{"id":35955,"date":"2019-10-31T22:08:26","date_gmt":"2019-10-31T19:08:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/razvertyvanie-prilozhenij-na-neskolkih-klasterah-kubernetes-s-helm\/"},"modified":"2019-10-31T22:08:26","modified_gmt":"2019-10-31T19:08:26","slug":"razvertyvanie-prilozhenij-na-neskolkih-klasterah-kubernetes-s-helm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/razvertyvanie-prilozhenij-na-neskolkih-klasterah-kubernetes-s-helm","title":{"rendered":"Nasazen\u00ed aplikac\u00ed na n\u011bkolika klastrech Kubernetes s Helm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<\/p>\n<p><\/p>\n<h2 id=\"kak-dailymotion-ispolzuet-kubernetes-razvertyvanie-prilozheniy\">Jak Dailymotion vyu\u017e\u00edv\u00e1 Kubernetes: nasazen\u00ed aplikac\u00ed<\/h2>\n<p><\/p>\n<p>V Dailymotion jsme za\u010dali pou\u017e\u00edvat Kubernetes v produkci p\u0159ed 3 lety. Ale nasazen\u00ed aplikac\u00ed na n\u011bkolika clusterech je obt\u00ed\u017en\u00e9, tak\u017ee b\u011bhem posledn\u00edch n\u011bkolika let jsme se sna\u017eili zlep\u0161it na\u0161e n\u00e1stroje a pracovn\u00ed postupy.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3 id=\"s-chego-nachalos\">Jak to za\u010dalo<\/h3>\n<p><\/p>\n<p>Zde pop\u00ed\u0161eme, jak nasazujeme na\u0161e aplikace na n\u011bkolika clusterech Kubernetes po cel\u00e9m sv\u011bt\u011b.<\/p>\n<p><\/p>\n<p>Pro hromadn\u00e9 nasazen\u00ed n\u011bkolika objekt\u016f Kubernetes pou\u017e\u00edv\u00e1me <noindex><a rel=\"nofollow\" href=\"https:\/\/helm.sh\/\">Helm<\/a><\/noindex>, a v\u0161echny na\u0161e chartov\u00e9 soubory uchov\u00e1v\u00e1me v jednom repozit\u00e1\u0159i git. Pro nasazen\u00ed kompletn\u00edho stacku aplikace slo\u017een\u00e9ho z n\u011bkolika servis\u016f pou\u017e\u00edv\u00e1me takzvan\u00fd agregovan\u00fd chart. V podstat\u011b se jedn\u00e1 o chart, kter\u00fd deklaruje z\u00e1vislosti a umo\u017e\u0148uje inicializaci API a jeho servis\u016f jedn\u00edm p\u0159\u00edkazem.<\/p>\n<p><\/p>\n<p>Tak\u00e9 jsme napsali mal\u00fd Python skript nad Helm, abychom prov\u00e1d\u011bli kontroly, vytv\u00e1\u0159eli chartov\u00e9 soubory, p\u0159id\u00e1vali tajemstv\u00ed a nasazovali aplikace. V\u0161echny tyto \u00fakoly se prov\u00e1d\u011bj\u00ed na centr\u00e1ln\u00ed CI platform\u011b za pou\u017eit\u00ed docker obrazu.<\/p>\n<p><\/p>\n<p>P\u0159ejd\u011bme k j\u00e1dru.<\/p>\n<p><\/p>\n<blockquote><p>Pozn\u00e1mka: Kdy\u017e toto \u010dtete, prvn\u00ed release candidate Helm 3 ji\u017e byl ozn\u00e1men. Hlavn\u00ed verze obsahuje celou \u0159adu vylep\u0161en\u00ed ur\u010den\u00fdch k \u0159e\u0161en\u00ed n\u011bkter\u00fdch probl\u00e9m\u016f, se kter\u00fdmi jsme se v minulosti pot\u00fdkali.<\/p><\/blockquote>\n<p><\/p>\n<h3 id=\"rabochiy-process-razrabotki-chartov\">Pracovn\u00ed postup v\u00fdvoje chart\u016f<\/h3>\n<p><\/p>\n<p>Pro aplikace pou\u017e\u00edv\u00e1me v\u011btven\u00ed a stejn\u00fd p\u0159\u00edstup jsme se rozhodli aplikovat na chartov\u00e9 soubory.<\/p>\n<p><\/p>\n<ul>\n<li>V\u011btev <strong>dev<\/strong> se pou\u017e\u00edv\u00e1 pro vytv\u00e1\u0159en\u00ed chart\u016f, kter\u00e9 budou testov\u00e1ny na v\u00fdvojov\u00fdch clusterech.<\/li>\n<li>Kdy\u017e je pull request odesl\u00e1n do <strong>master<\/strong>, je testov\u00e1n na stagingu.