🥇Layisha ukulungelelanisa kunye nokukala unxibelelwano oluhlala ixesha elide kwi-Kubernetes

Eli nqaku liza kukunceda uqonde ukuba ulungelelwaniso lomthwalo lusebenza njani kwi-Kubernetes, kwenzeka ntoni xa ulinganisa uxhulumaniso oluhlala ixesha elide, kwaye kutheni kufuneka ucinge ukulinganisa icala lomxhasi ukuba usebenzisa iHTTP/2, gRPC, RSockets, AMQP, okanye ezinye iiprothokholi ezihlala ixesha elide. .

Kancinci malunga nokuba i-traffic isasazwa njani kwakhona kwi-Kubernetes

I-Kubernetes ibonelela ngezithintelo ezimbini ezifanelekileyo zokuthumela izicelo: Iinkonzo kunye nokusasazwa.

Ukusasazwa kuchaza ukuba zingaphi kwaye zingaphi iikopi zesicelo sakho ekufuneka zisebenze nangaliphi na ixesha. Isicelo ngasinye sisetyenziswa njengePod kwaye sabelwe idilesi ye-IP.

Iinkonzo zifana nomsebenzi kwisilinganisi somthwalo. Ziyilelwe ukusasaza i-traffic kwiipod ezininzi.

Makhe sibone ukuba ikhangeleka njani.

Kumzobo ongezantsi unokubona imizekelo emithathu yesicelo esifanayo kunye nesilinganisi somthwalo:
Umlinganisi womthwalo ubizwa ngokuba yiNkonzo kwaye unikwe idilesi ye-IP. Nasiphi na isicelo esingenayo sithunyelwa kwenye yeepod:
Imeko yokusasazwa imisela inani leemeko zesicelo. Awusoze ufune ukwandisa ngokuthe ngqo phantsi:
I-pod nganye inikwe idilesi yayo ye-IP:

Kuluncedo ukucinga ngeenkonzo njengengqokelela yeedilesi ze-IP. Ngalo lonke ixesha ufikelela kwinkonzo, enye yeedilesi zeIP iyakhethwa kuluhlu kwaye isetyenziswe njengedilesi yendawo.

Ijongeka ngolu hlobo.

Isicelo se-curl 10.96.45.152 sifunyenwe kwinkonzo:
Inkonzo ikhetha enye yeedilesi ezintathu zepod njengendawo yokufikela:
Itrafikhi iphinde yasiwa kwindawo ethile:

Ukuba isicelo sakho siquka i-frontend kunye ne-backend, ngoko uya kuba nazo zombini inkonzo kunye nokusasazwa nganye.

Xa i-frontend yenza isicelo kwi-backend, akufuneki ukuba yazi kakuhle ukuba zingaphi iipods ezisebenza ngasemva: kunokubakho enye, ishumi, okanye ikhulu.

Kwakhona, i-frontend ayiyazi nantoni na malunga needilesi zeepods ezikhonza i-backend.

Xa i-frontend yenza isicelo kwi-backend, isebenzisa idilesi ye-IP yenkonzo yangasemva, engatshintshi.

Nantsi oku kubonakala ngathi..

Ngaphantsi kwe-1 icela inxalenye yangaphakathi yangasemva. Endaweni yokukhetha enye ye-backend, yenza isicelo kwinkonzo:
Inkonzo ikhetha enye yeepod ezingasemva njengedilesi yendawo:
Itrafikhi isuka kwiPod 1 iye kwiPod 5, ekhethwe yinkonzo:
Ngaphantsi kwe-1 akazi ngokuthe ngqo ukuba zingaphi iipod ezingaphantsi kwe-5 ezifihlwe emva kwenkonzo:

Kodwa ingaba inkonzo isasaza njani izicelo? Kubonakala ngathi kusetyenziswa ukulinganisa i-robin ejikelezayo? Masiyiqonde.

Ukulinganisa kwiinkonzo zeKubernetes

Iinkonzo zeKubernetes azikho. Akukho nkqubo yenkonzo eyabelwe idilesi ye-IP kunye nezibuko.

Ungaqinisekisa oku ngokungena kuyo nayiphi na indawo kwiqela kwaye usebenzise i netstat -ntlp umyalelo.

Awuzukwazi nokufumana idilesi ye-IP eyabelwe inkonzo.

Idilesi ye-IP yenkonzo ibekwe kuluhlu lolawulo, kumlawuli, kwaye irekhodwe kwisiseko sedatha - njl. Kwale dilesi isetyenziswa lelinye icandelo - kube-proxy.
I-Kube-proxy ifumana uluhlu lweedilesi ze-IP kuzo zonke iinkonzo kwaye ivelise isethi yemithetho ye-iptables kwi-node nganye kwiqela.

