[G1-Sync] Manual knowledge update

2026-05-09 21:08:02 +09:00
parent f0befc887a
commit 93ec7e9056
363 changed files with 68333 additions and 64 deletions
@@ -0,0 +1,195 @@
+---
+id: devops-service-mesh-deep
+title: Service Mesh — Istio / Linkerd / 트래픽 관리
+category: Coding
+status: draft
+source_trust_level: B
+verification_status: conceptual
+created_at: 2026-05-09
+updated_at: 2026-05-09
+tags: [devops, service-mesh, istio, linkerd, vibe-coding]
+tech_stack: { language: "YAML / Istio / Linkerd", applicable_to: ["DevOps"] }
+applied_in: []
+aliases: [Istio, Linkerd, service mesh, sidecar, mTLS, traffic split, virtual service]
+---
+
+# Service Mesh
+
+> Pod 옆 sidecar proxy (Envoy / linkerd2-proxy) 가 통신 가로챔. **mTLS 자동 / traffic split / retry / circuit breaker 코드 외부화**. **Linkerd = 가벼움, Istio = 풀 기능**.
+
+## 📖 핵심 개념
+- Sidecar: 매 pod 옆 proxy.
+- Data plane: 실제 트래픽 처리.
+- Control plane: 정책 배포 (Istiod, linkerd-controller).
+- mTLS: 자동 - 모든 service 간 암호화 + 인증.
+
+## 💻 코드 패턴
+
+### Linkerd 설치
+```bash
+linkerd check --pre
+linkerd install --crds | kubectl apply -f -
+linkerd install | kubectl apply -f -
+linkerd check
+```
+
+### Inject sidecar
+```bash
+kubectl get deploy api -o yaml | linkerd inject - | kubectl apply -f -
+
+# 또는 namespace 자동
+kubectl annotate ns prod linkerd.io/inject=enabled
+```
+
+### mTLS (자동)
+```bash
+linkerd viz edges deployment
+# 모든 service 간 → mTLS
+```
+
+### Istio VirtualService (traffic split)
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata: { name: api }
+spec:
+  hosts: [api]
+  http:
+  - match: [{ headers: { x-canary: { exact: "true" } } }]
+    route: [{ destination: { host: api, subset: v2 } }]
+  - route:
+    - { destination: { host: api, subset: v1 }, weight: 90 }
+    - { destination: { host: api, subset: v2 }, weight: 10 }
+```
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata: { name: api }
+spec:
+  host: api
+  subsets:
+  - name: v1
+    labels: { version: v1 }
+  - name: v2
+    labels: { version: v2 }
+```
+
+→ 90/10 canary, header 가 있으면 100% v2.
+
+### Retry / timeout
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata: { name: api }
+spec:
+  http:
+  - route: [{ destination: { host: api } }]
+    timeout: 5s
+    retries:
+      attempts: 3
+      perTryTimeout: 2s
+      retryOn: 5xx,reset,connect-failure
+```
+
+### Circuit breaker
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata: { name: api }
+spec:
+  host: api
+  trafficPolicy:
+    connectionPool:
+      tcp: { maxConnections: 100 }
+      http: { http2MaxRequests: 1000, maxRequestsPerConnection: 10 }
+    outlierDetection:
+      consecutive5xxErrors: 5
+      interval: 30s
+      baseEjectionTime: 30s
+```
+
+### AuthorizationPolicy
+```yaml
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata: { name: api-allow }
+spec:
+  selector: { matchLabels: { app: api } }
+  rules:
+  - from:
+    - source: { principals: ["cluster.local/ns/prod/sa/web"] }
+    to:
+    - operation: { methods: [GET, POST] }
+```
+
+### Linkerd traffic split (SMI)
+```yaml
+apiVersion: split.smi-spec.io/v1alpha1
+kind: TrafficSplit
+metadata: { name: api-split }
+spec:
+  service: api
+  backends:
+    - { service: api-v1, weight: 90 }
+    - { service: api-v2, weight: 10 }
+```
+
+### 관찰 (Linkerd viz)
+```bash
+linkerd viz dashboard
+# 자동: success rate, RPS, p95/p99, mTLS 표시
+```
+
+### Istio observability
+- Kiali: service graph.
+- Jaeger: tracing.
+- Grafana: metrics.
+
+### Ambient mode (Istio sidecar 없는)
+- ztunnel (per-node) + waypoint proxy.
+- 자원 효율 더 좋음.
+- 새 (2024+).
+
+### Trade-offs
+```
+장점:
+- 코드 변경 X
+- 통일 정책 (mTLS, retry, CB)
+- Observability 자동
+
+단점:
+- 자원 (각 pod + sidecar)
+- 복잡도 (특히 Istio)
+- Latency (~1-3ms per hop)
+- Debug 어려움
+```
+
+## 🤔 의사결정 기준
+| 규모 | 추천 |
+|---|---|
+| <10 service | mesh 불필요 — 직접 |
+| 10-100 service | Linkerd (가볍고 단순) |
+| 큰 / 복잡 정책 | Istio |
+| 자원 절약 | Linkerd 또는 Istio Ambient |
+| GKE | Istio (기본 통합) |
+| 자체 호스트 작은 팀 | Linkerd |
+
+## ❌ 안티패턴
+- **Mesh 도입 + 단순 정책**: overkill. ingress + library 충분.
+- **모든 retry 같은 정책**: 어떤 endpoint 는 idempotent X.
+- **CB 없이 cascading failure**: 한 service 죽으면 모두.
+- **mTLS 가정 + 외부 통신**: gateway 만 mTLS — 외부 API 는 공개.
+- **Sidecar resource 안 잡음**: pod scheduling 깨짐.
+- **Istio 1.0 부터 풀 기능 도입**: 점진. STRICT mTLS 부터.
+- **Egress 무제어**: 외부 호출 무제한.
+
+## 🤖 LLM 활용 힌트
+- Linkerd 시작 → 단순.
+- Istio = 풀 기능, 학습 곡선.
+- mTLS / retry / CB / observability 가 ROI 높음.
+
+## 🔗 관련 문서
+- [[Security_mTLS_Patterns]]
+- [[DevOps_Kubernetes_Basics]]
+- [[Backend_Circuit_Breaker]]