{"id":36918,"date":"2019-10-31T22:14:43","date_gmt":"2019-10-31T19:14:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/bezopasnost-helm\/"},"modified":"2019-10-31T22:14:43","modified_gmt":"2019-10-31T19:14:43","slug":"bezopasnost-helm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bezopasnost-helm","title":{"rendered":"Bezpe\u010dnost Helm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Podstata p\u0159\u00edb\u011bhu o nejobl\u00edben\u011bj\u0161\u00edm spr\u00e1vci bal\u00ed\u010dk\u016f pro Kubernetes by mohla b\u00fdt zn\u00e1zorn\u011bna pomoc\u00ed emoji:<\/p>\n<ul>\n<li>krabice \u2014 to je Helm (to je nejp\u0159esn\u011bj\u0161\u00ed, co je v posledn\u00ed verzi Emoji);<\/li>\n<li>z\u00e1mek \u2014 bezpe\u010dnost;<\/li>\n<li>\u010dlov\u00ed\u010dek \u2014 \u0159e\u0161en\u00ed probl\u00e9mu.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/91099b372fd73bce94268563c3ee2c50.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVe skute\u010dnosti to v\u0161ak bude o n\u011bco slo\u017eit\u011bj\u0161\u00ed a p\u0159\u00edb\u011bh je pln\u00fd technick\u00fdch podrobnost\u00ed o tom, <b>jak u\u010dinit Helm bezpe\u010dn\u00fdm<\/b>.<\/p>\n<ul>\n<li>Stru\u010dn\u011b o tom, co je Helm, pokud jste to nev\u011bd\u011bli nebo zapomn\u011bli. Jak\u00e9 probl\u00e9my \u0159e\u0161\u00ed a kde se nach\u00e1z\u00ed v ekosyst\u00e9mu.<\/li>\n<li>Pod\u00edvejme se na architekturu Helmu. \u017d\u00e1dn\u00e1 diskuse o bezpe\u010dnosti a o tom, jak u\u010dinit n\u00e1stroj nebo \u0159e\u0161en\u00ed bezpe\u010dn\u011bj\u0161\u00ed, se neobejde bez pochopen\u00ed architektury komponentu.<\/li>\n<li>Probereme komponenty Helmu.<\/li>\n<li>Nejpal\u010div\u011bj\u0161\u00ed ot\u00e1zka \u2014 budoucnost \u2014 nov\u00e1 verze Helmu 3.\u00a0<\/li>\n<\/ul>\n<p>\nV\u0161e v tomto \u010dl\u00e1nku se vztahuje na Helm 2. Tato verze je nyn\u00ed v produkci a pravd\u011bpodobn\u011b je to ta, kterou pr\u00e1v\u011b pou\u017e\u00edv\u00e1te, a pr\u00e1v\u011b v n\u00ed jsou bezpe\u010dnostn\u00ed hrozby.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n<center><div class=\"youtube-placeholder\" data-id=\"_8zNTJ1_R5I\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/_8zNTJ1_R5I\/hqdefault.jpg\" alt=\"P\u0159ehr\u00e1t video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\n<strong>O \u0159e\u010dn\u00edkovi:<\/strong> Alexander Chajjorov (<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/allexx\/\" class=\"user_link\">allexx<\/a><\/noindex>) se v\u011bnuje v\u00fdvoji 10 let, pom\u00e1h\u00e1 zlep\u0161ovat obsah <noindex><a rel=\"nofollow\" href=\"https:\/\/conf.python.ru\/2019\">Moscow Python Conf++<\/a><\/noindex> a p\u0159ipojil se k v\u00fdboru <noindex><a rel=\"nofollow\" href=\"https:\/\/events.linuxfoundation.org\/events\/helm-summit-2019\/\">Helm Summit<\/a><\/noindex>. Nyn\u00ed pracuje v Chainstack jako vedouc\u00ed v\u00fdvoje \u2014 co\u017e je hybrid mezi vedouc\u00edm v\u00fdvoje a osobou, kter\u00e1 odpov\u00edd\u00e1 za doru\u010dov\u00e1n\u00ed fin\u00e1ln\u00edch verz\u00ed. To znamen\u00e1 b\u00fdt na frontov\u00e9 linii, kde se d\u011bje v\u0161echno od vytv\u00e1\u0159en\u00ed produktu a\u017e po jeho provoz.<\/p>\n<p>Chainstack je mal\u00fd, aktivn\u011b rostouc\u00ed startup, jeho\u017e \u00fakolem je poskytnout z\u00e1kazn\u00edk\u016fm mo\u017enost zapomenout na infrastrukturu a slo\u017eitosti operov\u00e1n\u00ed decentralizovan\u00fdch aplikac\u00ed, t\u00fdm v\u00fdvoje se nach\u00e1z\u00ed v Singapuru. Neptejte se Chainstacku, aby prodal nebo koupil kryptom\u011bnu, ale nab\u00eddn\u011bte jim, \u017ee si promluv\u00edte o podnikov\u00fdch blockchainov\u00fdch r\u00e1mc\u00edch, a radostn\u011b v\u00e1m odpov\u00ed.