λ‘œμΌ“πŸΎ
article thumbnail

 

 

Istio λŠ” ν”νžˆ K8S ν΄λŸ¬μŠ€ν„° λ‚΄μ—μ„œ μ„œλΉ„μŠ€ λ©”μ‹œ 역할을 ν•΄μ€λ‹ˆλ‹€. μ„œλΉ„μŠ€ λ©”μ‹œ 뿐만 μ•„λ‹ˆλΌ Nginx Ingress, ELB Ingress 처럼 Ingress μ—­ν•  λ˜ν•œ ν•΄μ€λ‹ˆλ‹€.

 

Istio Ingress Gateway κ°€ 정식 λͺ…μΉ­μ΄λ‚˜ μ‰½κ²Œ Istio Ingress 둜 μ§€μΉ­ν•˜λ„λ‘ ν•˜μ£  🀟

 

EKS 와 같은 퍼블릭 ν΄λΌμš°λ“œλ₯Ό μ΄μš©ν•΄μ„œ Load Balancer Service λ₯Ό 생성해주면 μžλ™μœΌλ‘œ CLB κ°€ ν• λ‹Ήλ©λ‹ˆλ‹€. λ”°λΌμ„œ Istio Ingress λ˜ν•œ CLB 둜 할당이 λ©λ‹ˆλ‹€.

 

CLB λŠ” μ•žμœΌλ‘œ AWS μ—μ„œ deprecated 되기 λ•Œλ¬Έμ— Network Load Balancer(μ΄ν•˜ NLB) λ‚˜ Application Load Balancer(μ΄ν•˜ ALB) 둜 λŒ€μ²΄λ˜μ–΄μ•Ό ν•©λ‹ˆλ‹€.

 

κ·Έλž˜μ„œ 이번 κΈ€μ—μ„œλŠ” Istio κ°€ CLB κ°€ μ•„λ‹Œ Elastic Load Balancer(μ΄ν•˜ ELB) 쀑 ν•˜λ‚˜μΈ ALB λ₯Ό μ‚¬μš©ν•  수 μžˆλ„λ‘ ν•˜κ² μŠ΅λ‹ˆλ‹€.

 

Istio λŠ” 뭘까? 


λ“€μ–΄κ°€κΈ° μ•žμ„œ Istio 에 λŒ€ν•΄ μ•Œμ•„λ³΄μ£ .

 

Istio λŠ” AWS App Mesh 와 같은 μ„œλΉ„μŠ€ λ©”μ‹œλ₯Ό μ œκ³΅ν•  수 μžˆλ„λ‘ λ„μ™€μ€λ‹ˆλ‹€.


Istio λŠ” 사싀 Envoy λΌλŠ” μ„œλΉ„μŠ€λ₯Ό μΏ λ²„λ„€ν‹°μŠ€ ν™˜κ²½μ—μ„œ μ‚¬μš©μžλ“€μ΄ 쑰금 더 μ‰½κ²Œ Envoy λ₯Ό μ‚¬μš©ν•  수 μžˆλ„λ‘ ν•΄μ£ΌλŠ” CNCF μ‘Έμ—…μž‘ν’ˆμž…λ‹ˆλ‹€.

 

즉, Envoy == Istio μž…λ‹ˆλ‹€. λ‹€λ§Œ Envoy λŠ” C++ 둜 λ˜μ–΄μžˆκ³ , 맀우 μ €μˆ˜μ€€μ˜ νˆ΄μ΄λΌμ„œ μ§„μž…μž₯벽이 μ–΄λ ΅μŠ΅λ‹ˆλ‹€. λ”°λΌμ„œ 이λ₯Ό μ‰½κ²Œ κ΅¬ν˜„ν•˜κ³ μž ν•΄μ£ΌλŠ” 것이 λ°”λ‘œ Istio 라고 μ΄ν•΄ν•˜λ©΄ λ©λ‹ˆλ‹€.

100% λ§žλŠ” 말은 μ•„λ‹ˆμ§€λ§Œ Istio λŠ” Envoy μœ„μ— μžˆλŠ” 좔상화 λ ˆμ΄μ–΄λΌκ³  생각할 수 μžˆμŠ΅λ‹ˆλ‹€. πŸ™‚

 

λ˜ν•œ Istio λŠ” νŒŒλ“œ λ””μžμΈ νŒ¨ν„΄ 쀑 SideCar Container Pattern 을 μ‚¬μš©ν•©λ‹ˆλ‹€.

