{"id":28137,"date":"2026-08-22T23:45:46","date_gmt":"2026-08-22T23:45:46","guid":{"rendered":"https:\/\/umang.pk\/2026\/08\/22\/kubernetes-%d9%86%db%8c%d9%b9-%d9%88%d8%b1%da%a9%d9%86%da%af-%da%a9%db%8c-%d9%88%d8%b6%d8%a7%d8%ad%d8%aa-%da%a9%db%8c-%da%af%d8%a6%db%8c-clusterip-%d8%b3%db%92-cilium-service-mesh-%d8%aa%da%a9\/"},"modified":"2026-08-22T23:45:46","modified_gmt":"2026-08-22T23:45:46","slug":"kubernetes-%d9%86%db%8c%d9%b9-%d9%88%d8%b1%da%a9%d9%86%da%af-%da%a9%db%8c-%d9%88%d8%b6%d8%a7%d8%ad%d8%aa-%da%a9%db%8c-%da%af%d8%a6%db%8c-clusterip-%d8%b3%db%92-cilium-service-mesh-%d8%aa%da%a9","status":"publish","type":"post","link":"https:\/\/umang.pk\/ur\/2026\/08\/22\/kubernetes-%d9%86%db%8c%d9%b9-%d9%88%d8%b1%da%a9%d9%86%da%af-%da%a9%db%8c-%d9%88%d8%b6%d8%a7%d8%ad%d8%aa-%da%a9%db%8c-%da%af%d8%a6%db%8c-clusterip-%d8%b3%db%92-cilium-service-mesh-%d8%aa%da%a9\/","title":{"rendered":"Kubernetes \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u06a9\u06cc \u0648\u0636\u0627\u062d\u062a \u06a9\u06cc \u06af\u0626\u06cc: ClusterIP \u0633\u06d2 Cilium Service Mesh \u062a\u06a9"},"content":{"rendered":"\n<div id=\"\">\n<p>\u06cc\u06c1 \u0648\u06c1 \u06c1\u06d2 \u062c\u0648 \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 Kubernetes \u0679\u06cc\u0648\u0679\u0648\u0631\u06cc\u0644\u0632 \u0622\u067e \u06a9\u0648 \u0646\u06c1\u06cc\u06ba \u0628\u062a\u0627\u062a\u06d2 \u06c1\u06cc\u06ba: \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631 \u0627\u0633 \u0642\u0627\u0628\u0644 \u06c1\u0648\u06ba \u06af\u06d2: <code>kubectl expose<\/code>. 10% \u0633\u06d2 \u06a9\u0645 \u0644\u0648\u06af \u0633\u0645\u062c\u06be\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u06c1 \u062c\u0628 \u0648\u06c1 \u0627\u06cc\u0633\u0627 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u062a\u0648 \u06a9\u06cc\u0627 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0645\u06cc\u06ba \u0646\u06d2 10 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u06a9\u0645\u067e\u0646\u06cc\u0648\u06ba \u0645\u06cc\u06ba Kubernetes \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u06a9\u06d2 \u0645\u0633\u0627\u0626\u0644 \u06a9\u0648 \u0688\u06cc\u0628\u06af \u06a9\u06cc\u0627 \u06c1\u06d2\u06d4 \u0639\u0644\u0645 \u06a9\u0627 \u0627\u06cc\u06a9 \u06c1\u06cc \u062e\u0644\u0627 \u06c1\u0631 \u0628\u0627\u0631 \u0638\u0627\u06c1\u0631 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0632 \u06cc\u06c1 \u0646\u06c1\u06cc\u06ba \u0633\u0645\u062c\u06be\u062a\u06d2 \u06a9\u06c1 \u06a9\u0644\u0633\u0679\u0631 \u0622\u0626\u06cc \u067e\u06cc \u0627\u0646\u062f\u0631\u0648\u0646\u06cc \u0637\u0648\u0631 \u067e\u0631 \u06a9\u06cc\u0633\u06d2 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0648\u06c1 \u0646\u06c1\u06cc\u06ba \u0633\u0645\u062c\u06be\u062a\u06d2 \u06a9\u06c1 \u0645\u062e\u062a\u0644\u0641 \u0646\u0627\u0645 \u06a9\u06cc \u062c\u06af\u06c1\u0648\u06ba \u0645\u06cc\u06ba \u067e\u0648\u0688\u0632 \u0627\u06cc\u06a9 \u062f\u0648\u0633\u0631\u06d2 \u0633\u06d2 \u0645\u0642\u0627\u0645\u06cc \u0637\u0648\u0631 \u067e\u0631 \u06a9\u06cc\u0648\u06ba \u0628\u0627\u062a \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0627\u0648\u0631 \u0648\u06c1 \u0646\u06c1\u06cc\u06ba \u0633\u0645\u062c\u06be\u062a\u06d2 \u06a9\u06c1 CNI \u067e\u0644\u06af \u0627\u0646 \u0627\u0635\u0644 \u0645\u06cc\u06ba \u06a9\u0631\u0646\u0644 \u06a9\u06cc \u0633\u0637\u062d \u067e\u0631 \u06a9\u06cc\u0627 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1 \u0679\u06cc\u0648\u0679\u0648\u0631\u06cc\u0644 \u062d\u0644 \u06c1\u06d2\u06d4 \u0622\u067e \u06cc\u06c1 \u0633\u06cc\u06a9\u06be\u06cc\u06ba \u06af\u06d2 \u06a9\u06c1 Kubernetes \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u0646\u06cc\u0686\u06d2 \u0633\u06d2 \u06a9\u06cc\u0633\u06d2 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u060c \u0628\u0634\u0645\u0648\u0644 \u067e\u0648\u0688 \u0622\u0626\u06cc \u067e\u06cc \u06a9\u0648 \u06a9\u0633 \u0637\u0631\u062d \u062a\u0641\u0648\u06cc\u0636 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0648\u06c1 \u0646\u0648\u0688\u0633 \u067e\u0631 \u06a9\u06cc\u0648\u06ba \u06a9\u0627\u0645 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u06a9\u06cc\u0648\u0628 \u067e\u0631\u0627\u06a9\u0633\u06cc iptables \u06a9\u06d2 \u0642\u0648\u0627\u0646\u06cc\u0646 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u06a9\u0644\u0633\u0679\u0631 \u0622\u0626\u06cc \u067e\u06cc \u06a9\u0648 \u06a9\u0633 \u0637\u0631\u062d \u0644\u0627\u06af\u0648 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u060c \u06a9\u0633 \u0637\u0631\u062d Ingress \u06a9\u0646\u0679\u0631\u0648\u0644\u0631 \u0628\u06cc\u0631\u0648\u0646\u06cc \u0679\u0631\u06cc\u0641\u06a9 \u06a9\u0648 \u0633\u0646\u06af\u0644 \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0631\u0648\u0679 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u06a9\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u06a9\u0633 \u0637\u0631\u062d SOC2 \u06a9\u06cc \u062a\u0639\u0645\u06cc\u0644 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0645\u0627\u0626\u06cc\u06a9\u0631\u0648 \u0633\u06cc\u06af\u0645\u06cc\u0646\u0679\u06cc\u0634\u0646 \u06a9\u0648 \u0646\u0627\u0641\u0630 \u06a9\u0631\u062a\u06cc \u06c1\u06cc\u06ba\u060c EB \u06a9\u0648 \u062a\u06cc\u0632\u06cc \u0633\u06d2 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0648\u0631 \u062a\u0645\u0627\u0645 EB \u06a9\u0648 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0642\u0627\u0628\u0644 \u0645\u0634\u0627\u06c1\u062f\u06c1\u060c \u0627\u0648\u0631 \u0632\u06cc\u0627\u062f\u06c1 \u0645\u062d\u0641\u0648\u0638 \u0645\u062a\u0628\u0627\u062f\u0644\u06d4<\/p>\n<p>\u0627\u0633 \u06af\u0627\u0626\u06cc\u0688 \u06a9\u06d2 \u0627\u062e\u062a\u062a\u0627\u0645 \u062a\u06a9\u060c \u0622\u067e &quot;\u0645\u06cc\u0631\u06d2 \u067e\u0648\u0688\u0632 \u0627\u0633 \u0633\u0631\u0648\u0633 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0628\u0627\u062a \u0686\u06cc\u062a \u06a9\u06cc\u0648\u06ba \u0646\u06c1\u06cc\u06ba \u06a9\u0631 \u0633\u06a9\u062a\u06d2\u061f&#8221; \u06a9\u0648 \u0688\u06cc\u0628\u06af \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0642\u0627\u0628\u0644 \u06c1\u0648 \u062c\u0627\u0626\u06cc\u06ba \u06af\u06d2\u060c \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0637\u06d2 \u0634\u062f\u06c1 \u0627\u0646\u06a9\u0627\u0631 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u06a9\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648 \u0644\u0627\u06af\u0648 \u06a9\u0631\u06cc\u06ba \u062c\u0648 SOC2 CC6.1 \u067e\u0631 \u067e\u0648\u0631\u0627 \u0627\u062a\u0631\u062a\u06cc \u06c1\u0648\u060c \u0627\u0648\u0631 \u0627\u0639\u062a\u0645\u0627\u062f \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0627\u067e\u0646\u06d2 \u06a9\u0644\u0633\u0679\u0631 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0635\u062d\u06cc\u062d CNI \u06a9\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<h2 id=\"heading-table-of-contents\">\u0627\u0646\u0688\u06cc\u06a9\u0633<\/h2>\n<h2 id=\"heading-what-youll-learn\">\u062c\u0648 \u0622\u067e \u0633\u06cc\u06a9\u06be\u06cc\u06ba \u06af\u06d2\u06d4<\/h2>\n<ul>\n<li>\n<p>Pod IP\u060c \u06a9\u0646\u0679\u06cc\u0646\u0631 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0645\u0627\u0688\u0644\u060c \u06a9\u0633 \u0637\u0631\u062d CNI \u067e\u062a\u06d2 \u0645\u062e\u062a\u0635 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>kube-proxy iptables \u06a9\u06d2 \u0633\u0627\u062a\u06be ClusterIP \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u0646\u0627\u0641\u0630 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 eBPF \u062a\u06cc\u0632 \u06a9\u06cc\u0648\u06ba \u06c1\u06d2<\/p>\n<\/li>\n<li>\n<p>\u0627\u0646\u06af\u0631\u06cc\u0633 \u06a9\u0646\u0679\u0631\u0648\u0644\u0631: \u062a\u0645\u0627\u0645 \u0628\u06cc\u0631\u0648\u0646\u06cc \u0679\u0631\u06cc\u0641\u06a9 \u06a9\u0648 \u0627\u06cc\u06a9 \u06c1\u06cc \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0631 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0631\u0648\u0679 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0646\u06cc\u0679 \u0648\u0631\u06a9 \u06a9\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc: \u0688\u06cc\u0641\u0627\u0644\u0679 \u0627\u0646\u06a9\u0627\u0631 \u0627\u0648\u0631 \u0641\u06cc \u0633\u0631\u0648\u0633 \u0635\u0641\u0631 \u0679\u0631\u0633\u0679 \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u06a9\u06d2 \u0627\u0635\u0648\u0644\u0648\u06ba \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>CNI \u0645\u0648\u0627\u0632\u0646\u06c1: Cilium, Calico, AWS VPC CNI \u0627\u0648\u0631 \u06c1\u0631 \u0627\u06cc\u06a9 \u06a9\u0648 \u06a9\u0628 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u0646\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0633\u0631\u0648\u0633 \u0645\u06cc\u0634: Cilium, Istio, Linkerd for mTLS \u0627\u0648\u0631 \u0645\u0634\u0627\u06c1\u062f\u06c1 \u06a9\u06d2 \u0644\u06cc\u06d2<\/p>\n<\/li>\n<\/ul>\n<p>\u0622\u0626\u06cc\u06d2 \u0627\u0646\u062f\u0631 \u063a\u0648\u0637\u06c1 \u0644\u06af\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h2 id=\"heading-prerequisites\">\u0634\u0631\u0637\u06cc\u06ba<\/h2>\n<p>\u067e\u06cc\u0631\u0648\u06cc \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2\u060c \u0622\u067e \u06a9\u0648 \u0636\u0631\u0648\u0631\u062a \u06c1\u0648 \u06af\u06cc:<\/p>\n<p><strong>\u0639\u0644\u0645:<\/strong><\/p>\n<ul>\n<li>\n<p>\u0628\u0646\u06cc\u0627\u062f\u06cc Kubernetes \u0648\u0627\u0642\u0641\u06cc\u062a: \u0622\u067e \u067e\u0648\u0688 \u062a\u0639\u06cc\u0646\u0627\u062a \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0648\u0631 \u062e\u062f\u0645\u0627\u062a \u062a\u062e\u0644\u06cc\u0642 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0628\u0646\u06cc\u0627\u062f\u06cc \u0644\u06cc\u0646\u06a9\u0633 \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u062a\u0635\u0648\u0631\u0627\u062a: \u0622\u067e \u062c\u0627\u0646\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u06c1 IP \u0627\u06cc\u0688\u0631\u06cc\u0633 \u0627\u0648\u0631 \u067e\u0648\u0631\u0679 \u06a9\u06cc\u0627 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0631 \u06a9\u06cc \u0635\u0644\u0627\u062d\u06cc\u062a\u0648\u06ba \u06a9\u06cc \u0639\u0645\u0648\u0645\u06cc \u062a\u0641\u06c1\u06cc\u0645<\/p>\n<\/li>\n<\/ul>\n<p><strong>\u0627\u0648\u0632\u0627\u0631 \u0627\u0648\u0631 \u0631\u0633\u0627\u0626\u06cc:<\/strong><\/p>\n<ul>\n<li>\n<p>Kubernetes \u06a9\u0644\u0633\u0679\u0631 \u0686\u0644\u0627\u0646\u0627 (EKS\u060c GKE\u060c \u06cc\u0627 \u06a9\u0633\u06cc \u062f\u0648\u0633\u0631\u06cc \u0642\u0633\u0645 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0645\u0642\u0627\u0645\u06cc \u06a9\u0644\u0633\u0679\u0631)<\/p>\n<\/li>\n<li>\n<p><code>kubectl<\/code>    \u062a\u0631\u062a\u06cc\u0628 \u062f\u06cc\u0646\u0627 \u0627\u0648\u0631 \u0627\u06cc\u06a9 \u06a9\u0644\u0633\u0679\u0631 \u06a9\u06cc \u0637\u0631\u0641 \u0627\u0634\u0627\u0631\u06c1 \u06a9\u0631\u0646\u0627<\/p>\n<\/li>\n<li>\n<p><code>helm<\/code>    3 \u062a\u0646\u0635\u06cc\u0628\u0627\u062a (\u062d\u0635\u06c1 4 \u0645\u06cc\u06ba \u0633\u06cc\u0644\u06cc\u0645 \u06a9\u06cc \u062a\u0646\u0635\u06cc\u0628 \u06a9\u06d2 \u0644\u06cc\u06d2)<\/p>\n<\/li>\n<li>\n<p>\u062d\u0635\u06c1 4 \u0627\u0648\u0631 \u0627\u0633 \u06a9\u06d2 \u0628\u0639\u062f: \u0627\u067e\u0646\u06d2 \u06a9\u0644\u0633\u0679\u0631 \u067e\u0631 Cilium \u0627\u0646\u0633\u0679\u0627\u0644 \u06a9\u0631\u0646\u0627 (<code>helm install cilium cilium\/cilium<\/code>)<\/p>\n<\/li>\n<\/ul>\n<p>CNI \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u0646\u0648\u0679: \u062d\u0635\u06d2 1-3 \u06a9\u0627 \u0627\u0637\u0644\u0627\u0642 CNI \u0633\u06d2 \u0642\u0637\u0639 \u0646\u0638\u0631 \u062a\u0645\u0627\u0645 Kubernetes \u06a9\u0644\u0633\u0679\u0631\u0632 \u067e\u0631 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u062d\u0635\u0648\u06ba 4 \u0633\u06d2 6 \u0645\u06cc\u06ba \u0633\u06cc\u0644\u06cc\u0645 \u0633\u06d2 \u0645\u062a\u0639\u0644\u0642\u06c1 \u0648\u0633\u0627\u0626\u0644 \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba (<code>CiliumNetworkPolicy<\/code>\u06c1\u0628\u0644)\u06d4 \u0627\u06af\u0631 \u0622\u067e \u0627\u06cc\u06a9 \u0645\u062e\u062a\u0644\u0641 CNI \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 \u062a\u0635\u0648\u0631 \u0627\u06cc\u06a9 \u062c\u06cc\u0633\u0627 \u06c1\u06d2\u06d4 \u0635\u0631\u0641 YAML \u0646\u062d\u0648 \u0645\u062e\u062a\u0644\u0641 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-part-1-pod-ips-and-the-container-network-model\">\u062d\u0635\u06c1 1: Pod IP \u0627\u0648\u0631 \u06a9\u0646\u0679\u06cc\u0646\u0631 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0645\u0627\u0688\u0644<\/h2>\n<h3 id=\"heading-11-why-every-pod-gets-its-own-ip\">1.1 \u06c1\u0631 \u067e\u0648\u0688 \u06a9\u0627 \u0627\u067e\u0646\u0627 IP \u06a9\u06cc\u0648\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/h3>\n<p>Kubernetes \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u0645\u0627\u0688\u0644 \u06a9\u0627 \u0627\u06cc\u06a9 \u0628\u0646\u06cc\u0627\u062f\u06cc \u0627\u0635\u0648\u0644 \u06c1\u06d2: \u06c1\u0631 Pod \u06a9\u0627 \u0627\u06cc\u06a9 \u0645\u0646\u0641\u0631\u062f IP \u067e\u062a\u06c1 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u06c1\u0631 Pod \u0627\u0633 IP \u06a9\u0648 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0627\u06cc\u0688\u0631\u06cc\u0633 \u0679\u0631\u0627\u0646\u0633\u0644\u06cc\u0634\u0646 (NAT) \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u06c1\u0631 \u062f\u0648\u0633\u0631\u06d2 Pod \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0628\u0627\u062a \u0686\u06cc\u062a \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1 \u0688\u0648\u06a9\u0631 \u06a9\u06d2 \u0688\u06cc\u0641\u0627\u0644\u0679 \u0631\u0648\u06cc\u06d2 \u0633\u06d2 \u0645\u062e\u062a\u0644\u0641 \u06c1\u06d2\u060c \u062c\u06c1\u0627\u06ba \u06a9\u0646\u0679\u06cc\u0646\u0631\u0632 \u0645\u06cc\u0632\u0628\u0627\u0646 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u06a9\u0627 \u0627\u0634\u062a\u0631\u0627\u06a9 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u06cc\u0627 \u067e\u0648\u0631\u0679 \u0645\u06cc\u067e\u0646\u06af \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 Kubernetes \u0645\u06cc\u06ba pods \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u067e\u0648\u0631\u0679 \u0645\u06cc\u067e\u0646\u06af \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u0622\u0626\u06cc \u067e\u06cc \u06a9\u0627 \u067e\u0648\u0688 \u0627\u06d2 <code>10.244.1.2<\/code> Pod B \u062a\u06a9 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u067e\u06c1\u0646\u0686\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4 <code>10.244.2.3<\/code> \u06cc\u06c1 \u0645\u062e\u062a\u0644\u0641 \u0646\u0648\u0688\u0633 \u067e\u0631 \u067e\u06be\u06cc\u0644\u0627 \u06c1\u0648\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0633\u0648\u0631\u0633 \u0622\u0626\u06cc \u067e\u06cc \u0645\u062d\u0641\u0648\u0638 \u06c1\u06d2\u06d4<\/p>\n<p>\u0627\u067e\u0646\u06d2 \u06a9\u0644\u0633\u0679\u0631 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0633\u06d2 \u0686\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-bash\"># List all pods across all namespaces with their IP addresses and node placement\nkubectl get pods -o wide --all-namespaces\n<\/code><\/pre>\n<p>\u0645\u062a\u0648\u0642\u0639 \u067e\u06cc\u062f\u0627\u0648\u0627\u0631:<\/p>\n<pre><code class=\"language-text\">NAMESPACE     NAME                                READY   STATUS    IP            NODE\nproduction    payment-api-5d6b8d8c4f-abc12        1\/1     Running   10.244.1.2    node-1\nproduction    user-api-5d6b8d8c4f-def34           1\/1     Running   10.244.2.3    node-2\nproduction    redis-master-0                      1\/1     Running   10.244.1.4    node-1\n<\/code><\/pre>\n<p>\u06c1\u0631 \u067e\u0648\u0688 \u06a9\u0627 \u0627\u06cc\u06a9 \u0645\u0646\u0641\u0631\u062f IP \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u0646\u0648\u0688-1 \u067e\u0631 \u0627\u062f\u0627\u0626\u06cc\u06af\u06cc-\u0627\u06d2 \u067e\u06cc \u0622\u0626\u06cc \u0627\u0648\u0631 \u0646\u0648\u0688-2 \u067e\u0631 \u0635\u0627\u0631\u0641-\u0627\u06d2 \u067e\u06cc \u0622\u0626\u06cc \u0645\u062a\u0639\u0644\u0642\u06c1 IP \u067e\u0631 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0627\u06cc\u06a9 \u062f\u0648\u0633\u0631\u06d2 \u0633\u06d2 \u062c\u0691 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 IP \u0627\u0633 \u0633\u06d2 \u0622\u062a\u0627 \u06c1\u06d2: <code>10.244.0.0\/16<\/code> CIDR: \u0627\u06cc\u06a9 \u067e\u0648\u0688 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u062c\u0648 \u0646\u0648\u0688 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0633\u06d2 \u0627\u0644\u06af \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-12-what-the-cni-plugin-actually-does\">1.2 CNI \u067e\u0644\u06af \u0627\u0646 \u0627\u0635\u0644 \u0645\u06cc\u06ba \u06a9\u06cc\u0627 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/h3>\n<p>\u06a9\u0646\u0679\u06cc\u0646\u0631 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0627\u0646\u0679\u0631\u0641\u06cc\u0633 (CNI) \u0627\u06cc\u06a9 \u067e\u0644\u06af \u0627\u0646 \u06c1\u06d2 \u062c\u0648 Kubernetes \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u0645\u0627\u0688\u0644 \u06a9\u0648 \u0686\u0644\u0627\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0630\u0645\u06c1 \u062f\u0627\u0631 \u06c1\u06d2\u06d4 \u062c\u0628 \u0646\u0648\u0688 \u067e\u0631 \u0627\u06cc\u06a9 \u0646\u06cc\u0627 \u067e\u0648\u0688 \u0645\u0642\u0631\u0631 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 Kubernetes kubelet CNI \u067e\u0644\u06af \u0627\u0646 \u06a9\u0648 \u06a9\u0627\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u062c\u0648 \u0686\u0627\u0631 \u06a9\u0627\u0645 \u0627\u0646\u062c\u0627\u0645 \u062f\u06cc\u062a\u0627 \u06c1\u06d2:<\/p>\n<ol>\n<li>\n<p>\u0627\u067e\u0646\u06d2 Pod \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u0646\u06cc\u0627 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0646\u0627\u0645 \u06a9\u06cc \u062c\u06af\u06c1 \u0628\u0646\u0627\u0626\u06cc\u06ba\u060c \u062c\u0648 \u06a9\u06c1 \u0627\u06cc\u06a9 \u0627\u0644\u06af \u062a\u06be\u0644\u06af \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u0645\u0627\u062d\u0648\u0644 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0627\u06cc\u06a9 \u0648\u0631\u0686\u0648\u0626\u0644 \u0627\u06cc\u062a\u06be\u0631\u0646\u06cc\u0679 \u062c\u0648\u0691\u0627 \u0628\u0646\u0627\u0626\u06cc\u06ba (<code>veth<\/code>): \u067e\u0648\u0688 \u0646\u0627\u0645 \u06a9\u06cc \u062c\u06af\u06c1 \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0627\u06cc\u06a9 \u0633\u0631\u06c1\u060c \u0646\u0648\u0688 \u067e\u0631 \u0627\u06cc\u06a9 \u0633\u0631\u0627<\/p>\n<\/li>\n<li>\n<p>\u067e\u0648\u0688 \u06a9\u06cc \u0648\u06cc\u062a\u06be \u062c\u0648\u0691\u06cc \u06a9\u06d2 \u0622\u062e\u0631 \u0645\u06cc\u06ba \u06a9\u0644\u0633\u0679\u0631 \u067e\u0648\u0688 CIDR \u06a9\u0627 IP \u0627\u06cc\u0688\u0631\u06cc\u0633 \u062a\u0641\u0648\u06cc\u0636 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0631\u0648\u0679\u0646\u06af \u06a9\u06d2 \u0627\u0635\u0648\u0644 \u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba \u062a\u0627\u06a9\u06c1 \u0646\u0648\u0688\u0633 \u06a9\u0648 \u0645\u0639\u0644\u0648\u0645 \u06c1\u0648 \u06a9\u06c1 \u06a9\u0644\u0633\u0679\u0631 \u0645\u06cc\u06ba \u0645\u0648\u062c\u0648\u062f \u062a\u0645\u0627\u0645 \u067e\u0648\u0688 \u0622\u0626\u06cc \u067e\u06cc \u0633\u06d2 \u06a9\u06cc\u0633\u06d2 \u062c\u0691\u0646\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<\/ol>\n<p>\u0633\u06cc \u0627\u06cc\u0646 \u0622\u0626\u06cc \u06a9\u06d2 \u0628\u063a\u06cc\u0631\u060c \u067e\u0648\u0688 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0633\u06d2 \u0646\u06c1\u06cc\u06ba \u062c\u0691\u06d2 \u06af\u0627\u06d4 \u06cc\u06c1 \u0641\u0644\u06cc\u0679 \u067e\u0648\u0688 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0645\u0627\u0688\u0644 \u06a9\u0648 \u062d\u0642\u06cc\u0642\u062a \u0628\u0646\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0686\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba \u06a9\u06c1 \u0622\u067e \u06a9\u06d2 \u06a9\u0644\u0633\u0679\u0631 \u067e\u0631 \u06a9\u0648\u0646 \u0633\u06d2 CNI \u067e\u0644\u06af \u0627\u0646 \u0627\u0646\u0633\u0679\u0627\u0644 \u06c1\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-bash\"># List the CNI binaries installed on a node\nls \/opt\/cni\/bin\/\n<\/code><\/pre>\n<p>\u0630\u06cc\u0644 \u0645\u06cc\u06ba \u06a9\u0686\u06be \u0639\u0627\u0645 CNI \u067e\u0644\u06af \u0627\u0646 \u0627\u0648\u0631 \u06c1\u0631 \u0627\u06cc\u06a9 \u06a9\u0648 \u06a9\u0628 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u0646\u0627 \u06c1\u06d2\u06d4<\/p>\n<table>\n<thead>\n<tr>\n<th>\u0633\u06cc \u0627\u06cc\u0646 \u0622\u0626\u06cc<\/th>\n<th>\u06a9\u06cc\u0627 \u06cc\u06c1 \u0628\u0637\u0648\u0631 \u0688\u06cc\u0641\u0627\u0644\u0679 \u0622\u0646 \u06c1\u06d2\u061f<\/th>\n<th>\u06a9\u0644\u06cc\u062f\u06cc \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u06d2 \u0645\u0639\u0627\u0645\u0644\u0627\u062a<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>AWS VPC CNI<\/td>\n<td>\u06c1\u0627\u06ba (EKS)<\/td>\n<td>\u067e\u06be\u0644\u06cc\u0648\u06ba \u06a9\u0648 \u0627\u06cc\u06a9 \u062d\u0642\u06cc\u0642\u06cc VPC IP \u0645\u0644\u062a\u0627 \u06c1\u06d2\u06d4 AWS \u0645\u0642\u0627\u0645\u06cc \u0627\u0646\u0636\u0645\u0627\u0645 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0628\u06c1\u062a\u0631\u06cc\u0646 \u0645\u0648\u0632\u0648\u06ba \u06c1\u06d2\u06d4<\/td>\n<\/tr>\n<tr>\n<td>\u06a9\u06cc\u0644\u06cc\u06a9\u0648<\/td>\n<td>\u0646\u06c1\u06cc\u06ba<\/td>\n<td>BGP \u0631\u0648\u0679\u0646\u06af \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u062c\u062f\u06cc\u062f \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u067e\u0627\u0644\u06cc\u0633\u06cc<\/td>\n<\/tr>\n<tr>\n<td>\u067e\u0644\u06a9\u06cc\u06ba<\/td>\n<td>\u0646\u06c1\u06cc\u06ba<\/td>\n<td>eBPF \u067e\u0631 \u0645\u0628\u0646\u06cc \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af\u060c \u067e\u0631\u062a 7 \u067e\u0627\u0644\u06cc\u0633\u06cc\u060c \u0633\u0631\u0648\u0633 \u0645\u06cc\u0634\u060c SOC2 \u062b\u0628\u0648\u062a<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3 id=\"heading-13-verifying-pod-to-pod-communication\">1.3 \u067e\u06be\u0644\u06cc\u0648\u06ba \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0631\u0627\u0628\u0637\u06d2 \u06a9\u06cc \u062c\u0627\u0646\u0686 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<p>\u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u06a9\u0627 \u0633\u0628 \u0633\u06d2 \u0628\u0646\u06cc\u0627\u062f\u06cc \u0679\u06cc\u0633\u0679: \u0627\u06cc\u06a9 \u067e\u0648\u0688 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0686\u0644\u0627\u0626\u06cc\u06ba \u0627\u0648\u0631 \u062f\u0648\u0633\u0631\u06d2 \u067e\u0648\u0688 \u06a9\u0648 \u0622\u0626\u06cc \u067e\u06cc \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u067e\u0646\u06af \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-bash\"># Step 1: Get the IP of a target pod\nTARGET_IP=$(kubectl get pod redis-master-0 -o jsonpath=\"{.status.podIP}\")\necho \"Target IP: $TARGET_IP\"\n\n# Step 2: Exec into another pod and ping the target\nkubectl exec -it payment-api-5d6b8d8c4f-abc12 -- ping -c 3 $TARGET_IP\n<\/code><\/pre>\n<p>\u0645\u062a\u0648\u0642\u0639 \u067e\u06cc\u062f\u0627\u0648\u0627\u0631:<\/p>\n<pre><code class=\"language-text\">PING 10.244.1.4 (10.244.1.4): 56 data bytes\n64 bytes from 10.244.1.4: icmp_seq=0 ttl=62 time=0.8ms\n64 bytes from 10.244.1.4: icmp_seq=1 ttl=62 time=0.7ms\n64 bytes from 10.244.1.4: icmp_seq=2 ttl=62 time=0.9ms\n<\/code><\/pre>\n<p>\u0627\u06af\u0631 \u06cc\u06c1 \u06a9\u0627\u0645\u06cc\u0627\u0628 \u06c1\u0648 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u0622\u067e \u06a9\u0627 CNI \u0635\u062d\u06cc\u062d \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u06a9\u0627\u0645 \u06a9\u0631 \u0631\u06c1\u0627 \u06c1\u06d2\u06d4 \u0627\u06af\u0631 \u06cc\u06c1 \u0646\u0627\u06a9\u0627\u0645 \u06c1\u0648\u062c\u0627\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u0686\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba \u06a9\u06c1 \u0622\u06cc\u0627 \u0622\u067e \u06a9\u06d2 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u06a9\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc ICMP \u0679\u0631\u06cc\u0641\u06a9 \u06a9\u0648 \u0631\u0648\u06a9 \u0631\u06c1\u06cc \u06c1\u06d2 (\u0627\u0633 \u06a9\u0627 \u0627\u062d\u0627\u0637\u06c1 \u062d\u0635\u06c1 4 \u0645\u06cc\u06ba \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2)\u06d4<\/p>\n<p>\u06cc\u0627\u062f \u0631\u06a9\u06be\u0646\u06d2 \u06a9\u0627 \u0627\u06cc\u06a9 \u0627\u0635\u0648\u0644 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u06c1\u0631 \u067e\u0648\u0688 \u06a9\u0648 \u0627\u06cc\u06a9 IP \u062f\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u067e\u0648\u0688\u0633 \u0627\u067e\u0646\u06d2 \u0622\u0626\u06cc \u067e\u06cc \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0628\u0627\u062a \u0686\u06cc\u062a \u06a9\u0631\u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 CNI \u067e\u0644\u06af \u0627\u0646 \u062f\u0648\u0646\u0648\u06ba \u06a9\u0648 \u062d\u0627\u0635\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-part-2-services-clusterip-nodeport-and-loadbalancer\">\u062d\u0635\u06c1 2: \u062e\u062f\u0645\u0627\u062a \u2014 \u06a9\u0644\u0633\u0679\u0631 \u0622\u0626\u06cc \u067e\u06cc\u060c \u0646\u0648\u0688 \u067e\u0648\u0631\u0679\u060c \u0627\u0648\u0631 \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633<\/h2>\n<h3 id=\"heading-21-the-problem-pod-ips-are-not-stable\">2.1 \u0645\u0633\u0626\u0644\u06c1: Pod IP \u0645\u0633\u062a\u062d\u06a9\u0645 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/h3>\n<p>Pod IP \u06c1\u0631 \u0628\u0627\u0631 \u062c\u0628 Pod \u062f\u0648\u0628\u0627\u0631\u06c1 \u0634\u0631\u0648\u0639 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u062a\u0628\u062f\u06cc\u0644 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u062c\u0628 \u0622\u067e \u0627\u067e\u0646\u06d2 Payments API \u06a9\u0627 \u0646\u06cc\u0627 \u0648\u0631\u0698\u0646 \u062a\u0639\u06cc\u0646\u0627\u062a \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 \u067e\u0631\u0627\u0646\u0627 Pod \u062d\u0630\u0641 \u06c1\u0648 \u062c\u0627\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0646\u0626\u06d2 IP \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0627\u06cc\u06a9 \u0646\u06cc\u0627 Pod \u0628\u0646\u0627\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u067e\u0631\u0627\u0646\u06d2 \u0622\u0626\u06cc \u067e\u06cc \u06a9\u0648 \u06a9\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0646\u0641\u06cc\u06af\u0631 \u06a9\u0631\u062f\u06c1 \u06a9\u0633\u06cc \u0628\u06be\u06cc \u062e\u062f\u0645\u0627\u062a \u06a9\u0627 \u0627\u0628 \u0688\u06cc\u0688 \u062d\u0648\u0627\u0644\u06c1 \u06c1\u0648\u06af\u0627\u06d4<\/p>\n<p>\u063a\u0644\u0637 \u0646\u0642\u0637\u06c1 \u0646\u0638\u0631 \u06c1\u06d2: \u0627\u0633 \u0645\u06cc\u06ba Pod IP \u06a9\u0648 \u06c1\u0627\u0631\u0688 \u06a9\u0648\u0688\u0646\u06af \u06a9\u0631\u0646\u0627 \u0634\u0627\u0645\u0644 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-yaml\"># Bad: Direct Pod IP in application configuration\n# This IP will stop working the next time the database Pod restarts\napiVersion: v1\nkind: Pod\nmetadata:\n  name: payment-api\nspec:\n  containers:\n  - name: api\n    env:\n    - name: DATABASE_HOST\n      value: \"10.244.1.4\"  # Pod IP \u2014 will change on next restart\n<\/code><\/pre>\n<p>\u06cc\u06c1 \u062a\u0631\u0642\u06cc \u06a9\u0648 \u06a9\u0645\u0632\u0648\u0631 \u0627\u0648\u0631 \u067e\u06cc\u062f\u0627\u0648\u0627\u0631 \u06a9\u0648 \u062a\u0628\u0627\u06c1 \u06a9\u0646 \u0628\u0646\u0627 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4 \u0631\u0648\u0679\u06cc\u0646 \u067e\u0648\u0688 \u06a9\u0648 \u062f\u0648\u0628\u0627\u0631\u06c1 \u0634\u0631\u0648\u0639 \u06a9\u0631\u0646\u0627\u060c \u062c\u06cc\u0633\u06d2 \u06a9\u06c1 \u0646\u0648\u0688 \u0688\u0631\u06cc\u0646\u0646\u06af\u060c OOM \u0634\u0679 \u0688\u0627\u0624\u0646\u060c \u06cc\u0627 \u062a\u0639\u06cc\u0646\u0627\u062a\u06cc \u0631\u0648\u0644 \u0622\u0624\u0679\u060c \u06a9\u0633\u06cc \u0628\u06be\u06cc \u0627\u06cc\u0633\u06cc \u0627\u06cc\u067e\u0644\u06cc \u06a9\u06cc\u0634\u0646 \u06a9\u0648 \u062a\u0648\u0691 \u062f\u06d2 \u06af\u0627 \u062c\u0633 \u0646\u06d2 \u067e\u0631\u0627\u0646\u06d2 IP \u06a9\u0648 \u06c1\u0627\u0631\u0688 \u06a9\u0648\u0688 \u06a9\u06cc\u0627 \u06c1\u0648\u06d4<\/p>\n<h3 id=\"heading-22-how-services-solve-the-stability-problem\">2.2 \u0633\u0631\u0648\u0633 \u0627\u0633\u062a\u062d\u06a9\u0627\u0645 \u06a9\u06d2 \u0645\u0633\u0627\u0626\u0644 \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u062d\u0644 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u06d4<\/h3>\n<p>Kubernetes \u0633\u0631\u0648\u0633\u0632 \u062f\u0648 \u062e\u0635\u0648\u0635\u06cc\u0627\u062a \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u06cc \u06c1\u06cc\u06ba \u062c\u0648 Pod IPs \u0646\u06c1\u06cc\u06ba \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba: \u0627\u06cc\u06a9 \u0645\u0633\u062a\u062d\u06a9\u0645 IP \u0627\u06cc\u0688\u0631\u06cc\u0633 \u062c\u0648 \u0633\u0631\u0648\u0633 \u06a9\u06cc \u0632\u0646\u062f\u06af\u06cc \u06a9\u06d2 \u062f\u0648\u0631\u0627\u0646 \u06a9\u0628\u06be\u06cc \u062a\u0628\u062f\u06cc\u0644 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2 (ClusterIP)\u060c \u0627\u0648\u0631 \u0627\u06cc\u06a9 \u0645\u0633\u062a\u062d\u06a9\u0645 DNS \u0646\u0627\u0645 \u062c\u0648 \u062f\u0648\u0633\u0631\u06d2 Pods \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627 \u06c1\u06d2 \u0627\u0646 \u06a9\u06d2 IP \u0633\u06d2 \u0642\u0637\u0639 \u0646\u0638\u0631\u06d4<\/p>\n<p>\u062c\u0628 \u0622\u067e \u06a9\u0648\u0626\u06cc \u0633\u0631\u0648\u0633 \u0628\u0646\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 Kubernetes \u0633\u0631\u0648\u0633 CIDR \u0633\u06d2 \u0627\u06cc\u06a9 \u0648\u0631\u0686\u0648\u0626\u0644 \u06a9\u0644\u0633\u0679\u0631 \u0622\u0626\u06cc \u067e\u06cc \u062a\u0641\u0648\u06cc\u0636 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u062c\u06cc\u0633\u06d2 <code>10.100.0.0\/16<\/code>)\u060c CoreDNS \u0645\u06cc\u06ba \u062f\u0631\u062c \u0630\u06cc\u0644 \u0627\u06cc\u06a9 DNS \u0631\u06cc\u06a9\u0627\u0631\u0688 \u0628\u0646\u0627\u0626\u06cc\u06ba: <code><service-name>.<namespace>.svc.cluster.local<\/namespace><\/service-name><\/code>\u06a9\u0644\u0633\u0679\u0631 \u0622\u0626\u06cc \u067e\u06cc \u0633\u06d2 \u0627\u0633 \u06a9\u06d2 \u067e\u06cc\u0686\u06be\u06d2 \u0635\u062d\u062a \u0645\u0646\u062f \u067e\u0648\u0688 \u0622\u0626\u06cc \u067e\u06cc \u067e\u0631 \u0628\u06cc\u0644\u0646\u0633 \u0679\u0631\u06cc\u0641\u06a9 \u0644\u0648\u0688 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 iptables \u0627\u0635\u0648\u0644 \u0634\u0627\u0645\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u062a\u0645\u0627\u0645 \u0646\u0648\u0688\u0633 \u067e\u0631 kube-proxy \u06a9\u0648 \u062a\u0631\u062a\u06cc\u0628 \u062f\u06cc\u06ba\u06d4<\/p>\n<p>\u062f\u0631\u0633\u062a \u0646\u0641\u0627\u0630 \u06a9\u0644\u0633\u0679\u0631 \u0622\u0626\u06cc \u067e\u06cc \u0633\u0631\u0648\u0633 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-yaml\"># Good: ClusterIP Service provides a stable IP and DNS name\n# redis.production.svc.cluster.local always resolves to 10.100.0.1\n# regardless of which Redis pods are running behind it\napiVersion: v1\nkind: Service\nmetadata:\n  name: redis\n  namespace: production\nspec:\n  selector:\n    app: redis\n    role: master   # Only pods with these labels receive traffic\n  ports:\n  - port: 6379        # Port the Service listens on\n    targetPort: 6379  # Port the Pod actually runs on\n  type: ClusterIP     # Default: accessible only inside the cluster\n<\/code><\/pre>\n<p>iptables \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 kube-proxy \u06a9\u0633 \u0637\u0631\u062d \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0646\u06af \u06a9\u0648 \u0644\u0627\u06af\u0648 \u06a9\u0631\u062a\u0627 \u06c1\u06d2: \u062c\u0628 \u06a9\u0648\u0626\u06cc \u0633\u0631\u0648\u0633 \u0628\u0646\u0627\u0626\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06d2\u060c \u062a\u0648 kube-proxy \u06a9\u0644\u0633\u0679\u0631 \u0645\u06cc\u06ba \u0645\u0648\u062c\u0648\u062f \u062a\u0645\u0627\u0645 \u0646\u0648\u0688\u0633 \u0645\u06cc\u06ba iptables \u06a9\u06d2 \u0627\u0635\u0648\u0644 \u0634\u0627\u0645\u0644 \u06a9\u0631 \u062f\u06cc\u062a\u06cc \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0642\u0648\u0627\u0639\u062f ClusterIP \u06a9\u06d2 \u0644\u06cc\u06d2 \u0637\u06d2 \u0634\u062f\u06c1 \u0679\u0631\u06cc\u0641\u06a9 \u06a9\u0648 \u0631\u0648\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0648\u0631 \u0627\u0633\u06d2 \u0635\u062d\u062a \u0645\u0646\u062f Pod IPs \u0645\u06cc\u06ba \u0633\u06d2 \u0627\u06cc\u06a9 \u067e\u0631 \u0628\u06be\u06cc\u062c \u062f\u06cc\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0642\u0648\u0627\u0646\u06cc\u0646 \u06a9\u0648 \u0639\u0645\u0644 \u0645\u06cc\u06ba \u062f\u06cc\u06a9\u06be\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0633\u06d2 \u0627\u067e\u0646\u06d2 \u0646\u0648\u0688 \u067e\u0631 \u0686\u0644\u0627\u0626\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-bash\"># View the iptables rules kube-proxy created for the redis Service\n# Each KUBE-SEP entry represents one Pod endpoint\nsudo iptables -t nat -L KUBE-SERVICES | grep redis\n<\/code><\/pre>\n<p>\u0645\u062a\u0648\u0642\u0639 \u067e\u06cc\u062f\u0627\u0648\u0627\u0631:<\/p>\n<pre><code class=\"language-text\">Chain KUBE-SVC-REDIS (1 references)\ntarget          prot  source    destination\nKUBE-SEP-AAA    all   anywhere  anywhere    \/* production\/redis *\/ statistic mode random probability 0.50\nKUBE-SEP-BBB    all   anywhere  anywhere    \/* production\/redis *\/\n<\/code><\/pre>\n<p>Redis ClusterIP \u06a9\u06cc \u0637\u0631\u0641 \u0679\u0631\u06cc\u0641\u06a9 \u0627\u0646 iptables \u0642\u0648\u0627\u0639\u062f \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u062f\u0648 \u067e\u0648\u0688 \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679\u0633 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 50\/50 \u062a\u0642\u0633\u06cc\u0645 \u06a9\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06d2\u06d4 \u062c\u0628 \u067e\u0648\u0688 \u062f\u0648\u0628\u0627\u0631\u06c1 \u0634\u0631\u0648\u0639 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u06cc\u06a9 \u0646\u06cc\u0627 IP \u0645\u0648\u0635\u0648\u0644 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 kube-proxy \u062e\u0648\u062f \u0628\u062e\u0648\u062f \u0642\u0648\u0627\u0646\u06cc\u0646 \u06a9\u0648 \u0627\u067e \u0688\u06cc\u0679 \u06a9\u0631 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-23-when-to-use-each-service-type\">2.3 \u06c1\u0631 \u0642\u0633\u0645 \u06a9\u06cc \u0633\u0631\u0648\u0633 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0628 \u06a9\u0631\u0646\u0627 \u06c1\u06d2\u06d4<\/h3>\n<table>\n<thead>\n<tr>\n<th>\u0632\u0645\u0631\u06c1<\/th>\n<th>DNS \u0646\u0627\u0645<\/th>\n<th>\u0633\u06d2 \u0642\u0627\u0628\u0644 \u0631\u0633\u0627\u0626\u06cc:<\/th>\n<th>\u06a9\u06cc\u0633\u0632 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u06a9\u0644\u0633\u0679\u0631 \u0622\u0626\u06cc \u067e\u06cc<\/td>\n<td><code>redis.production.svc.cluster.local<\/code><\/td>\n<td>\u0635\u0631\u0641 \u06a9\u0644\u0633\u0679\u0631 \u06a9\u06d2 \u0627\u0646\u062f\u0631<\/td>\n<td>\u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633\u060c \u06a9\u06cc\u0634\u06d2\u060c \u0627\u0646\u062f\u0631\u0648\u0646\u06cc API<\/td>\n<\/tr>\n<tr>\n<td>\u0646\u0648\u0688 \u067e\u0648\u0631\u0679<\/td>\n<td><code><node-ip>:30000\u201332767<\/node-ip><\/code><\/td>\n<td>\u0646\u0648\u0688 \u0622\u0626\u06cc \u067e\u06cc + \u067e\u0648\u0631\u0679<\/td>\n<td>\u0645\u0642\u0627\u0645\u06cc \u062a\u0631\u0642\u06cc\u060c \u0688\u06cc\u0628\u06af\u0646\u06af<\/td>\n<\/tr>\n<tr>\n<td>\u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0631<\/td>\n<td>AWS ELB DNS \u0646\u0627\u0645<\/td>\n<td>\u0627\u0646\u0679\u0631\u0646\u06cc\u0679 (\u06a9\u0644\u0627\u0624\u0688 \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0631 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2)<\/td>\n<td>\u0628\u06cc\u0631\u0648\u0646\u06cc API\u060c \u0648\u06cc\u0628 \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631\u06cc\u06ba \u06a9\u06c1 \u0633\u0631\u0648\u0633 \u0679\u0631\u06cc\u0641\u06a9 \u06a9\u0648 \u0635\u062d\u06cc\u062d \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u0631\u0648\u0679 \u06a9\u0631 \u0631\u06c1\u06cc \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-bash\"># Describe a Service to see its endpoints (the actual Pod IPs behind it)\nkubectl describe service redis -n production\n<\/code><\/pre>\n<p>\u0645\u062a\u0648\u0642\u0639 \u067e\u06cc\u062f\u0627\u0648\u0627\u0631:<\/p>\n<pre><code class=\"language-text\">Name:              redis\nNamespace:         production\nType:              ClusterIP\nIP:                10.100.0.1\nPort:              6379\/TCP\nTargetPort:        6379\/TCP\nEndpoints:         10.244.1.4:6379,10.244.2.5:6379\nSession Affinity:  None\n<\/code><\/pre>\n<p>\u0627\u06af\u0631 <code>Endpoints<\/code> \u062f\u06a9\u06be\u0627\u0626\u06cc\u06ba <code><none\/><\/code>\u0633\u0631\u0648\u0633 \u0633\u0644\u06cc\u06a9\u0679\u0631 \u0686\u0644\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u067e\u0648\u0688 \u0633\u06d2 \u0645\u0645\u0627\u062b\u0644 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06cc\u06c1 Kubernetes \u0645\u06cc\u06ba &quot;\u06a9\u0646\u06a9\u0634\u0646 \u0633\u06d2 \u0627\u0646\u06a9\u0627\u0631&#8221; \u06a9\u06cc \u063a\u0644\u0637\u06cc\u0648\u06ba \u06a9\u06cc \u0633\u0628 \u0633\u06d2 \u0639\u0627\u0645 \u0648\u062c\u06c1 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u0627\u062f \u0631\u06a9\u06be\u0646\u06d2 \u06a9\u0627 \u0627\u06cc\u06a9 \u0627\u0635\u0648\u0644 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u067e\u0648\u0688\u0632 \u06a9\u0648 \u06c1\u0645\u06cc\u0634\u06c1 \u0633\u0631\u0648\u0633 DNS \u0646\u0627\u0645 \u0633\u06d2 \u062c\u0691\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u060c \u067e\u0648\u0688 IP \u0633\u06d2 \u0646\u06c1\u06cc\u06ba\u06d4 \u0633\u0631\u0648\u0633 \u062e\u0648\u062f \u0628\u062e\u0648\u062f \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f\u060c \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0646\u06af\u060c \u0627\u0648\u0631 \u0635\u062d\u062a \u06a9\u06cc \u062c\u0627\u0646\u0686 \u06a9\u0648 \u0633\u0646\u0628\u06be\u0627\u0644\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-part-3-ingress-external-traffic-routing\">\u062d\u0635\u06c1 3: \u062f\u0627\u062e\u0644 &#8211; \u0628\u06cc\u0631\u0648\u0646\u06cc \u0679\u0631\u06cc\u0641\u06a9 \u0631\u0648\u0679\u0646\u06af<\/h2>\n<h3 id=\"heading-31-the-problem-a-loadbalancer-service-per-microservice-is-expensive\">3.1 \u0645\u0633\u0626\u0644\u06c1: \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0631 \u0633\u0631\u0648\u0633 \u0641\u06cc \u0645\u0627\u0626\u06cc\u06a9\u0631\u0648 \u0633\u0631\u0648\u0633 \u0645\u06c1\u0646\u06af\u06cc \u06c1\u06d2\u06d4<\/h3>\n<p>\u06c1\u0631 \u0627\u06cc\u06a9 <code>LoadBalancer<\/code> \u0633\u0631\u0648\u0633 \u0627\u06cc\u06a9 \u0648\u0642\u0641 \u0634\u062f\u06c1 \u06a9\u0644\u0627\u0624\u0688 \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633 \u062a\u062e\u0644\u06cc\u0642 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u06d4 AWS \u0645\u06cc\u06ba\u060c \u06c1\u0631 \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633 \u06a9\u06cc \u0642\u06cc\u0645\u062a \u062a\u0642\u0631\u06cc\u0628\u0627\u064b $(0.008\/LCU-hour + $)0.0225\/hour \u0628\u0646\u06cc\u0627\u062f\u06cc \u0634\u0631\u062d \u06c1\u06d2\u06d4 \u0627\u0633 \u06a9\u06cc \u0644\u0627\u06af\u062a \u062a\u0642\u0631\u06cc\u0628\u0627\u064b $16-27 \u0641\u06cc \u0645\u06c1\u06cc\u0646\u06c1 \u0641\u06cc \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0631 \u06c1\u06d2\u06d4<\/p>\n<p>20 \u0645\u0627\u0626\u06cc\u06a9\u0631\u0648 \u0633\u0631\u0648\u0633\u0632 \u06a9\u06d2 \u0644\u06cc\u06d2\u060c \u0627\u06a9\u06cc\u0644\u06d2 \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633 \u06a9\u06cc \u0641\u06cc\u0633 $320 \u0633\u06d2 $540 \u0641\u06cc \u0645\u06c1\u06cc\u0646\u06c1 \u062a\u06a9\u060c \u0627\u0633 \u06a9\u06d2 \u0639\u0644\u0627\u0648\u06c1 \u06c1\u0631 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u067e\u0631 \u06a9\u0627\u0631\u0631\u0648\u0627\u0626\u06cc \u06a9\u06d2 \u0644\u06cc\u06d2 $0.008\/LCU\u06d4<\/p>\n<p>\u06cc\u06c1\u0627\u06ba \u0627\u06cc\u06a9 \u062e\u0631\u0627\u0628 \u0646\u0642\u0637\u06c1 \u0646\u0638\u0631 \u06c1\u06d2: \u0641\u06cc \u0645\u0627\u0626\u06cc\u06a9\u0631\u0648 \u0633\u0631\u0648\u0633 \u0627\u06cc\u06a9 \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0631 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644\u06d4<\/p>\n<pre><code class=\"language-yaml\"># Bad: This creates a new AWS ALB every time it is applied\n# 20 microservices = 20 ALBs = $300-500\/month before any traffic charges\napiVersion: v1\nkind: Service\nmetadata:\n  name: payment-api\nspec:\n  type: LoadBalancer   # Creates a dedicated ALB\n  ports:\n  - port: 80\n    targetPort: 8080\n<\/code><\/pre>\n<h3 id=\"heading-32-how-an-ingress-controller-solves-this\">3.2 \u0648\u0635\u0648\u0644 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u0627 \u06a9\u0646\u0679\u0631\u0648\u0644\u0631 \u0627\u0633 \u0645\u0633\u0626\u0644\u06d2 \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u062d\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/h3>\n<p>Ingress \u06a9\u0646\u0679\u0631\u0648\u0644\u0631 \u0627\u06cc\u06a9 \u067e\u0648\u0688 \u06c1\u06d2 \u062c\u0648 \u06a9\u0644\u0633\u0679\u0631 \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0686\u0644\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u062f\u06cc\u06a9\u06be\u062a\u0627 \u06c1\u06d2: <code>Ingress<\/code> \u0645\u06cc\u0632\u0628\u0627\u0646 \u0646\u0627\u0645 \u0627\u0648\u0631 \u06cc\u0648 \u0622\u0631 \u0627\u06cc\u0644 \u067e\u0627\u062a\u06be \u06a9\u06cc \u0628\u0646\u06cc\u0627\u062f \u067e\u0631 \u0645\u062a\u0639\u062f\u062f \u0633\u0631\u0648\u0633\u0632 \u062a\u06a9 \u0679\u0631\u06cc\u0641\u06a9 \u06a9\u0648 \u0631\u0648\u0679 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u0648\u0627\u062d\u062f \u0628\u06cc\u0631\u0648\u0646\u06cc \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633 \u06a9\u0648 \u0648\u0633\u0627\u0626\u0644 \u0627\u0648\u0631 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<p>\u0645\u062b\u0627\u0644 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631\u060c AWS \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633 \u06a9\u0646\u0679\u0631\u0648\u0644\u0631 \u062a\u0645\u0627\u0645 Ingress \u0648\u0633\u0627\u0626\u0644 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 ALB \u0628\u0646\u0627\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u0646 \u06a9\u0648 \u0631\u0648\u0679 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0633\u0646\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u06a9\u06d2 \u0627\u0635\u0648\u0644\u06d4 <code>api.company.com\/payments<\/code> \u0627\u062f\u0627\u0626\u06cc\u06af\u06cc \u06a9\u06cc \u062e\u062f\u0645\u062a \u06a9\u06d2 \u0644\u06cc\u06d2 <code>api.company.com\/users<\/code> \u0633\u0628\u06be\u06cc \u06a9\u0648 \u0627\u06cc\u06a9 \u06c1\u06cc \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0631 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0622\u067e \u06a9\u06cc \u062e\u062f\u0645\u0627\u062a \u062a\u06a9 \u067e\u06c1\u0646\u0686\u0627\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u062f\u0631\u0633\u062a \u0646\u0641\u0627\u0630 \u06cc\u06c1 \u06c1\u06d2: \u062a\u0645\u0627\u0645 \u062e\u062f\u0645\u0627\u062a \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u062f\u0627\u062e\u0644\u06d4<\/p>\n<pre><code class=\"language-yaml\"># Good: One Ingress resource routes all external traffic\n# One ALB is created total, regardless of how many services are listed\napiVersion: networking.k8s.io\/v1\nkind: Ingress\nmetadata:\n  name: shared-ingress\n  namespace: production\n  