<\/p>\n<h2>Helm<\/h2>\n<p>\nJedn\u00e1 se o spr\u00e1vce bal\u00ed\u010dk\u016f (chart\u016f) pro Kubernetes. Nejjednodu\u0161\u0161\u00ed a nejuniverz\u00e1ln\u011bj\u0161\u00ed zp\u016fsob, jak dostat aplikace do Kubernetes clusteru.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/30c0fc1cc1c6ebde97c6e8ec1886ce9f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0158e\u010d je samoz\u0159ejm\u011b o strukturovan\u011bj\u0161\u00edm a pr\u016fmyslov\u011bj\u0161\u00edm p\u0159\u00edstupu, ne\u017e o vytv\u00e1\u0159en\u00ed vlastn\u00edch YAML manifest\u016f a psan\u00ed mal\u00fdch utilit.<\/p>\n<blockquote><p>Helm je to nejlep\u0161\u00ed, co je nyn\u00ed k dispozici a popul\u00e1rn\u00ed.<\/p><\/blockquote>\n<p>\nPro\u010d Helm? P\u0159edev\u0161\u00edm proto, \u017ee je podporov\u00e1n CNCF. Cloud Native je velk\u00e1 organizace, kter\u00e1 je mate\u0159skou spole\u010dnost\u00ed projekt\u016f Kubernetes, etcd, Fluentd a dal\u0161\u00edch.<\/p>\n<p>Jin\u00fd d\u016fle\u017eit\u00fd fakt je, \u017ee Helm je velmi popul\u00e1rn\u00ed projekt. Kdy\u017e jsem v lednu 2019 za\u010dal p\u0159em\u00fd\u0161let o tom, jak zefektivnit bezpe\u010dnost Helmu, m\u011bl projekt tis\u00edc hv\u011bzdi\u010dek na GitHubu. Do kv\u011btna jich ji\u017e bylo 12 tis\u00edc.<\/p>\n<p>Mnoz\u00ed se zaj\u00edmaj\u00ed o Helm, a proto, i kdy\u017e jej dosud nepou\u017e\u00edv\u00e1te, va\u0161e znalosti o jeho bezpe\u010dnosti se v\u00e1m budou hodit. <strong>Bezpe\u010dnost je d\u016fle\u017eit\u00e1.<\/strong><\/p>\n<p>Hlavn\u00ed t\u00fdm Helmu podporuje Microsoft Azure, a proto je to pom\u011brn\u011b stabiln\u00ed projekt na rozd\u00edl od mnoha jin\u00fdch. Vyd\u00e1n\u00ed Helm 3 Alpha 2 v polovin\u011b \u010dervence sv\u011bd\u010d\u00ed o tom, \u017ee na projektu pracuje dostatek lid\u00ed, kte\u0159\u00ed maj\u00ed chu\u0165 a s\u00edlu Helm rozv\u00edjet a zlep\u0161ovat.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/e53c8e64c3cf5eea3fbd9b0095b0f81e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHelm \u0159e\u0161\u00ed n\u011bkolik z\u00e1kladn\u00edch probl\u00e9m\u016f spr\u00e1vy aplikac\u00ed v Kubernetes.<\/p>\n<ul>\n<li>Balen\u00ed aplikac\u00ed. I aplikace typu 'Hello, World' na WordPress p\u0159edstavuje n\u011bkolik slu\u017eeb, kter\u00e9 je pot\u0159eba zabalit dohromady.<\/li>\n<li>Spr\u00e1va slo\u017eitosti, kter\u00e1 vznik\u00e1 p\u0159i managementu t\u011bchto aplikac\u00ed.<\/li>\n<li>\u017divotn\u00ed cyklus, kter\u00fd nekon\u010d\u00ed po instalaci nebo nasazen\u00ed aplikace. Ta pokra\u010duje v \u017eivot\u011b, je t\u0159eba ji aktualizovat, a v tom pom\u00e1h\u00e1 Helm a sna\u017e\u00ed se p\u0159in\u00e9st spr\u00e1vn\u00e1 opat\u0159en\u00ed a politiky.<\/li>\n<\/ul>\n<p>\n<strong>Balen\u00ed<\/strong> je uspo\u0159\u00e1d\u00e1no pochopiteln\u00fdm zp\u016fsobem: existuj\u00ed metadata v pln\u00e9m souladu s prac\u00ed b\u011b\u017en\u00e9ho spr\u00e1vce bal\u00ed\u010dk\u016f pro Linux, Windows nebo MacOS. To znamen\u00e1 repozit\u00e1\u0159, z\u00e1vislosti na r\u016fzn\u00fdch bal\u00ed\u010dc\u00edch, metainformace pro aplikace, nastaven\u00ed, konfigurace, indexov\u00e1n\u00ed informac\u00ed atd. To v\u0161e Helm umo\u017e\u0148uje z\u00edskat a pou\u017e\u00edvat pro aplikace.<\/p>\n<p><strong>Spr\u00e1va slo\u017eitosti<\/strong>. Pokud m\u00e1te hodn\u011b podobn\u00fdch aplikac\u00ed, je pot\u0159eba parametrizace. Z toho vypl\u00fdvaj\u00ed \u0161ablony, ale abyste nemuseli vym\u00fd\u0161let sv\u016fj vlastn\u00ed zp\u016fsob tvorby \u0161ablon, m\u016f\u017eete vyu\u017e\u00edt to, co Helm nab\u00edz\u00ed ji\u017e v z\u00e1kladu.