 

νŒŒλ“œ μ•ˆμ— SideCar 둜 Proxy κ°€ μƒκΈ°κ²Œ λ˜λŠ” 데 이 Proxy κ°€ 곧 Istio μž…λ‹ˆλ‹€. 그리고 Proxy λŠ” Istiod 에 μ˜ν•΄ κ΄€λ¦¬λ©λ‹ˆλ‹€.

 

Istio λ₯Ό μ΄μš©ν•˜λ©΄ λ‹€μŒκ³Ό 같은 κΈ°λŠ₯듀을 μ‚¬μš©ν•  수 μžˆμŠ΅λ‹ˆλ‹€.

  • ν”„λ‘μ‹œλ‘œλΆ€ν„° 원격 μΈ‘μ • κ²°κ³Ό μˆ˜μ§‘
  • ν”„λ‘μ‹œλ₯Ό μ΄μš©ν•œ 정책을 κ΅¬ν˜„
  • μΉ΄λ‚˜λ¦¬μ•„ 배포, A/B 배포, 닀크 배포 λ“± μ—¬λŸ¬κ°€μ§€ 배포 방법이 κ°€λŠ₯
  • ν…ŒμŠ€νŠΈ μ†Œν”„νŠΈμ›¨μ–΄λ₯Ό 라이브 ν”„λ‘œλ•μ…˜ ν™˜κ²½μ— 배포 κ°€λŠ₯
  • 이외 κ²°ν•© μ£Όμž…, μ„œν‚· λΈŒλ ˆμ΄ν‚Ή, mTLS 등이 κ°€λŠ₯

 

이외에도 μ—¬λŸ¬κ°€μ§€ κΈ°λŠ₯이 μžˆμ§€λ§Œ 이에 λŒ€ν•΄μ„œλŠ” λ‹€λ₯Έ κΈ€μ—μ„œ 닀루도둝 ν•˜κ² μŠ΅λ‹ˆλ‹€.

 

Istio λ₯Ό μ„€μΉ˜ν•΄λ³΄μž 


MAC m1 κΈ°μ€€μž…λ‹ˆλ‹€ 🍎

 

  1. brew λ₯Ό μ΄μš©ν•˜μ—¬ istioctl 을 μ„€μΉ˜ν•©λ‹ˆλ‹€
$ brew install istioctl

 

 

2. ν”„λ‘œν•„μ„ μ§€μ •ν•΄μ„œ istio λ₯Ό μ„€μΉ˜ν•©λ‹ˆλ‹€.
Istio λŠ” λ‹€μ–‘ν•œ ν”„λ‘œν•„μ„ μ œκ³΅ν•˜λŠ” 데 μ—¬κΈ°μ„  default 둜 μ„€μΉ˜ν•˜κ² μŠ΅λ‹ˆλ‹€.

$ istioctl install --set profile=default

ν”„λ‘œν•„μ— λŒ€ν•œ 좔가적인 정보λ₯Ό λ“œλ¦¬μžλ©΄...

  • default 와 demo κ°€ κ°€μž₯ 많이 μ‚¬μš©λ˜λŠ” ν”„λ‘œν•„μž…λ‹ˆλ‹€. (λ‚˜λ¨Έμ§„ λ”±νžˆ..)
  • production ν™˜κ²½μ΄λΌλ©΄ default κ°€ κ°€μž₯ μ ν•©ν•©λ‹ˆλ‹€.
  • demo λŠ” mini kube 와 같이 좔적이 많이 ν•„μš”ν•œ 곳에 ν•„μš”ν•©λ‹ˆλ‹€.

 

3. μ„€μΉ˜κ°€ μ™„λ£Œλ©λ‹ˆλ‹€. λͺ…λ Ήμ–΄λ₯Ό 톡해 ν™•μΈν•΄λ΄…μ‹œλ‹€!!

