{"id":34366,"date":"2019-10-31T21:57:56","date_gmt":"2019-10-31T18:57:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/benchmark-potrebleniya-tsp-dlya-istio-i-linkerd\/"},"modified":"2019-10-31T21:57:56","modified_gmt":"2019-10-31T18:57:56","slug":"benchmark-potrebleniya-tsp-dlya-istio-i-linkerd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/benchmark-potrebleniya-tsp-dlya-istio-i-linkerd","title":{"rendered":"Benchmark i konsumit t\u00eb CPU p\u00ebr Istio dhe Linkerd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Benchmark<\/p>\n

<\/p>\n

Hyrje<\/h2>\n

<\/p>\n

Ne n\u00eb Shopify<\/a><\/noindex> ne filluam p\u00ebrdorimin e Istio si nj\u00eb rrjet sh\u00ebrbimesh. N\u00eb thelb, gjith\u00e7ka \u00ebsht\u00eb mir\u00eb, p\u00ebrve\u00e7 nj\u00eb gj\u00ebje: \u00ebsht\u00eb e shtrenjt\u00eb<\/strong>.<\/p>\n

<\/p>\n

N\u00eb n\u00eb benchmark-\u00ebt e publikuar<\/a><\/noindex> p\u00ebr Istio thuhet:<\/p>\n

<\/p>\n

Me Istio 1.1, proksi konsumon rreth 0.6 vCPU (nuk \u00ebsht\u00eb b\u00ebrtham\u00eb virtuale) p\u00ebr 1000 k\u00ebrkesa n\u00eb sekond\u00eb.<\/p><\/blockquote>\n

P\u00ebr rajonin e par\u00eb n\u00eb rrjetin e sh\u00ebrbimeve (me 2 proksi nga secila an\u00eb e lidhjes), do t\u00eb kemi 1200 b\u00ebrthama vet\u00ebm p\u00ebr proksi, duke u bazuar n\u00eb nj\u00eb milion k\u00ebrkesa n\u00eb sekond\u00eb. Sipas kalkulatorit t\u00eb \u00e7mimeve t\u00eb Google, rezulton rreth $40\/muaj\/b\u00ebrthama p\u00ebr konfigurimin n1-standard-64<\/code>, k\u00ebshtu q\u00eb ky rajon do t\u00eb na kushtoj\u00eb m\u00eb shum\u00eb se 50 mij\u00eb dollar\u00eb n\u00eb muaj p\u00ebr 1 milion k\u00ebrkesa n\u00eb sekond\u00eb.<\/p>\n

<\/p>\n

Ivan Sim (Ivan Sim<\/a><\/noindex>) ilustroi qart\u00eb<\/a><\/noindex> vonimet e rrjetit t\u00eb sh\u00ebrbimeve vitin e kaluar dhe premtoi t\u00eb nj\u00ebjt\u00ebn gj\u00eb p\u00ebr memorin\u00eb dhe procesorin, por nuk arriti:<\/p>\n

<\/p>\n

Duket se values-istio-test.yaml do t\u00eb rris\u00eb ndjesh\u00ebm k\u00ebrkesat p\u00ebr procesorin. N\u00ebse e kam llogaritur si\u00e7 duhet, jan\u00eb rreth 24 b\u00ebrthama procesori p\u00ebr panelin e kontrollit dhe 0.5 CPU p\u00ebr \u00e7do proksi. Nuk kam aq shum\u00eb. Do t'i p\u00ebrs\u00ebris testet kur m\u00eb ndahen m\u00eb shum\u00eb burime.<\/p><\/blockquote>\n

D\u00ebshiroja t\u00eb sigurohesha sa t\u00eb ngjashme jan\u00eb treguesit e Istio me nj\u00eb rrjet sh\u00ebrbimesh me kod t\u00eb hapur: Linkerd<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Instalimi i rrjetit t\u00eb sh\u00ebrbimeve<\/h3>\n