<\/p>\n<p><strong>Management \u017eivotn\u00edho cyklu aplikace<\/strong> \u2014 to je podle m\u00e9ho n\u00e1zoru nejzaj\u00edmav\u011bj\u0161\u00ed a nevy\u0159e\u0161en\u00e9 t\u00e9ma. To je d\u016fvod, pro\u010d jsem se v t\u00e9 dob\u011b dostal k Helmu. Pot\u0159ebovali jsme sledovat \u017eivotn\u00ed cyklus aplikace, cht\u011bli jsme p\u0159en\u00e9st sv\u016fj CI\/CD a cykly aplikac\u00ed do t\u00e9to paradigmatu.<\/p>\n<p>Helm umo\u017e\u0148uje:<\/p>\n<ul>\n<li>spravovat nasazen\u00ed, zav\u00e1d\u00ed pojem konfigurace a revize;<\/li>\n<li>\u00fasp\u011b\u0161n\u011b prov\u00e1d\u011bt rollback;<\/li>\n<li>vyu\u017e\u00edvat hooky na r\u016fzn\u00e9 ud\u00e1losti;<\/li>\n<li>p\u0159id\u00e1vat dal\u0161\u00ed kontroly aplikac\u00ed a reagovat na jejich v\u00fdsledky.<\/li>\n<\/ul>\n<p>\nKrom\u011b toho <strong>Helm m\u00e1 'baterky'<\/strong> \u2014 obrovsk\u00e9 mno\u017estv\u00ed chutn\u00fdch v\u011bc\u00ed, kter\u00e9 lze zahrnout jako pluginy, \u010d\u00edm\u017e si usnadn\u00edte \u017eivot. Pluginy si m\u016f\u017eete ps\u00e1t sami, jsou dostate\u010dn\u011b izolovan\u00e9 a nevy\u017eaduj\u00ed slo\u017eitou architekturu. Pokud chcete n\u011bco realizovat, doporu\u010duji to ud\u011blat jako plugin a potom to mo\u017en\u00e1 zahrnout do upstreamu.<\/p>\n<p>Helm se zakl\u00e1d\u00e1 na t\u0159ech z\u00e1kladn\u00edch konceptech:<\/p>\n<ul>\n<li><strong>Chart Repo<\/strong> \u2014 popis a pole parametrizace, kter\u00e9 jsou mo\u017en\u00e9 pro v\u00e1\u0161 manifest.\u00a0<\/li>\n<li><strong>Nastaven\u00ed<\/strong> \u2014 tedy hodnoty, kter\u00e9 budou aplikov\u00e1ny (text, \u010d\u00edseln\u00e9 hodnoty atd.).<\/li>\n<li><strong>Release<\/strong> obsahuje dva vrcholn\u00e9 komponenty, a dohromady se prom\u011bn\u00ed v Release. Vyd\u00e1n\u00ed lze verziovat, \u010d\u00edm\u017e se dos\u00e1hne organizace \u017eivotn\u00edho cyklu: mal\u00e9 p\u0159i instalaci a velk\u00e9 p\u0159i upgrade, downgrade nebo rollbacku.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Architektura Helm<\/h2>\n<p>\nNa sch\u00e9matu je konceptu\u00e1ln\u011b zobrazen\u00e1 vysoce \u00farov\u0148ov\u00e1 architektura Helm.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/c5cf54890682a3d6ca7a45021b5006a1.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u0159ipom\u00edn\u00e1m, \u017ee Helm je n\u011bco, co souvis\u00ed s Kubernetes. Proto se bez Kubernetes clusteru neobejdeme (obd\u00e9ln\u00edk). Komponent kube-apiserver se nach\u00e1z\u00ed na masteru. Bez Helmu m\u00e1me Kubeconfig. Helm p\u0159in\u00e1\u0161\u00ed jeden mal\u00fd bin\u00e1rn\u00ed, pokud to lze tak nazvat, n\u00e1stroj Helm CLI, kter\u00fd se instaluje na po\u010d\u00edta\u010d, notebook, mainframe \u2014 na cokoliv.<\/p>\n<p>Ale to nesta\u010d\u00ed. Helm m\u00e1 serverovou komponentu Tiller. Ta zastupuje z\u00e1jmy Helmu uvnit\u0159 clusteru, je to stejn\u00e9 aplikace uvnit\u0159 clusteru Kubernetes jako jak\u00e1koli jin\u00e1.<\/p>\n<p>Dal\u0161\u00ed komponent Chart Repo \u2014 repozit\u00e1\u0159 s chartami. Existuje ofici\u00e1ln\u00ed repozit\u00e1\u0159, a m\u016f\u017ee to b\u00fdt priv\u00e1tn\u00ed repozit\u00e1\u0159 spole\u010dnosti nebo projektu.<\/p>\n<h3>Interakce<\/h3>\n<p>\nPod\u00edvejme se, jak spolu komunikuj\u00ed komponenty architektury, kdy\u017e chceme nainstalovat aplikaci pomoc\u00ed Helmu.<\/p>\n<ul>\n<li>\u0158\u00edk\u00e1me <code>Helm install<\/code>, obrac\u00edme se na repozit\u00e1\u0159 (Chart Repo) a z\u00edsk\u00e1v\u00e1me Helm chart.<\/li>\n<\/ul>\n<p><\/p>\n<ul>\n<li>Helm n\u00e1stroj (Helm CLI) interaguje s Kubeconfig, aby zjistil, ke kter\u00e9mu clusteru se p\u0159ipojit.