ืืืจ ืืขื ืขื ืฆืืคืจืืื ืฆื ืคืึธืจืฉืืขืื ืึท ืคืึธืจืืืกืืงืข ืืืืึทืืื ื ืืืขืจืกืืข
NSM ืืื ืคืจืื
ืื ืืืคึผืืึทืืขื ืืืืฉืึทื ืคืื ืืืงืจืึธืกืขืจืืืืก ืืขืืึทืืึทืืึทืืืฉื ืืื ืคืจืึธื ืืื ืฉืืืขืจืืงืืืื ืืื ืื ืืืึธื ืคืื ืขืงืกืคึผืจืขืก ืืืืงืกื, ืืื ืืขืืื ื ืืื ืืืึทื ืงืึทืืคึผืืขืงืกืืื. ืงืึธืืื ืืงืึทืฆืืข ืฆืืืืฉื ืกืขืจืืืืกืขืก ืืืขืจื ืืขืจ ืงืึธืืคึผืืืฆืืจื, ืืืืึทืืื ื ืคึผืจืึธืืืขืืก ืืืขืจื ืืขืจ ืฉืืืขืจ, ืืื ืืขืจ ืืื ืืขืจ ืืึทืืื ืื ืืก ืืึทืจืคื ืืขืจ ืจืขืกืืจืกื ืฆื ืคืืจื.
NSM ืกืึทืืืื ืื ืคึผืจืึธืืืขืืก ืืืจื ืฆืืฉืืขืื ืืืจ ืืื:
- ืืืืขืจืงืืึทื, ืืืึธืก ืืื ืืืฆื ืืขืจ ืืืืืืืง ืืื ืืืฅ. ื ืืึทืื ืืจืืืฉ ืงืขื ืงืึธืกืื ืึท ืคืืจืืข ืืืืืึทื ื ืคืื ืืึธืืืึทืจืก ืึทื ืืืึทืื ืืื ืคืึทืจืคืึทืื ืจืขืืืขื ืืื ืฉืขื. NSM ืื ืฉืืจื ืึทื ืึทืืข ืงืึทื ืขืงืฉืึทื ื ืืขื ืขื ืื ืงืจืืคึผืืื ืืื mTLS, ืึทืืื ืขืก ืืขื ืขื ืงืืื ืฉืคึผืืจืขืืืืืง ืืึทืื ืืืึธืก ืืึทืงืขืจื ืงืขื ืขื ืกืืึธืืขื ืืืืขืจ ืื ื ืขืฅ. ืึทืงืกืขืก ืงืึธื ืืจืึธื ืึทืืึทืื ืืืจ ืฆื ืฉืืขืื ืคึผืึทืืึทืกืื ืคึฟืึทืจ ืืื ืกืขืจืืืืกืขืก ืืืขืจืืขืื ืืื ืื ืืขืจืข ืืึทืืื ืื ืืก.
- ืคืึทืจืงืขืจ ืืึทื ืึทืืขืืขื ื. ืืืขื ืืืจ ืฉืืงื ืึท ื ืืึทืข ืืืขืจืกืืข ืคืื โโโโืึท ืึทืคึผืืึทืงืืืฉืึทื, ืืืจ ืงืขื ืืืขืื ืฆื ืึธื ืืืืื ืืื ืืึทืืจืขื ืขืฆื ืื ืงืึทืืื ื ืคืึทืจืงืขืจ ืฆื ืขืก ืืื ืคืึทื ืคืื ืึท ืืขืืช. ืืื NSM ืก ืื ืืขืืืืขื ื ืงืึทื ืืืื ืขืจ ืคืึทืจืงืขืจ ืคืึทืจืืืึทืืืื ื, ืืืจ ืงืขื ืขื ืฉืืขืื ืึท ืคืึทืจืงืขืจ ืจืืกืืจืืงืฉืึทื ืคึผืึธืืืืืง ืคึฟืึทืจ ื ืืึทืข ืืึทืืื ืื ืืก ืืืึธืก ืืืขื ืคืึทืจืืจืขืกืขืจื ืคืึทืจืงืขืจ ืืืืขืจ ืฆืืื. ืื ืืขืจืข ืคึฟืขืึดืงืืืื, ืึทืืึท ืืื ืืืืงืืึทื ืืืืืืื ื ืืื ืงืจืืึทื ืืจืขืึทืงืขืจืก, ืืขืื ืืืจ ืคืื ืงืึธื ืืจืึธื ืืืืขืจ ืื ืคืึทืจืงืขืจ ืืืืคื ืคืื ืึทืืข ืืืื ืืึทืืื ืื ืืก.