$ kubectl get all -n istio-system
NAME                       READY   STATUS    RESTARTS   AGE
pod/istio-ingressgateway   1/1    Running   0          3d4h
pod/istiod                 1/1     Running   0          3d4h

NAME                           TYPE           CLUSTER-IP       EXTERNAL-IP                              PORT(S)                                      AGE
service/istio-ingressgateway   LoadBalancer   172.20.147.69    xxxxx.ap-northeast-2.elb.amazonaws.com   15021:30098/TCP,80:30361/TCP,443:31567/TCP   3d4h
service/istiod                 ClusterIP      172.20.131.157   <none>                                   15010/TCP,15012/TCP,443/TCP,15014/TCP        3d4h

NAME                                   READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/istio-ingressgateway   1/1     1            1           3d4h
deployment.apps/istiod                 1/1     1            1           3d4h

NAME                                   DESIRED   CURRENT   READY   AGE
replicaset.apps/istio-ingressgateway   1         1         1       3d4h
replicaset.apps/istiod                 1         1         1       3d4h

NAME                                                       REFERENCE                         TARGETS         MINPODS   MAXPODS   REPLICAS   AGE
horizontalpodautoscaler.autoscaling/istio-ingressgateway   Deployment/istio-ingressgateway   <unknown>/80%   1         5         1          3d4h
horizontalpodautoscaler.autoscaling/istiod                 Deployment/istiod                 <unknown>/80%   1         5         1          3d4h

 

μ„±κ³΅μ μœΌλ‘œ μ„€μΉ˜λ₯Ό λ§ˆμ³€μŠ΅λ‹ˆλ‹€.

 

κ°„λ‹¨νžˆ 짚고 λ„˜μ–΄κ°€λ³΄μž!


pods λ₯Ό 보면 istio-ingressgateway 와 istiod κ°€ μƒμ„±λœ κ±Έ 확인할 수 μžˆλŠ”λ°μš”, μ•„κΉŒ ν”„λ‘œν•„μ„ default λ₯Ό μ£Όμ—ˆκΈ° λ•Œλ¬Έμž…λ‹ˆλ‹€.

Tip.
ν”„λ‘œν•„μ„ default 둜 ν–ˆλ‹€κ³  egress λ₯Ό μ„€μΉ˜ λͺ»ν•˜λŠ” 것은 μ•„λ‹™λ‹ˆλ‹€.

$ kubectl edit istiooperators.install.istio.io -n istio-system

λͺ…λ Ήμ–΄λ₯Ό μ‚¬μš©ν•΄ 섀정을 λ°”κΏ€ 수 μžˆμŠ΅λ‹ˆλ‹€.

 

그리고 κ°€μž₯ μ£Όλͺ©ν•  것이 λ°”λ‘œ service/istio-ingressgateway μž…λ‹ˆλ‹€. 뒀에 EXTERNAL-IP λ₯Ό λ³΄μ‹œλ©΄ AWS Domain 이 ν• λ‹Ήλœ 것을 확인할 수 μžˆλŠ”λ° 이것이 λ°”λ‘œ CLB μž…λ‹ˆλ‹€.

aws elb describe-load-balancers

 

μƒμ„±λœ LB κ°€ 좜λ ₯λ˜λŠ” 것을 확인할 수 μžˆμŠ΅λ‹ˆλ‹€.

 

 

사싀 μ΄λ ‡κ²Œλ§Œ κ΅¬μ„±λ˜μ–΄λ„ μΆ©λΆ„νžˆ Ingress 역할을 ν•  수 μžˆμŠ΅λ‹ˆλ‹€.

Istio 의 CRD 인 Gateway, VirtualService, DestinationRule λ₯Ό μ΄μš©ν•΄μ„œ 말이죠 😎

 

ν•˜μ§€λ§Œ CLB λŠ” μ•žμ—μ„œλ„ λ§μ”€λ“œλ Έλ‹€μ‹œν”Ό 더 이상 μ„œλΉ„μŠ€λ˜μ§€ μ•ŠκΈ° λ•Œλ¬Έμ— NLB, ALB 둜 λ°”κΎΈμ–΄μ•Ό ν•©λ‹ˆλ‹€.

 

ALB 둜 λ°”κΎΈμ–΄λ³΄μž !


