1 verzia aplik\u00e1cie.<\/p>\n<p>Ak kv\u00f4li \u010dinnosti v\u00fdvoj\u00e1rov alebo chyb\u00e1m vo verzii pre v\u00fdvoj v klastri d\u00f4jde k zlyhaniu, m\u00f4\u017ee to potenci\u00e1lne ovplyvni\u0165 aj produk\u010dn\u00fa verziu \u2014 \u010do je obrovsk\u00e1 nev\u00fdhoda tohto pr\u00edstupu.<\/p>\n<p><i>A nakoniec, posledn\u00fd scen\u00e1r v na\u0161om zozname.<\/i><\/p>\n<h2>4. Jeden klaster pre ka\u017ed\u00e9 prostredie<\/h2>\n<p>\nTento scen\u00e1r predpoklad\u00e1 vy\u010dlenenie samostatn\u00e9ho klastra pre ka\u017ed\u00e9 prostredie:<\/p>\n<p><img decoding=\"async\" alt=\"N\u00e1vrh Kubernetes klastra: ko\u013eko ich m\u00e1 by\u0165?\" src=\"\/wp-content\/uploads\/2020\/05\/157da599edf178832b1b15459786fbc8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Jeden klaster pre prostredie<\/i><\/p>\n<p>Napr\u00edklad, m\u00f4\u017eete ma\u0165 klastre <i>dev<\/i>, <i>test<\/i> a <i>produkcia<\/i>, v ktor\u00fdch budete sp\u00fa\u0161\u0165a\u0165 v\u0161etky in\u0161tancie aplik\u00e1cie ur\u010den\u00e9 pre konkr\u00e9tne prostredie.<\/p>\n<p><i>Tu s\u00fa v\u00fdhody a nev\u00fdhody tak\u00e9hoto pr\u00edstupu.<\/i><\/p>\n<h3>+ Izol\u00e1cia produk\u010dn\u00e9ho prostredia<\/h3>\n<p>\nV r\u00e1mci tohto pr\u00edstupu s\u00fa v\u0161etky prostredia izolovan\u00e9 od seba. Av\u0161ak v praxi je to obzvl\u00e1\u0161\u0165 d\u00f4le\u017eit\u00e9 pre prod-prostredie.<\/p>\n<p>Produk\u010dn\u00e9 verzie aplik\u00e1ci\u00ed teraz nie s\u00fa z\u00e1visl\u00e9 od toho, \u010do sa deje v in\u00fdch klastroch a prostrediach.<\/p>\n<p>Tak\u017ee ak v dev-klastre n\u00e1hle nastane probl\u00e9m, produk\u010dn\u00e9 verzie aplik\u00e1ci\u00ed bud\u00fa na\u010falej fungova\u0165, ako keby sa ni\u010d nestalo.<\/p>\n<h3>+ Klaster sa d\u00e1 prisp\u00f4sobi\u0165 prostrediu<\/h3>\n<p>\nKa\u017ed\u00fd klaster sa d\u00e1 prisp\u00f4sobi\u0165 jeho prostrediu. Napr\u00edklad je mo\u017en\u00e9:<\/p>\n<ul>\n<li> nain\u0161talova\u0165 v dev-klastre n\u00e1stroje na v\u00fdvoj a ladenie;<\/li>\n<li> nain\u0161talova\u0165 testovacie frameworky a n\u00e1stroje v klastri <i>test<\/i>;<\/li>\n<li> pou\u017ei\u0165 v\u00fdkonnej\u0161ie zariadenia a sie\u0165ov\u00e9 kan\u00e1ly v klastri <i>produkcia<\/i>.<\/li>\n<\/ul>\n<p>\nTo umo\u017e\u0148uje zv\u00fd\u0161i\u0165 efektivitu ako v\u00fdvoja, tak aj prev\u00e1dzky aplik\u00e1ci\u00ed.<\/p>\n<h3>+ Obmedzenie pr\u00edstupu k produk\u010dn\u00e9mu klastromu<\/h3>\n<p>\nPotrebnos\u0165 pracova\u0165 priamo s prod-klastrom sa vyskytuje zriedkavo, tak\u017ee je mo\u017en\u00e9 zna\u010dne obmedzi\u0165 okruh os\u00f4b, ktor\u00e9 maj\u00fa k nemu pr\u00edstup.<\/p>\n<p>M\u00f4\u017eete \u00eds\u0165 e\u0161te \u010falej a \u00faplne od\u0148a\u0165 pr\u00edstup \u013eu\u010fom k tomuto klastromu, pri\u010dom v\u0161etky nasadenia vykon\u00e1va\u0165 pomocou automatizovan\u00e9ho n\u00e1stroja CI\/CD. Tak\u00fdto pr\u00edstup maximalizuje zn\u00ed\u017eenie rizika \u013eudsk\u00fdch ch\u00fdb presne tam, kde to m\u00e1 najv\u00e4\u010d\u0161\u00ed v\u00fdznam.<\/p>\n<p><i>A teraz nieko\u013eko slov o nev\u00fdhod\u00e1ch.<\/i><\/p>\n<h3>\u2212 Absencia izol\u00e1cie medzi aplik\u00e1ciami<\/h3>\n<p>\nHlavnou nev\u00fdhodou pr\u00edstupu je absencia hardv\u00e9rovej a zdrojovej izol\u00e1cie medzi aplik\u00e1ciami.