{"id":32766,"date":"2019-10-31T21:48:48","date_gmt":"2019-10-31T18:48:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1\/"},"modified":"2019-10-31T21:48:48","modified_gmt":"2019-10-31T18:48:48","slug":"kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","title":{"rendered":"Kako pokrenuti Istio koriste\u0107i Kubernetes u produkciji. Deo 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kaj je to Istio<\/a><\/noindex>? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u043f\u043e\u0445\u043e\u0434\u044b \u0438\u0437 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u0415\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0434\u0430\u0432\u0430\u0442\u044c policy \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043f\u043e\u0445\u043e\u0434\u043e\u0432 \u043c\u0435\u0436\u0434\u0443 \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438. \u041d\u0430\u043a\u043e\u043d\u0435\u0446, \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0432\u0441\u044e \u043a\u0430\u0440\u0442\u0443 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438 \u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u043c\u0435\u0442\u0440\u0438\u043a \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439.<\/p>\n

O mehanizmu delovanja lahko preberete v uradni dokumentaciji<\/a><\/noindex>. Istio je resni\u010dno zmogljivo orodje, ki omogo\u010da re\u0161evanje \u0161tevilnih nalog in te\u017eav. V tem \u010dlanku bi rad odgovoril na osnovna vpra\u0161anja, ki se obi\u010dajno pojavijo na za\u010detku dela z Istio. To vam bo pomagalo, da se hitreje spoprijateljite z njim.<\/p>\n

\"Kako
\n<\/a><\/noindex><\/p>\n

Na\u010delo delovanja<\/h3>\n

\nIstio se sestoji iz dveh glavnih obmo\u010dij \u2014 control plane in data plane. Control plane vsebuje osnovne komponente, ki zagotavljajo pravilno delovanje drugih. V trenutni razli\u010dici (1.0) control plane vklju\u010duje tri glavne komponente: Pilot, Mixer, Citadel. Citadel ne bomo obravnavali, saj je potreben za generiranje certifikatov za zagotavljanje dela mutual TLS med storitvami. Oglejmo si podrobneje strukturo in namen Pilot in Mixer.<\/p>\n

\"Kako
\n
\nPilot je glavni upravljalski komponent, ki distribuira vse informacije o tem, kar imamo v klasterju \u2013 storitve, njihove kon\u010dne to\u010dke in pravila usmerjanja (na primer pravila za Canary deployment ali pravila circuit breaker).<\/p>\n

Mixer je opcionalna komponenta control plane, ki omogo\u010da zbiranje metrik, dnevnikov in vseh informacij o mre\u017enem interakciji. Prav tako spremlja skladnost s pravili politike in omejitvami hitrosti.<\/p>\n

Data plane se realizira s sidecar proxy kontejnerji. Privzeto se uporablja zmogljiv proxy stre\u017enik envoy<\/a><\/noindex>. Lahko ga nadomestimo z drugo implementacijo, na primer nginx (nginmesh).<\/p>\n

Da bi Istio deloval popolnoma prozorno za aplikacije, obstaja sistem samodejnega injiciranja. Zadnja implementacija je primerna za verzije Kubernetes 1.9+ (mutational admission webhook). Za razli\u010dice Kubernetes 1.7 in 1.8 je na voljo mo\u017enost uporabe Initializer.<\/p>\n

Sidecar kontejnerji se povezujejo s Pilotom prek protokola GRPC, ki omogo\u010da optimizacijo modela potiskanja sprememb, ki se dogajajo v klasterju. GRPC se je za\u010del uporabljati v Envoy od razli\u010dice 1.6, v Istio pa se uporablja od verzije 0.8 in predstavlja pilot-agent \u2014 ovitek v golangu nad envoy, ki konfigurira parametre za zagon.<\/p>\n

Pilot in Mixer sta povsem stateless komponenti, vso stanje hranita v spominu. Konfiguracija zanje je dolo\u010dena v obliki Kubernetes Custom Resources, ki se shranjujejo v etcd.
\nIstio-agent pridobi naslov Pilota in odpre GRPC tok k njemu. <\/p>\n

Kot sem \u017ee povedal, Istio \u0440\u0435\u0430\u043b\u0438\u0437ira celotno funkcionalnost popolnoma prozorno za aplikacije. Poglejmo si, kako. Algoritem je tak\u0161en:<\/p>\n