Le mithetho ithi: "Ukuba sibona idilesi ye-IP yenkonzo, kufuneka silungise idilesi yendawo yesicelo kwaye siyithumele kwenye yeepods."

Idilesi ye-IP yenkonzo isetyenziswa kuphela njengendawo yokungena kwaye ayihanjiswa yiyo nayiphi na inkqubo yokuphulaphula loo dilesi ye-IP kunye nezibuko.

Makhe sijonge oku.

Khawucinge ngeqela lee nodi ezintathu. Indawo nganye ineepods:
Iipod ezibotshiweyo ezipeyintwe i-beige ziyinxalenye yenkonzo. Ngenxa yokuba inkonzo ayikho njengenkqubo, iboniswa ngegrey:
Ipod yokuqala icela inkonzo kwaye kufuneka iye kwenye yeepods ezinxulumeneyo:
Kodwa inkonzo ayikho, inkqubo ayikho. Ingaba isebenza kanjani?
Ngaphambi kokuba isicelo sishiye i-node, sihamba ngemithetho ye-iptables:
Imithetho ye-iptables iyazi ukuba inkonzo ayikho kwaye ithathe indawo yedilesi ye-IP enye yeedilesi ze-IP yeepod ezinxulumene naloo nkonzo:
Isicelo sifumana idilesi ye-IP esebenzayo njengedilesi yendawo ekuyiwa kuyo kwaye ilungiswa ngesiqhelo:
Ngokuxhomekeke kwi-topology yenethiwekhi, isicelo ekugqibeleni sifikelela kwipod:

Ngaba i-iptables ingalayisha ibhalansi?

Hayi, iiptables zisetyenziselwa ukucoca kwaye azizange zenzelwe ukulinganisa.

Nangona kunjalo, kunokwenzeka ukuba ubhale uluhlu lwemigaqo esebenza njengaye pseudo-balancer.

Kwaye yiloo nto kanye ephunyezwayo kwi-Kubernetes.

Ukuba uneepod ezintathu, kube-proxy iya kubhala le migaqo ilandelayo:

Khetha i-sub yokuqala enokwenzeka ye-33%, kungenjalo yiya kumgaqo olandelayo.
Khetha okwesibini okunokwenzeka kwi-50%, kungenjalo yiya kumgaqo olandelayo.
Khetha eyesithathu ngaphantsi.

Le nkqubo ibangela ukuba iphod nganye ikhethwe nge 33%.

Kwaye akukho siqinisekiso sokuba iPod 2 iya kukhethwa ngokulandelayo emva kwePod 1.

Qaphela:: iptables isebenzisa imodyuli yezibalo kunye nokusabalalisa okungahleliwe. Ngaloo ndlela, i-algorithm yokulinganisa isekelwe ekukhethweni okungahleliwe.

Ngoku ukuba uyayiqonda indlela iinkonzo ezisebenza ngayo, makhe sijonge iimeko zenkonzo ezinomdla ngakumbi.

Uxhulumaniso oluhlala ixesha elide kwi-Kubernetes alukhuli ngokungagqibekanga

Isicelo ngasinye se-HTTP esivela kwi-frontend ukuya kwi-backend sinikezelwa ngoxhumo oluhlukeneyo lwe-TCP, oluvulwa kwaye luvaliwe.

Ukuba i-frontend ithumela izicelo ze-100 ngesibini kwi-backend, emva koko i-100 i-TCP edibeneyo ivuliwe kwaye ivaliwe.

Unokunciphisa ixesha lokucubungula isicelo kunye nomthwalo ngokuvula uxhumano lwe-TCP enye kwaye uyisebenzise kuzo zonke izicelo ze-HTTP ezilandelayo.

Iprothokholi yeHTTP inophawu olubizwa ngokuba yi-HTTP gcina-iphila, okanye ukusetyenziswa kwakhona koqhagamshelwano. Kule meko, uxhulumaniso olulodwa lwe-TCP lusetyenziselwa ukuthumela nokufumana izicelo ezininzi ze-HTTP kunye neempendulo:

Olu phawu ayenziwanga lusebenze ngokungagqibekanga: zombini umncedisi kunye nomxhasi kufuneka ziqwalaselwe ngokufanelekileyo.

Ukuseta ngokwalo kulula kwaye kuyafikeleleka kuninzi lweelwimi zokucwangcisa kunye nokusingqongileyo.