\u00a0<\/li>\n<li>Po z\u00edsk\u00e1n\u00ed t\u011bchto informac\u00ed se n\u00e1stroj obrac\u00ed na Tiller, kter\u00fd se nach\u00e1z\u00ed v na\u0161em clusteru, ji\u017e jako na aplikaci.\u00a0<\/li>\n<li>Tiller se obrac\u00ed na Kube-apiserver, aby provedl akce v Kubernetes, vytvo\u0159il n\u011bjak\u00e9 objekty (slu\u017eby, pody, repliky, tajn\u00e9 informace atd.).<\/li>\n<\/ul>\n<p>\nD\u00e1le sch\u00e9ma zkomplikujeme, abychom vid\u011bli vektory \u00fatok\u016f, kter\u00fdmi m\u016f\u017ee b\u00fdt cel\u00e1 architektura Helmu vystavena. A pak se pokus\u00edme ji ochr\u00e1nit.<\/p>\n<h3>Vektor \u00fatok\u016f<\/h3>\n<p>\nPrvn\u00ed potenci\u00e1ln\u011b slab\u00e9 m\u00edsto \u2014 <strong>privilegovan\u00fd API<\/strong>&#8212;<strong>u\u017eivateli<\/strong>. V r\u00e1mci sch\u00e9matu je to hacker, kter\u00fd z\u00edskal administr\u00e1torsk\u00fd p\u0159\u00edstup k Helm CLI.<\/p>\n<p><strong>Nep\u0159id\u011blen\u00fd API u\u017eivatel<\/strong> m\u016f\u017ee tak\u00e9 p\u0159edstavovat nebezpe\u010d\u00ed, pokud se nach\u00e1z\u00ed pobl\u00ed\u017e. Takov\u00fd u\u017eivatel bude m\u00edt jin\u00fd kontext, nap\u0159\u00edklad m\u016f\u017ee b\u00fdt zafixov\u00e1n v jednom namespace clusteru v nastaven\u00edch Kubeconfig.<\/p>\n<p>Nejzaj\u00edmav\u011bj\u0161\u00edm vektorem \u00fatoku m\u016f\u017ee b\u00fdt proces, kter\u00fd se nach\u00e1z\u00ed uvnit\u0159 clusteru n\u011bkde pobl\u00ed\u017e Tiller a m\u016f\u017ee k n\u011bmu p\u0159istupovat. M\u016f\u017ee to b\u00fdt webov\u00fd server nebo mikroslu\u017eba, kter\u00e1 vid\u00ed s\u00ed\u0165ov\u00e9 prost\u0159ed\u00ed clusteru.<\/p>\n<p>Exotick\u00e1, ale st\u00e1le v\u00edce popul\u00e1rn\u00ed varianta \u00fatoku souvis\u00ed s Chart Repo. Graf, vytvo\u0159en\u00fd nedbal\u00fdm autorem, m\u016f\u017ee obsahovat nebezpe\u010dn\u00fd zdroj a vy ho vykon\u00e1te, ani\u017e byste o tom pochybovali. Nebo m\u016f\u017ee nahradit graf, kter\u00fd stahujete z ofici\u00e1ln\u00edho repozit\u00e1\u0159e, a nap\u0159\u00edklad vytvo\u0159it zdroj ve form\u011b politiky a eskalovat si p\u0159\u00edstup.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/2828046feb9ba8413a1b0e8741b4c354.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPokud se pokus\u00edme odrazit \u00fatoky ze v\u0161ech t\u011bchto \u010dty\u0159 stran, zjist\u00edme, kde jsou probl\u00e9my v architektu\u0159e Helm a kde mo\u017en\u00e1 nejsou.<\/p>\n<p>Zv\u011bt\u0161\u00edme sch\u00e9ma, p\u0159id\u00e1me v\u00edce prvk\u016f, ale zachov\u00e1me v\u0161echny z\u00e1kladn\u00ed sou\u010d\u00e1sti.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/4110898e79619b8546408c668c48da0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHelm CLI komunikuje s Chart Repo, interaguje s Kubeconfig, pr\u00e1ce je p\u0159ed\u00e1na do clusteru v komponent\u011b Tiller.<\/p>\n<p>Tiller je reprezentov\u00e1n dv\u011bma objekty:<\/p>\n<ul>\n<li>Tiller-deploy svc, kter\u00fd vystavuje jak\u00fdsi servis;<\/li>\n<li>Tiller-deploy pod (na sch\u00e9matu v jedin\u00e9m exempl\u00e1\u0159i v jedn\u00e9 replikaci), na kter\u00e9m b\u011b\u017e\u00ed ve\u0161ker\u00e1 z\u00e1t\u011b\u017e, kter\u00fd se obrac\u00ed na cluster.<\/li>\n<\/ul>\n<p>\nPro interakci se pou\u017e\u00edvaj\u00ed r\u016fzn\u00e9 protokoly a sch\u00e9mata. Z pohledu bezpe\u010dnosti n\u00e1s nejv\u00edce zaj\u00edmaj\u00ed:<\/p>\n<ul>\n<li>Mechanismus, pomoc\u00ed kter\u00e9ho se Helm CLI obrac\u00ed na chart repo: jak\u00fd protokol, jestli existuje autentizace a co s t\u00edm lze ud\u011blat.<\/li>\n<li>Protokol, podle kter\u00e9ho Hel CLI, pou\u017e\u00edvaj\u00edc\u00ed kubectl, komunikuje s Tiller. To je RPC server instalovan\u00fd uvnit\u0159 clusteru.