Linkerd

DEV CommunityDeploying Linkerd Service Mesh on Amazon EKS for Secure Microservices

App

Linkerd Cli Install

curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install-edge | sh
export PATH=$HOME/.linkerd2/bin:$PATH
linkerd version
Shell
복사

linkerd cli를 사용하여 kubernetes 검증 과정은 진행

linkerd check --pre
Shell
복사

linkerd를 Kubernetes에 배포

•

Gateway API CRDs 설치

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/standard-install.yaml
Shell
복사

•

Linkerd CRDs 설치

linkerd install --crds | kubectl apply -f -
Shell
복사

•

Linkerd Control Plane 설치

linkerd install | kubectl apply -f -
Shell
복사

•

Linkerd Viz(옵션) 설치

linkerd viz install | kubectl apply -f -
Shell
복사

•

설치 확인

linkerd check
Shell
복사

•

Dashboard

linkerd viz dashboard &
Shell
복사

나중에 TrafficSplit 같은 SMI도 사용하기 위해서 linkerd smi 설치

curl -sL https://linkerd.github.io/linkerd-smi/install | sh
linkerd smi install | kubectl apply -f -
linkerd smi check
Shell
복사

Linkerd를 설치하게 되면 Linkerd에서는 자동으로 mTLS 설정을 해주기에 설정할 필요가 없습니다. 이제 사용할 namespace에 annotation을 추가하면 됩니다.

kubectl create ns app
kubectl annotate ns app linkerd.io/inject=enabled
Shell
복사

apiVersion: apps/v1
kind: Deployment
metadata:
  name: customer-svc
  namespace: app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: customer-svc
  template:
    metadata:
      labels:
        app: customer-svc
    spec:
      containers:
      - name: customer-svc
        image: 362708816803.dkr.ecr.ap-northeast-2.amazonaws.com/customer:latest
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: customer-svc 
  namespace: app
spec:
  selector:
    app: customer-svc
  ports:
    - port: 80
      targetPort: 8080
  type: ClusterIP
YAML
복사

apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-svc  
  namespace: app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: payment-svc
  template:
    metadata:
      labels:
        app: payment-svc
    spec:
      containers:
      - name: payment-svc
        image: 362708816803.dkr.ecr.ap-northeast-2.amazonaws.com/payment:latest
        ports:
        - containerPort: 8081
---
apiVersion: v1
kind: Service
metadata:
  name: payment-svc
  namespace: app
spec:
  selector:
    app: payment-svc
  ports:
    - port: 80
      targetPort: 8081
  type: ClusterIP
YAML
복사

kubectl apply -f customer-app.yaml -n app
kubectl apply -f payment-app.yaml -n app
Shell
복사

Ingress 배포

public_a=$(aws ec2 describe-subnets --filters "Name=tag:Name,Values=skills-public-subnet-a" --query "Subnets[].SubnetId[]" --region ap-northeast-2 --output text)
public_b=$(aws ec2 describe-subnets --filters "Name=tag:Name,Values=skills-public-subnet-b" --query "Subnets[].SubnetId[]" --region ap-northeast-2 --output text)
private_a=$(aws ec2 describe-subnets --filters "Name=tag:Name,Values=skills-private-subnet-a" --query "Subnets[].SubnetId[]" --region ap-northeast-2 --output text)
private_b=$(aws ec2 describe-subnets --filters "Name=tag:Name,Values=skills-private-subnet-b" --query "Subnets[].SubnetId[]" --region ap-northeast-2 --output text)

public_subnet_name=("$public_a" "$public_b")
private_subnet_name=("$private_a" "$private_b")

for name in "${public_subnet_name[@]}"
do
    aws ec2 create-tags --resources $name --tags Key=kubernetes.io/role/elb,Value=1
done

for name in "${private_subnet_name[@]}"
do
    aws ec2 create-tags --resources $name --tags Key=kubernetes.io/role/internal-elb,Value=1
done
Shell
복사

helm repo add eks https://aws.github.io/eks-charts
helm repo update eks
helm install aws-load-balancer-controller eks/aws-load-balancer-controller \
  -n kube-system \
  --set clusterName=$EKS_CLUSTER_NAME \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-load-balancer-controller
Shell
복사

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  namespace: app
  annotations:
    alb.ingress.kubernetes.io/load-balancer-name: app-alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}]'
    alb.ingress.kubernetes.io/healthcheck-path: /healthz
    alb.ingress.kubernetes.io/healthcheck-interval-seconds: "5"
    alb.ingress.kubernetes.io/healthcheck-timeout-seconds: "3"
    alb.ingress.kubernetes.io/healthy-threshold-count: "3"
    alb.ingress.kubernetes.io/unhealthy-threshold-count: "2"
    alb.ingress.kubernetes.io/target-group-attributes: deregistration_delay.timeout_seconds=30
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /customer
            pathType: Prefix
            backend:
              service:
                name: customer-svc
                port:
                  number: 80
          - path: /payment
            pathType: Prefix
            backend:
              service:
                name: payment-svc
                port:
                  number: 80
YAML
복사

kubectl apply -f ingress.yaml
Shell
복사

Linkerd로 가중치 기반 라우팅

•

사용하기 위해서는 linker smi가 설치되있어야 한다.

linkerd-service를 배포해야 하는데 이때 주의해야 할 점은 TargetPort는 app service에 대해 Port를 적으면 된다. 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-svc
  namespace: app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-svc
  template:
    metadata:
      labels:
        app: nginx-svc
    spec:
      containers:
      - name: nginx-svc
        image: nginx
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
  namespace: app
spec:
  selector:
    app: nginx-svc
  ports:
    - port: 80
      targetPort: 80
  type: ClusterIP
YAML
복사

kubectl apply -f nginx.yaml
Shell
복사

apiVersion: apps/v1
kind: Deployment
metadata:
  name: apache-svc
  namespace: app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: apache-svc
  template:
    metadata:
      labels:
        app: apache-svc
    spec:
      containers:
      - name: apache-svc
        image: httpd
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: apache-svc
  namespace: app
spec:
  selector:
    app: apache-svc
  ports:
    - port: 80
      targetPort: 80
  type: ClusterIP
YAML
복사

kubectl apply -f apache.yaml
Shell
복사

apiVersion: v1
kind: Service
metadata:
  name: linkerd-svc
  namespace: app
spec:
  selector:
    app: linkerd-svc
  ports:
    - port: 80
      targetPort: 80
  type: ClusterIP
YAML
복사

kubectl apply -f linkerd-service.yaml
Shell
복사

apiVersion: split.smi-spec.io/v1alpha2
kind: TrafficSplit
metadata:
  name: linkerd-split
  namespace: app
spec:
  service: linkerd-svc
  backends:
  - service: nginx-svc
    weight: 50
  - service: apache-svc
    weight: 50
YAML
복사

kubectl apply -f trafficsplit.yaml
Shell
복사

nginx ingress controller 설치

LinkerdHandling ingress traffic

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm install ingress-nginx ingress-nginx/ingress-nginx -n ingress-nginx --create-namespace
Shell
복사

•

정상적으로 동작한다면 ingress로 요청을 보냈을 때 50%씩 트래픽이 분산되어야 한다.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
  namespace: app
  annotations:
    nginx.ingress.kubernetes.io/service-upstream: "true"
spec:
  ingressClassName: nginx
  defaultBackend:
    service:
      name: linkerd-svc
      port:
        number: 80
YAML
복사

kubectl apply -f ingress.yaml
Shell
복사