<\/li>\n<li>Nakonec vytvo\u0159\u00edme pull request, abychom p\u0159edali zm\u011bny do v\u011btve <strong>prod<\/strong> a aplikovali je v produkci.<\/li>\n<\/ul>\n<p><\/p>\n<p>Ka\u017ed\u00e9 prost\u0159ed\u00ed m\u00e1 sv\u016fj vlastn\u00ed soukrom\u00fd repozit\u00e1\u0159, kter\u00fd uchov\u00e1v\u00e1 na\u0161e chartov\u00e9 soubory, a pou\u017e\u00edv\u00e1me <noindex><a rel=\"nofollow\" href=\"https:\/\/chartmuseum.com\/\">Chartmuseum<\/a><\/noindex> s velmi u\u017eite\u010dn\u00fdm API. T\u00edmto zp\u016fsobem zaji\u0161\u0165ujeme p\u0159\u00edsnou izolaci mezi prost\u0159ed\u00edmi a kontrolu chart\u016f v re\u00e1ln\u00fdch podm\u00ednk\u00e1ch, ne\u017e je pou\u017eijeme v produkci.<\/p>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/rz\/vt\/uk\/rzvtuk6q7b_rkeaxnyujzhmfjog.png\"><\/a><\/noindex><\/p>\n<p><\/p>\n<p><em>Repozit\u00e1\u0159e chart\u016f v r\u016fzn\u00fdch prost\u0159ed\u00edch<\/em><\/p>\n<p><\/p>\n<p>Je t\u0159eba poznamenat, \u017ee kdy\u017e v\u00fdvoj\u00e1\u0159i odes\u00edlaj\u00ed v\u011btev dev, verze jejich chartu je automaticky odesl\u00e1na do dev Chartmuseum. Takto v\u0161ichni v\u00fdvoj\u00e1\u0159i pou\u017e\u00edvaj\u00ed jeden dev repozit\u00e1\u0159 a mus\u00ed si pe\u010dliv\u011b uv\u011bdomovat verzi sv\u00e9ho chartu, aby n\u00e1hodou nepou\u017eili zm\u011bny n\u011bkoho jin\u00e9ho.<\/p>\n<p><\/p>\n<p>Nav\u00edc, n\u00e1\u0161 mal\u00fd skript v Pythonu kontroluje objekty Kubernetes podle specifikac\u00ed Kubernetes OpenAPI pomoc\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/kubeval.instrumenta.dev\/\">, instalovan\u00fd lok\u00e1ln\u011b nebo p\u0159ipojen\u00fd v CICD pipeline. Kubeval vezme YAML definici nastaven\u00ed Kubernetes a vr\u00e1t\u00ed zp\u011bt informace o spr\u00e1vnosti. Tak\u00e9 um\u00ed vyprodukovat data v JSON nebo TAP a analyzovat zdrojov\u00e9 \u0161ablony, na kter\u00e9 se odkazuje nastaven\u00ed chartu Helm, ani\u017e by prov\u00e1d\u011bl dal\u0161\u00ed dotazy.<\/a><\/noindex>, ne\u017e je zve\u0159ejn\u00ed v Chartmusem.<\/p>\n<p><\/p>\n<h3 id=\"obschee-opisanie-rabochego-processa-razrabotki-charta\">Obecn\u00fd popis pracovn\u00edho postupu pro v\u00fdvoj grafu<\/h3>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/yd\/cw\/qw\/ydcwqw-vqfitu5bj8ky4nh7xxea.png\"><\/a><\/noindex><\/p>\n<p><\/p>\n<ol>\n<li>Nastaven\u00ed \u00faloh pipeline podle specifikace <noindex><a rel=\"nofollow\" href=\"https:\/\/gazr.io\/\">gazr.io<\/a><\/noindex> pro kontrolu kvality (lint, unit-test).<\/li>\n<li>Odesl\u00e1n\u00ed docker obrazu s n\u00e1stroji Python, kter\u00e9 nasazuj\u00ed na\u0161e aplikace.<\/li>\n<li>Nastaven\u00ed prost\u0159ed\u00ed podle n\u00e1zvu v\u011btve.<\/li>\n<li>Kontrola yaml soubor\u016f Kubernetes pomoc\u00ed Kubeval.<\/li>\n<li>Automatick\u00e9 zv\u00fd\u0161en\u00ed verze grafu a jeho parent graf\u016f (graf\u016f, kter\u00e9 z\u00e1vis\u00ed na m\u011bn\u011bn\u00e9m grafu).