<\/li>\n<li>S\u00e1m Tiller je dostupn\u00fd pro mikroslu\u017eby, kter\u00e9 se nach\u00e1zej\u00ed v clusteru, a interaguje s Kube-apiserver.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/19e7e085567f3bbb49746e6402926bd6.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nProbereme v\u0161echny tyto sm\u011bry postupn\u011b.<\/p>\n<h2>RBAC<\/h2>\n<p><\/p>\n<blockquote><p>Je zbyte\u010dn\u00e9 hovo\u0159it o jak\u00e9koli bezpe\u010dnosti Helm nebo jin\u00fdch slu\u017eeb uvnit\u0159 clusteru, pokud nen\u00ed zapnuto RBAC.<\/p><\/blockquote>\n<p>\nZd\u00e1 se, \u017ee to nen\u00ed \u00fapln\u011b \u010derstv\u00e9 doporu\u010den\u00ed, ale jsem si jist\u00fd, \u017ee mnoz\u00ed st\u00e1le nezapnuli RBAC ani v produkci, proto\u017ee to vy\u017eaduje spoustu \u00fasil\u00ed a je pot\u0159eba mnoho co nastavit. Nicm\u00e9n\u011b, vyz\u00fdv\u00e1m k tomu, abyste to ud\u011blali.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/37ee8aeb2b331b75ea5569c0b114a756.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/rbac.dev\/\">https:\/\/rbac.dev\/<\/a><\/noindex> \u2014 pr\u00e1vnick\u00e1 str\u00e1nka pro RBAC. Obsahuje obrovsk\u00e9 mno\u017estv\u00ed zaj\u00edmav\u00e9ho materi\u00e1lu, kter\u00fd pom\u016f\u017ee nastavit RBAC, uk\u00e1\u017ee, pro\u010d je dobr\u00fd a jak s n\u00edm v podstat\u011b \u017e\u00edt v produkci.<\/p>\n<p>Zkus\u00edm vysv\u011btlit, jak funguje Tiller a RBAC. Tiller pracuje uvnit\u0159 clusteru pod ur\u010dit\u00fdm servisn\u00edm \u00fa\u010dtem. Obvykle, pokud nen\u00ed RBAC nastaven, bude to superu\u017eivatel. V z\u00e1kladn\u00ed konfiguraci bude Tiller administr\u00e1torem. Pr\u00e1v\u011b proto se \u010dasto \u0159\u00edk\u00e1, \u017ee Tiller je SSH tunel k va\u0161emu clusteru. V praxi je to pravda, tak\u017ee m\u016f\u017eete pou\u017e\u00edt odd\u011blen\u00fd specializovan\u00fd servisn\u00ed \u00fa\u010det m\u00edsto v\u00fdchoz\u00edho servisn\u00edho \u00fa\u010dtu na sch\u00e9matu v\u00fd\u0161e.<\/p>\n<p>Kdy\u017e inicializujete Helm, poprv\u00e9 ho instalujete na server, m\u016f\u017eete nastavit servisn\u00ed \u00fa\u010det pomoc\u00ed <code>--service-account<\/code>. To umo\u017en\u00ed pou\u017e\u00edt u\u017eivatele s minim\u00e1ln\u011b nezbytn\u00fdmi opr\u00e1vn\u011bn\u00edmi. Bohu\u017eel, budete muset vytvo\u0159it takovou \"girlandu\": Role a RoleBinding.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/ec805cde756495cfd5c480ac40739c43.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nBohu\u017eel, Helm to za v\u00e1s neud\u011bl\u00e1. Vy nebo v\u00e1\u0161 administr\u00e1tor Kubernetes clusteru mus\u00edte p\u0159edem p\u0159ipravit sady Role, RoleBinding pro servisn\u00ed \u00fa\u010det, aby byly p\u0159ed\u00e1ny Helmu.<\/p>\n<p>Poj\u010fme se zeptat \u2014 jak\u00fd je rozd\u00edl mezi Role a ClusterRole? Rozd\u00edl je v tom, \u017ee ClusterRole plat\u00ed pro v\u0161echny namespaces, na rozd\u00edl od b\u011b\u017en\u00fdch Role a RoleBinding, kter\u00e9 funguj\u00ed pouze pro specializovan\u00fd namespace. M\u016f\u017eete nastavit politiky jak pro cel\u00fd cluster a v\u0161echny namespaces, tak individu\u00e1ln\u011b pro ka\u017ed\u00fd namespace zvl\u00e1\u0161\u0165.<\/p>\n<p>Je t\u0159eba zm\u00ednit, \u017ee RBAC tak\u00e9 \u0159e\u0161\u00ed je\u0161t\u011b jeden velk\u00fd probl\u00e9m. Mnoz\u00ed si st\u011b\u017euj\u00ed, \u017ee Helm bohu\u017eel nepodporuje multitenancy. Pokud n\u011bkolik t\u00fdm\u016f vyu\u017e\u00edv\u00e1 cluster a pou\u017e\u00edv\u00e1 Helm, nelze v podstat\u011b nastavit politiky a omezit jejich p\u0159\u00edstup v r\u00e1mci tohoto clusteru, proto\u017ee je tu ur\u010dit\u00fd servisn\u00ed \u00fa\u010det, pod kter\u00fdm Helm pracuje, a ten vytv\u00e1\u0159\u00ed v\u0161echny prost\u0159edky v clusteru, co\u017e m\u016f\u017ee b\u00fdt velmi nepohodln\u00e9. To je pravda \u2014 jak samotn\u00fd bin\u00e1rn\u00ed soubor, tak proces, <strong>Helm Tiller nem\u00e1 pojem o multitenancy.