- ืืืืกืืึทืืืืึทืืืึธื. ืึธื ืคืืจืื ื ืืืืื ืืขืจ ืคืื ืืึทืืื ืื ืืก ืงืขื ืขื ืืืื ืึท ื ืืืืืขืจ ืคึฟืึทืจ ืืืืึทืืื ื ืืื ืืืืืฉืืืึทืืึทืืืืฉืึทื. NSM ืืขืืคึผืก ืฆื ืืึทื ืืืขื ืืื ืืขื ืกืืืืึทืฆืืข ืืื ืึท ืืขืืืื-ืืื Grafana ืืึทืฉืืึธืจื ืืืึธืก ืืืกืคึผืืืื ืึทืืข ืื ืคึฟืขืึดืงืืืื ืื ืืืฆื ืืื NGINX Plus. ืืื ืืืื ืื ืืืคึผืืึทืืขื ืึทื ืขืคึฟื ืืจืืืกืื ื ืึทืืึทืื ืืืจ ืฆื ืืึธื ืืืึธืจ ืืจืึทื ืืึทืงืฉืึทื ื ืืื ืืขืืึทื.
- ืืืืจืื ืืืืืืืขืจืื, ืืืื ืืืื ืคืืจืืข, ืืื ืจืืึฟ ืื ืืขืจืข, ืืื ื ืืฉื ื ืืฆื ืื ืคืจืึทืกืืจืึทืงืืฉืขืจ ืคืืืกื ืืืง ืืขืืึทืืจืข ืืืืฃ Kubernetes. NSM ืื ืฉืืจื ืึทื ืืขืืึทื ืึทืคึผืืึทืงืืืฉืึทื ื ืืขื ืขื ื ืืฉื ืืื ืงืก ืึทื ืึทืืขื ืืื. ืืื ืืขืจ ืืืืฃ ืคืื ืื ืืืคึผืืึทืืขื ืึทื NGINX Kubernetes Ingress Controller, ืืขืืึทื ืืึทืืื ืื ืืก ืงืขื ืขื ืืืขืจืืขืื ืืื ืืขืฉ ืืึทืืื ืื ืืก, ืืื ืืืืฆืข ืืืขืจืกืึท.
NSM ืืืื ืื ืฉืืจื ืึทืคึผืืึทืงืืืฉืึทื ืืืืขืจืืืื ืืื ื ืื ืฆืืืจืื ืื ืืืืืจืึทื ืืึทื ืฅ ืืืจื ืืจืึทื ืกืคึผืขืจืึทื ื ืึทืคึผืืืืื ื ืขื ืงืจืืคึผืฉืึทื ืืื ืึธืืขื ืืึทืงืืืฉืึทื ืฆื ืงืึทื ืืืื ืขืจ ืคืึทืจืงืขืจ. ืขืก ืืืื ืืื ืืจืึทื ืกืึทืงืืืึธื ืืืืืึทืืืืืื ืืื ืึทื ืึทืืืกืืก, ืืขืืคึผืื ื ืืืจ ืืขืฉืืืื ื ืืื ืึทืงืืขืจืึทืืื ืงืึทืืขืจ ืืืคึผืืืืืึทื ืฅ ืืื ืืจืึธืืืืขืฉืึธืึธื ืคึผืจืึธืืืขืืก. ืขืก ืืืื ืคึผืจืึธืืืืืขืก ืืจืึทื ืืึทืืขืจ ืคืึทืจืงืขืจ ืงืึธื ืืจืึธื, ืึทืืึทืืื ื DevOps ืืืื ืฆื ืฆืขืืืืงืืขื ืืื ืึทืคึผืืึทืืืื ืคึผืึทืจืฅ ืคืื ืึทืคึผืืึทืงืืืฉืึทื ื ืืื ืืขืื ืืขืืืขืืึธืคึผืขืจืก ืฆื ืืืืขื ืืื ืืืืื ืคืึทืจืืื ืื ืืืืขืจ ืคืื ืื ืืขืจืืขืืืืื ืึทืคึผืืึทืงืืืฉืึทื ื.
ืืื ืึทืจืืขื ืื NGINX ืกืขืจืืืืก ืืขืฉ?
NSM ืืืฉืืืื ืคืื ืึท ืืื ืึทืคืืื ืืึทืื ืคืืึทื ืคึฟืึทืจ ืืึธืจืืืึธื ืืึทื (ืืื ืกื-ืฆื-ืืื ืกื) ืคืึทืจืงืขืจ ืืื ืึทื ืขืืืขืืื NGINX Plus ืื ืืจืขืกืก ืงืึธื ืืจืึธืืืขืจ ืคึฟืึทืจ ืืืขืจืืืงืึทื ืคืึทืจืงืขืจ, ืืขืจืืื ืืืจื ืึท ืืืื ืงืึธื ืืจืึธื ืคืืึทื.