Nanga amanye amakhonkco kwimizekelo kwiilwimi ezahlukeneyo:

Kwenzeka ntoni ukuba sisebenzisa ukugcina-ukuphila kwinkonzo ye-Kubernetes?
Makhe sicinge ukuba zombini i-frontend kunye ne-backend inkxaso gcina uphila.

Sinekopi enye ye-frontend kunye neekopi ezintathu ze-backend. I-frontend yenza isicelo sokuqala kwaye ivula uxhumano lwe-TCP kwi-backend. Isicelo sifikelela kwinkonzo, enye yeepod zangasemva ikhethwa njengedilesi yendawo ekuyiwa kuyo. I-backend ithumela impendulo, kwaye i-frontend iyayifumana.

Ngokungafaniyo nemeko eqhelekileyo apho uxhulumaniso lwe-TCP luvaliwe emva kokufumana impendulo, ngoku lugcinwe luvulekile kwizicelo ezingaphezulu ze-HTTP.

Kwenzeka ntoni ukuba i-frontend ithumela izicelo ezininzi kwi-backend?

Ukuthumela ezi zicelo, uqhagamshelo lwe-TCP oluvulekileyo luya kusetyenziswa, zonke izicelo ziya kwi-backend efanayo apho isicelo sokuqala sahamba khona.

Ngaba akufuneki ukuba iiptables ziphinde zisasaze itrafikhi?

Hayi kule meko.

Xa uxhulumaniso lwe-TCP lwenziwa, luhamba ngemithetho ye-iptables, ekhetha i-backend ethile apho i-traffic iya kuhamba khona.

Ekubeni zonke izicelo ezilandelayo ziseluqhagamshelo lwe-TCP esele luvulekile, imigaqo ye-iptables ayisabizwa.

Makhe sibone ukuba ikhangeleka njani.

Ipod yokuqala ithumela isicelo kwinkonzo:
Sele uyazi ukuba kuza kwenzeka ntoni emva koko. Inkonzo ayikho, kodwa kukho imigaqo ye-iptables eya kuqhuba isicelo:
Enye yeepod zangasemva iya kukhethwa njengedilesi yendawo ekuyiwa kuyo:
Isicelo sifikelela kwipod. Ngeli xesha, uxhulumaniso oluqhubekayo lwe-TCP phakathi kweepod ezimbini luya kusekwa:
Nasiphi na isicelo esilandelayo esivela kwi-pod yokuqala siya kugqitha kuqhagamshelwano olusele lusekiwe:

Isiphumo lixesha lokuphendula ngokukhawuleza kunye nokugqithisa okuphezulu, kodwa ulahlekelwa ukukwazi ukukala i-backend.

Nokuba uneepod ezimbini kwi-backend, kunye noqhagamshelo oluqhubekayo, i-traffic iya kuhlala isiya kwenye yazo.

Ngaba le nto inokulungiswa?

Kuba uKubernetes engayazi indlela yokulinganisa unxibelelwano oluzingileyo, lo msebenzi uwela kuwe.

Iinkonzo yingqokelela yeedilesi ze-IP kunye namazibuko abizwa ngokuba zii-endpoints.

Isicelo sakho sinokufumana uluhlu lweesiphelo kwinkonzo kwaye uthathe isigqibo malunga nendlela yokuhambisa izicelo phakathi kwabo. Ungavula uqhagamshelo oluzingisileyo kwi-pod nganye kunye nezicelo zebhalansi phakathi kolu nxibelelwano usebenzisa i-round-robin.

Okanye faka isicelo ngakumbi i-algorithms yokulinganisa enzima.

Ikhowudi yecala lomxhasi onoxanduva lokulungelelanisa kufuneka ilandele le ngqiqo:

Fumana uluhlu lweesiphelo kwinkonzo.
Vula uqhagamshelo oluzingisileyo kwisiphelo ngasinye.
Xa isicelo kufuneka senziwe, sebenzisa enye yoqhagamshelo oluvulekileyo.
Hlaziya rhoqo uluhlu lweesiphelo, yenza ezintsha okanye uvale imidibaniso emidala eqhubekayo ukuba uluhlu luyatshintsha.

Le nto iya kukhangeleka.

Endaweni yepod yokuqala yokuthumela isicelo kwinkonzo, unokulinganisa izicelo kwicala lomxhasi:
Kufuneka ubhale ikhowudi ebuza ukuba zeziphi iipod eziyinxalenye yenkonzo:
Nje ukuba uludwe luluhlu, lugcine kwicala lomxhasi kwaye ulisebenzise ukudibanisa kwiipods:
Unoxanduva lwealgorithm yokulinganisa umthwalo:

Ngoku umbuzo uvela: ngaba le ngxaki isebenza kuphela kwi-HTTP yokugcina-iphila?