<\/strong>.<\/p>\n<p>Existuje v\u0161ak skv\u011bl\u00fd zp\u016fsob, jak spustit Tiller v clusteru n\u011bkolikr\u00e1t. S t\u00edm nejsou \u017e\u00e1dn\u00e9 probl\u00e9my, Tiller lze spustit v ka\u017ed\u00e9m namespace. T\u00edmto zp\u016fsobem m\u016f\u017eete vyu\u017e\u00edt RBAC, Kubeconfig jako kontext a omezit p\u0159\u00edstup k specializovan\u00e9mu Helmu.<\/p>\n<p>Bude to vypadat n\u00e1sledovn\u011b.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/eae922c7b5e1422fb51667364ed79e0a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNap\u0159\u00edklad existuj\u00ed dv\u011b Kubeconfig s kontexty pro r\u016fzn\u00e9 t\u00fdmy (dv\u011b namespace): t\u00fdm X pro v\u00fdvoj\u00e1\u0159e a cluster administr\u00e1tor\u016f. Cluster administr\u00e1tor\u016f m\u00e1 sv\u016fj \u0161irok\u00fd Tiller, kter\u00fd se nach\u00e1z\u00ed v prostoru namespace Kube-system, co\u017e odpov\u00edd\u00e1 pokro\u010dil\u00e9mu service-account. A samostatn\u00fd namespace pro t\u00fdm v\u00fdvoj\u00e1\u0159\u016f, kte\u0159\u00ed mohou nasazovat sv\u00e9 slu\u017eby do speci\u00e1ln\u00edho namespace.<\/p>\n<p>To je funk\u010dn\u00ed p\u0159\u00edstup, Tiller nen\u00ed tak n\u00e1ro\u010dn\u00fd, aby to v\u00fdrazn\u011b ovlivnilo v\u00e1\u0161 rozpo\u010det. To je jedno z rychl\u00fdch \u0159e\u0161en\u00ed.<\/p>\n<blockquote><p>Nebojte se nastavit Tiller odd\u011blen\u011b a poskytnout Kubeconfig s kontextem pro t\u00fdm, pro konkr\u00e9tn\u00edho v\u00fdvoj\u00e1\u0159e nebo pro prost\u0159ed\u00ed: Dev, Staging, Production (je pochybn\u00e9, \u017ee v\u0161e bude na jednom clusteru, nicm\u00e9n\u011b, ud\u011blat to lze).<\/p><\/blockquote>\n<p>\nPokra\u010dujeme v na\u0161em p\u0159\u00edb\u011bhu, p\u0159epneme se od RBAC a budeme mluvit o ConfigMaps.<\/p>\n<h3>ConfigMaps<\/h3>\n<p>\nHelm pou\u017e\u00edv\u00e1 ConfigMaps jako \u00falo\u017ei\u0161t\u011b dat. Kdy\u017e jsme hovo\u0159ili o architektu\u0159e, nikde tam nebyla datab\u00e1ze, kter\u00e1 by uchov\u00e1vala informace o relezech, konfigurac\u00edch, rollbacks atd. K tomu se pou\u017e\u00edvaj\u00ed ConfigMaps.<\/p>\n<p>Hlavn\u00ed probl\u00e9m s ConfigMaps je zn\u00e1m\u00fd \u2014 nejsou bezpe\u010dn\u00e9 v principu, lze v nich <strong>uchov\u00e1vat sensitive-\u00fadaje<\/strong>. Jde o v\u0161e, co by se nem\u011blo dostat d\u00e1l od slu\u017eby, nap\u0159\u00edklad hesla. Nejp\u0159irozen\u011bj\u0161\u00edm zp\u016fsobem pro Helm je nyn\u00ed p\u0159ej\u00edt od pou\u017e\u00edv\u00e1n\u00ed ConfigMaps k tajemstv\u00edm.<\/p>\n<p>To se d\u011bl\u00e1 velmi jednodu\u0161e. P\u0159edefinujete nastaven\u00ed Tiller a uvedete, \u017ee \u00falo\u017ei\u0161t\u011bm budou tajemstv\u00ed. Pak p\u0159i ka\u017ed\u00e9m nasazen\u00ed dostanete m\u00edsto ConfigMapu tajemstv\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/7fd12bfbed5c6c8111a5126c2ab9f853.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u016f\u017eete nam\u00edtnout, \u017ee sama tajemstv\u00ed \u2014 podivn\u00fd koncept, a to nen\u00ed p\u0159\u00edli\u0161 bezpe\u010dn\u00e9. Nicm\u00e9n\u011b, je t\u0159eba ch\u00e1pat, \u017ee t\u00edmto se zab\u00fdvaj\u00ed sami v\u00fdvoj\u00e1\u0159i Kubernetes. Od verze 1.10, tedy u\u017e n\u011bjakou dobu, je mo\u017enost, minim\u00e1ln\u011b v ve\u0159ejn\u00fdch cloudech, p\u0159ipojit spr\u00e1vn\u00e9 \u00falo\u017ei\u0161t\u011b pro uchov\u00e1v\u00e1n\u00ed tajemstv\u00ed. V sou\u010dasnosti t\u00fdm pracuje na tom, jak l\u00e9pe distribuovat p\u0159\u00edstup k tajemstv\u00edm, jednotliv\u00fdm pod\u016fm nebo jin\u00fdm entit\u00e1m.