ืื ืงืึธื ืืจืึธื ืคืืึทื ืืื ืกืคึผืึทืกืืคืืงืื ืืืืืื ื ืืื ืึธืคึผืืืืืืขื ืคึฟืึทืจ ืื NGINX Plus ืืึทืื ืคืืึทื ืืื ืืืคืืื ื ืคืึทืจืงืขืจ ืงืึธื ืืจืึธื ืึผืืืื ืคืื ืื ืืขืจืืขืืืืื ืืืืขืจ NGINX Plus ืกืืืืงืึทืจืก.
ืืื NSM, ืกืืืืงืึทืจืก ืคึผืจืึทืงืกืื ืืขื ืขื ืืื ืกืืึทืืืจื ืคึฟืึทืจ ืืขืืขืจ ืกืขืจืืืืก ืืื ืื ืืืื. ืืื ืคืึทืจืืื ืื ืืื ืื ืคืืืืขื ืืข ืึธืคึฟื ืืงืืจ ืกืึทืืืฉืึทื ื:
- ืืจืึทืคืึทื ืึท, ืคึผืจืึธืืขืืืขืืก ืคึผืึทืจืึทืืขืืขืจ ืืืืืฉืืืึทืืึทืืืืฉืึทื, ืึท ืืขืืืื-ืืื NSM ืืึทืคืืืข ืืขืืคึผืก ืืืจ ืืื ืืืื ืึทืจืืขื;
- Kubernetes Ingress Controllers, ืคึฟืึทืจ ืึธื ืคืืจืื ื ืื ืงืึทืืื ื ืืื ืึทืืืืึธืืื ื ืคืึทืจืงืขืจ ืืื ืื ืืืื;
- SPIRE, CA ืคึฟืึทืจ ืึธื ืคืืจืื ื, ืืืกืืจืืืืืืื ื ืืื ืึทืคึผืืืืืื ื ืกืขืจืืืคืืงืึทืฅ ืืื ืื ืืืื;
- NATS, ืึท ืกืงืึทืืึทืืืข ืกืืกืืขื ืคึฟืึทืจ ืฉืืงื ืึทืจืืืงืืขื, ืึทืืึท ืืื ืืึทืจืฉืจืื ืืขืจืืืึทื ืืืงืื ืืขื, ืคึฟืื ืื ืงืึธื ืืจืึธื ืคืืึทื ืฆื ืกืืืืงืึทืจืก;
- ืขืคึฟื ืืจืืืกืื ื, ืคืื ืื ืืขืจืืขืืืืื ืืืืึทืืื ื (ืืืคึผืงืื ืืื ืืืฉืืืขืจ ืืขืฉืืืฆื);
- ืคึผืจืึธืืขืืืขืืก, ืงืึทืืขืงืฅ ืืื ืงืจืึธื ืงืขืจืึทืงืืขืจืืกืืืงืก ืคืื NGINX Plus ืกืืืืงืึทืจืก, ืึทืืึท ืืื ืื ื ืืืขืจ ืคืื ืจืืงืืืขืก, ืงืึทื ืขืงืฉืึทื ื ืืื ืกืกื ืืึทื ืืฉืืืงืก.
ืคืึทื ืืงืฉืึทื ื ืืื ืงืึทืืคึผืึธืื ืึทื ืฅ
NGINX Plus ืืื ืึท ืืึทืื ืคืืึทื ืงืึธืืืขืจืก ืกืืืืงืึทืจ ืคึผืจืึทืงืกื (ืืึธืจืืืึธื ืืึทื ืคืึทืจืงืขืจ) ืืื ืื ืืจืขืกืก ืงืึธื ืืจืึธืืืขืจ (ืืืขืจืืืงืึทื), ืื ืืขืจืกืขืคึผืืื ื ืืื ืึธื ืคืืจืื ื ืงืึทื ืืืื ืขืจ ืคืึทืจืงืขืจ ืฆืืืืฉื ืืึทืืื ืื ืืก.
ืคึฟืขืึดืงืืืื ืึทืจืืึทื ื ืขืืขื:
- ืงืขืื ืฆืืึทืืืง TLS (mTLS) ืึธืืขื ืืึทืงืืืฉืึทื;
- ืืึทืกืข ืืึทืืึทื ืกืื ื;
- ืฉืืื ืืึธืืขืจืึทื ืฅ;
- ืืืืงืืึทื ืฉืืขืืจ;
- ืงืจืืื ืืจืืืงืื ื;
- ืืื-ืืจืื ืืื ืงืึทื ืึทืจื ืืืคึผืืืืืึทื ืฅ;
- ืึทืงืกืขืก ืงืึธื ืืจืึธื.