    \n
  1. Depoliramo novo razli\u010dico storitve.<\/li>\n
  2. Odvisno od pristopa k dodajanju sidecar kontejnerja se na stopnji apliciranja konfiguracije dodata istio-init kontejner in istio-agent kontejner (envoy), ali pa sta \u017ee ro\u010dno vstavljen v opis Pod entitete Kubernetes.<\/li>\n
  3. istio-init kontejner je skript, ki uporablja pravila iptables za pod. Obstajata dva na\u010dina za nastavitev preusmeritve prometa v istio-agent kontejner: uporabiti pravila preusmeritve iptables, ali TPROXY<\/a><\/noindex>. Ob \u010dasu pisanja tega \u010dlanka se po privzetku uporablja pristop s pravili preusmeritve. V istio-init je mogo\u010de nastaviti, kateri promet je treba ujeti in usmeriti v istio-agent. Na primer, da bi zajeli celoten vhodni in celoten izhodni promet, je treba nastaviti parametre -i<\/code> in -b<\/code> na vrednost *<\/code>. Lahko dolo\u010dite specifi\u010dne porte, ki jih je treba ujeti. Da bi se izognili zajemanju dolo\u010denega podomre\u017eja, ga lahko dolo\u010dite s pomo\u010djo zastavice -x<\/code>.<\/li>\n
  4. Po izvedbi init kontejnerjev se za\u017eenejo glavni, vklju\u010dno s pilot-agent (envoy). Ta se pove\u017ee z \u017ee razporejenim Pilot preko GRPC in pridobi informacije o vseh obstoje\u010dih storitvah in usmerjevalnih politikah v klastru. Na podlagi prejetih podatkov konfigurira klastre in neposredno vpi\u0161e endpoint-e na\u0161ih aplikacij v Kubernetes klastru. Prav tako je treba omeniti pomembno to\u010dko: envoy dinami\u010dno nastavi poslu\u0161alnike (pare IP, port), ki jih za\u010dne poslu\u0161ati. Tako ko vstopajo poizvedbe v pod, jih preusmerijo s pomo\u010djo pravil preusmeritve iptables v sidecar, envoy \u017ee uspe\u0161no obdeluje te povezave in razume, kam naprej usmeriti promet. Prav tako v tej fazi poteka po\u0161iljanje informacij v Mixer, ki ga bomo obravnavali kasneje, in po\u0161iljanje sledilnih razponov.<\/li>\n<\/ol>\n

    \nNa koncu dobimo celo mre\u017eo envoy proxy stre\u017enikov, ki jih lahko konfiguriramo iz ene to\u010dke (Pilot). Vse inbound in outbound zahteve gredo preko envoy. Pri tem se prestreza le TCP promet. To pomeni, da se IP-\u0161tevilka Kubernetes storitev razre\u0161i z uporabo kube-dns preko UDP brez sprememb. \u0160ele po razre\u0161itvi pride do prestrezanja odhodne zahteve in obdelave z envoyem, ki nato odlo\u010di, na kateri endpoint je treba poslati zahtevo (ali je ne poslati, v primeru pravil dostopa ali aktivacije algoritma circuit breaker).<\/p>\n

    S Pilotom smo se \u017ee seznanili, zdaj moramo razumeti, kako deluje Mixer in zakaj je potreben. Uradno dokumentacijo o tem lahko preberete. tukaj<\/a><\/noindex>.<\/p>\n

    Mixer v trenutni obliki predstavlja dva komponenta: istio-telemetry, istio-policy (do razli\u010dice 0.8 je bila enotni komponent istio-mixer). Obe predstavljata mixer, vsaka od njiju pa je odgovorna za svojo nalogo. Istio telemetry sprejema preko GRPC od sidecar vsebnikov Report informacije o tem, kdo kam gre in s kak\u0161nimi parametri. Istio-policy sprejema Check zahteve za preverjanje skladnosti s pravili politike. Preverjanje pravil politike se seveda ne izvaja za vsako zahtevo, temve\u010d se shranjuje v predpomnilniku na odjemalcu (v sidecar) za dolo\u010deno obdobje. Check poro\u010dila se po\u0161iljajo v serijah. Kako nastaviti in kak\u0161ne natan\u010dno parametre je treba posredovati, bomo videli malo kasneje. <\/p>\n

