I-VPN ye-Pod ku-Kubernetes uma iqhathaniswa nesango lokuphuma: umhubhe kawubani?
I-Pod inendawo yayo yamagama yenethiwekhi, ngakho ukukhetha kwangempela ukuthi yiluphi ungqimba oluphethe umhubhe: ubunikazi bomsebenzi ngamunye noma ukuphuma okuqondiswa yi-CNI ngomthombo owodwa owabiwe.
Usabalalisa i-Pod ebizwa ngokuthi vpn-gateway, uqondisa iklayenti lokuhlola ekhelini layo futhi ubona amaphakethe enyamalala. Akukho okungalungile ku-manifest futhi i-kubelet ayinasikhalo. Isizathu singokwakheka hhayi ukulungiselelwa: i-Kubernetes inikeza i-Pod ngayinye indawo yayo yamagama yenethiwekhi, ngakho igama, ilebula noma indawo yamagama ye-API eyabiwe akukushintshi lutho mayelana nokuthi amaphakethe aya kuphi. Ngakho isinqumo sokuthi ithrafikhi ye-VPN iphuma kanjani eqoqweni siqala ngumbuzo mayelana nobunikazi, hhayi ngezithombe zekhontheyna.
Izindlela ezimbili zihlanganisa iningi lokusabalalisa kwangempela, futhi azikwazi ukushintshwa. Enye ibeka umhubhe ngaphakathi kwendawo yamagama yenethiwekhi yomsebenzi uqobo. Enye icela i-CNI ukuthi iqondise ithrafikhi ekhethiwe ngokusebenzisa inodi yesango eqokiwe. Zihluleka ngezindlela ezahlukene, zikhula ngezindlela ezahlukene futhi ziphendula amaqembu ahlukene, yingakho umbuzo wekhontheyna uvame ukukhiqiza izimpikiswano ezingapheli.
Umkhawulo we-Pod yindawo yamagama, hhayi umphathi wokugxuma
Indawo yamagama yenethiwekhi ye-Linux iphethe izixhumanisi zayo, amakheli, imizila nemithetho yodonga lomlilo, futhi i-Pod ngayinye ithola eyodwa. Amakhontheyna angaphakathi kwale-Pod ayahlangana nayo, futhi yingakho ikhontheyna elisizayo lingabhala kabusha imizila elandelwa uhlelo kamuva. I-Pod engumakhelwane inestakhi ebukeka ifana kodwa ehluke ngokuphelele. Awekho amathebula abiwe i-Pod yesango engawazuzela, futhi akukho ukudluliselwa okungaqondile kwethrafikhi ukusuka kwenye indawo yamagama kuya kwenye.
Yingakho iphethini ye-Pod yesango isebenza kuphela lapho okuthile phezulu ngempela kuthumela amaphakethe kuyo: i-Service, umzila ongaguquki kunodi noma inqubomgomo yokuqondisa ku-CNI. Ikheli lodwa aluhehi lutho.
Umhubhe we-Pod ngayinye uthenga ini, futhi kubiza ini
Umhubhe osebenza endaweni yamagama yomsebenzi unikeza lowo msebenzi ubunikazi bakhe bokuba iklayenti, obudingwa izinsizakalo eziningi zokufinyelela kude ngaphambi kokugunyaza noma ukubala isikhathi. Umkhawulo womthelela nawo uhlala uyingxenye: umhubhe ophukile uwisa i-Deployment eyodwa esikhundleni somzila owabiwe osetshenziswa yikho konke. Indlela esebenza ngayo incike ekusetshenzisweni, futhi yilapho abantu baqagela kabi khona.
Isetho esidinga isimo se-kernel kuphela singaqeda kukhontheyna ye-init bese siphuma. I-daemon yendawo yomsebenzisi okufanele ihlale iphila isikhathi sokuphila se-Pod idinga uhlobo lwekhontheyna ye-init eqalwa kabusha eyethulwa njenge-sidecar yemvelo ku-Kubernetes 1.29, futhi umehluko lowo uvela ekusetshenzisweni komhubhe hhayi ekuthandeni. Izindleko zale modeli ukuphindaphinda: yonke impinda iqinisekisa, ithola ikheli layo lomhubhe futhi isebenzisa indawo yesikhathi sekude, ngakho umcimbi wokukhulisa ngokuzenzakalela uba umcimbi womthamo ngaphesheya kwesixhumanisi. Ukukopisha ubufakazi obubodwa kuzo zonke izimpinda akukususi lokho kusiza, kususa umkhondo wokucwaninga. Amandla nawo afanelwe ukuhlolwa okufanayo, ngoba umhubhe ofuna NET_ADMIN endaweni yawo yamagama awunasizathu sokuzuza igunya phezu komphathi wonke kusukela kusibonelo esine-privileged: true.