CLB 둜 ALB 둜 λ°”κΎΈλŠ” 것은 κ·Έλ¦Όμ—μ„œ λ³΄μ΄λŠ” κ²ƒμ²˜λŸΌ CLB λŒ€μ‹  ALB 둜 κ΅μ²΄ν•˜λ©΄ λ©λ‹ˆλ‹€. ν•˜μ§€λ§Œ ALB λŠ” CLB 와 λ‹€λ₯΄κ²Œ AWS Load Balancer Controller λΌλŠ” 것을 ν•„μš”λ‘œ ν•©λ‹ˆλ‹€.

 

AWS Load Balancer Controller λ₯Ό μ„€μΉ˜ν•˜λŠ” κ²ƒλ§ŒμœΌλ‘œλ„ λ§Žμ€ λΆ„λŸ‰μ΄ ν•„μš”ν•˜λ‹ˆ μ—¬κΈ°μ„  닀루지 μ•Šκ² μŠ΅λ‹ˆλ‹€. λΆ„λŸ‰μ΄ λ§Žμ„ 뿐 사싀 AWS κ³΅μ‹λ¬Έμ„œλ₯Ό 보면 μ‰½κ²Œ λ”°λΌν•˜μ‹€ 수 μžˆμ„ κ²λ‹ˆλ‹€.

 

AWS Load Balancer Controller λŠ” Nginx Ingress Controller 와 μ™„μ „νžˆ λ˜‘κ°™μ€ 역할을 ν•©λ‹ˆλ‹€. λ‹€λ§Œ AWS μ—μ„œ μ œκ³΅ν•΄μ£ΌλŠ” 것이라고 λ³΄μ‹œλ©΄ λ©λ‹ˆλ‹€.

 

 

 

그럼 AWS LB Controller κ°€ 잘 μ„€μΉ˜λ˜μ—ˆλŠ”μ§€ 확인해보죠! πŸ™

$ kubectl get all -n kube-system
NAME                                               READY   STATUS    RESTARTS   AGE
pod/aws-load-balancer-controller-794f85d67-6jncw   1/1     Running   0          176m
pod/aws-load-balancer-controller-794f85d67-bhlmq   1/1     Running   0          176m

NAME                                        TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)         AGE
service/aws-load-balancer-webhook-service   ClusterIP   172.20.82.65   <none>        443/TCP         176m

 

문제 없이 잘 μž‘λ™ν•˜λ„€μš” πŸ˜€

 

그럼 ν•œλ²ˆ 연결해보죠!

  1. service/istio-ingressgateway λ₯Ό μˆ˜μ •ν•©λ‹ˆλ‹€.
$ kubectl edit -n istio-system service istio-ingressgateway

 

 

 

μ•„λž˜μ™€ 같이 μˆ˜μ •ν•΄μ€λ‹ˆλ‹€.

spec:
  ...
  type: NodePort
  ...

 

μ΄λ ‡κ²Œ ν•˜λŠ” μ΄μœ λŠ” CLB λ₯Ό μ‚¬μš©ν•˜μ§€ μ•ŠκΈ° μœ„ν•΄μ„œμž…λ‹ˆλ‹€. type: Loadbalancer 둜 λ˜μ–΄μžˆμœΌλ©΄ μžλ™μœΌλ‘œ CLB κ°€ μƒμ„±λ˜κ³ , μš°λ¦¬λŠ” 이것을 μ‚¬μš©ν•˜μ§€ μ•Šμ„ κ±°κΈ° λ•Œλ¬Έμ— type 을 NodePort λ₯Ό λ°”κΏ”μ€λ‹ˆλ‹€. (μ°Έκ³ )

 

그러면 이전에 Istio μ—μ„œ μƒμ„±ν•œ CLB λŠ” μ‚­μ œλ˜κ³ , ALB 만 λ‚¨μ•„μžˆμŠ΅λ‹ˆλ‹€.

 

 

Tip.
ClusterIP λ‘œλ„ κ°€λŠ₯할거라 μƒκ°ν•΄μ„œ λ°”κΏ”λ΄€λŠ”λ°.. μž‘λ™ν•˜μ§€ μ•Šμ•˜μŠ΅λ‹ˆλ‹€. 생각해보면 λ‹Ήμ—°ν•©λ‹ˆλ‹€.

