Typha 구성
Typha는 대규모 쿠버네티스 클러스터에서 Felix 대신 데이터스토어 연결을 대행해 부하를 분산해 주는 구성 요소예요. 이 문서에서는 Typha가 사용하는 환경 변수와 구성 파일 옵션을 정리해요. operator로 Calico를 설치했다면 Typha 구성을 수정할 수 없고, 매니페스트로 설치한 경우에만 조정할 수 있다는 점을 기억해요.
출처: 문서
본문
Tab: Operator
operator로 Calico를 설치한 경우에는 Typha 구성을 수정할 수 없어요.
Tab: Manifest
Typha 구성은 다음 두 위치에서 순서대로 읽어요.
-
TYPHA_접두사가 붙은 환경 변수 -
Typha 구성 파일. 경로 기본값은
/etc/calico/typha.cfg이고, 명령줄에서-c또는--config-file옵션으로 바꿀 수 있어요.
구성 파라미터의 값은 값을 담고 있는 첫 번째 위치에서 읽은 값이에요. 예를 들어 환경 변수에 값이 들어 있으면 그 값이 우선해요.
어느 위치에도 설정하지 않으면 대부분의 구성 파라미터는 기본값을 사용하고, 명시적으로 설정할 일은 드물어요.
설정할 수 있는 파라미터 전체 목록은 다음과 같아요.
일반 구성
| Configuration parameter | Environment variable | Description | Schema |
|---|---|---|---|
DatastoreType |
TYPHA_DATASTORETYPE |
The datastore that Typha should read endpoints and policy information from. [Default: etcdv3] |
etcdv3, kubernetes |
HealthEnabled |
TYPHA_HEALTHENABLED |
When enabled, exposes Typha health information via an http endpoint. | boolean |
HealthPort |
TYPHA_HEALTHPORT |
The port that Typha will serve health information over. [Default: 9098] |
int |
HealthHost |
TYPHA_HEALTHHOST |
The address that Typha will bind its health endpoint to. [Default: localhost] |
string |
LogFilePath |
TYPHA_LOGFILEPATH |
The full path to the Typha log. Set to none to disable file logging. [Default: /var/log/calico/typha.log] |
string |
LogSeverityFile |
TYPHA_LOGSEVERITYFILE |
The log severity above which logs are sent to the log file. [Default: Info] |
Debug, Info, Warning, Error, Fatal |
LogSeverityScreen |
TYPHA_LOGSEVERITYSCREEN |
The log severity above which logs are sent to the stdout. [Default: Info] |
Debug, Info, Warning, Error, Fatal |
LogSeveritySys |
TYPHA_LOGSEVERITYSYS |
The log severity above which logs are sent to the syslog. Set to "" for no logging to syslog. [Default: Info] |
Debug, Info, Warning, Error, Fatal |
PrometheusGoMetricsEnabled |
TYPHA_PROMETHEUSGOMETRICSENABLED |
Set to false to disable Go runtime metrics collection, which the Prometheus client does by default. This reduces the number of metrics reported, reducing Prometheus load. [Default: true] |
boolean |
PrometheusMetricsEnabled |
TYPHA_PROMETHEUSMETRICSENABLED |
Set to true to enable the Prometheus metrics server in Typha. [Default: false] |
boolean |
PrometheusMetricsHost |
TYPHA_PROMETHEUSMETRICSHOST |
TCP network address that the Prometheus metrics server should bind to. [Default: ""] |
string |
PrometheusMetricsPort |
TYPHA_PROMETHEUSMETRICSPORT |
TCP port that the Prometheus metrics server should bind to. [Default: 9091] |
int |
PrometheusProcessMetricsEnabled |
TYPHA_PROMETHEUSPROCESSMETRICSENABLED |
Set to false to disable process metrics collection, which the Prometheus client does by default. This reduces the number of metrics reported, reducing Prometheus load. [Default: true] |
boolean |
ServerHandshakeTimeoutSecs |
TYPHA_SERVERHANDSHAKETIMEOUTSECS |
Maximum time that Typha server should wait for the client TLS handshake to be performed. | int |
ServerHost |
TYPHA_SERVERHOST |
TCP network address that typha sync_server endpoint should bind to. [Default: ""] |
string |
ServerPort |
TYPHA_SERVERPORT |
TCP port that typha sync_server endpoint should bind to. [Default: 5473] |
int |
ShutdownTimeoutSecs |
TYPHA_SHUTDOWNTIMEOUTSECS |
Maximum time that Typha should take to do a graceful shut down. In Kubernetes, this should match Typha's terminationGracePeriodSeconds. |
int |
ShutdownConnectionDropIntervalMaxSecs |
TYPHA_SHUTDOWNCONNECTIONDROPINTERVALMAXSECS |
Maximum time between terminating two connections when doing a graceful shutdown. Prevents very slow shut downs if ShutdownTimeoutSecs is large but Typha only has a small number of clients. |
int |
SECONDARY: 기본적으로 헬스 엔드포인트를 활성화하면 Typha는 localhost에서 대기해요. 하지만 쿠버네티스에서 Typha를 사용하면 kubelet이 pod IP로 헬스 체크를 수행해요. 이 불일치를 해결하려고 Typha 이미지는 헬스 엔드포인트를 호출하는 헬스 체크 CLI 명령인
calico-typha check (readiness|liveness) --port=<port>를 제공해요. 헬스 포트를 수정했다면 매니페스트의 liveness와 readiness 프로브 명령에--port=<port>인자를 추가해야 해요.