<\/p>\n

I pari q\u00eb instalova n\u00eb klas\u00ebr SuperGloo<\/a><\/noindex>:<\/p>\n

<\/p>\n

$ supergloo init\ninstalling supergloo version 0.3.12\nusing chart uri https:\/\/storage.googleapis.com\/supergloo-helm\/charts\/supergloo-0.3.12.tgz\nconfigmap\/sidecar-injection-resources created\nserviceaccount\/supergloo created\nserviceaccount\/discovery created\nserviceaccount\/mesh-discovery created\nclusterrole.rbac.authorization.k8s.io\/discovery created\nclusterrole.rbac.authorization.k8s.io\/mesh-discovery created\nclusterrolebinding.rbac.authorization.k8s.io\/supergloo-role-binding created\nclusterrolebinding.rbac.authorization.k8s.io\/discovery-role-binding created\nclusterrolebinding.rbac.authorization.k8s.io\/mesh-discovery-role-binding created\ndeployment.extensions\/supergloo created\ndeployment.extensions\/discovery created\ndeployment.extensions\/mesh-discovery created\ninstall successful!<\/code><\/pre>\n
<\/p>\n
Kam p\u00ebrdorur SuperGloo, sepse ai e b\u00ebn shum\u00eb m\u00eb t\u00eb leht\u00eb ngarkimin fillestar t\u00eb rrjetit t\u00eb sh\u00ebrbimeve. Nuk m\u00eb duhej t\u00eb b\u00ebja shum\u00eb. N\u00eb prodhim, nuk p\u00ebrdorim SuperGloo, por p\u00ebr nj\u00eb detyr\u00eb t\u00eb till\u00eb ai \u00ebsht\u00eb perfekt. M\u00eb duhej t\u00eb aplikoj vet\u00ebm disa komand\u00eb p\u00ebr \u00e7do rrjet sh\u00ebrbimesh. P\u00ebrdorja dy klastra p\u00ebr izolim - nj\u00eb p\u00ebr Istio dhe nj\u00eb p\u00ebr Linkerd.<\/p>\n
<\/p>\n
Eksperimenti u realizua n\u00eb Google Kubernetes Engine. Kam p\u00ebrdorur Kubernetes 1.12.7-gke.7<\/code> dhe nj\u00eb grup nyjesh n1-standard-4<\/code> me shkall\u00ebzim automatik nyjesh (minimum 4, maksimum 16).<\/p>\n
<\/p>\n
Pastaj instalova t\u00eb dy rrjetet e sh\u00ebrbimeve nga linja e komandave.<\/p>\n
<\/p>\n
Fillimisht Linkerd:<\/p>\n
<\/p>\n
$ supergloo install linkerd --name linkerd\n+---------+--------------+---------+---------------------------+\n| INSTALL |     TYPE     | STATUS  |          DETAILS          |\n+---------+--------------+---------+---------------------------+\n| linkerd | Linkerd Mesh | Pending | enabled: true             |\n|         |              |         | version: stable-2.3.0     |\n|         |              |         | namespace: linkerd        |\n|         |              |         | mtls enabled: true        |\n|         |              |         | auto inject enabled: true |\n+---------+--------------+---------+---------------------------+<\/code><\/pre>\n
<\/p>\n
M\u00eb pas Istio:<\/p>\n
<\/p>\n
$ supergloo install istio --name istio --installation-namespace istio-system --mtls=true --auto-inject=true\n+---------+------------+---------+---------------------------+\n| INSTALL |    TYPE    | STATUS  |          DETAILS          |\n+---------+------------+---------+---------------------------+\n| istio   | Istio Mesh | Pending | enabled: true             |\n|         |            |         | version: 1.0.6            |\n|         |            |         | namespace: istio-system   |\n|         |            |         | mtls enabled: true        |\n|         |            |         | auto inject enabled: true |\n|         |            |         | grafana enabled: true     |\n|         |            |         | prometheus enabled: true  |\n|         |            |         | jaeger enabled: true      |\n+---------+------------+---------+---------------------------+<\/code><\/pre>\n
<\/p>\n
Crash-loop zgjati disa minuta, pastaj panelet e kontrollit u stabilizuan.<\/p>\n
<\/p>\n
(Sh\u00ebnim. SuperGloo aktualisht mb\u00ebshtet vet\u00ebm Istio 1.0.x. E p\u00ebrs\u00ebris eksperimentin me Istio 1.1.3, por nuk v\u00eb re ndonj\u00eb ndryshim t\u00eb ndjesh\u00ebm.)<\/em><\/p>\n
<\/p>\n
Konfigurimi i injektimit automatik t\u00eb Istio<\/h3>\n
<\/p>\n