Ukulinganisa umthwalo kwicala lomxumi

I-HTTP ayisiyiyo yodwa iprotocol enokusebenzisa imidibaniso ye-TCP eqhubekayo.

Ukuba isicelo sakho sisebenzisa i-database, ngoko uxhumano lwe-TCP aluvulwanga rhoqo xa ufuna ukwenza isicelo okanye ukubuyisela uxwebhu oluvela kwisiseko sedatha.

Endaweni yoko, uxhulumaniso oluqhubekayo lwe-TCP kwisiseko sedatha luvulwa kwaye lusetyenziswe.

Ukuba i-database yakho isetyenziswe kwi-Kubernetes kwaye ukufikelela kunikezelwa njengenkonzo, ngoko uya kuhlangabezana neengxaki ezifanayo ezichazwe kwicandelo langaphambili.

Enye ikopi yedatabase iya kulayishwa ngaphezulu kunezinye. I-Kube-proxy kunye ne-Kubernetes ayiyi kunceda ukudibanisa ukudibanisa. Kufuneka unakekele ukulungelelanisa imibuzo kwisiseko sakho sedatha.

Kuxhomekeke ekubeni leliphi ithala leencwadi olisebenzisayo ukudibanisa kuvimba weenkcukacha, unokuba neendlela ezahlukeneyo zokusombulula le ngxaki.

Apha ngezantsi ngumzekelo wokufikelela kwiqoqo ledatha ye-MySQL evela kwi-Node.js:

var mysql = require('mysql');
var poolCluster = mysql.createPoolCluster();

var endpoints = /* retrieve endpoints from the Service */

for (var [index, endpoint] of endpoints) {
  poolCluster.add(`mysql-replica-${index}`, endpoint);
}

// Make queries to the clustered MySQL database

Zininzi ezinye iiprothokholi ezisebenzisa uqhagamshelo lwe-TCP oluzingisileyo:

IiWebSockets kunye neeWebSockets ezikhuselekileyo
HTTP / 2
I-GRPC
RSockets
AMQP

Kuya kufuneka ukuba sele uqhelene noninzi lwezi protocols.

Kodwa ukuba ezi protocol zithandwa kakhulu, kutheni kungekho sisombululo sisemgangathweni sokulinganisa? Kutheni ingqiqo yomxhasi kufuneka itshintshe? Ngaba sikhona isisombululo saseKubernetes somthonyama?

I-Kube-proxy kunye ne-iptables ziyilelwe ukugubungela iimeko ezininzi zokusetyenziswa xa zithunyelwa kwi-Kubernetes. Oku kwenzelwa lula.

Ukuba usebenzisa inkonzo yewebhu eveza i-REST API, unethamsanqa - kulo mzekelo, uqhagamshelo lwe-TCP oluzingileyo alusetyenziswanga, ungasebenzisa nayiphi na inkonzo ye-Kubernetes.

Kodwa nje ukuba uqale ukusebenzisa uqhagamshelo lwe-TCP oluzingisileyo, kuya kufuneka ufumanise ukuba ungasasaza njani ngokulinganayo umthwalo kwii-backends. I-Kubernetes ayinazo izisombululo esele zenziwe kule meko.

Nangona kunjalo, kukho ngokuqinisekileyo ukhetho olunokunceda.

Ukulinganisa unxibelelwano oluhlala ixesha elide eKubernetes

Kukho iintlobo ezine zeenkonzo eKubernetes:

ClusterIP
I-NodePort
LoadBalancer
Engenantloko

Iinkonzo ezintathu zokuqala zisebenza ngokusekelwe kwidilesi ye-IP yenyani, esetyenziswa yi-kube-proxy ukwakha imithetho ye-iptables. Kodwa isiseko esisisiseko sazo zonke iinkonzo yinkonzo engenantloko.

Inkonzo engenantloko ayinayo nayiphi na idilesi ye-IP ehambelana nayo kwaye inika kuphela indlela yokufumana uluhlu lweedilesi ze-IP kunye namachweba eepods (iisiphelo) ezinxulumene nayo.

Zonke iinkonzo zisekelwe kwinkonzo engenantloko.

Inkonzo ye-ClusterIP yinkonzo engenantloko kunye nezongezo ezithile:

Umaleko wolawulo unika idilesi ye-IP.
I-Kube-proxy ivelisa imithetho efunekayo ye-iptables.

Ngale ndlela unokuhoya i-kube-proxy kwaye usebenzise ngokuthe ngqo uluhlu lweendawo zokuphela ezifunyenwe kwinkonzo engenantloko ukulayisha ibhalansi isicelo sakho.