    Mixer se predvideva kot komponenta z visoko razpolo\u017eljivostjo, ki zagotavlja nemoteno delovanje pri zbiranju in obdelavi telemetry podatkov. Sistem v kon\u010dni fazi deluje kot ve\u010dslojni pomnilnik. Sprva se podatki shranijo na strani sidecar vsebnikov, nato na strani mixerja in nato se po\u0161ljejo na tako imenovane mixer backend-e. Na koncu, \u010de kateri koli od komponent sistema odpove, se pomnilnik pove\u010da in po obnovitvi sistema se prazni. Mixer backend-i predstavljajo kon\u010dne to\u010dke za po\u0161iljanje podatkov o telemetriji: statsd, newrelic itd. Lahko napi\u0161ete svoj backend, to je precej preprosto, in poglejali bomo, kako to storiti.<\/p>\n

    \"Kako
    \n
    \n\u010ce povzamemo, je shema dela z istio-telemetry taka.<\/p>\n

      \n
    1. Storitev 1 po\u0161lje zahtevo v storitev 2.<\/li>\n
    2. Ob izhodu iz storitve 1 se zahteva ovije v njen sidecar.<\/li>\n
    3. Sidecar envoy spremlja, kako poteka zahteva v storitev 2 in pripravlja potrebne informacije.<\/li>\n
    4. Nato jih po\u0161lje v istio-telemetry s pomo\u010djo Report zahteve.<\/li>\n
    5. Istio-telemetry dolo\u010da, ali je treba poslati to poro\u010dilo v backend-e, v katere in katere podatke je treba poslati.<\/li>\n
    6. Istio-telemetry po\u0161ilja podatke o poro\u010dilih v backend, \u010de je to potrebno.<\/li>\n<\/ol>\n

      \nPoglejmo, kako razporediti sistem Istio, ki je sestavljen le iz osnovnih komponent (Pilot in sidecar envoy).<\/p>\n