ืืึธื ืืฉืื ื NGINX ืกืขืจืืืืก ืืขืฉ
ืฆื ืืืืคื NSM ืืืจ ืืึทืจืคึฟื:
- ืฆืืืจืื ืฆื ืื Kubernetes ืกืืืืืืข. NGINX Service Mesh ืืื ืืขืฉืืืฆื ืืืืฃ ืคืืืข Kubernetes ืคึผืืึทืืคืึธืจืืก, ืึทืจืืึทื ืืขืจืขืื ื Amazon Elastic Container Service for Kubernetes (EKS), Azure Kubernetes Service (AKS), Google Kubernetes Engine (GKE), VMware vSphere ืืื ืจืขืืืืขืจ Kubernetes ืงืืึทืกืืขืจื ืืืคึผืืืื ืืืืฃ ืืึทืื ืืืึทืจื ืกืขืจืืืขืจืก;
- ืงืืืืข
kubectl
, ืืื ืกืืึทืืืจื ืืืืฃ ืื ืืึทืฉืื ืคึฟืื ืืืึธืก NSM ืืืขื ืืืื ืืื ืกืืึทืืืจื; - ืึทืงืกืขืก ืฆื NGINX Service Mesh ืืขืืืื ื ืคึผืึทืงืึทืืืฉืึทื. ืืขืจ ืคึผืขืงื ืึผืืื NSM ืืืืืขืจ ืืืจืฃ ืคึฟืึทืจ ืืคึผืืึธืึทืืื ื ืฆื ืึท ืคึผืจืืืืึทื ืจืขืืืกืืจื ืคึฟืึทืจ ืงืึทื ืืืื ืขืจื ืื ืืืฆื ืืื ืื Kubernetes ืงื ืืื. ืืขืจ ืคึผืขืงื ืืืื ืึผืืื
nginx-meshctl
, ืืืจืฃ ืฆื ืฆืขืืืืงืืขื NSM.
ืฆื ืฆืขืืืืงืืขื NSM ืืื ืคืขืืืงืืึทื ืกืขืืืื ืืก, ืืืืคื ืื ืคืืืืขื ืืข ืืึทืคึฟืขื. ืืขืฉืึทืก ืืืคึผืืืืืึทื ื, ืึทืจืืืงืืขื ืืขื ืขื ืืขืืืืื ืืืึธืก ืื ืืืงืืืฅ ืึทื ืื ืงืึทืืคึผืึธืื ืึทื ืฅ ืืขื ืขื ืืื ืกืืึทืืืจื ืืฆืืื, ืืื ืืขืกืึธืฃ ืึท ืึธื ืืึธื ืืืึธืก ืื ืืืงืืืฅ ืึทื NSM ืืื ืคืืืกื ืืืง ืืื ืึท ืืึทืืื ืืขืจ ื ืึทืืขืกืคึผืึทืกืข (ืืืจ ืืึทืจืคึฟื ืืืื ืขืจ ืขืจืฉืืขืจ).
$ DOCKER_REGISTRY=your-Docker-registry ; MESH_VER=0.6.0 ;
./nginx-meshctl deploy
--nginx-mesh-api-image "${DOCKER_REGISTRY}/nginx-mesh-api:${MESH_VER}"
--nginx-mesh-sidecar-image "${DOCKER_REGISTRY}/nginx-mesh-sidecar:${MESH_VER}"
--nginx-mesh-init-image "${DOCKER_REGISTRY}/nginx-mesh-init:${MESH_VER}"
--nginx-mesh-metrics-image "${DOCKER_REGISTRY}/nginx-mesh-metrics:${MESH_VER}"
Created namespace "nginx-mesh".
Created SpiffeID CRD.
Waiting for Spire pods to be running...done.
Deployed Spire.
Deployed NATS server.
Created traffic policy CRDs.
Deployed Mesh API.
Deployed Metrics API Server.
Deployed Prometheus Server nginx-mesh/prometheus-server.
Deployed Grafana nginx-mesh/grafana.
Deployed tracing server nginx-mesh/zipkin.
All resources created. Testing the connection to the Service Mesh API Server...
Connected to the NGINX Service Mesh API successfully.
NGINX Service Mesh is running.