<\/li>\n<li>Odesl\u00e1n\u00ed grafu do Chartmuseum, kter\u00e9 odpov\u00edd\u00e1 jeho prost\u0159ed\u00ed<\/li>\n<\/ol>\n<p><\/p>\n<h2 id=\"upravlenie-razlichiyami-v-klasterah\">Spr\u00e1va rozd\u00edl\u016f v clusterech<\/h2>\n<p><\/p>\n<h3 id=\"federaciya-klasterov\">Federace cluster\u016f<\/h3>\n<p><\/p>\n<p>Byla doba, kdy jsme pou\u017e\u00edvali <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/cluster-administration\/federation\/\">federaci cluster\u016f Kubernetes<\/a><\/noindex>, kde bylo mo\u017en\u00e9 deklarovat objekty Kubernetes z jednoho API endpointu. Ale objevily se probl\u00e9my. Nap\u0159\u00edklad n\u011bkter\u00e9 objekty Kubernetes nebylo mo\u017en\u00e9 vytvo\u0159it na federovan\u00e9m endpointu, tak\u017ee bylo obt\u00ed\u017en\u00e9 udr\u017eovat slou\u010den\u00e9 objekty a dal\u0161\u00ed objekty pro jednotliv\u00e9 clustery.<\/p>\n<p><\/p>\n<p>Abychom tento probl\u00e9m vy\u0159e\u0161ili, za\u010dali jsme spravovat clustry nez\u00e1visle, co\u017e v\u00fdrazn\u011b zjednodu\u0161ilo proces (pou\u017e\u00edvali jsme prvn\u00ed verzi federace; ve druh\u00e9 se mohlo n\u011bco zm\u011bnit).<\/p>\n<p><\/p>\n<h3 id=\"georaspredelennaya-platforma\">Geograficky distribuovan\u00e1 platforma<\/h3>\n<p><\/p>\n<p>Na\u0161e platforma je nyn\u00ed distribuov\u00e1na do 6 region\u016f \u2013 3 lok\u00e1ln\u011b a 3 v cloudu.<\/p>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/jq\/c1\/mr\/jqc1mru36g5byams4wddzducauw.png\"><\/a><\/noindex><br \/>\n<em>Distribuovan\u00e9 nasazen\u00ed<\/em><\/p>\n<p><\/p>\n<h3 id=\"globalnye-znacheniya-helm\">Glob\u00e1ln\u00ed hodnoty Helm<\/h3>\n<p><\/p>\n<p>4 glob\u00e1ln\u00ed hodnoty Helm umo\u017e\u0148uj\u00ed ur\u010dit rozd\u00edly mezi clustery. Pro v\u0161echny na\u0161e grafy existuj\u00ed minim\u00e1ln\u00ed v\u00fdchoz\u00ed hodnoty.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">global:\n  cloud: True\n  env: staging\n  region: us-central1\n  clusterName: staging-us-central1<\/code><\/pre>\n<p><\/p>\n<p><em>Glob\u00e1ln\u00ed hodnoty<\/em><\/p>\n<p><\/p>\n<p>Tyto hodnoty pom\u00e1haj\u00ed ur\u010dit kontext pro na\u0161e aplikace a pou\u017e\u00edvaj\u00ed se pro r\u016fzn\u00e9 \u00fakoly: monitorov\u00e1n\u00ed, trasov\u00e1n\u00ed, logov\u00e1n\u00ed, prov\u00e1d\u011bn\u00ed extern\u00edch vol\u00e1n\u00ed, \u0161k\u00e1lov\u00e1n\u00ed atd.<\/p>\n<p><\/p>\n<ul>\n<li>\"cloud\": m\u00e1me hybridn\u00ed platformu Kubernetes. Nap\u0159\u00edklad n\u00e1\u0161 API se nasazuje v oblastech GCP a v na\u0161ich datov\u00fdch centrech.<\/li>\n<li>\"env\": n\u011bkter\u00e9 hodnoty se mohou m\u011bnit pro nepracovn\u00ed prost\u0159ed\u00ed. Nap\u0159\u00edklad definice zdroj\u016f a konfigurace automatick\u00e9ho \u0161k\u00e1lov\u00e1n\u00ed.<\/li>\n<li>\"region\": tyto informace pom\u00e1haj\u00ed ur\u010dit um\u00edst\u011bn\u00ed clusteru a mohou b\u00fdt pou\u017eity k ur\u010den\u00ed nejbli\u017e\u0161\u00edch endpoint\u016f pro extern\u00ed slu\u017eby.<\/li>\n<li>\"clusterName\": pokud a kdy chceme ur\u010dit hodnotu pro jednotliv\u00fd cluster.<\/li>\n<\/ul>\n<p><\/p>\n<p>Toto je konkr\u00e9tn\u00ed p\u0159\u00edklad:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">{{\n\/* Vrac\u00ed horizont\u00e1ln\u00ed autoscaler repliku pro GraphQL *\/}}\n{{- define \"graphql.hpaReplicas\" -}}\n{{- if eq .Values.global.env \"prod\" }}\n{{- if eq .Values.global.region \"europe-west1\" }}\nminReplicas: 40\n{{- else }}\nminReplicas: 150\n{{- end }}\nmaxReplicas: 1400\n{{- else }}\nminReplicas: 4\nmaxReplicas: 20\n{{- end }}\n{{- end -}}<\/code><\/pre>\n<p><\/p>\n<p><em>P\u0159\u00edklad \u0161ablony Helm<\/em><\/p>\n<p><\/p>\n<p>Tato logika je definov\u00e1na v pomocn\u00e9 \u0161ablon\u011b, aby nedoch\u00e1zelo k zne\u010di\u0161t\u011bn\u00ed Kubernetes YAML.