annotations:\n    kubernetes.io\/ingress.class: alb\n    alb.ingress.kubernetes.io\/scheme: internet-facing\n    alb.ingress.kubernetes.io\/listen-ports: '[{\"HTTP\": 80}, {\"HTTPS\": 443}]'\n    alb.ingress.kubernetes.io\/ssl-redirect: \"443\"\nspec:\n  rules:\n  - host: api.company.com\n    http:\n      paths:\n      - path: \/payments\n        pathType: Prefix\n        backend:\n          service:\n            name: payment-service\n            port:\n              number: 8080\n      - path: \/users\n        pathType: Prefix\n        backend:\n          service:\n            name: user-service\n            port:\n              number: 8080\n  - host: dashboard.company.com\n    http:\n      paths:\n      - path: \/\n        pathType: Prefix\n        backend:\n          service:\n            name: dashboard-service\n            port:\n              number: 3000\n  tls:\n  - hosts:\n    - api.company.com\n    - dashboard.company.com\n    secretName: tls-wildcard-cert\n<\/code><\/pre>\n<p>\u06cc\u0642\u06cc\u0646\u06cc \u0628\u0646\u0627\u0626\u06cc\u06ba \u06a9\u06c1 \u062f\u0627\u062e\u0644\u06d2 \u06a9\u0627 \u0627\u0646\u062a\u0638\u0627\u0645 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u06cc\u06a9 ALB DNS \u0646\u0627\u0645 \u062a\u0641\u0648\u06cc\u0636 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-bash\"># Watch until the ADDRESS column shows the ALB DNS name (typically 2-3 minutes)\nkubectl get ingress shared-ingress -n production -w\n<\/code><\/pre>\n<p>\u0645\u062a\u0648\u0642\u0639 \u067e\u06cc\u062f\u0627\u0648\u0627\u0631:<\/p>\n<pre><code class=\"language-text\">NAME             CLASS   HOSTS                                    ADDRESS                                              PORTS\nshared-ingress   alb     api.company.com,dashboard.company.com   k8s-prod-sharedin-abc123.us-east-1.elb.amazonaws.com   80, 443\n<\/code><\/pre>\n<p>\u0644\u0627\u06af\u062a \u06a9\u0627 \u0641\u0631\u0642:<\/p>\n<table>\n<thead>\n<tr>\n<th>\u0646\u0642\u0637\u06c1 \u0646\u0638\u0631<\/th>\n<th>\u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0631<\/th>\n<th>\u0645\u0627\u06c1\u0627\u0646\u06c1 \u0644\u0627\u06af\u062a<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633 \u0633\u0631\u0648\u0633 \u0641\u06cc \u0645\u0627\u0626\u06cc\u06a9\u0631\u0648 \u0633\u0631\u0648\u0633 (20 \u0633\u0631\u0648\u0633\u0632)<\/td>\n<td>20 ALBs<\/td>\n<td>~$400\/\u0645\u06c1\u06cc\u0646\u06c1<\/td>\n<\/tr>\n<tr>\n<td>\u0648\u0627\u062d\u062f \u0648\u0635\u0648\u0644 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u0627 \u06a9\u0646\u0679\u0631\u0648\u0644\u0631<\/td>\n<td>1 \u0627\u0644\u0628\u06cc<\/td>\n<td>~$27\/\u0645\u06c1\u06cc\u0646\u06c1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u06cc\u0627\u062f \u0631\u06a9\u06be\u0646\u06d2 \u06a9\u0627 \u0627\u06cc\u06a9 \u0627\u0635\u0648\u0644 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0631\u0648\u0679 \u067e\u0631 \u0645\u0628\u0646\u06cc \u0631\u0648\u0679\u0646\u06af \u0648\u0627\u0644\u0627 \u0627\u06cc\u06a9 Ingress \u06a9\u0646\u0679\u0631\u0648\u0644\u0631 \u0627\u06cc\u06a9 \u06c1\u06cc \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0631 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u062a\u0645\u0627\u0645 \u062e\u062f\u0645\u0627\u062a \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0641\u06cc \u0633\u0631\u0648\u0633 LoadBlancer \u0627\u067e\u0631\u0648\u0686 \u0635\u0631\u0641 \u0627\u0628\u062a\u062f\u0627\u0626\u06cc \u067e\u0631\u0648\u0679\u0648 \u0679\u0627\u0626\u067e\u0633 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-part-4-network-policies-micro-segmentation\">\u062d\u0635\u06c1 4: \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u067e\u0627\u0644\u06cc\u0633\u06cc &#8211; \u0645\u0627\u0626\u06cc\u06a9\u0631\u0648 \u0633\u06cc\u06af\u0645\u0646\u0679\u06cc\u0634\u0646<\/h2>\n<h3 id=\"heading-41-the-default-every-pod-can-talk-to-every-other-pod\">4.1 \u0688\u06cc\u0641\u0627\u0644\u0679: \u062a\u0645\u0627\u0645 \u067e\u0648\u0688\u0632 \u062f\u06cc\u06af\u0631 \u062a\u0645\u0627\u0645 \u067e\u0648\u0688\u0632 \u0633\u06d2 \u0628\u0627\u062a \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/h3>\n<p>\u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0637\u06d2 \u0634\u062f\u06c1 \u0637\u0648\u0631 \u067e\u0631\u060c Kubernetes pods \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u06a9\u06cc \u067e\u0627\u0628\u0646\u062f\u06cc\u0627\u06ba \u0646\u0627\u0641\u0630 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0641\u0631\u0646\u0679 \u0627\u06cc\u0646\u0688 \u067e\u0648\u0688\u0632 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u067e\u0648\u0688\u0632 \u067e\u0631 API \u06a9\u0627\u0644 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u062a\u062c\u0632\u06cc\u0627\u062a\u06cc \u0633\u0631\u0648\u0633 \u0628\u0644\u0646\u06af \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0633\u06d2 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u0631 \u0633\u06a9\u062a\u06cc \u06c1\u06d2\u06d4 \u0633\u0645\u062c\u06be\u0648\u062a\u06c1 \u0634\u062f\u06c1 \u067e\u0648\u0688 \u06a9\u0644\u0633\u0679\u0631 \u0645\u06cc\u06ba \u0645\u0648\u062c\u0648\u062f \u062f\u06cc\u06af\u0631 \u062a\u0645\u0627\u0645 \u067e\u0648\u0688\u0632 \u06a9\u0648 \u0627\u0633\u06a9\u06cc\u0646 \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1 \u0645\u062d\u0641\u0648\u0638 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 SOC2 CC6.1 (Logical Access Control)\u060c HIPAA\u060c \u0627\u0648\u0631 \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u0627\u0646\u0679\u0631\u067e\u0631\u0627\u0626\u0632 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0641\u0631\u06cc\u0645 \u0648\u0631\u06a9 \u06a9\u06d2 \u0644\u06cc\u06d2\u060c \u0622\u067e \u06a9\u0648 \u06cc\u06c1 \u062b\u0627\u0628\u062a \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0642\u0627\u0628\u0644 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2 \u06a9\u06c1 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0679\u0631\u06cc\u0641\u06a9 \u0636\u0631\u0648\u0631\u06cc \u062d\u062f \u062a\u06a9 \u0645\u062d\u062f\u0648\u062f \u06c1\u06d2\u06d4<\/p>\n<p>\u0686\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba \u06a9\u06c1 \u0622\u06cc\u0627 \u0622\u067e \u06a9\u06d2 \u067e\u0627\u0633 \u0641\u06cc \u0627\u0644\u062d\u0627\u0644 \u0644\u0627\u0645\u062d\u062f\u0648\u062f \u0679\u0631\u06cc\u0641\u06a9 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-bash\"># Without Network Policies, this call from the frontend to the payment DB will succeed\n# It should not be allowed in a secure cluster\nkubectl exec -it frontend-pod -n production -- \\\n  curl http:\/\/payment-postgres.production.svc.cluster.local:5432\n<\/code><\/pre>\n<p>\u0627\u06af\u0631 \u06cc\u06c1 \u0622\u067e \u06a9\u06d2 \u06a9\u0644\u0633\u0679\u0631 \u0645\u06cc\u06ba \u06a9\u0627\u0645\u06cc\u0627\u0628 \u06c1\u0648 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u06a9\u0648\u0626\u06cc \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u067e\u0627\u0631\u0679\u06cc\u0634\u0646 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-42-the-solution-default-deny-with-cilium-network-policies\">4.2 \u062d\u0644: Cilium \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0688\u06cc\u0641\u0627\u0644\u0679 \u0627\u0646\u06a9\u0627\u0631<\/h3>\n<p>\u0635\u062d\u06cc\u062d \u0646\u0642\u0637\u06c1 \u0646\u0638\u0631 \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0637\u06d2 \u0634\u062f\u06c1 \u0627\u0646\u06a9\u0627\u0631 \u06c1\u06d2\u06d4 \u0633\u0628 \u0633\u06d2 \u067e\u06c1\u0644\u06d2\u060c \u067e\u0648\u0688\u0632 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u062a\u0645\u0627\u0645 \u0679\u0631\u06cc\u0641\u06a9 \u06a9\u0648 \u0645\u0633\u062f\u0648\u062f \u06a9\u0631\u06cc\u06ba\u060c \u0627\u0648\u0631 \u067e\u06be\u0631 \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u0635\u0631\u0641 \u0627\u0646 \u0645\u062e\u0635\u0648\u0635 \u0645\u0648\u0627\u0635\u0644\u0627\u062a\u06cc \u0631\u0627\u0633\u062a\u0648\u06ba \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u06ba \u062c\u0648 \u0622\u067e \u06a9\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u06d2 \u0644\u06cc\u06d2 \u062f\u0631\u06a9\u0627\u0631 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h4 id=\"heading-step-1-apply-the-default-deny-policy\">\u0645\u0631\u062d\u0644\u06c1 1 &#8211; \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0637\u06d2 \u0634\u062f\u06c1 \u0627\u0646\u06a9\u0627\u0631 \u06a9\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0627 \u0627\u0637\u0644\u0627\u0642 \u06a9\u0631\u06cc\u06ba\u06d4<\/h4>\n<pre><code class=\"language-yaml\"># This policy applies to all pods in the namespace (empty endpointSelector matches all)\n# It blocks all ingress and egress traffic by default\n# Warning: apply this and all pod-to-pod communication immediately stops\n# Have your allow rules ready before applying this in production\napiVersion: cilium.io\/v2\nkind: CiliumNetworkPolicy\nmetadata:\n  name: default-deny-all\n  namespace: production\nspec:\n  description: \"Block all inter-pod traffic by default \u2014 zero-trust baseline\"\n  endpointSelector: {}  # Matches all pods in this namespace\n  ingress:\n  - {}                  # Empty ingress rule = deny all inbound\n  egress:\n  - {}                  # Empty egress rule = deny all outbound\n<\/code><\/pre>\n<p>\u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0637\u06d2 \u0634\u062f\u06c1 \u0627\u0646\u06a9\u0627\u0631 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648 \u0644\u0627\u06af\u0648 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u0646\u0627\u0645 \u06a9\u06cc \u062c\u06af\u06c1 \u0645\u06cc\u06ba \u0645\u0648\u062c\u0648\u062f \u062a\u0645\u0627\u0645 \u067e\u0648\u0688\u0632 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0631\u0627\u0628\u0637\u06d2 \u0641\u0648\u0631\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0628\u0646\u062f \u06c1\u0648 \u062c\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0642\u0628\u0648\u0644\u06cc\u062a \u06a9\u06d2 \u0648\u06c1\u06cc \u0627\u0635\u0648\u0644 \u0644\u0627\u06af\u0648 \u06a9\u0631\u06cc\u06ba (\u0646\u06cc\u0686\u06d2)\u06d4 <code>kubectl apply<\/code> \u0627\u06cc\u06a9 \u06a9\u0645\u0627\u0646\u0688 \u062c\u0627\u0631\u06cc \u06a9\u0631\u06cc\u06ba \u06cc\u0627 \u067e\u06c1\u0644\u06d2 \u0627\u062c\u0627\u0632\u062a \u0646\u0627\u0645\u06d2 \u06a9\u0627 \u0627\u0637\u0644\u0627\u0642 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<h4 id=\"heading-step-2-add-namespace-level-isolation\">\u0645\u0631\u062d\u0644\u06c1 2 &#8211; \u0646\u0627\u0645 \u06a9\u06cc \u062c\u06af\u06c1 \u06a9\u06cc \u0633\u0637\u062d \u06a9\u06cc \u062a\u0646\u06c1\u0627\u0626\u06cc \u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/h4>\n<pre><code class=\"language-yaml\"># Allow pods to communicate within the same namespace\n# Block cross-namespace traffic by default\napiVersion: cilium.io\/v2\nkind: CiliumNetworkPolicy\nmetadata:\n  name: allow-same-namespace\n  namespace: production\nspec:\n  endpointSelector: {}\n  ingress:\n  - fromEndpoints:\n    - matchLabels:\n        