Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Consul Connect and Kubernetes Integration / clo...

Consul Connect and Kubernetes Integration / cloud native meetup tokyo 7

Ryo Takaishi

March 29, 2019
Tweet

More Decks by Ryo Takaishi

Other Decks in Technology

Transcript

  1. ∁ੴྒ / GMO Pepabo, Inc. 2019-03-29 Cloud Native Meetup Tokyo

    #7 Consul Connect and Kubernetes Integration
  2. TAKAISHI Ryo @r_takaishi Software Engineer @ GMO Pepabo, Inc. Belgian

    Beer ☕ Tea Go, Kubernetes https://repl.info/ % Cloud Native Meetup Tokyo
  3. !3 • About Consul • Our background • Consul Connect

    • Consul Kubernetes Integration Agenda
  4. • Service Discovery for connectivity • Health check, DNS, HTTP

    interface • Service Segmentation for security • Secure service-to-service communication • Service Configuration for runtime configuration • KVS, Transaction, Watch !5 About Consul
  5. !6 About Consul app client app client client server server

    server Consul Cluster 192.168.0.21 192.168.0.22 192.168.0.23 192.168.0.11 192.168.0.12 192.168.0.13 app.service.consul app health check health check health check
  6. !7 About Consul app client app client client server server

    server Consul Cluster 192.168.0.21 192.168.0.22 192.168.0.23 192.168.0.11 192.168.0.12 192.168.0.13 app.service.consul app health check health check health check
  7. • Data Plane୲౰ • Sidecarͱͯ͠ `consul connect proxy` Λಈ͔͢ •

    ϓϥΨϒϧʹͳ͍ͬͯͯɺEnvoyΛ࢖͏͜ͱ΋Մೳ !14 Sidecar Proxy $ consul connect proxy \ -http-addr=${HOST_IP}:8500 \ -service=source-service \ -upstream=“dest-service:9001”
  8. !15 Sidecar Proxy app Source Service’s Pod consul connect proxy

    http://localhost:9001 consul cluster app Destination Service’s Pod consul connect proxy resolve `dest-service:9001` by consul API
  9. • consul connect proxyͷ୅ΘΓʹEnvoyΛ࢖͑Δ • Support Envoy’s xDS configuration API

    • Consul͸ControlPlaneͱͳΔ • v1.3.0࣌఺Ͱ੍͍͔ͭ͘ݶ͕͋Δ • ྫɿLayer4(TCP)ϓϩΩγͷΈαϙʔτ !16 Envoy Integration
  10. !17 Connect with Envoy app Source Service’s Pod envoy http://localhost:9001

    consul cluster app Destination Service’s Pod envoy resolve `dest-service:9001` by Envoy xDS API
  11. !24 Consul ServerΫϥελʔΛKubernetes্Ͱಈ͔͢ consul-server-0 Kubernetes cluster node-000 node-001 node-002 StatefulSet

    consul-server-1 consul-server-2 node-003 consul-client consul-client Consul Cluster
  12. !29 ྫɿReplica਺3୆ͷDeploymentͱServiceΛ༻ҙ͢Δ $ kubectl get svc -l app=hello-consul NAME TYPE

    CLUSTER-IP EXTERNAL-IP PORT(S) AGE hello-consul NodePort 10.233.59.91 <none> 8080:31321/TCP 11m $ kubectl get pod -l app=hello-consul NAME READY STATUS RESTARTS AGE hello-consul-697658fbd5-b9sg5 1/1 Running 0 51s hello-consul-697658fbd5-p72nx 1/1 Running 0 11m hello-consul-697658fbd5-swxrd 1/1 Running 0 11m
  13. • Address ͸Pod͕ಈ͍͍ͯΔNodeͷIPΞυϨε !30 ྫɿConsul DNSͰ໊લղܾͰ͖Δ $ nslookup hello-consul.service.minne.lan Server:

    127.0.0.1 Address: 127.0.0.1#53 Name: hello-consul.service.minne.lan Address: 10.230.0.211 Name: hello-consul.service.minne.lan Address: 10.230.1.135 Name: hello-consul.service.minne.lan Address: 10.230.0.103
  14. !31 ྫɿConsul APIͰIPΞυϨεͱPortΛऔಘͰ͖Δ $ curl -sS http://127.0.0.1:8500/v1/catalog/service/hello-consul \ | jq

    -r ".[] | [.Address, .ServicePort] | @tsv" 10.230.0.211 31321 10.230.1.135 31321 10.230.0.103 31321
  15. !32 Kubernetes ServiceΛConsul΁ಉظ app Kubernetes cluster node-001 node-002 app node-000

    lb consul-templateΛ༻͍ͯk8s্ͷαʔϏεΛ nginxͷconfigʹupstreamͱͯ͠ઃఆ {{ range service “app" }} server {{.Address}}:{{.Port}};{{end}} } app.service.consul
  16. • istio-sidecar-injectorͷΑ͏ʹɺconsul connect proxyΛPod ʹ஫ೖͯ͘͠ΕΔ !34 Injection Consul Connect Sidecar

    Proxy annotations: 'consul.hashicorp.com/connect-inject': 'true' 'consul.hashicorp.com/connect-service-upstreams': 'counting:9001'
  17. • Kubernetes্ͰConsulΛಈ͔͢ػೳΛఏڙ • ConsulͱKubernetesͰ૬ޓʹαʔϏεΛಉظՄೳ • Consul Connect Sidecar ProxyΛinjection͢ΔػೳΛఏڙ •

    طଘͷConsulΫϥελʔͱKubernetes͕ฒߦՔಇ͍ͯ͠Δ৔ ߹ɺ࿈ܞͤ͞Δ͜ͱͰศརʹͳΓͦ͏ !35 Kubernetes Integration·ͱΊ