<\/p>\n<blockquote><p>\u00dalo\u017ei\u0161t\u011b Helm by se m\u011blo p\u0159ev\u00e9st na tajemstv\u00ed, a ta zase zabezpe\u010dit centr\u00e1ln\u011b.<\/p><\/blockquote>\n<p>\nSamoz\u0159ejm\u011b, z\u016fstane <strong>limit pro uchov\u00e1v\u00e1n\u00ed dat v 1 Mbyte<\/strong>. Helm zde pou\u017e\u00edv\u00e1 etcd jako distribuovan\u00e9 \u00falo\u017ei\u0161t\u011b pro ConfigMaps. A tam zjistili, \u017ee je to vhodn\u00fd chunk dat pro replikaci a podobn\u011b. K tomu je zaj\u00edmav\u00e1 diskuse na Redditu, doporu\u010duji naj\u00edt si tuto z\u00e1bavnou \u010detbu na v\u00edkend nebo si p\u0159e\u010d\u00edst shrnut\u00ed. <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/helm\/helm\/issues\/1413\">tady<\/a><\/noindex>.<\/p>\n<h3>Repozi\u00e1\u0159e chart\u016f<\/h3>\n<p>\nCharty jsou nejv\u00edce soci\u00e1ln\u011b zraniteln\u00e9 a mohou se st\u00e1t zdrojem \"Man in the middle\", obzvl\u00e1\u0161\u0165 pokud se pou\u017e\u00edv\u00e1 standardn\u00ed \u0159e\u0161en\u00ed. P\u0159edev\u0161\u00edm se jedn\u00e1 o repozit\u00e1\u0159e, kter\u00e9 jsou vystaveny p\u0159es HTTP.<\/p>\n<blockquote><p>Ur\u010dit\u011b je pot\u0159eba vystavovat Helm Repo p\u0159es HTTPS \u2014 to je nejlep\u0161\u00ed varianta a nen\u00ed drah\u00e1.<\/p><\/blockquote>\n<p>\nVezm\u011bte na v\u011bdom\u00ed <strong>mechanismus podpis\u016f chart\u016f<\/strong>. Technologie je \u00fa\u017easn\u011b jednoduch\u00e1. Je to to sam\u00e9, co pou\u017e\u00edv\u00e1te na GitHubu, oby\u010dejn\u00e1 PGP ma\u0161inerie s ve\u0159ejn\u00fdmi a soukrom\u00fdmi kl\u00ed\u010di. Nastavte si to a budete si jisti, m\u00e1te-li pot\u0159ebn\u00e9 kl\u00ed\u010de a podepisujete v\u0161e, co je opravdu v\u00e1\u0161 chart.<\/p>\n<p>Krom\u011b toho, <strong>Helm klient podporuje TLS<\/strong> (ne v smyslu HTTP ze strany serveru, ale vz\u00e1jemn\u00fd TLS). M\u016f\u017eete pou\u017e\u00edt serverov\u00e9 a klientsk\u00e9 kl\u00ed\u010de pro komunikaci. P\u0159izn\u00e1m se, \u017ee tuto metodu nepou\u017e\u00edv\u00e1m kv\u016fli neochot\u011b k vz\u00e1jemn\u00fdm certifik\u00e1t\u016fm. V z\u00e1sad\u011b, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/helm\/chartmuseum\">chartmuseum<\/a><\/noindex> \u2014 hlavn\u00ed n\u00e1stroj pro vystavov\u00e1n\u00ed Helm Repo pro Helm 2 \u2014 podporuje tak\u00e9 basic auth. M\u016f\u017eete pou\u017e\u00edt basic auth, pokud je to pohodln\u011bj\u0161\u00ed a bezpe\u010dn\u011bj\u0161\u00ed.<\/p>\n<p>Je tu tak\u00e9 plugin <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hayorov\/helm-gcs\">helm-gcs<\/a><\/noindex>, kter\u00fd umo\u017e\u0148uje um\u00eds\u0165ovat Chart Repos do Google Cloud Storage. Je to docela pohodln\u00e9, skv\u011ble to funguje a je to dost bezpe\u010dn\u00e9, proto\u017ee se pou\u017e\u00edvaj\u00ed v\u0161echny popsan\u00e9 mechanismy.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/6a72bfd96c7eb0e2fdd7bcbf128e6433.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPokud zapnete HTTPS nebo TLS, pou\u017eijete mTLS, p\u0159ipoj\u00edte basic auth, abyste sn\u00ed\u017eili rizika, vznikne bezpe\u010dn\u00fd komunika\u010dn\u00ed kan\u00e1l mezi Helm CLI a Chart Repo.<\/p>\n<h3>gRPC API<\/h3>\n<p>\nDal\u0161\u00ed krok je velmi odpov\u011bdn\u00fd \u2014 zabezpe\u010dit Tiller, kter\u00fd se nach\u00e1z\u00ed v klastru a je na jedn\u00e9 stran\u011b serverem, na druh\u00e9 stran\u011b se s\u00e1m obrac\u00ed na jin\u00e9 komponenty a sna\u017e\u00ed se p\u0159edstavit jako n\u011bkdo jin\u00fd.