Pod, node noma i-cluster: yini i-sidecar ye-VPN eyiphinda ikhomba kabusha

I-sidecar ye-VPN ku-Pod ye-Kubernetes ibukeka njenge-VPN yezinga le-host enokuziphatha okungcono, futhi ukufana kuphela emngceleni we-namespace. Ama-container ku-Pod elilodwa abelana i-network namespace, kuhlanganise nendawo yamakheli nezimbobo, ngakho i-sidecar efaka imizila nenqubomgomo ishintsha ngempela lapho amaphakethe ohlelo lokusebenza eya khona. Akushintshi lutho kwezinye ama-Pod ku-node, futhi akuthinti isitaki se-node ngokwaso ngaphandle uma usimisa kanjalo. Ukuqonda kahle lo mngcele kunquma kokubili okungase kubekwe nokufanele kuhlolwe. Izigaba ezingezansi zikulandela kusukela ku-namespace ziya ngaphandle.

I-namespace eyabiwe, imiphumela eyabiwe

Ama-container amabili ku-Pod akhuluma nge-loopback futhi abona ama-interface afanayo, yingakho iphethini ye-sidecar isebenza nhlobo: uhlelo lokusebenza akudingeki lwazi ukuthi ikhona i-tunnel, ngoba umzila eliwuxazululayo wafakwa ku-namespace eliwusebenzisayo. Leyo mpawu efanayo isho ukuthi amaphutha e-sidecar amaphutha ohlelo lokusebenza. Umzila obamba kakhulu, noma ushintsho lwe-DNS olukhomba kusixazululi ngaphakathi kwe-tunnel, lusebenza ngokushesha kuyo yonke inqubo kulelo Pod. Ku-namespace eyabiwe akukho ukuhambisa imizila ngayinye ye-container, ngakho i-sidecar ayikwazi ukulinganiswa enqubeni eyodwa.

Lona umshini okufanele ukhunjulwe ngesikhathi sokubuyekezwa: indawo yomphumela yi-Pod, hhayi i-node futhi hhayi i-cluster.

Lapho i-sidecar ingafinyeleli khona

Amanye ama-Pod agcina ama-namespace awo nokuhambisa kwawo imizila, ngakho umthwalo womsebenzi odinga ukuphuma okufanayo udinga i-sidecar efanayo noma, esikhundleni salokho, umklamo wezinga le-node. Nokuthutha kwe-node kungaphandle kwe-namespace ye-Pod, futhi ama-Pod anenethiwekhi ye-host azikhethela ngamabomu ukuphuma ngokuphelele kulokhu kuhlukaniswa. Uma usebenzisa i-sidecar ngenethiwekhi ye-host ukuze ufinyelele into elula, unwebise ububanzi busuka ku-Pod eyodwa kuya ku-node yonke futhi kufanele usho lokho ngokuzwakalayo.

Ukuthutha okuya emisebenzini ye-cluster kungenye isimanga esivamile. Umzila oyisisekelo obanzi ngaphakathi kwe-Pod ungabamba izicelo ezibhekiswe kuseva ye-API noma emsebenzini we-ClusterIP, bese zihluleka ngendlela ebukeka sengathi i-tunnel iphukile.

Uhlelo lwemizila: izigaba ze-Pod, isevisi, i-node ne-VPN

Bhala izigaba ezine futhi uzihlole ukuthi ziyahlangana yini ngaphambi kokubeka noma yini: i-Pod CIDR, isevisi CIDR, amakheli e-node kanye nezindawo ezingemuva kwe-VPN. Ukuhlangana phakathi kwezigaba eziyimfihlo ze-VPN nendawo ye-cluster uqobo akujwayelekile, futhi umzila oyisisekelo uyisixazululo esingalungile salokho. Uhlelo lwemizila lufanele lube kusitoreji esifanayo ne-manifest, ngoba i-cluster elandelayo inganikeza izigaba ze-Pod nesevisi ezihluke ngokuphelele.

I-DNS iyingxenye yohlelo hhayi ukukhathazeka okuhlukile. I-sidecar ebhala kabusha ukucushwa kwesixazululi ingaphula ukutholakala kwemisebenzi ngaphakathi kwe-cluster ngenkathi ukusesha kwangaphandle kusebenza kahle.

Ukuqala nokwehluleka kuyizimo ezisobala

Inqubo ye-sidecar esebenzayo ayiyona inqubomgomo yokuphuma. Nquma ukuthi yikuphi ukuthutha okuvunyelwe ukuhamba ngaphambi kokulungela kwe-tunnel nokuthi kwenzekani uma icisha ngemuva kwalokho, bese ufeza leso sinqumo: iphrobu evimbela i-container yohlelo lokusebenza, inqubomgomo yenethiwekhi enqabayo ngokwezisekelo, noma kokubili. Ngaphandle kokukodwa kulokho uhlelo lokusebenza luqala, luxazulule futhi luthumele ukuthutha ngaphandle komzila ojwayelekile we-node ngenkathi i-tunnel isaxhuma.

Leyo gebe ifushane ku-cluster enempilo futhi ihlala njalo kweyephukile, futhi yileyo mpawu umhlaseli noma ukuvuza kwedatha okungazelelwe akuthandayo.

Hlanganisa ukulandelana nokuhlolwa kokwehluleka. Bulala i-sidecar futhi uqinisekise ukuthi uhlelo lokusebenza lulahlekelwa ukuphuma okuhloselwe kona kunokuba luhlehlele emuva buthule.

Amakhono, izinqubomgomo nokuhlolwa kusukela ku-container yohlelo

Ukunikeza amakhono adingekayo ukuze kwakhiwe ama-interface futhi kushintshwe imizila kuyisinqumo samalungelo, futhi ilungelo elifanele i-Pod ehlukanisiwe alifanelekile ngokuzenzakalela esitakini se-node. Sebenzisa izindlela zenqubomgomo yenethiwekhi nokuphepha ezisekelwa i-cluster, futhi ungacabangi ukuthi zonke izisekelo ze-CNI noma zenqubomgomo ziphatha i-interface ye-VPN ngendlela efanayo; umehluko ubonakala kanye kulezo zimo zokwehluleka onakekelayo.

Hlola kusukela ku-container yangempela yohlelo lokusebenza, ngezicelo ezintsha eziya endaweni eyimfihlo, emsebenzini we-cluster nakwi-inthanethi yomphakathi. Ukuhlolwa okuvela ku-sidecar kufakazela ukuthi i-tunnel iyasebenza, hhayi ukuthi uhlelo lokusebenza lufinyelela lokho olukudingayo.

Bhala phansi imicabango yenethiwekhi ye-cluster eduze nokucushwa kwe-VPN. Khona-ke ukuhambisa umthwalo womsebenzi kwenye i-cluster kuba umsebenzi wokuhlola uhlelo lwemizila esikhundleni sokushintsha kwe-image okuma ngokuthula ukusebenza.