ALB μž…μž₯μ—μ„œ νƒ€κ²Ÿκ·Έλ£ΉμœΌλ‘œ 각 μΈμŠ€ν„΄μŠ€μ—κ²Œ 톡신을 λ³΄λ‚΄μ£Όκ²Œ λ˜λŠ”λ° ALB λŠ” EKS Cluster 내에 μ‘΄μž¬ν•˜λŠ” 것이 μ•„λ‹ˆλ‹ˆ λ‹Ήμ—°νžˆ λ…Έλ“œ 포트둜 접근을 ν•  수 밖에 μ—†μŠ΅λ‹ˆλ‹€.

 

2. Ingress λ₯Ό μƒμ„±ν•©λ‹ˆλ‹€.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: common-external-ingress
  namespace: istio-system
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
    alb.ingress.kubernetes.io/actions.ssl-redirect: '443'
    alb.ingress.kubernetes.io/load-balancer-name: common-external-ingress
    alb.ingress.kubernetes.io/target-type: instance
    alb.ingress.kubernetes.io/subnets: subnet-031c06XXXXXXXXXXX, subnet-03444dXXXXXXXXXXX, subnet-0360f0XXXXXXXXXXX
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-west-2:123456789011:certificate/26cec536-5d01-4140-890d-XXXXXXXXXXXX
    alb.ingress.kubernetes.io/wafv2-acl-arn: arn:aws:wafv2:us-west-2:123456789011:regional/webacl/prod-common-alb-acl/ae2e63f9-02f4-44b8-9d25-XXXXXXXXXXXX
  labels:
    app: common-external-ingress
spec:
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: istio-ingressgateway
                port:
                  number: 443

 

μ–΄λ…Έν…Œμ΄μ…˜λ“€μ΄ λ§Žμ€λ° 맀우 직관적이라 λ³΄μ‹œλ©΄ μ–΄λŠ 것인지 μ‰½κ²Œ νŒŒμ•…ν•˜μ‹€ 수 μžˆμŠ΅λ‹ˆλ‹€.

κ·Έλž˜λ„ κ·Έ 쀑 μ€‘μš”ν•œ 것듀에 λŒ€ν•΄ λ§μ”€λ“œλ¦¬κ² μŠ΅λ‹ˆλ‹€.

 

alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
alb.ingress.kubernetes.io/actions.ssl-redirect: '443'

"http, https λ¦¬μŠ€λ„ˆλ₯Ό μ‚¬μš©ν•˜κ³ , http 둜 톡신이 μ˜¨λ‹€λ©΄ https 둜 λ¦¬λ‹€μ΄λ ‰μ…˜ ν•˜λΌ!"

 

alb.ingress.kubernetes.io/target-type: instance

"ip mode 와 instance κ°€ μžˆλŠ” 데 instance λ₯Ό μ‚¬μš©ν•˜κ² λ‹€! μ°Έκ³ "

 

alb.ingress.kubernetes.io/scheme: internet-facing

"ALB λ₯Ό νΌλΈ”λ¦­μœΌλ‘œ μ§€μ •ν•˜λΌ! λ§Œμ•½ ν”„λΌμ΄λΉ—μœΌλ‘œ ν•˜κ³  μ‹Άλ‹€λ©΄ internal 을 주거라"

 

이 정도가 μžˆμ„ κ±° κ°™κ³ , 더 μžμ„Ένžˆ μ•Œκ³  μ‹Άλ‹€λ©΄ μ—¬κΈ°λ₯Ό μ°Έκ³ ν•΄μ£Όμ„Έμš”!

 

이둜써 λͺ¨λ“  섀정이 끝이 λ‚¬μŠ΅λ‹ˆλ‹€.

 

λŒ€λž΅ μ•„λž˜μ™€ 같이 λ™μž‘ν•œλ‹€κ³  λ³΄μ‹œλ©΄ 될 것 κ°™μŠ΅λ‹ˆλ‹€ πŸ‘

 

κΈ΄ κΈ€ μ½μ–΄μ£Όμ…”μ„œ κ°μ‚¬ν•©λ‹ˆλ‹€ πŸ™‚

profile on loading

Loading...