io.kubernetes.pod.namespace: production\n  egress:\n  - toEndpoints:\n    - matchLabels:\n        io.kubernetes.pod.namespace: production\n<\/code><\/pre>\n<h4 id=\"heading-step-3-add-per-service-allow-rules\">\u0645\u0631\u062d\u0644\u06c1 3 &#8211; \u0633\u0631\u0648\u0633 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0645\u062e\u0635\u0648\u0635 \u0627\u062c\u0627\u0632\u062a \u06a9\u06d2 \u0627\u0635\u0648\u0644 \u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/h4>\n<pre><code class=\"language-yaml\"># Grant the payment service only the specific network access it needs\napiVersion: cilium.io\/v2\nkind: CiliumNetworkPolicy\nmetadata:\n  name: payment-service-network-policy\n  namespace: production\nspec:\n  endpointSelector:\n    matchLabels:\n      app: payment-service\n  egress:\n  # Allow: payment-service \u2192 postgres on port 5432\n  - toEndpoints:\n    - matchLabels:\n        app: postgres-db\n    toPorts:\n    - ports:\n      - port: \"5432\"\n        protocol: TCP\n  # Allow: payment-service \u2192 Stripe API externally\n  - toFQDNs:\n    - matchName: \"api.stripe.com\"\n    toPorts:\n    - ports:\n      - port: \"443\"\n        protocol: TCP\n<\/code><\/pre>\n<h3 id=\"heading-43-using-hubble-to-verify-policies-and-collect-soc2-evidence\">4.3 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0648\u06ba \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u0627\u0648\u0631 SOC2 \u062b\u0628\u0648\u062a \u062c\u0645\u0639 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06c1\u0628\u0644 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644<\/h3>\n<p>Cilium \u0645\u06cc\u06ba Hubble \u0634\u0627\u0645\u0644 \u06c1\u06d2\u060c \u0627\u06cc\u06a9 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0645\u0634\u0627\u06c1\u062f\u0627\u062a\u06cc \u0679\u0648\u0644 \u062c\u0648 \u0622\u067e \u06a9\u0648 \u0628\u0627\u0644\u06a9\u0644 \u0638\u0627\u06c1\u0631 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0622\u067e \u06a9\u06d2 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u06a9\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc\u0648\u06ba \u06a9\u06cc \u0628\u0646\u06cc\u0627\u062f \u067e\u0631 \u06a9\u0646 \u0628\u06c1\u0627\u0624 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u06c1\u06d2 \u0627\u0648\u0631 \u06a9\u0646 \u06a9\u0648 \u0645\u0633\u062a\u0631\u062f \u06a9\u0631 \u062f\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4 \u06c1\u0628\u0644 SOC2 \u062b\u0628\u0648\u062a \u06c1\u06d2 \u06a9\u06c1 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0633\u06cc\u06af\u0645\u0646\u0679\u06cc\u0634\u0646 \u0635\u062d\u06cc\u062d \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u06a9\u0627\u0645 \u06a9\u0631 \u0631\u06c1\u0627 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-bash\"># Install the Hubble CLI\nexport HUBBLE_VERSION=$(curl -s https:\/\/raw.githubusercontent.com\/cilium\/hubble\/master\/stable.txt)\ncurl -L --remote-name-all https:\/\/github.com\/cilium\/hubble\/releases\/download\/$HUBBLE_VERSION\/hubble-linux-amd64.tar.gz\ntar xzvf hubble-linux-amd64.tar.gz\nsudo mv hubble \/usr\/local\/bin\/\n\n# Port-forward to the Hubble relay\nkubectl port-forward -n kube-system svc\/hubble-relay 4245:80 &\n\n# Show all flows in the production namespace from the last hour\nhubble observe --namespace production --since 1h\n\n# Show only dropped flows \u2014 proves policies are blocking unauthorised traffic\nhubble observe --namespace production --verdict DROPPED --since 1h\n<\/code><\/pre>\n<p>\u06c1\u0628\u0644 \u0622\u0624\u0679 \u067e\u0679 \u06a9\u06cc \u0645\u062b\u0627\u0644 \u0628\u0644\u0627\u06a9 \u0634\u062f\u06c1 \u06a9\u0646\u06a9\u0634\u0646 \u06a9\u06cc \u06a9\u0648\u0634\u0634\u06cc\u06ba \u062f\u06a9\u06be\u0627 \u0631\u06c1\u06cc \u06c1\u06d2:<\/p>\n<pre><code class=\"language-text\">Apr 19 03:17:41.234   DROPPED   TCP   10.244.1.5:52341 \u2192 10.244.1.4:5432   policy-deny\nApr 19 03:17:41.235   ALLOWED   TCP   10.244.1.2:43211 \u2192 10.244.1.4:5432   allow-same-namespace\n<\/code><\/pre>\n<p>\u067e\u06c1\u0644\u06cc \u0644\u0627\u0626\u0646 \u063a\u06cc\u0631 \u0645\u062c\u0627\u0632 \u06a9\u0646\u06a9\u0634\u0646 \u06a9\u06cc \u06a9\u0648\u0634\u0634\u0648\u06ba \u06a9\u0648 \u062f\u06a9\u06be\u0627\u062a\u06cc \u06c1\u06d2 \u062c\u0648 \u0628\u0644\u0627\u06a9 \u06a9\u0631 \u062f\u06cc \u06af\u0626\u06cc \u06c1\u06cc\u06ba\u06d4 \u062f\u0648\u0633\u0631\u0627 \u0634\u0648 \u062c\u0627\u0626\u0632 \u06a9\u0646\u06a9\u0634\u0646 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u062a\u0627 \u06c1\u06d2. \u06cc\u06c1 \u0644\u0627\u06af\u0632 \u0631\u0648\u0632\u0627\u0646\u06c1 SOC2 \u062b\u0628\u0648\u062a \u0628\u0627\u0644\u0679\u06cc \u0645\u06cc\u06ba \u0628\u0631\u0622\u0645\u062f \u06a9\u06cc\u06d2 \u062c\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u06cc\u0627\u062f \u0631\u06a9\u06be\u0646\u06d2 \u06a9\u0627 \u0627\u06cc\u06a9 \u0627\u0635\u0648\u0644: \u0688\u06cc\u0641\u0627\u0644\u0679 \u0627\u0646\u06a9\u0627\u0631 \u0635\u0641\u0631 \u0679\u0631\u0633\u0679 \u06a9\u0627 \u0645\u0639\u06cc\u0627\u0631 \u06c1\u06d2\u06d4 \u067e\u06be\u0631 \u062a\u0645\u0627\u0645 \u0645\u0637\u0644\u0648\u0628\u06c1 \u0645\u0648\u0627\u0635\u0644\u0627\u062a\u06cc \u0631\u0627\u0633\u062a\u0648\u06ba \u06a9\u06d2 \u0644\u06cc\u06d2 \u0648\u0627\u0636\u062d \u0627\u062c\u0627\u0632\u062a \u06a9\u06d2 \u0627\u0635\u0648\u0644 \u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba\u06d4 \u06c1\u0628\u0644 \u062b\u0628\u0648\u062a \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u06cc\u06c1 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-part-5-cni-comparison-cilium-vs-calico-vs-aws-vpc-cni\">\u062d\u0635\u06c1 5: CNI \u0645\u0648\u0627\u0632\u0646\u06c1 \u2014 Cilium, Calico, AWS VPC CNI<\/h2>\n<p>\u0635\u062d\u06cc\u062d CNI \u06a9\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u0627\u06cc\u06a9 \u0627\u06cc\u0633\u0627 \u0641\u06cc\u0635\u0644\u06c1 \u06c1\u06d2 \u062c\u0633 \u06a9\u0648 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u0646\u0627 \u0645\u0634\u06a9\u0644 \u06c1\u06d2\u06d4 CNIs \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0645\u0646\u062a\u0642\u0644\u06cc \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0644\u0633\u0679\u0631 \u0645\u06cc\u06ba \u062a\u0645\u0627\u0645 \u0646\u0648\u0688\u0633 \u06a9\u0648 \u062e\u0627\u0644\u06cc \u06a9\u0631\u0646\u06d2 \u0627\u0648\u0631 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4 \u0627\u06cc\u06a9 \u0628\u0627\u0631 \u0627\u0648\u0631 \u062a\u0645\u0627\u0645 \u0635\u062d\u06cc\u062d \u0648\u062c\u0648\u06c1\u0627\u062a \u06a9\u06cc \u0628\u0646\u0627\u0621 \u067e\u0631 \u0641\u06cc\u0635\u0644\u06c1 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<p>\u06cc\u06c1\u0627\u06ba \u062e\u0635\u0648\u0635\u06cc\u0627\u062a \u06a9\u0627 \u062d\u0642\u06cc\u0642\u06cc \u062f\u0646\u06cc\u0627 \u06a9\u0627 \u0645\u0648\u0627\u0632\u0646\u06c1 \u06c1\u06d2 \u062c\u0648 \u067e\u0631\u0648\u0688\u06a9\u0634\u0646 EKS \u06a9\u0644\u0633\u0679\u0631 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06c1\u0645 \u06c1\u06cc\u06ba:<\/p>\n<table>\n<thead>\n<tr>\n<th>\u0635\u0644\u0627\u062d\u06cc\u062a<\/th>\n<th>AWS VPC CNI<\/th>\n<th>\u06a9\u06cc\u0644\u06cc\u06a9\u0648<\/th>\n<th>\u067e\u0644\u06a9\u06cc\u06ba<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>VPC CIDR \u0645\u06cc\u06ba Pod IP<\/td>\n<td> \u06c1\u0627\u06ba<\/td>\n<td> \u0646\u06c1\u06cc\u06ba (\u0627\u0648\u0648\u0631\u0644\u06d2 \u0646\u06cc\u0679 \u0648\u0631\u06a9)<\/td>\n<td> \u0646\u06c1\u06cc\u06ba (\u0627\u0648\u0648\u0631\u0644\u06d2 \u0646\u06cc\u0679 \u0648\u0631\u06a9)<\/td>\n<\/tr>\n<tr>\n<td>\u0688\u06cc\u0641\u0627\u0644\u0679 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u067e\u0627\u0644\u06cc\u0633\u06cc<\/td>\n<td> \u06c1\u0627\u06ba (Kubernetes \u0633\u0679\u06cc\u0646\u0688\u0631\u0688)<\/td>\n<td> \u06c1\u0627\u06ba<\/td>\n<td> \u06c1\u0627\u06ba<\/td>\n<\/tr>\n<tr>\n<td>\u067e\u0631\u062a 7 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba (HTTP \u0631\u0648\u0679\u0633\u060c gRPC \u0637\u0631\u06cc\u0642\u06d2)<\/td>\n<td> \u0646\u06c1\u06cc\u06ba<\/td>\n<td> \u0646\u06c1\u06cc\u06ba<\/td>\n<td> \u06c1\u0627\u06ba<\/td>\n<\/tr>\n<tr>\n<td>\u0627\u06cc \u0628\u06cc \u067e\u06cc \u0627\u06cc\u0641 \u0688\u06cc\u0679\u0627 \u067e\u0644\u06cc\u0646<\/td>\n<td> \u0646\u06c1\u06cc\u06ba<\/td>\n<td> \u0646\u06c1\u06cc\u06ba<\/td>\n<td> \u06c1\u0627\u06ba<\/td>\n<\/tr>\n<tr>\n<td>\u06c1\u0628\u0644 \u0633\u0679\u0631\u06cc\u0645 \u0622\u0628\u0632\u0631\u0648\u06cc\u0628\u0644\u0679\u06cc<\/td>\n<td> \u0646\u06c1\u06cc\u06ba<\/td>\n<td> \u0646\u06c1\u06cc\u06ba<\/td>\n<td> \u06c1\u0627\u06ba<\/td>\n<\/tr>\n<tr>\n<td>\u0633\u0631\u0648\u0633 \u0645\u06cc\u0634 (\u0633\u0627\u0626\u06cc\u0688 \u06a9\u0627\u0631 \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0627\u06cc\u0645 \u0679\u06cc \u0627\u06cc\u0644 \u0627\u06cc\u0633)<\/td>\n<td> \u0646\u06c1\u06cc\u06ba<\/td>\n<td> \u0646\u06c1\u06cc\u06ba<\/td>\n<td> \u06c1\u0627\u06ba<\/td>\n<\/tr>\n<tr>\n<td>\u0628\u0644\u0679 \u0627\u0646 SOC2 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0634\u0648\u0627\u06c1\u062f<\/td>\n<td> \u0646\u06c1\u06cc\u06ba<\/td>\n<td> \u0646\u06c1\u06cc\u06ba<\/td>\n<td> \u06c1\u0627\u06ba (\u06c1\u0628\u0644)<\/td>\n<\/tr>\n<tr>\n<td>\u06a9\u0627\u0631\u06a9\u0631\u062f\u06af\u06cc \u0627\u0648\u0648\u0631 \u06c1\u06cc\u0688<\/td>\n<td>\u06a9\u0645<\/td>\n<td>\u062f\u0631\u0645\u06cc\u0627\u0646\u06cc<\/td>\n<td>\u0628\u06c1\u062a \u06a9\u0645 (eBPF iptable \u06a9\u0648 \u0646\u0638\u0631\u0627\u0646\u062f\u0627\u0632 \u06a9\u0631\u062a\u0627 \u06c1\u06d2)<\/td>\n<\/tr>\n<tr>\n<td>AWS \u0645\u0642\u0627\u0645\u06cc \u0627\u0646\u0679\u06cc\u06af\u0631\u06cc\u0634\u0646<\/td>\n<td> \u0628\u06c1\u062a\u0631\u06cc\u0646<\/td>\n<td>\u062f\u0631\u0645\u06cc\u0627\u0646\u06cc<\/td>\n<td>\u062f\u0631\u0645\u06cc\u0627\u0646\u06cc<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u062a\u062c\u0648\u06cc\u0632 \u0645\u06cc\u0679\u0631\u06a9\u0633:<\/p>\n<table>\n<thead>\n<tr>\n<th>\u0622\u067e \u06a9\u06cc \u062d\u0627\u0644\u062a<\/th>\n<th>\u062a\u062c\u0648\u06cc\u0632 \u06a9\u0631\u062f\u06c1 CNI<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u0633\u0627\u062f\u06c1 EKS \u06a9\u0644\u0633\u0679\u0631\u060c AWS \u067e\u0631 \u0645\u0628\u0646\u06cc \u0679\u0648\u0644\u0632\u060c \u06a9\u0648\u0626\u06cc \u062c\u062f\u06cc\u062f \u067e\u0627\u0644\u06cc\u0633\u06cc \u0646\u06c1\u06cc\u06ba\u06d4<\/td>\n<td>AWS VPC CNI<\/td>\n<\/tr>\n<tr>\n<td>\u0646\u06cc\u0679 \u0648\u0631\u06a9 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u060c \u0644\u06cc\u06a9\u0646 \u06a9\u0648\u0626\u06cc \u067e\u0631\u062a 7 \u06cc\u0627 \u0645\u0634\u0627\u06c1\u062f\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/td>\n<td>\u06a9\u06cc\u0644\u06cc\u06a9\u0648<\/td>\n<\/tr>\n<tr>\n<td>\u067e\u0648\u0688 \u06a9\u06cc \u0633\u0637\u062d \u06a9\u06cc \u062a\u0646\u06c1\u0627\u0626\u06cc \u06a9\u06d2 \u062b\u0628\u0648\u062a \u06a9\u06d2 \u0633\u0627\u062a\u06be SOC2 \u06a9\u06cc \u062a\u0639\u0645\u06cc\u0644 