<\/p>\n<p><\/p>\n<h3 id=\"obyavlenie-prilozheniya\">Ozn\u00e1men\u00ed aplikace<\/h3>\n<p><\/p>\n<p>Na\u0161e nasazovac\u00ed n\u00e1stroje jsou zalo\u017eeny na n\u011bkolika souborech YAML. N\u00ed\u017ee je p\u0159\u00edklad toho, jak oznamujeme slu\u017ebu a jej\u00ed topologii \u0161k\u00e1lov\u00e1n\u00ed (po\u010det replik) v klastru.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">releases:\n  - foo.world\n\nfoo.world:                # N\u00e1zev vyd\u00e1n\u00ed\n  services:               # Seznam aplikac\u00ed\/projekt\u016f dailymotion\n    foobar:\n      chart_name: foo-foobar\n      repo: git@github.com:dailymotion\/foobar\n      contexts:\n        prod-europe-west1:\n          deployments:\n            - name: foo-bar-baz\n              replicas: 18\n            - name: another-deployment\n              replicas: 3<\/code><\/pre>\n<p><\/p>\n<p><em>Definice slu\u017eby<\/em><\/p>\n<p><\/p>\n<p>Toto je sch\u00e9ma v\u0161ech krok\u016f, kter\u00e9 definuj\u00ed n\u00e1\u0161 pracovn\u00ed postup nasazen\u00ed. Posledn\u00ed krok nasazuje aplikaci sou\u010dasn\u011b na n\u011bkolika pracovn\u00edch klastrech.<\/p>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/iu\/qh\/xk\/iuqhxki4nfqoi0mus258j0feylu.png\"><\/a><\/noindex><br \/>\n<em>Kroky nasazen\u00ed v Jenkins<\/em><\/p>\n<p><\/p>\n<h3 id=\"a-sekrety\">A co tajemstv\u00ed?<\/h3>\n<p><\/p>\n<p>Pokud jde o bezpe\u010dnost, sledujeme v\u0161echna tajemstv\u00ed z r\u016fzn\u00fdch zdroj\u016f a ukl\u00e1d\u00e1me je v unik\u00e1tn\u00edm \u00falo\u017ei\u0161ti <noindex><a rel=\"nofollow\" href=\"https:\/\/www.vaultproject.io\/\">Vault<\/a><\/noindex> v Pa\u0159\u00ed\u017ei.<\/p>\n<p><\/p>\n<p>Na\u0161e nasazovac\u00ed n\u00e1stroje na\u010d\u00edtaj\u00ed hodnoty tajemstv\u00ed z Vault a, kdy\u017e nastane \u010das nasazen\u00ed, vkl\u00e1daj\u00ed je do Helm.<\/p>\n<p><\/p>\n<p>K tomu jsme definovali mapov\u00e1n\u00ed mezi tajemstv\u00edmi ve Vault a tajemstv\u00edmi, kter\u00e9 na\u0161e aplikace pot\u0159ebuj\u00ed:<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">secrets:                                                                                                                                                                                                        \n     - secret_id: \"stack1-app1-password\"                                                                                                                                                                                  \n       contexts:                                                                                                                                                                                                   \n         - name: \"default\"                                                                                                                                                                                         \n           vaultPath: \"\\\/kv\\\/dev\\\/stack1\\\/app1\\\/test\"                                                                                                                                                               \n           vaultKey: \"password\"                                                                                                                                                                                    \n         - name: \"cluster1\"                                                                                                                                                                           \n           vaultPath: \"\\\/kv\\\/dev\\\/stack1\\\/app1\\\/test\"                                                                                                                                                               \n           vaultKey: \"password\"<\/code><\/pre>\n<p><\/p>\n<ul>\n<li>Stanovili jsme obecn\u00e1 pravidla, kter\u00fdmi se mus\u00edme \u0159\u00eddit p\u0159i zapisov\u00e1n\u00ed tajemstv\u00ed do Vaultu.<\/li>\n<li>Pokud se tajemstv\u00ed vztahuje <strong>k ur\u010dit\u00e9mu kontextu nebo clusteru<\/strong>, je nutn\u00e9 p\u0159idat konkr\u00e9tn\u00ed z\u00e1znam. (Zde m\u00e1 kontext cluster1 vlastn\u00ed hodnotu pro tajemstv\u00ed stack-app1-password).<\/li>\n<li>V opa\u010dn\u00e9m p\u0159\u00edpad\u011b se pou\u017e\u00edv\u00e1 hodnota <strong>ve v\u00fdchoz\u00edm nastaven\u00ed<\/strong>.<\/li>\n<li>Pro ka\u017ed\u00fd bod v tomto seznamu je <strong>tajemstv\u00ed Kubernetes<\/strong> vlo\u017een p\u00e1r kl\u00ed\u010d-hodnota. Proto je \u0161ablona tajemstv\u00ed v na\u0161ich chartech velmi jednoduch\u00e1.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">apiVersion: v1\ndata:\n{{- range $key,$value := .Values.secrets }}\n  {{ $key }}: {{ $value | b64enc | quote }}\n{{ end }}\nkind: Secret\nmetadata:\n  name: \"{{ .Chart.Name }}\"\n  labels:\n    chartVersion: \"{{ .Chart.Version }}\"\n    tillerVersion: \"{{ .Capabilities.TillerVersion.SemVer }}\"\ntype: Opaque<\/code><\/pre>\n<p><\/p>\n<h2 id=\"problemy-i-ogranicheniya\">Probl\u00e9my a omezen\u00ed<\/h2>\n<p><\/p>\n<h3 id=\"rabota-s-neskolkimi-repozitoriyami\">Pr\u00e1ce s v\u00edce repozit\u00e1\u0159i<\/h3>\n<p><\/p>\n<p>Moment\u00e1ln\u011b odd\u011blujeme v\u00fdvoj chart\u016f a aplikac\u00ed. To znamen\u00e1, \u017ee v\u00fdvoj\u00e1\u0159i mus\u00ed pracovat ve dvou git repozit\u00e1\u0159\u00edch: jednom pro aplikaci a druh\u00e9m pro definici jej\u00edho nasazen\u00ed v Kubernetes. Dva git repozit\u00e1\u0159e znamenaj\u00ed dva pracovn\u00ed postupy a nov\u00e1\u010dek se m\u016f\u017ee snadno zm\u00e1st.<\/p>\n<p><\/p>\n<h3 id=\"upravlyat-obobschennymi-chartami-hlopotno\">Spr\u00e1va generick\u00fdch chart\u016f je pracn\u00e1<\/h3>\n<p><\/p>\n<p>Jak jsme ji\u017e zm\u00ednili, generick\u00e9 chartov\u00e9 soubory jsou velmi pohodln\u00e9 pro definov\u00e1n\u00ed z\u00e1vislost\u00ed a rychl\u00e9 nasazen\u00ed n\u011bkolika aplikac\u00ed. Ale pou\u017e\u00edv\u00e1me <code>--reuse-values<\/code>, abychom se vyhnuli p\u0159ed\u00e1v\u00e1n\u00ed v\u0161ech hodnot poka\u017ed\u00e9, kdy\u017e nasazujeme aplikaci pat\u0159\u00edc\u00ed do tohoto generick\u00e9ho chartu.<\/p>\n<p><\/p>\n<p>V pracovn\u00edm procesu kontinu\u00e1ln\u00ed dod\u00e1vky m\u00e1me pouze dv\u011b hodnoty, kter\u00e9 se pravideln\u011b m\u011bn\u00ed: po\u010det replik a tag obrazu (verze). Ostatn\u00ed, stabiln\u011bj\u0161\u00ed hodnoty, se m\u011bn\u00ed ru\u010dn\u011b, co\u017e je pom\u011brn\u011b slo\u017eit\u00e9. Nav\u00edc jedna chyba p\u0159i nasazen\u00ed generick\u00e9ho chartu m\u016f\u017ee v\u00e9st k v\u00e1\u017en\u00fdm probl\u00e9m\u016fm, jak jsme zjistili na vlastn\u00ed k\u016f\u017ei.