etcd 데이터스토어 구성
| Configuration parameter | Environment variable | Description | Schema |
|---|---|---|---|
EtcdCaFile |
TYPHA_ETCDCAFILE |
Path to the file containing the root certificate of the certificate authority (CA) that issued the etcd server certificate. Configures Typha to trust the CA that signed the root certificate. The file may contain multiple root certificates, causing Typha to trust each of the CAs included. To disable authentication of the server by Typha, set the value to none. [Default: /etc/ssl/certs/ca-certificates.crt] |
string |
EtcdCertFile |
TYPHA_ETCDCERTFILE |
Path to the file containing the client certificate issued to Typha. Enables Typha to participate in mutual TLS authentication and identify itself to the etcd server. Example: /etc/typha/cert.pem (optional) |
string |
EtcdEndpoints |
TYPHA_ETCDENDPOINTS |
Comma-delimited list of etcd endpoints to connect to. Example: http://127.0.0.1:2379,http://127.0.0.2:2379. |
<scheme>://<ip-or-fqdn>:<port> |
EtcdKeyFile |
TYPHA_ETCDKEYFILE |
Path to the file containing the private key matching the Typha client certificate. Enables Typha to participate in mutual TLS authentication and identify itself to the etcd server. Example: /etc/typha/key.pem (optional) |
string |
쿠버네티스 API 데이터스토어 구성
쿠버네티스 API 데이터스토어 드라이버는 쿠버네티스가 제공하는 환경 변수에서 구성을 읽어요.
환경 변수
| Environment | Description | Schema |
|---|---|---|
| USE_POD_CIDR | Use the Kubernetes Node.Spec.PodCIDR field. This field is required when using the Kubernetes API datastore with host-local IPAM. [Default: false] |
boolean |
Felix-Typha TLS 구성
| Configuration parameter | Environment variable | Description | Schema |
|---|---|---|---|
CAFile |
TYPHA_CAFILE |
Path to the file containing the root certificate of the CA that issued the Felix client certificate. Configures Typha to trust the CA that signed the Felix client certificate. The file may contain multiple root certificates, causing Typha to trust each of the CAs included. Example: /etc/typha/ca.pem |
string |
ClientCN |
TYPHA_CLIENTCN |
If set, the Common Name that Felix's certificate must have. If you have enabled TLS on the communications from Felix to Typha, you must set a value here or in ClientURISAN. You can set values in both, as well, such as to facilitate a migration from using one to the other. If either matches, the communication succeeds. [Default: none] |
string |
ClientURISAN |
TYPHA_CLIENTURISAN |
If set, a URI SAN that Felix's certificate must have. We recommend populating this with a SPIFFE string that identifies Felix. All Felix instances should use the same SPIFFE ID. If you have enabled TLS on the communications from Felix to Typha, you must set a value here or in ClientCN. You can set values in both, as well, such as to facilitate a migration from using one to the other. If either matches, the communication succeeds. [Default: none] |
string |
ServerCertFile |
TYPHA_SERVERCERTFILE |
Path to the file containing the server certificate issued to Typha. Typha presents this to Felix clients during the TLS handshake. Example: /etc/typha/cert.pem |
string |
ServerKeyFile |
TYPHA_SERVERKEYFILE |
Path to the file containing the private key matching the Typha server certificate. Example: /etc/typha/key.pem (optional) |
string |
이 변수들을 사용하고 설정하는 방법이 궁금하다면 Felix에서 Typha로의 연결 (Kubernetes) 문서를 참고하세요.
더 알아보기 (Learn more)
매니페스트 설치에서는 TYPHA_ 접두사 환경 변수가 구성 파일보다 우선해요. Felix와 Typha 사이 통신에 TLS를 적용하는 절차는 암호화 인증 문서에서 자세히 확인할 수 있어요.