ืคึฟืึทืจ ืืขืจ ืึธืคึผืฆืืขืก, ืึทืจืืึทื ืืขืจืขืื ื ืึทืืืึทื ืกืืจืืข ืกืขืืืื ืืก, ืืืืคื ืืขื ืืึทืคึฟืขื:
$ nginx-meshctl deploy โh
ืงืึธื ืืจืึธืืืจื ืึทื ืื ืงืึธื ืืจืึธื ืคืืึทื ืึทืจืืขื ืจืืืืืง ืืื ืื ื ืึธืืขื nginx-mesh, ืืืจ ืงืขื ืขื ืืึธื ืืึธืก:
$ kubectl get pods โn nginx-mesh
NAME READY STATUS RESTARTS AGE
grafana-6cc6958cd9-dccj6 1/1 Running 0 2d19h
mesh-api-6b95576c46-8npkb 1/1 Running 0 2d19h
nats-server-6d5c57f894-225qn 1/1 Running 0 2d19h
prometheus-server-65c95b788b-zkt95 1/1 Running 0 2d19h
smi-metrics-5986dfb8d5-q6gfj 1/1 Running 0 2d19h
spire-agent-5cf87 1/1 Running 0 2d19h
spire-agent-rr2tt 1/1 Running 0 2d19h
spire-agent-vwjbv 1/1 Running 0 2d19h
spire-server-0 2/2 Running 0 2d19h
zipkin-6f7cbf5467-ns6wc 1/1 Running 0 2d19h
ืืขืคึผืขื ืืื ื ืืืืฃ ืื ืืืคึผืืืืืึทื ื ืกืขืืืื ืืก ืืืึธืก ืฉืืขืื ืืึทื ืืึทื ืึธืืขืจ ืึธืืึทืืึทืืืง ืื ืืืฉืขืงืฉืึทื ืคึผืึทืืึทืกืื, โโNGINX ืกืืืืงืึทืจืก ืคึผืจืึทืงืกืื ืืืขื ืืืื ืืืกืืฃ ืฆื ืึทืคึผืืึทืงืืืฉืึทื ื ืืืจื ืคืขืืืงืืึทื. ืฆื ืืืกืืืืึทื ืึธืืึทืืึทืืืง ืึทืืื ื, ืืืืขื ืขื
ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืื ืืืจ ืฆืขืืืืงืืขื ืื ืึทืคึผืืึทืงืืืฉืึทื ืฉืืึธืฃ ืืื ื ืึธืืขื ืคึผืืึทืฅ ื ืื ืืืกืฆืึธืื, ืืื ืืึทื ืืฉืขืง ืื ืคึผืึธื - ืืืจ ืืืขืื ืืขื ืฆืืืื ืคืืืกื ืืืง ืงืึทื ืืืื ืขืจื, ืื ืึทืคึผืืึทืงืืืฉืึทื ืฉืืึธืฃ ืืื ืื ืคึฟืึทืจืืื ืื ืกืืืืงืึทืจ:
$ kubectl apply โf sleep.yaml
$ kubectl get pods โn default
NAME READY STATUS RESTARTS AGE
sleep-674f75ff4d-gxjf2 2/2 Running 0 5h23m
ืืืจ ืงืขื ืขื ืืืื ืืึธื ืืืึธืจ ืื ืึทืคึผืืึทืงืืืฉืึทื ืฉืืึธืฃ ืืื ืื NGINX Plus ืืึทืคืืืข, ืืืืคื ืืขื ืืึทืคึฟืขื ืฆื ืึทืงืกืขืก ืกืืืืงืึทืจ ืคึฟืื ืืืื ืืืืข ืืึทืฉืื:
$ kubectl port-forward sleep-674f75ff4d-gxjf2 8080:8886
ืืขืืึธืื ืืืจ ื ืึธืจ ืืืื ืืื
ืืืจ ืงืขื ื ื ืืฆื ืืืื Kubernetes ืจืขืกืืจืกื ืฆื ืงืึทื ืคืืืืขืจ ืคืึทืจืงืขืจ ืคึผืึทืืึทืกืื, โโืึทืืึท ืืื ืึทืงืกืขืก ืงืึธื ืืจืึธื, ืงืืจืก ืืืืืืื ื ืืื ืงืจืืึทื ืืจืืืงืื ื.
ืกืึธืฃ
NGINX Service Mesh ืืื ืืืจืขืืืืื ืคึฟืึทืจ ืคืจืื ืืจืืคืงืืคืืข ืืื
ืฆื ืคึผืจืืืืจื NGINX Plus Ingress Controller, ืึทืงืืึทืืืืื
ืืืืขืจืืขืฆืื ื ืืืจื Pavel Demkovich, ืคืืจืืข ืื ืืฉืขื ืืจ
ืืงืืจ: www.habr.com