      Najprej poglejmo osnovno konfiguracijo (mesh), ki jo bere Pilot:<\/p>\n

      apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: istio\n  namespace: istio-system\n  labels:\n    app: istio\n    service: istio\ndata:\n  mesh: |-\n\n    # zaenkrat ne vklju\u010dujemo po\u0161iljanja informacij o sledenju (pilot bo nastavil envoyje tako, da po\u0161iljanje ne bo potekalo)\n    enableTracing: false\n\n    # zaenkrat ne dolo\u010damo mixer endpointov, da sidecar kontejnerji ne bodo po\u0161iljali informacij tja\n    #mixerCheckServer: istio-policy.istio-system:15004\n    #mixerReportServer: istio-telemetry.istio-system:15004\n\n    # nastavimo \u010dasovni zamik, s katerim bo envoy ponovno spra\u0161eval Pilota (to je za staro razli\u010dico envoy proxy)\n    rdsRefreshDelay: 5s\n\n    # privzeta konfiguracija za envoy sidecar\n    defaultConfig:\n      # podobno kot rdsRefreshDelay\n      discoveryRefreshDelay: 5s\n\n      # pustimo privzeto (pot do konfiguracije in binarne razli\u010dice envoy)\n      configPath: \"\/etc\/istio\/proxy\"\n      binaryPath: \"\/usr\/local\/bin\/envoy\"\n\n      # privzeto ime zagnanega sidecar kontejnerja (uporablja se, na primer, v imenih storitev pri po\u0161iljanju sledenja spanov)\n      serviceCluster: istio-proxy\n\n      # \u010das, ki ga bo envoy \u010dakal, preden prisilno kon\u010da vsa vzpostavljena povezovanja\n      drainDuration: 45s\n      parentShutdownDuration: 1m0s\n\n      # privzeto se uporabljajo REDIRECT pravila iptables. Lahko jih spremenimo v TPROXY.\n      #interceptionMode: REDIRECT\n\n      # Prusotnostni port, na katerem bo zagnana administrativna plo\u0161\u010da vsakega sidecar kontejnerja (envoy)\n      proxyAdminPort: 15000\n\n      # naslov, kjer bodo po\u0161iljali sledi po zipkin protokolu (na za\u010detku smo izklopili samo po\u0161iljanje, zato to polje trenutno ne bo uporabljeno)\n      zipkinAddress: tracing-collector.tracing:9411\n\n      # statsd naslov za po\u0161iljanje metrik envoy kontejnerjev (izklopimo)\n      # statsdUdpAddress: aggregator:8126\n\n      # izklopimo podporo za mo\u017enost Mutual TLS\n      controlPlaneAuthPolicy: NONE\n\n      # naslov, na katerem bo istio-pilot poslu\u0161al za obvestila o iskanju storitev za vse sidecar kontejnerje\n      discoveryAddress: istio-pilot.istio-system:15007\n<\/code><\/pre>\n
      \nVse osnovne komponente nadzora (control plane) bomo postavili v namespace istio-system v Kubernetes.<\/p>\n
      Minimalno moramo razporediti le Pilota. Za to bomo uporabili tak\u0161no konfiguracijo.<\/a><\/noindex><\/p>\n
      In ro\u010dno nastavimo injecting sidecar kontejnerja.<\/p>\n
      Init container:<\/p>\n
      initContainers:\n - name: istio-init\n   args:\n   - -p\n   - \"15001\"\n   - -u\n   - \"1337\"\n   - -m\n   - REDIRECT\n   - -i\n   - '*'\n   - -b\n   - '*'\n   - -d\n   - \"\"\n   image: istio\/proxy_init:1.0.0\n   imagePullPolicy: IfNotPresent\n   resources:\n     limits:\n       memory: 128Mi\n   securityContext:\n     capabilities:\n       add:\n       - NET_ADMIN\n<\/code><\/pre>\n
      \n\u0418 sidecar:<\/p>\n
             name: istio-proxy\n       args:\n         - \"bash\"\n         - \"-c\"\n         - |\n           exec \/usr\/local\/bin\/pilot-agent proxy sidecar \n           --configPath \n           \/etc\/istio\/proxy \n           --binaryPath \n           \/usr\/local\/bin\/envoy \n           --serviceCluster \n           service-name \n           --drainDuration \n           45s \n           --parentShutdownDuration \n           1m0s \n           --discoveryAddress \n           istio-pilot.istio-system:15007 \n           --discoveryRefreshDelay \n           1s \n           --connectTimeout \n           10s \n           --proxyAdminPort \n           \"15000\" \n           --controlPlaneAuthPolicy \n           NONE\n         env:\n         - name: POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: POD_NAMESPACE\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.namespace\n         - name: INSTANCE_IP\n           valueFrom:\n             fieldRef:\n               fieldPath: status.podIP\n         - name: ISTIO_META_POD_NAME\n           valueFrom:\n             fieldRef:\n               fieldPath: metadata.name\n         - name: ISTIO_META_INTERCEPTION_MODE\n           value: REDIRECT\n         image: istio\/proxyv2:1.0.0\n         imagePullPolicy: IfNotPresent\n         resources:\n           requests:\n             cpu: 100m\n             memory: 128Mi\n           limits:\n             memory: 2048Mi\n         securityContext:\n           privileged: false\n           readOnlyRootFilesystem: true\n           runAsUser: 1337\n         volumeMounts:\n         - mountPath: \/etc\/istio\/proxy\n           name: istio-envoy\n<\/code><\/pre>\n
      \n\u0414\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u0432\u0441\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u043e\u0441\u044c, \u043d\u0443\u0436\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u0442\u044c ServiceAccount, ClusterRole, ClusterRoleBinding \u0438 CRD \u0434\u043b\u044f Pilot, \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 tukaj<\/a><\/noindex>. <\/p>\n
      \u0412 \u0438\u0442\u043e\u0433\u0435 \u0441\u0435\u0440\u0432\u0438\u0441, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u044b inject\u2019\u0438\u043c sidecar \u0441 envoy, \u0434\u043e\u043b\u0436\u0435\u043d \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c\u0441\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0432\u0435\u0441\u044c discovery \u043e\u0442 \u043f\u0438\u043b\u043e\u0442\u0430 \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u044b.<\/p>\n