Lapho i-CNI iphethe ukuphuma
Uma i-CNI ikusekela, isango lokuphuma likhetha ithrafikhi ngokomsebenzi nangebanga lendawo okuyiwa kuyo, bese liyithumela ngamanodi akhethiwe ngaphansi kwekheli elilodwa lomthombo elingabikezelwa. Inguqulo ye-Cilium iyisihlobo esivamile, futhi imibhalo yayo isho ngokusobala ukuthi le nsimbi idinga ukulungiselelwa okuthile kwe-Cilium kanye namanodi esango anezixhumanisi namakheli afanele. Iphinde ibale isikhathi sokuqala ngemva kokudalwa kwe-Pod lapho ukuqondisa kungakaqalisi ukusebenza, futhi lokho kuyisilinganiso sokuklama hhayi umbhalo waphansi.
Funda lokho kubambezeleka uma kuqhathaniswa nesithembiso sakho. Uma umthetho uthi akukho thrafikhi engaphuma ngomunye umzila, i-Pod entsha ethumela ngesikhathi sesikhala isivele yawephula, ngakho ukulandelana kokuqalisa kudinga impendulo yako: bamba uhlelo kuze kusebenze inqubomgomo, noma wamukele iwindi bese uyalibhala.
Gcina isimangalo sincane. Isango lokuphuma likhetha futhi lihumushe umzila. Aliqedi i-VPN, futhi aliguquli iqoqo libe iklayenti lenethiwekhi yakho ekude ngaphandle koxhumano olusekelwe ngemuva kwalo.
| Question | Per-Pod tunnel | CNI egress gateway |
|---|---|---|
| Who holds the client identity | Each workload | The gateway, shared |
| What scaling changes | Enrollment and sessions per replica | Throughput and capacity per node |
| What the remote side sees | Distinct addresses | One translated source |
| Failure scope | One Deployment | Every workload behind the gateway |
Ukuhumusha kushintsha ngokuthula lokho okubonwa uhlangothi olukude
Lapho isango selibhala kabusha umthombo, amakheli e-Pod ngayinye ayanyamalala, ngakho uhlu lwemvume olusekelwe kubunikazi luba uhlu olusekelwe ekhelini elilodwa elabiwe. Lokhu ukushintshana hhayi iphutha: imithetho emincane yokunakekela, ukwabelwa okukhuluphala lapho okuthile kuziphatha kabi.
Ukuqinisekisa ezingeni lohlelo nokuloga izicelo kufanele kuthwale lokho inethiwekhi engasakubiki. Thatha umthamo wesango nokushintshwa kwalo njengengqalasizinda eyabiwe, ngoba ukuqalisa kabusha inodi eyodwa manje kuphazamisa wonke umsebenzi ongemuva kwayo, futhi hlola indlela yokubuya kusenesikhathi: umkhawulo okude kufanele wazi ukuthi ufinyelela kanjani ekhelini elihunyushiwe, ngokuvamile ngomzila noma nge-NAT okufanele ibe ngumuntu, hhayi i-manifest, ophetheyo. Ukuhlelwa kwamakheli nakho kungaphansi kwalokhu, ngoba izigaba ezigqagqene zeqoqo nezikude zephula zombili lezi zinhlobo futhi ukwamukela i-IPv6 akusona isizathu sokuhlela okushayisanayo.
Nquma ngobunikazi, bese uhlola ukwehluleka okuthembise
Khetha umhubhe we-Pod ngayinye lapho insizakalo ekude iqinisekisa imisebenzi ngayinye, lapho ama-Deployment ambalwa kuphela adinga isixhumanisi, noma lapho ukwehluleka kufanele kuhlale kuyingxenye. Khetha isango lapho iqembu lenethiwekhi selivele liphethe umzila, lapho imisebenzi eminingi yabelana ngendawo eyodwa, noma lapho ikheli lomthombo elizinzile liyiyo yonke inhloso yalo msebenzi.
Kungakhathaliseki, qinisekisa impahla oyidayisile hhayi isimo esizinzile. Dala i-Pod, yivumele ithumele ngokushesha futhi ubuke imizuzwana yokuqala uma isithembiso bekungukuthi akukho okubalekayo emhubheni. Khulisa kumapinda amahlanu futhi ubale izikhathi ezibikwa umkhawulo okude uma isithembiso bekungubunikazi bomsebenzi ngamunye. Lezi zivivinyo ezimbili zidalula imikhawulo yendlela ngokushesha kakhulu kunokubuyekezwa kwe-manifest, futhi zikutshela ukuthi iyiphi iqembu eliphethe isigameko esilandelayo.