<\/p>\n<p>Nes\u00favisiace aplik\u00e1cie spolo\u010dn\u011b vyu\u017e\u00edvaj\u00fa zdroje klastra: syst\u00e9mov\u00e9 jadro, procesor, pam\u00e4\u0165 a niektor\u00e9 in\u00e9 slu\u017eby.<\/p>\n<p>Ako u\u017e bolo spomenut\u00e9, to m\u00f4\u017ee by\u0165 potenci\u00e1lne nebezpe\u010dn\u00e9.<\/p>\n<h3>\u2212 Nemo\u017enos\u0165 lokalizova\u0165 z\u00e1vislosti aplik\u00e1ci\u00ed<\/h3>\n<p>\nAk m\u00e1 aplik\u00e1cia \u0161peci\u00e1lne po\u017eiadavky, mus\u00ed ich splni\u0165 vo v\u0161etk\u00fdch klastroch.<\/p>\n<p>Napr\u00edklad, ak aplik\u00e1cii je potrebn\u00fd GPU, ka\u017ed\u00fd klaster mus\u00ed obsahova\u0165 aspo\u0148 jeden worker s GPU (aj ke\u010f sa pou\u017e\u00edva len touto aplik\u00e1ciou).<\/p>\n<p>V d\u00f4sledku toho riskujeme vy\u0161\u0161ie n\u00e1klady a neefekt\u00edvne vyu\u017e\u00edvanie zdrojov.<\/p>\n<h2>Z\u00e1ver<\/h2>\n<p>\nPri pr\u00edtomnosti ur\u010dit\u00e9ho s\u00faboru aplik\u00e1ci\u00ed ich m\u00f4\u017eeme umiestni\u0165 do nieko\u013ek\u00fdch ve\u013ek\u00fdch klastrov alebo do mnoh\u00fdch mal\u00fdch.<\/p>\n<p>V \u010dl\u00e1nku s\u00fa rozobran\u00e9 v\u00fdhody a nev\u00fdhody r\u00f4znych pr\u00edstupov, od jedn\u00e9ho glob\u00e1lneho klastra a\u017e po nieko\u013eko mal\u00fdch a \u0161pecializovan\u00fdch:<\/p>\n<ul>\n<li> jeden ve\u013ek\u00fd spolo\u010dn\u00fd klaster;<\/li>\n<li> mno\u017estvo mal\u00fdch \u0161pecializovan\u00fdch klastrov;<\/li>\n<li> jeden klaster pre ka\u017ed\u00fa aplik\u00e1ciu;<\/li>\n<li> jeden klaster pre ka\u017ed\u00e9 prostredie.<\/li>\n<\/ul>\n<p>\n<i>Ak\u00fd pr\u00edstup si teda vybra\u0165?<\/i><\/p>\n<p>Ako obvykle, odpove\u010f z\u00e1vis\u00ed od scen\u00e1ra pou\u017eitia: je potrebn\u00e9 zv\u00e1\u017ei\u0165 v\u00fdhody a nev\u00fdhody r\u00f4znych pr\u00edstupov a vybra\u0165 ten najoptim\u00e1lnej\u0161\u00ed variant.<\/p>\n<p>Av\u0161ak v\u00fdber nie je obmedzen\u00fd len na uveden\u00e9 pr\u00edklady \u2014 m\u00f4\u017eete vyu\u017ei\u0165 ak\u00fako\u013evek ich kombin\u00e1ciu!<\/p>\n<p>Napr\u00edklad, m\u00f4\u017eete usporiada\u0165 po dvojici klastrov pre ka\u017ed\u00fd t\u00edm: klaster pre v\u00fdvoj (v ktorom bud\u00fa prostredia <i>dev<\/i> a <i>test<\/i>) a klaster pre <i>produkciu<\/i> (kde sa bude nach\u00e1dza\u0165 produk\u010dn\u00e9 prostredie).<\/p>\n<p>Na z\u00e1klade inform\u00e1ci\u00ed z tohto \u010dl\u00e1nku budete m\u00f4c\u0165 pr\u00edslu\u0161ne optimalizova\u0165 v\u00fdhody a nev\u00fdhody pod\u013ea konkr\u00e9tneho scen\u00e1ra. Ve\u013ea \u0161\u0165astia!<\/p>\n<h2>P.S.<\/h2>\n<p>\nPre\u010d\u00edtajte si tie\u017e na na\u0161om blogu:<\/p>\n<ul>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/484954\/\">Vizualn\u00e1 pr\u00edru\u010dka k diagnostike probl\u00e9mov v Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/480946\/\">Protokoly v Kubernetes (a nielen tam) dnes: o\u010dak\u00e1vania a realita<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/478306\/\">Service Mesh: \u010do by mal ka\u017ed\u00fd Software Engineer vedie\u0165 o najpopul\u00e1rnej\u0161ej technol\u00f3gii<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/468679\/\">Abeceda bezpe\u010dnosti v Kubernetes: autentifik\u00e1cia, autoriz\u00e1cia, audit<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/498100\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u044d\u0442\u043e\u0442 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b \u043e\u0442 \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 learnk8s \u2014 \u043e\u0442\u0432\u0435\u0442 \u043d\u0430 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 \u0432\u043e\u043f\u0440\u043e\u0441 \u043f\u0440\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043d\u0430 \u0431\u0430\u0437\u0435 Kubernetes. \u041d\u0430\u0434\u0435\u0435\u043c\u0441\u044f, \u0447\u0442\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0440\u0430\u0437\u0432\u0451\u0440\u043d\u0443\u0442\u044b\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043f\u043b\u044e\u0441\u043e\u0432 \u0438 \u043c\u0438\u043d\u0443\u0441\u043e\u0432 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0438\u0437 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u043f\u043e\u043c\u043e\u0433\u0443\u0442 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043e\u043f\u0442\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0432\u044b\u0431\u043e\u0440 \u0438 \u0434\u043b\u044f \u0432\u0430\u0448\u0435\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430. TL;DR: \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u043d\u0430\u0431\u043e\u0440 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445 (\u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043a\u043b\u0430\u0441\u0442\u0435\u0440 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":80077,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-80076","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/proektirovanie-kubernetes-klasterov-skolko-ih-dolzhno-byt\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 Kubernetes-\u043a\u043b\u0430\u0441\u0442\u0435\u0440\u043e\u0432: \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u0445 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c? | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/proektirovanie-kubernetes-klasterov-skolko-ih-dolzhno-byt\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-02T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-02T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47N\u00e1vrh Kubernetes klastrov: ko\u013eko ich m\u00e1 by\u0165? | ProHoster","description":"Pr\u00edklad","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/proektirovanie-kubernetes-klasterov-skolko-ih-dolzhno-byt","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 Kubernetes-\u043a\u043b\u0430\u0441\u0442\u0435\u0440\u043e\u0432: \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u0445 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c? | ProHoster","og:description":"\u041f\u0440\u0438\u043c.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/proektirovanie-kubernetes-klasterov-skolko-ih-dolzhno-byt","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-02T23:42:34+00:00","article:modified_time":"2020-05-02T23:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"80076","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:24:58","updated":"2022-10-02 20:23:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/80076","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=80076"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/80076\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/80077"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=80076"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=80076"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=80076"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}