P\u00ebr t\u00eb instaluar sidecar-in Envoy, p\u00ebrdorim injektorin e sidecar-it - MutatingAdmissionWebhook<\/code>. Nuk do t\u00eb flasim p\u00ebr t\u00eb n\u00eb k\u00ebt\u00eb artikull. Thjesht do t\u00eb them se ky \u00ebsht\u00eb nj\u00eb kontrollues q\u00eb monitoron qasjen e t\u00eb gjitha pod-ve t\u00eb rinj dhe shton dinamikisht sidecar dhe initContainer, i cili \u00ebsht\u00eb p\u00ebrgjegj\u00ebs p\u00ebr detyrat iptables<\/code>.<\/p>\n
<\/p>\n
Ne n\u00eb Shopify shkruam kontrolluesin ton\u00eb t\u00eb aksesit p\u00ebr injektimin e sidecar-eve, por n\u00eb k\u00ebt\u00eb benchmark mora kontrolluesin q\u00eb vjen me Istio. Kontrolluesi p\u00ebr default injekton sidecar-e kur n\u00eb hap\u00ebsir\u00ebn e emrave ka nj\u00eb etik\u00ebt istio-injection: enabled<\/code>:<\/p>\n
<\/p>\n
$ kubectl label namespace irs-client-dev istio-injection=enabled\nnamespace\/irs-client-dev labeled\n\n$ kubectl label namespace irs-server-dev istio-injection=enabled\nnamespace\/irs-server-dev labeled<\/code><\/pre>\n
<\/p>\n
Konfigurimi i injektimit automatik t\u00eb Linkerd<\/h3>\n
<\/p>\n
P\u00ebr t\u00eb konfiguruar injektimin e sidecar-eve t\u00eb Linkerd, p\u00ebrdorim anota (i kam shtuar manualisht p\u00ebrmes kubectl edit<\/code>):<\/p>\n
<\/p>\n
metadata:\n  annotations:\n    linkerd.io\/inject: enabled<\/code><\/pre>\n
<\/p>\n
$ k edit ns irs-server-dev \nnamespace\/irs-server-dev edited\n\n$ k get ns irs-server-dev -o yaml\napiVersion: v1\nkind: Namespace\nmetadata:\n  annotations:\n    linkerd.io\/inject: enabled\n  name: irs-server-dev\nspec:\n  finalizers:\n  - kubernetes\nstatus:\n  phase: Active<\/code><\/pre>\n
<\/p>\n
Simuluesi i munges\u00ebs s\u00eb q\u00ebndrueshm\u00ebris\u00eb t\u00eb Istio<\/h3>\n
<\/p>\n
Ne kemi krijuar nj\u00eb simulator q\u00ebndrueshm\u00ebrie p\u00ebr Istio p\u00ebr t\u00eb eksperimentuar me trafikun unik p\u00ebr Shopify. Na duhej nj\u00eb mjet p\u00ebr t\u00eb krijuar nj\u00eb topologji t\u00eb rast\u00ebsishme q\u00eb do p\u00ebrfaq\u00ebsonte nj\u00eb pjes\u00eb t\u00eb caktuar t\u00eb grafikut t\u00eb sh\u00ebrbimit ton\u00eb me konfigurim dinamik p\u00ebr modelimin e ngarkesave t\u00eb caktuara.<\/p>\n
<\/p>\n
Infrastruktura e Shopify p\u00ebrballet me nj\u00eb ngarkes\u00eb t\u00eb madhe gjat\u00eb shitjeve flash. N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, Shopify u rekomandon shit\u00ebsve q\u00eb t\u00eb organizojn\u00eb shpesh shitje t\u00eb tilla<\/a><\/noindex>. Klient\u00ebt e m\u00ebdhenj ndonj\u00ebher\u00eb lajm\u00ebrojn\u00eb p\u00ebr shitjet e planifikuara flash. T\u00eb tjer\u00eb i organizojn\u00eb ato papritur p\u00ebr ne n\u00eb \u00e7do or\u00eb t\u00eb dit\u00ebs e nat\u00ebs.<\/p>\n
<\/p>\n
Ne doja q\u00eb simulatori yn\u00eb i q\u00ebndrueshm\u00ebris\u00eb t\u00eb modelonte proceset q\u00eb p\u00ebrputhen me topologjit\u00eb dhe ngarkesat q\u00eb kan\u00eb \u00e7uar n\u00eb mbingarkesa t\u00eb infrastruktur\u00ebs s\u00eb Shopify n\u00eb t\u00eb kaluar\u00ebn. Q\u00ebllimi kryesor i p\u00ebrdorimit t\u00eb service mesh \u00ebsht\u00eb se na nevojitet besueshm\u00ebri dhe q\u00ebndrueshm\u00ebri n\u00eb nivelin e rrjetit, dhe \u00ebsht\u00eb e r\u00ebnd\u00ebsishme p\u00ebr ne q\u00eb service mesh t\u00eb p\u00ebrballoj\u00eb efektivisht ngarkesat q\u00eb m\u00eb par\u00eb kan\u00eb penguar funksionimin e sh\u00ebrbimeve.<\/p>\n
<\/p>\n
N\u00eb thelb, simulatori i q\u00ebndrueshm\u00ebris\u00eb bazohet n\u00eb nj\u00eb nod t\u00eb pun\u00ebs q\u00eb vepron si nod i service mesh. Nodet e pun\u00ebs mund t\u00eb konfigurohen n\u00eb m\u00ebnyr\u00eb statike gjat\u00eb nisjes ose n\u00eb m\u00ebnyr\u00eb dinamike p\u00ebrmes REST API. Ne p\u00ebrdorim konfigurimin dinamik t\u00eb nod\u00ebve t\u00eb pun\u00ebs p\u00ebr t\u00eb krijuar procese si teste regresive.<\/p>\n
<\/p>\n
Ja nj\u00eb shembull i nj\u00eb procesi t\u00eb till\u00eb:<\/p>\n
<\/p>\n