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/td>\n<td>\u067e\u0644\u06a9\u06cc\u06ba<\/td>\n<\/tr>\n<tr>\n<td>\u0622\u067e \u06a9\u0648 \u0633\u0627\u0626\u0688 \u06a9\u0627\u0631 \u067e\u0631\u0627\u06a9\u0633\u06cc \u0627\u0648\u0648\u0631 \u06c1\u06cc\u0688 \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0633\u0631\u0648\u0633 \u0645\u06cc\u0634 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/td>\n<td>\u067e\u0644\u06a9\u06cc\u06ba<\/td>\n<\/tr>\n<tr>\n<td>\u0644\u06cc\u0626\u0631 7 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2 (GET\/health \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u06ba\u060c POST\/admin \u0633\u06d2 \u0627\u0646\u06a9\u0627\u0631 \u06a9\u0631\u06cc\u06ba)<\/td>\n<td>\u067e\u0644\u06a9\u06cc\u06ba<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u06cc\u0627\u062f \u0631\u06a9\u06be\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u0627\u0635\u0648\u0644: EKS \u0645\u06cc\u06ba SOC2 \u06a9\u06cc \u062a\u0639\u0645\u06cc\u0644 \u0627\u0648\u0631 \u0635\u0641\u0631 \u0679\u0631\u0633\u0679 \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u06a9\u06d2 \u0644\u06cc\u06d2\u060c Cilium \u0635\u062d\u06cc\u062d \u0627\u0646\u062a\u062e\u0627\u0628 \u06c1\u06d2\u06d4 \u067e\u0648\u0688 \u0644\u06cc\u0648\u0644 \u0622\u0626\u0633\u0648\u0644\u06cc\u0634\u0646\u060c \u067e\u0631\u062a 7 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba\u060c \u0627\u0648\u0631 \u0622\u0688\u0679 \u062b\u0628\u0648\u062a \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06c1\u0648\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u06c1\u0628\u0644 \u0641\u0644\u0648 \u0644\u0627\u06af\u0632 \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0627\u06cc\u06a9 \u0627\u06cc\u0633\u06cc \u062e\u0635\u0648\u0635\u06cc\u062a \u06c1\u06d2 \u062c\u0633 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u06a9\u0648\u0626\u06cc \u062f\u0648\u0633\u0631\u0627 CNI \u0646\u06c1\u06cc\u06ba \u0622\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-part-6-service-mesh-cilium-vs-istio-vs-linkerd\">\u062d\u0635\u06c1 6: \u0633\u0631\u0648\u0633 \u0645\u06cc\u0634 \u2014 Cilium \u0628\u0645\u0642\u0627\u0628\u0644\u06c1 Istio \u0628\u0645\u0642\u0627\u0628\u0644\u06c1 Linkerd<\/h2>\n<h3 id=\"heading-61-what-a-service-mesh-provides\">6.1 \u0633\u0631\u0648\u0633 \u0645\u06cc\u0634 \u06a9\u06cc\u0627 \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/h3>\n<p>\u0633\u0631\u0648\u0633 \u0645\u06cc\u0634 \u06a9\u0644\u0633\u0679\u0631 \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u0645\u06cc\u06ba \u062a\u06cc\u0646 \u062e\u0635\u0648\u0635\u06cc\u0627\u062a \u06a9\u0627 \u0627\u0636\u0627\u0641\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u062c\u0648 \u06a9\u0648\u0628\u0631\u0646\u06cc\u0679\u0633 \u0645\u0642\u0627\u0645\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0641\u0631\u0627\u06c1\u0645 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u06d2:<\/p>\n<p>\u0628\u0627\u06c1\u0645\u06cc TLS (mTLS) \u062e\u062f\u0645\u0627\u062a \u06a9\u06d2 \u06a9\u0633\u06cc \u0628\u06be\u06cc \u062c\u0648\u0691\u06d2 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0645\u0648\u0627\u0635\u0644\u0627\u062a \u06a9\u0648 \u062e\u0641\u06cc\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u062f\u0648\u0646\u0648\u06ba \u0641\u0631\u06cc\u0642\u0648\u06ba \u06a9\u06cc \u0634\u0646\u0627\u062e\u062a \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u06cc\u0645 \u0679\u06cc \u0627\u06cc\u0644 \u0627\u06cc\u0633 \u06a9\u06d2 \u0628\u063a\u06cc\u0631\u060c \u0627\u062f\u0627\u0626\u06cc\u06af\u06cc \u06a9\u06cc \u062e\u062f\u0645\u062a \u0627\u0648\u0631 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0679\u0631\u06cc\u0641\u06a9 \u06a9\u0644\u0633\u0679\u0631 \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0648\u0627\u0636\u062d \u0645\u062a\u0646 \u0645\u06cc\u06ba \u0633\u0641\u0631 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<p>\u0679\u0631\u06cc\u0641\u06a9 \u0645\u0634\u0627\u06c1\u062f\u06c1 \u062a\u0645\u0627\u0645 \u06a9\u0631\u0627\u0633 \u0633\u0631\u0648\u0633 \u06a9\u0627\u0644\u0632 \u06a9\u06d2 \u0644\u06cc\u06d2 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u06cc \u0634\u0631\u062d\u0648\u06ba\u060c \u062a\u0627\u062e\u06cc\u0631 \u06a9\u06d2 \u067e\u0631\u0633\u0646\u0679\u0627\u0626\u0644\u0632\u060c \u0627\u0648\u0631 \u062e\u0631\u0627\u0628\u06cc \u06a9\u06cc \u0634\u0631\u062d\u0648\u06ba \u06a9\u0648 \u0679\u0631\u06cc\u06a9 \u06a9\u0631\u06a9\u06d2 \u0622\u067e \u06a9\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0627 \u062d\u0642\u06cc\u0642\u06cc \u0648\u0642\u062a \u06a9\u06cc \u06a9\u0627\u0631\u06a9\u0631\u062f\u06af\u06cc \u06a9\u0627 \u0646\u0642\u0634\u06c1 \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0679\u0631\u06cc\u0641\u06a9 \u0645\u06cc\u0646\u062c\u0645\u0646\u0679 \u06a9\u0646\u0679\u0631\u0648\u0644 \u06a9\u0631\u062a\u06cc \u06c1\u06d2 \u06a9\u06c1 \u0679\u0631\u06cc\u0641\u06a9 \u06a9\u06cc\u0633\u06d2 \u0686\u0644\u062a\u06cc \u06c1\u06d2\u060c \u0628\u0634\u0645\u0648\u0644 \u0646\u0627\u06a9\u0627\u0645\u06cc\u0648\u06ba \u067e\u0631 \u062f\u0648\u0628\u0627\u0631\u06c1 \u06a9\u0648\u0634\u0634\u06cc\u06ba\u060c \u0679\u0627\u0626\u0645 \u0622\u0624\u0679\u060c \u0688\u0627\u0648\u0646 \u0627\u0633\u0679\u0631\u06cc\u0645 \u0633\u0631\u0648\u0633\u0632 \u06a9\u06d2 \u06a9\u0645 \u06c1\u0648\u0646\u06d2 \u067e\u0631 \u0633\u0631\u06a9\u0679 \u0628\u0644\u0627\u06a9 \u06a9\u0631\u0646\u0627\u060c \u0627\u0648\u0631 \u06a9\u06cc\u0646\u0631\u06cc \u062a\u0639\u06cc\u0646\u0627\u062a\u06cc\u0648\u06ba \u06a9\u06d2 \u0644\u06cc\u06d2 \u0679\u0631\u06cc\u0641\u06a9 \u06a9\u06cc \u062a\u0642\u0633\u06cc\u0645\u06d4<\/p>\n<h3 id=\"heading-62-the-sidecar-problem\">6.2 \u0633\u0627\u0626\u06cc\u0688 \u06a9\u0627\u0631 \u06a9\u0627 \u0645\u0633\u0626\u0644\u06c1<\/h3>\n<p>\u0645\u0648\u062c\u0648\u062f\u06c1 \u0633\u0631\u0648\u0633 \u0645\u06cc\u0634\u0632 \u062c\u06cc\u0633\u06d2 Istio \u0627\u0648\u0631 Linkerd \u06c1\u0631 Pod \u0645\u06cc\u06ba \u0627\u06cc\u06a9 \u0633\u0627\u0626\u0688 \u06a9\u0627\u0631 \u067e\u0631\u0627\u06a9\u0633\u06cc \u06a9\u0646\u0679\u06cc\u0646\u0631 \u0688\u0627\u0644\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u0633\u0627\u0626\u0688 \u06a9\u0627\u0631 \u062a\u0645\u0627\u0645 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0679\u0631\u06cc\u0641\u06a9 \u06a9\u0648 \u0631\u0648\u06a9\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0645\u06cc\u0634 \u067e\u0627\u0644\u06cc\u0633\u06cc\u0648\u06ba \u06a9\u0648 \u0646\u0627\u0641\u0630 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0645\u0633\u0626\u0644\u06c1 \u0648\u0633\u0627\u0626\u0644 \u0627\u0648\u0648\u0631 \u06c1\u06cc\u0688 \u06a9\u0627 \u06c1\u06d2\u06d4 Istio&#8217;s Envoy sidecar \u062a\u0642\u0631\u06cc\u0628\u0627\u064b 128MB \u0645\u06cc\u0645\u0648\u0631\u06cc \u0641\u06cc \u067e\u0648\u0688 \u0627\u0648\u0631 5-10% \u0644\u06cc\u0679\u0646\u0633\u06cc \u0627\u0648\u0648\u0631 \u06c1\u06cc\u0688 \u06a9\u0627 \u0627\u0636\u0627\u0641\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>200 \u067e\u0648\u0688\u0632 \u0648\u0627\u0644\u06d2 \u06a9\u0644\u0633\u0679\u0631 \u0645\u06cc\u06ba\u060c Istio sidecar \u06c1\u0631 \u0633\u0631\u0648\u0633 \u06a9\u0627\u0644 \u0645\u06cc\u06ba 25.6 GB \u0645\u06cc\u0645\u0648\u0631\u06cc \u0627\u0648\u0648\u0631 \u06c1\u06cc\u0688 \u0627\u0648\u0631 \u0642\u0627\u0628\u0644 \u067e\u06cc\u0645\u0627\u0626\u0634 \u062a\u0627\u062e\u06cc\u0631 \u06a9\u0627 \u0627\u0636\u0627\u0641\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>Cilium \u0627\u0633\u06d2 \u0645\u062e\u062a\u0644\u0641 \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u062d\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0633\u0627\u0626\u06cc\u0688 \u06a9\u0627\u0631 \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0627\u06cc \u0628\u06cc \u067e\u06cc \u0627\u06cc\u0641 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u06a9\u0631\u0646\u0644 \u0644\u06cc\u0648\u0644 \u067e\u0631 \u0633\u0631\u0648\u0633 \u0645\u06cc\u0634 \u0644\u06af\u0627\u0626\u06cc\u06ba\u06d4<\/p>\n<h3 id=\"heading-63-the-full-comparison\">6.3 \u0645\u062c\u0645\u0648\u0639\u06cc \u0645\u0648\u0627\u0632\u0646\u06c1<\/h3>\n<table>\n<thead>\n<tr>\n<th>\u0635\u0644\u0627\u062d\u06cc\u062a<\/th>\n<th>\u067e\u0644\u06a9\u06cc\u06ba<\/th>\n<th>\u0627\u0633 \u067e\u0631<\/th>\n<th>\u0686\u06be\u0648\u0691 \u062f\u06cc\u0627<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u0633\u0627\u0626\u06cc\u0688 \u06a9\u0627\u0631 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/td>\n<td> \u0646\u06c1\u06cc\u06ba (eBPF \u06a9\u0631\u0646\u0644)<\/td>\n<td> \u06c1\u0627\u06ba (\u0627\u06cc\u0644\u0686\u06cc\u060c ~128MB\/pod)<\/td>\n<td> \u06c1\u0627\u06ba (\u0631\u0633\u0679 \u067e\u0631\u0627\u06a9\u0633\u06cc\u060c ~10MB\/pod)<\/td>\n<\/tr>\n<tr>\n<td>\u0645\u06cc\u0645\u0648\u0631\u06cc \u0627\u0648\u0648\u0631 \u06c1\u06cc\u0688 \u0641\u06cc \u067e\u0648\u0688<\/td>\n<td>0MB<\/td>\n<td>~128MB<\/td>\n<td>~10MB<\/td>\n<\/tr>\n<tr>\n<td>\u0627\u0648\u0648\u0631 \u06c1\u06cc\u0688 \u0645\u06cc\u06ba \u062a\u0627\u062e\u06cc\u0631<\/td>\n<td><1%<\/td>\n<td>5-10%<\/td>\n<td>2~3%<\/td>\n<\/tr>\n<tr>\n<td>mTLS<\/td>\n<td> \u06c1\u0627\u06ba<\/td>\n<td> \u06c1\u0627\u06ba<\/td>\n<td> \u06c1\u0627\u06ba<\/td>\n<\/tr>\n<tr>\n<td>\u0679\u0631\u06cc\u0641\u06a9 \u0645\u06cc\u0646\u062c\u0645\u0646\u0679 (\u06a9\u06cc\u0646\u0631\u06cc\u0632\u060c \u0633\u0631\u06a9\u0679 \u0628\u0644\u0627\u06a9\u0646\u06af)<\/td>\n<td>\u0645\u062d\u062f\u0648\u062f<\/td>\n<td> \u062a\u0645\u0627\u0645<\/td>\n<td> \u062a\u0645\u0627\u0645<\/td>\n<\/tr>\n<tr>\n<td>\u0628\u0644\u0679 \u0627\u0646 \u0628\u06c1\u0627\u0624 \u0645\u0634\u0627\u06c1\u062f\u06c1 (\u06c1\u0628\u0644)<\/td>\n<td> \u06c1\u0627\u06ba<\/td>\n<td> \u06a9\u06cc\u0627\u0644\u06cc \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/td>\n<td> \u0628\u0648\u06cc\u0627\u0646\u0633\u06cc \u06a9\u0644\u0627\u0624\u0688 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/td>\n<\/tr>\n<tr>\n<td>SOC2 \u062b\u0628\u0648\u062a \u0628\u0637\u0648\u0631 \u0688\u06cc\u0641\u0627\u0644\u0679<\/td>\n<td> \u06c1\u0627\u06ba<\/td>\n<td> \u0627\u0636\u0627\u0641\u06cc \u0679\u0648\u0644\u0632<\/td>\n<td> \u0627\u0636\u0627\u0641\u06cc \u0679\u0648\u0644\u0632<\/td>\n<\/tr>\n<tr>\n<td>\u0633\u06cc\u0679 \u0627\u067e \u06a9\u06cc \u067e\u06cc\u0686\u06cc\u062f\u06af\u06cc<\/td>\n<td>\u06a9\u0645<\/td>\n<td>\u0627\u0639\u0644\u06cc<\/td>\n<td>\u062f\u0631\u0645\u06cc\u0627\u0646\u06cc<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u062a\u062c\u0648\u06cc\u0632 \u0645\u06cc\u0679\u0631\u06a9\u0633:<\/p>\n<table>\n<thead>\n<tr>\n<th>\u0622\u067e \u06a9\u06cc \u062d\u0627\u0644\u062a<\/th>\n<th>\u062a\u062c\u0648\u06cc\u0632 \u06a9\u0631\u062f\u06c1 \u0633\u0631\u0648\u0633 \u0645\u06cc\u0634<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u06a9\u0645 \u0633\u06d2 \u06a9\u0645 \u0648\u0633\u0627\u0626\u0644 \u0627\u0648\u0648\u0631 \u06c1\u06cc\u0688 \u06a9\u06d2 \u0633\u0627\u062a\u06be mTLS \u0627\u0648\u0631 SOC2 \u062b\u0628\u0648\u062a \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/td>\n<td>\u067e\u0644\u06a9\u06cc\u06ba<\/td>\n<\/tr>\n<tr>\n<td>\u0627\u0639\u0644\u06cc \u062f\u0631\u062c\u06d2 \u06a9\u06cc \u0679\u0631\u06cc\u0641\u06a9 \u0645\u06cc\u0646\u062c\u0645\u0646\u0679 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2: \u06a9\u06cc\u0646\u0631\u06cc\u0632\u060c \u0633\u0631\u06a9\u0679 \u0628\u0631\u06cc\u06a9\u0646\u06af\u060c \u0648\u0632\u0646\u06cc \u0631\u0648\u0679\u0646\u06af<\/td>\n<td>\u0627\u0633 \u067e\u0631<\/td>\n<\/tr>\n<tr>\n<td>\u0622\u067e \u06a9\u0648 Istio \u06a9\u06cc \u0622\u067e\u0631\u06cc\u0634\u0646\u0644 \u067e\u06cc\u0686\u06cc\u062f\u06af\u06cc \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u06c1\u0644\u06a9\u06d2 \u0648\u0632\u0646 \u0648\u0627\u0644\u06d2 mTLS \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/td>\n<td>\u0686\u06be\u0648\u0691 \u062f\u06cc\u0627<\/td>\n<\/tr>\n<tr>\n<td>\u0633\u06cc\u06a9\u0691\u0648\u06ba \u067e\u0648\u0688\u0632 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u06a9\u0644\u0633\u0679\u0631 \u0686\u0644\u0627\u0646\u0627 \u062c\u06c1\u0627\u06ba \u0633\u0627\u0626\u06cc\u0688 \u06a9\u0627\u0631 \u0627\u0648\u0648\u0631 \u06c1\u06cc\u0688 \u0628\u062c\u0679 \u06a9\u0627 \u0645\u0633\u0626\u0644\u06c1 \u06c1\u06d2\u06d4<\/td>\n<td>\u067e\u0644\u06a9\u06cc\u06ba<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Cilium \u06a9\u06d2 \u0633\u0631\u0648\u0633 \u0645\u06cc\u0634 \u0645\u0648\u0688 \u06a9\u0648 \u0641\u0639\u0627\u0644 \u06a9\u0631\u06cc\u06ba (\u0633\u0627\u0626\u06cc\u0688 \u06a9\u0627\u0631 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0646\u06c1\u06cc\u06ba):<\/p>\n<pre><code class=\"language-bash\"># Upgrade your Cilium installation to enable service mesh features\nhelm upgrade cilium cilium\/cilium \\\n  --namespace kube-system \\\n  --reuse-values \\\n  --set envoy.enabled=true \\\n  --set ingressController.enabled=true\n\n# Verify the service mesh is active\ncilium status | grep \"Service Mesh\"\n<\/code><\/pre>\n<p>\u06cc\u0627\u062f \u0631\u06a9\u06be\u0646\u06d2 \u06a9\u0627 \u0627\u06cc\u06a9 \u0627\u0635\u0648\u0644: Cilium \u0628\u063a\u06cc\u0631 \u0633\u0627\u0626\u0688 \u06a9\u0627\u0631 \u0627\u0648\u0648\u0631 \u06c1\u06cc\u0688 \u06a9\u06d2 mTLS \u0627\u0648\u0631 SOC2 \u062b\u0628\u0648\u062a \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u0646 \u0679\u06cc\u0645\u0648\u06ba \u06a9\u06d2 \u0644\u06cc\u06d2 \u062c\u0646\u06c1\u06cc\u06ba \u0679\u0631\u06cc\u0641\u06a9 \u0645\u06cc\u0646\u062c\u0645\u0646\u0679 \u06cc\u0627 \u067e\u06cc\u0686\u06cc\u062f\u06c1 \u06a9\u06cc\u0646\u0631\u06cc \u0631\u06cc\u0644\u06cc\u0632 \u067e\u06cc\u0679\u0631\u0646 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u060c Istio \u0622\u067e\u0631\u06cc\u0634\u0646\u0644 \u067e\u06cc\u0686\u06cc\u062f\u06af\u06cc \u0645\u06cc\u06ba \u0627\u0636\u0627\u0641\u06d2 \u06a9\u06cc \u0642\u06cc\u0645\u062a \u067e\u0631 \u0645\u0632\u06cc\u062f \u06a9\u0646\u0679\u0631\u0648\u0644 \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-best-practices-for-kubernetes-networking\">Kubernetes \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u06a9\u06d2 \u0628\u06c1\u062a\u0631\u06cc\u0646 \u0637\u0631\u06cc\u0642\u06d2<\/h2>\n<p> <strong>\u06a9\u0631\u0646\u0627:<\/strong> Pod IPs \u06a9\u06d2 \u0639\u0644\u0627\u0648\u06c1 \u062f\u06cc\u06af\u0631 \u062e\u062f\u0645\u0627\u062a \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4 \u067e\u0648\u0688 IP \u06c1\u0631 \u062f\u0648\u0628\u0627\u0631\u06c1 \u0634\u0631\u0648\u0639 \u06c1\u0648\u0646\u06d2 \u067e\u0631 \u062a\u0628\u062f\u06cc\u0644 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u0633\u0631\u0648\u0633 DNS \u06a9\u0627 \u0646\u0627\u0645 \u06a9\u0628\u06be\u06cc \u062a\u0628\u062f\u06cc\u0644 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p> <strong>\u06a9\u0631\u0646\u0627:<\/strong> \u0631\u0648\u0679 \u067e\u0631 \u0645\u0628\u0646\u06cc \u0631\u0648\u0679\u0646\u06af \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0627\u06cc\u06a9 \u0648\u0627\u062d\u062f \u0627\u0646\u06af\u0631\u06cc\u0633 \u06a9\u0646\u0679\u0631\u0648\u0644\u0631 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4 \u0627\u06cc\u06a9 ALB \u062a\u0645\u0627\u0645 \u062e\u062f\u0645\u0627\u062a \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633 \u0641\u06cc \u0633\u0631\u0648\u0633 \u06a9\u06d2 \u0645\u0642\u0627\u0628\u0644\u06d2 \u0645\u06cc\u06ba \u06c1\u0631 \u0645\u0627\u06c1 $300 \u0633\u06d2 $400 \u06a9\u06cc \u0628\u0686\u062a \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p> <strong>\u06a9\u0631\u0646\u0627:<\/strong> Cilium \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0688\u06cc\u0641\u0627\u0644\u0679 \u0627\u0646\u06a9\u0627\u0631 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u0648 \u0646\u0627\u0641\u0630 \u06a9\u0631\u06cc\u06ba\u06d4 \u06cc\u06c1 \u0627\u06cc\u06a9 \u062a\u06a9\u0646\u06cc\u06a9\u06cc \u06a9\u0646\u0679\u0631\u0648\u0644 \u06c1\u06d2 \u062c\u0648 SOC2 CC6.1 \u06a9\u0648 \u062f\u0631\u06a9\u0627\u0631 \u06c1\u06d2\u06d4<\/p>\n<p> <strong>\u06a9\u0631\u0646\u0627:<\/strong> \u06c1\u0628\u0644 \u0641\u0644\u0648 \u0644\u0627\u06af\u0632 \u06a9\u0648 SOC2 \u062b\u0628\u0648\u062a \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4 \u0688\u06cc\u0644\u06cc\u0679 \u0634\u062f\u06c1 \u0641\u0644\u0648 \u0644\u0627\u06af\u0632 \u06a9\u0648 \u06c1\u0631 \u0631\u0648\u0632 \u062b\u0628\u0648\u062a \u06a9\u06cc \u0628\u0627\u0644\u0679\u06cc \u0645\u06cc\u06ba \u0627\u06cc\u06a9\u0633\u067e\u0648\u0631\u0679 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<p> <strong>\u06a9\u0631\u0646\u0627:<\/strong> \u0627\u0646\u06a9\u0631\u067e\u0679\u0688 \u0627\u0646\u0679\u0631 \u0633\u0631\u0648\u0633 \u06a9\u0645\u06cc\u0648\u0646\u06cc\u06a9\u06cc\u0634\u0646 \u06a9\u06d2 \u0644\u06cc\u06d2 Cilium \u06a9\u06d2 \u0633\u0627\u062a\u06be mTLS \u06a9\u0648 \u0641\u0639\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4 \u0633\u0627\u0626\u0688 \u06a9\u0627\u0631 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<p> <strong>\u06a9\u0631\u0646\u0627:<\/strong> \u0679\u0631\u06cc\u0641\u06a9 \u06a9\u0648 \u0627\u06cc\u06a9 \u06c1\u06cc Availability Zone \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0631\u06a9\u06be\u0646\u06d2 \u0627\u0648\u0631 AZs \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0688\u06cc\u0679\u0627 \u06a9\u06cc \u0645\u0646\u062a\u0642\u0644\u06cc \u06a9\u06d2 \u0627\u062e\u0631\u0627\u062c\u0627\u062a \u06a9\u0648 \u06a9\u0645 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0679\u0627\u067e\u0648\u0644\u0648\u062c\u06cc \u0633\u06d2 \u0622\u06af\u0627\u06c1 \u0631\u0648\u0679\u0646\u06af \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<p> <strong>\u0645\u062a \u06a9\u0631\u0648:<\/strong> \u06c1\u0631 \u0645\u0627\u0626\u06cc\u06a9\u0631\u0648 \u0633\u0631\u0648\u0633 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0644\u0648\u0688 \u0628\u06cc\u0644\u0646\u0633\u0631 \u0633\u0631\u0648\u0633 \u0628\u0646\u0627\u0626\u06cc\u06ba\u06d4 \u0628\u06cc\u0631\u0648\u0646\u06cc \u0631\u0648\u0679\u0646\u06af \u06a9\u06d2 \u0644\u06cc\u06d2\u060c \u06c1\u0645 Ingress \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p> <strong>\u0645\u062a \u06a9\u0631\u0648:<\/strong> \u067e\u0648\u0688 \u0644\u06cc\u0648\u0644 \u0622\u0626\u0633\u0648\u0644\u06cc\u0634\u0646 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0635\u0631\u0641 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u06af\u0631\u0648\u067e\u0633 \u067e\u0631 \u0628\u06be\u0631\u0648\u0633\u06c1 \u06a9\u0631\u06cc\u06ba\u06d4 \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u06af\u0631\u0648\u067e \u0646\u0648\u0688 \u0644\u06cc\u0648\u0644 \u067e\u0631 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0646\u0648\u0688 \u067e\u0631 \u0645\u0648\u062c\u0648\u062f \u062a\u0645\u0627\u0645 \u067e\u0648\u0688\u0632 \u0646\u0648\u0688 \u06a9\u06d2 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u06af\u0631\u0648\u067e \u06a9\u0648 \u0634\u06cc\u0626\u0631 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u06a9\u06cc \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u067e\u0648\u0688 \u06a9\u06cc \u0633\u0637\u062d \u067e\u0631 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u06cc \u06c1\u06cc\u06ba\u06d4<\/p>\n<p> <strong>\u0645\u062a \u06a9\u0631\u0648:<\/strong> \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0637\u06d2 \u0634\u062f\u06c1 &quot;Allow All&#8221; \u067e\u0648\u0688 \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u06a9\u0648 \u0645\u062d\u0641\u0648\u0638 \u0633\u0645\u062c\u06be\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0637\u06d2 \u0634\u062f\u06c1 \u0627\u0646\u06a9\u0627\u0631 \u06a9\u0627 \u0627\u0637\u0644\u0627\u0642 \u06a9\u0631\u06cc\u06ba \u0627\u0633 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u06a9\u06c1 \u0622\u067e \u06a9\u0627 \u067e\u06c1\u0644\u0627 \u0627\u0646\u0679\u0631\u067e\u0631\u0627\u0626\u0632 \u06a9\u0633\u0679\u0645\u0631 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u0633\u06cc\u06af\u0645\u0646\u0679\u06cc\u0634\u0646 \u0688\u0627\u06cc\u0627\u06af\u0631\u0627\u0645 \u06a9\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0631\u06d2\u06d4<\/p>\n<h2 id=\"heading-resources\">\u0648\u0633\u0627\u0626\u0644<\/h2>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u06cc\u06c1 \u0648\u06c1 \u06c1\u06d2 \u062c\u0648 \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 Kubernetes \u0679\u06cc\u0648\u0679\u0648\u0631\u06cc\u0644\u0632 \u0622\u067e \u06a9\u0648 \u0646\u06c1\u06cc\u06ba \u0628\u062a\u0627\u062a\u06d2 \u06c1\u06cc\u06ba: \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631 \u0627\u0633 \u0642\u0627\u0628\u0644 \u06c1\u0648\u06ba \u06af\u06d2: kubectl expose. 10% \u0633\u06d2 \u06a9\u0645 \u0644\u0648\u06af \u0633\u0645\u062c\u06be\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u06c1 \u062c\u0628 \u0648\u06c1 \u0627\u06cc\u0633\u0627 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u062a\u0648 \u06a9\u06cc\u0627 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u0645\u06cc\u06ba \u0646\u06d2 10 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u06a9\u0645\u067e\u0646\u06cc\u0648\u06ba \u0645\u06cc\u06ba Kubernetes \u0646\u06cc\u0679 \u0648\u0631\u06a9\u0646\u06af \u06a9\u06d2 \u0645\u0633\u0627\u0626\u0644 \u06a9\u0648 \u0688\u06cc\u0628\u06af \u06a9\u06cc\u0627 \u06c1\u06d2\u06d4 \u0639\u0644\u0645 [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-28137","post","type-post","status-publish","format-standard","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts\/28137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/comments?post=28137"}],"version-history":[{"count":0,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts\/28137\/revisions"}],"wp:attachment":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/media?parent=28137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/categories?post=28137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/tags?post=28137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}