<\/p>\n<p><\/p>\n<h3 id=\"obnovlenie-neskolkih-faylov-konfiguracii\">Aktualizace n\u011bkolika konfigura\u010dn\u00edch soubor\u016f<\/h3>\n<p><\/p>\n<p>Kdy\u017e v\u00fdvoj\u00e1\u0159 p\u0159id\u00e1 novou aplikaci, mus\u00ed zm\u011bnit n\u011bkolik soubor\u016f: p\u0159\u00edslu\u0161nost aplikace, seznam tajnost\u00ed, p\u0159id\u00e1n\u00ed aplikace do z\u00e1vislost\u00ed, pokud je sou\u010d\u00e1st\u00ed generick\u00e9ho chartu.<\/p>\n<p><\/p>\n<h3 id=\"razresheniya-jenkins-slishkom-rasshireny-v-vault\">Opr\u00e1vn\u011bn\u00ed Jenkins jsou p\u0159\u00edli\u0161 roz\u0161\u00ed\u0159ena ve Vault<\/h3>\n<p><\/p>\n<p>Moment\u00e1ln\u011b m\u00e1me jednu <noindex><a rel=\"nofollow\" href=\"https:\/\/www.vaultproject.io\/docs\/auth\/approle.html\">AppRole<\/a><\/noindex>, kter\u00e1 \u010dte v\u0161echna tajemstv\u00ed z Vault.<\/p>\n<p><\/p>\n<h3 id=\"process-otkata-ne-avtomatizirovan\">Proces rollbacku nen\u00ed automatizov\u00e1n<\/h3>\n<p><\/p>\n<p>Pro rollback je t\u0159eba vykonat p\u0159\u00edkaz na n\u011bkolika clusterech, co\u017e je n\u00e1chyln\u00e9 k chyb\u00e1m. Tento \u00fakon prov\u00e1d\u00edme ru\u010dn\u011b, abychom mohli ur\u010dit spr\u00e1vn\u00fd identifik\u00e1tor verze.<\/p>\n<p><\/p>\n<h2 id=\"my-dvizhemsya-v-storonu-gitops\">Sm\u011b\u0159ujeme k GitOps<\/h2>\n<p><\/p>\n<h3 id=\"nasha-cel\">Na\u0161\u00edm c\u00edlem<\/h3>\n<p><\/p>\n<p>Chceme vr\u00e1tit chart do repozit\u00e1\u0159e aplikace, kterou nasazuje.<\/p>\n<p><\/p>\n<p>Pracovn\u00ed postup bude stejn\u00fd jako pro v\u00fdvoj. Nap\u0159\u00edklad, kdy\u017e je v\u011btev odesl\u00e1na do master, nasazen\u00ed se spust\u00ed automaticky. Hlavn\u00ed rozd\u00edl mezi t\u00edmto p\u0159\u00edstupem a sou\u010dasn\u00fdm pracovn\u00edm postupem bude v tom, \u017ee <strong>v\u0161echno bude \u0159\u00edzeno v gitu<\/strong> (jak aplikace, tak zp\u016fsob jej\u00edho nasazen\u00ed v Kubernetes).<\/p>\n<p><\/p>\n<p>Je n\u011bkolik v\u00fdhod:<\/p>\n<p><\/p>\n<ul>\n<li>Daleko <strong>jasn\u011bj\u0161\u00ed<\/strong> pro v\u00fdvoj\u00e1\u0159e. Snaz\u0161\u00ed nau\u010dit se aplikovat zm\u011bny v m\u00edstn\u00edm chartu.<\/li>\n<li>Definice nasazen\u00ed slu\u017eby m\u016f\u017ee b\u00fdt uvedena <strong>tam, kde je k\u00f3d<\/strong> slu\u017eby.<\/li>\n<li><strong>Spr\u00e1va odstra\u0148ov\u00e1n\u00ed generick\u00fdch chart\u016f<\/strong>. Slu\u017eba bude m\u00edt sv\u016fj vlastn\u00ed Helm release. To umo\u017en\u00ed \u0159\u00eddit \u017eivotn\u00ed cyklus aplikace (rollback, upgrade) na nejni\u017e\u0161\u00ed \u00farovni, aby se nedot\u00fdkala jin\u00fdch slu\u017eeb.<\/li>\n<li><strong>V\u00fdhody gitu<\/strong> pro spr\u00e1vu chart\u016f: zru\u0161en\u00ed zm\u011bn, protokol auditu atd. Pokud je pot\u0159eba zru\u0161it zm\u011bnu chartu, lze to ud\u011blat pomoc\u00ed gitu. Nasazen\u00ed se spust\u00ed automaticky.<\/li>\n<li>M\u016f\u017eeme uva\u017eovat o zlep\u0161en\u00ed pracovn\u00edho postupu v\u00fdvoje pomoc\u00ed takov\u00fdch n\u00e1stroj\u016f, jako je <strong>Skaffold<\/strong>, se kter\u00fdm mohou v\u00fdvoj\u00e1\u0159i testovat zm\u011bny v kontextu bl\u00edzk\u00e9m produkci.