Kodwa singongeza njani ingqiqo efanayo kuzo zonke izicelo ezifakwe kwiqela?

Ukuba isicelo sakho sele sisetyenziswa, lo msebenzi unokubonakala ungenakwenzeka. Nangona kunjalo, kukho enye indlela.

I-Service Mesh iya kukunceda

Mhlawumbi sele uqaphele ukuba iqhinga lokulinganisa umthwalo wecala lomthengi lisemgangathweni.

Xa isicelo siqala, siya:

Ifumana uluhlu lweedilesi ze-IP kwinkonzo.
Ivula kwaye igcine iphuli yoqhagamshelwano.
Ukuhlaziya idama ngamaxesha athile ngokudibanisa okanye ukususa iindawo zokuphela.

Nje ukuba isicelo sifune ukwenza isicelo, siya:

Khetha umdibaniso okhoyo usebenzisa ingqiqo ethile (umzekelo, i-round-robin).
Yenza isicelo.

La manyathelo asebenza kuzo zombini iiWebSockets, i-gRPC, kunye noqhagamshelwano lwe-AMQP.

Ungahlula le ngqiqo kwilayibrari eyahlukileyo kwaye uyisebenzise kwizicelo zakho.

Nangona kunjalo, unokusebenzisa i-meshes zenkonzo njenge-Istio okanye i-Linkerd endaweni yoko.

I-Service Mesh yongeza isicelo sakho ngenkqubo ethi:

Ukukhangela ngokuzenzekelayo iidilesi ze-IP zenkonzo.
Ivavanya imidibaniso efana neWebSockets kunye negRPC.
Ulinganisa izicelo usebenzisa iprothokholi echanekileyo.

I-Service Mesh inceda ukulawula i-traffic ngaphakathi kweqela, kodwa ibaluleke kakhulu kwimithombo. Olunye ukhetho lusebenzisa iilayibrari zomntu wesithathu njengeNetflix Ribhoni okanye iiproxi ezicwangcisiweyo ezifana noMthunywa.

Kwenzeka ntoni xa ungayihoyi imiba yokulungelelanisa?

Unokukhetha ukungasebenzisi ukulinganisa umthwalo kwaye awuboni naluphi na utshintsho. Makhe sijonge iimeko ezimbalwa zomsebenzi.

Ukuba unabathengi abaninzi kuneeseva, oku akuyongxaki enkulu.

Masithi kukho abaxhasi abahlanu abaqhagamshela kwiiseva ezimbini. Nokuba akukho lungelelaniso, zombini iiseva ziya kusetyenziswa:

Uqhagamshelo alunakusasazwa ngokulinganayo: mhlawumbi abathengi abane baqhagamshelwe kumncedisi omnye, kodwa kukho ithuba elihle lokuba zombini iiseva ziya kusetyenziswa.

Okuyingxaki ngakumbi yimeko echaseneyo.

Ukuba unabathengi abambalwa kunye neeseva ezininzi, izixhobo zakho zisenokungasetyenziswa kwaye umqobo onokuthi uvele.

Masithi kukho abathengi ababini kunye neeseva ezintlanu. Kwimeko engcono, kuya kubakho uqhagamshelwano olusisigxina ezimbini kwiiseva ezimbini kwabahlanu.

Iiseva ezishiyekileyo ziyakusebenza:

Ukuba ezi seva zimbini azikwazi kujongana nezicelo zabaxhasi, ukukala okuthe tye akuyi kunceda.

isiphelo

Iinkonzo ze-Kubernetes ziyilelwe ukusebenza kwezona meko ziqhelekileyo zesicelo sewebhu.

Nangona kunjalo, xa uqala ukusebenza ngeeprothokholi zesicelo ezisebenzisa uqhagamshelo lwe-TCP oluzingisileyo, olunje ngogcino-lwazi, i-gRPC okanye ii-WebSockets, iinkonzo azisafanelekanga. I-Kubernetes ayiboneleli ngeendlela zangaphakathi zokulinganisa uxhulumaniso lwe-TCP oluqhubekayo.

Oku kuthetha ukuba kufuneka ubhale izicelo kunye nokulungelelanisa icala lomxhasi engqondweni.

Uguqulo olulungiselelwe liqela Kubernetes aaS evela kwi-Mail.ru.

Yintoni enye ekufuneka uyifunde ngesihloko:

umthombo: www.habr.com

Ukulayisha ulungelelwaniso kunye nokulinganisa uqhagamshelwano oluhlala ixesha elide kwi-Kubernetes