      \u0412\u0430\u0436\u043d\u043e \u043f\u043e\u043d\u0438\u043c\u0430\u0442\u044c, \u0447\u0442\u043e \u0432\u0441\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b control plane \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f stateless \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0431\u0435\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0433\u043e\u0440\u0438\u0437\u043e\u043d\u0442\u0430\u043b\u044c\u043d\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0438\u0440\u043e\u0432\u0430\u043d\u044b. \u0412\u0441\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0432 etcd \u0432 \u0432\u0438\u0434\u0435 \u043a\u0430\u0441\u0442\u043e\u043c\u043d\u044b\u0445 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 Kubernetes.<\/p>\n
      \u0422\u0430\u043a\u0436\u0435 \u0443 Istio (\u043f\u043e\u043a\u0430 \u0447\u0442\u043e \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e) \u0435\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0432\u043d\u0435 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u0438\u0434\u0435\u0442\u044c \u0438 \u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f service discovery \u043c\u0435\u0436\u0434\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 Kubernetes \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u043c\u0438. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043e\u0431 \u044d\u0442\u043e\u043c \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0447\u0438\u0442\u0430\u0442\u044c tukaj<\/a><\/noindex>.<\/p>\n
      \u041f\u0440\u0438 \u043c\u0443\u043b\u044c\u0442\u0438\u043a\u043b\u0430\u0441\u0442\u0435\u0440\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f:<\/p>\n
        \n
      1. Pod CIDR \u0438 Service CIDR \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b \u043f\u043e \u0432\u0441\u0435\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u043c \u0438 \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u043f\u0435\u0440\u0435\u0441\u0435\u043a\u0430\u0442\u044c\u0441\u044f.<\/li>\n
      2. \u0412\u0441\u0435 Pod CIDR \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043e\u0442 \u043b\u044e\u0431\u044b\u0445 Pod CIDR \u043c\u0435\u0436\u0434\u0443 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u043c\u0438.<\/li>\n
      3. \u0412\u0441\u0435 Kubernetes API \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0434\u0440\u0443\u0433 \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u0430.<\/li>\n<\/ol>\n
        \nTo so osnovne informacije, ki vam bodo pomagale za\u010deti delati z Istio. Vendar pa je \u0161e veliko pastmi. Na primer, posebnosti usmerjanja zunanjega prometa (izven gru\u010de), pristopi k odpravljanju napak sidecar-ov, profiliranje, nastavitev mixerja in pisanje po meri mixer backend-a, nastavitev mehanizma sledenja in njegovo delovanje preko envoy-a.
        \nVse to bomo obravnavali v naslednjih objavah. Postavite svoja vpra\u0161anja, trudil se bom, da jih osvetlim.
        \n
        Izvor:         habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
        \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e. \u041c\u044b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u043c \u0432\u0435\u0441\u044c \u0438\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u043d\u0438\u043c. \u041a\u0430\u043a\u043e\u0439 \u0438\u043c\u0435\u043d\u043d\u043e? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u0435\u043b\u0430\u0435\u043c \u0443\u043c\u043d\u044b\u0439 \u0440\u043e\u0443\u0442\u0438\u043d\u0433, \u0438\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434 circuit breaker, \u043c\u043e\u0436\u0435\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u00abcanary deployment\u00bb, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0438\u0441\u0430, \u0430 \u043c\u043e\u0436\u0435\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kako zagnati Istio z uporabo Kubernetes v produkciji. Del 1 | ProHoster","description":"Kaj je Istio? To je tako imenovana Service mesh, tehnologija, ki doda raven abstrakcije nad omre\u017ejem.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c Istio, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f Kubernetes \u0432 production. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:description":"\u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 Istio? \u042d\u0442\u043e \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0439 Service mesh, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0431\u0441\u0442\u0440\u0430\u043a\u0446\u0438\u0438 \u043d\u0430\u0434 \u0441\u0435\u0442\u044c\u044e.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/kak-zapustit-istio-ispolzuya-kubernetes-v-production-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:48:48+00:00","article:modified_time":"2019-10-31T18:48:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32766","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 12:27:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:53:24","updated":"2026-01-21 12:27:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/32766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=32766"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/32766\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/24545"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=32766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=32766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=32766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}