<\/li>\n<\/ul>\n<p><\/p>\n<h3 id=\"dvuhetapnaya-migraciya\">Dvouf\u00e1zov\u00e1 migrace<\/h3>\n<p><\/p>\n<p>Na\u0161i v\u00fdvoj\u00e1\u0159i pou\u017e\u00edvaj\u00ed tento pracovn\u00ed proces ji\u017e 2 roky, tak\u017ee pot\u0159ebujeme co nejm\u00e9n\u011b bolestivou migraci. Proto jsme se rozhodli p\u0159idat mezi\u010dl\u00e1nek na cest\u011b k c\u00edli.<br \/>\nPrvn\u00ed krok je jednoduch\u00fd:<\/p>\n<p><\/p>\n<ul>\n<li>Zachov\u00e1v\u00e1me podobnou strukturu pro nastaven\u00ed nasazen\u00ed aplikac\u00ed, ale v jednom objektu s n\u00e1zvem DailymotionRelease.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">apiVersion: \"v1\"\nkind: \"DailymotionRelease\"\nmetadata:\n  name: \"app1.ns1\"\n  environment: \"dev\"\n  branch: \"mybranch\"\nspec:\n  slack_channel: \"#admin\"\n  chart_name: \"app1\"\n  scaling:\n    - context: \"dev-us-central1-0\"\n      replicas:\n        - name: \"hermes\"\n          count: 2\n    - context: \"dev-europe-west1-0\"\n      replicas:\n        - name: \"app1-deploy\"\n          count: 2\n  secrets:\n    - secret_id: \"app1\"\n      contexts:\n        - name: \"default\"\n          vaultPath: \"\\\/kv\\\/dev\\\/ns1\\\/app1\\\/test\"\n          vaultKey: \"password\"\n        - name: \"dev-europe-west1-0\"\n          vaultPath: \"\\\/kv\\\/dev\\\/ns1\\\/app1\\\/test\"\n          vaultKey: \"password\"<\/code><\/pre>\n<p><\/p>\n<ul>\n<li>1 release na aplikaci (bez obecn\u00fdch chart\u016f).<\/li>\n<li>Chartu v git repozit\u00e1\u0159i aplikace.<\/li>\n<\/ul>\n<p><\/p>\n<p>Pov\u00eddali jsme si se v\u0161emi v\u00fdvoj\u00e1\u0159i, tak\u017ee proces migrace ji\u017e za\u010dal. Prvn\u00ed f\u00e1ze se p\u0159esto st\u00e1le kontroluje pomoc\u00ed CI platformy. Brzy nap\u00ed\u0161u dal\u0161\u00ed p\u0159\u00edsp\u011bvek o druh\u00e9 f\u00e1zi: jak jsme p\u0159e\u0161li na pracovn\u00ed postup GitOps s <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/weaveworks\/flux\">Flux<\/a><\/noindex>. \u0158eknu, jak jsme v\u0161echno nastavili a s jak\u00fdmi obt\u00ed\u017eemi jsme se pot\u00fdkali (n\u011bkolik repozit\u00e1\u0159\u016f, tajemstv\u00ed atd.). Sledujte novinky.<\/p>\n<p><\/p>\n<p>Zde jsme se pokusili popsat n\u00e1\u0161 pokrok v pracovn\u00edmu postupu nasazen\u00ed aplikac\u00ed za posledn\u00ed roky, kter\u00fd vedl k my\u0161lenk\u00e1m na p\u0159\u00edstup GitOps. Je\u0161t\u011b jsme nedos\u00e1hli c\u00edle a budeme informovat o v\u00fdsledc\u00edch, ale nyn\u00ed jsme p\u0159esv\u011bd\u010deni, \u017ee jsme ud\u011blali spr\u00e1vnou v\u011bc, kdy\u017e jsme se rozhodli v\u0161echno zjednodu\u0161it a p\u0159ibl\u00ed\u017eit se zvyklostem v\u00fdvoj\u00e1\u0159\u016f.<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/southbridge\/blog\/458934\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u0430\u043a Dailymotion \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 Kubernetes: \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u041c\u044b \u0432 Dailymotion \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Kubernetes \u0432 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d\u0435 3 \u0433\u043e\u0434\u0430 \u043d\u0430\u0437\u0430\u0434. \u041d\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u0442\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445 \u0442\u043e \u0435\u0449\u0435 \u0443\u0434\u043e\u0432\u043e\u043b\u044c\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0435\u0442 \u043c\u044b \u0441\u0442\u0430\u0440\u0430\u043b\u0438\u0441\u044c \u0443\u043b\u0443\u0447\u0448\u0438\u0442\u044c \u043d\u0430\u0448\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b. \u0421 \u0447\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u043b\u043e\u0441\u044c \u0417\u0434\u0435\u0441\u044c \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u043c\u044b \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u0435\u043c \u043d\u0430\u0448\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445 Kubernetes \u043f\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35955","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u0430\u043a Dailymotion \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 Kubernetes: \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u041c\u044b \u0432 Dailymotion \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Kubernetes \u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/razvertyvanie-prilozhenij-na-neskolkih-klasterah-kubernetes-s-helm\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445 Kubernetes \u0441 Helm | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u0430\u043a Dailymotion \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 Kubernetes: \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u041c\u044b \u0432 Dailymotion \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Kubernetes \u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/razvertyvanie-prilozhenij-na-neskolkih-klasterah-kubernetes-s-helm\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:08:26+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:08:26+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nasazen\u00ed aplikac\u00ed na v\u00edce klastrech Kubernetes s Helm | ProHoster","description":"Jak Dailymotion pou\u017e\u00edv\u00e1 Kubernetes: nasazen\u00ed aplikac\u00ed. V Dailymotion jsme za\u010dali pou\u017e\u00edvat Kubernetes v.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/razvertyvanie-prilozhenij-na-neskolkih-klasterah-kubernetes-s-helm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445 Kubernetes \u0441 Helm | ProHoster","og:description":"\u041a\u0430\u043a Dailymotion \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 Kubernetes: \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u041c\u044b \u0432 Dailymotion \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Kubernetes \u0432.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/razvertyvanie-prilozhenij-na-neskolkih-klasterah-kubernetes-s-helm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:08:26+00:00","article:modified_time":"2019-10-31T19:08:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35955","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 01:25:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:53:31","updated":"2026-01-22 01:25:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35955","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=35955"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35955\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=35955"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=35955"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=35955"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}