<\/p>\n<p>Jak jsem ji\u017e \u0159ekl, Tiller je slu\u017eba, kter\u00e1 vystavuje gRPC, Helm klient k n\u011bmu p\u0159ich\u00e1z\u00ed p\u0159es gRPC. Ve v\u00fdchoz\u00edm nastaven\u00ed je samoz\u0159ejm\u011b TLS vypnuto. Pro\u010d je to takto ud\u011bl\u00e1no \u2014 to je diskutabiln\u00ed ot\u00e1zka, p\u0159ipad\u00e1 mi, \u017ee to m\u00e1 zjednodu\u0161it nastaven\u00ed na za\u010d\u00e1tku.<\/p>\n<blockquote><p>Pro produkci a dokonce i pro staging doporu\u010duji zapnout TLS na gRPC.<\/p><\/blockquote>\n<p>\nPodle m\u00e9ho n\u00e1zoru, na rozd\u00edl od mTLS pro chartov\u00e9 soubory, je zde to vhodn\u00e9 a velice jednoduch\u00e9 \u2014 generujete PQI infrastrukturu, vytv\u00e1\u0159\u00edte certifik\u00e1t, spou\u0161t\u00edte Tiller a p\u0159ed\u00e1v\u00e1te certifik\u00e1t b\u011bhem inicializace. Pot\u00e9 m\u016f\u017eete prov\u00e1d\u011bt v\u0161echny Helm p\u0159\u00edkazy s pou\u017eit\u00edm vygenerovan\u00e9ho certifik\u00e1tu a priv\u00e1tn\u00edho kl\u00ed\u010de.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/ed55b9a465ed1278b272c52c90b2b345.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00edmto se ochr\u00e1n\u00edte p\u0159ed v\u0161emi po\u017eadavky na Tiller zven\u010d\u00ed klastru.<\/p>\n<p>Tak\u017ee jsme zabezpe\u010dili kan\u00e1l p\u0159ipojen\u00ed k Tiller, ji\u017e jsme probrali RBAC a nastavili pr\u00e1va Kubernetes apiserveru, z\u00fa\u017eili jsme dom\u00e9nu, se kterou m\u016f\u017ee komunikovat.<\/p>\n<h2>Zabezpe\u010den\u00fd Helm<\/h2>\n<p>\nPod\u00edvejme se na fin\u00e1ln\u00ed sch\u00e9ma. To je stejn\u00e1 architektura se stejn\u00fdmi \u0161ipkami.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/6672e254ad93b917f57794e1619a572e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u0161echny p\u0159ipojen\u00ed nyn\u00ed lze bez obav kreslit zelen\u011b:<\/p>\n<ul>\n<li>pro Chart Repo pou\u017e\u00edv\u00e1me TLS nebo mTLS a z\u00e1kladn\u00ed autentizaci;<\/li>\n<li>mTLS pro Tiller, kter\u00fd je vystaven jako gRPC slu\u017eba s TLS, pou\u017e\u00edv\u00e1me certifik\u00e1ty;<\/li>\n<li>ve klastru pou\u017e\u00edv\u00e1me speci\u00e1ln\u00ed servisn\u00ed \u00fa\u010det s Role a RoleBinding.\u00a0<\/li>\n<\/ul>\n<p>\nV\u00fdrazn\u011b jsme zabezpe\u010dili klastr, ale n\u011bkdo chytr\u00fd \u0159ekl:<\/p>\n<blockquote><p>\u201eAbsolutn\u011b bezpe\u010dn\u00e9 \u0159e\u0161en\u00ed m\u016f\u017ee b\u00fdt pouze jedno \u2014 vypnut\u00fd po\u010d\u00edta\u010d, kter\u00fd se nach\u00e1z\u00ed v betonov\u00e9 krabi\u010dce a hl\u00eddaj\u00ed ho voj\u00e1ci.\u201c<\/p><\/blockquote>\n<p>\nExistuj\u00ed r\u016fzn\u00e9 zp\u016fsoby manipulac\u00ed s daty a nalezen\u00ed nov\u00fdch vektor\u016f \u00fatoku. Jsem v\u0161ak p\u0159esv\u011bd\u010den, \u017ee tato doporu\u010den\u00ed umo\u017en\u00ed implementovat z\u00e1kladn\u00ed pr\u016fmyslov\u00fd standard bezpe\u010dnosti.<\/p>\n<h2>Bonus<\/h2>\n<p>\nTato \u010d\u00e1st se p\u0159\u00edmo net\u00fdk\u00e1 bezpe\u010dnosti, ale tak\u00e9 bude u\u017eite\u010dn\u00e1. Uk\u00e1\u017eu n\u011bkter\u00e9 zaj\u00edmav\u00e9 v\u011bci, o kter\u00fdch mnoho lid\u00ed nev\u00ed. Nap\u0159\u00edklad, jak hledat chartov\u00e9 soubory \u2014 ofici\u00e1ln\u00ed i neofici\u00e1ln\u00ed.<\/p>\n<p>V repozit\u00e1\u0159i <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/helm\/charts\">github.com\/helm\/charts<\/a><\/noindex> v sou\u010dasnosti je k dispozici p\u0159ibli\u017en\u011b 300 chart\u016f a dva streamy: stable a incubator. Ten, kdo p\u0159isp\u00edv\u00e1, v\u00ed, jak obt\u00ed\u017en\u00e9 je dostat se z incubator do stable a jak snadno lze ze stable vypadnout. Nicm\u00e9n\u011b, to nen\u00ed nejlep\u0161\u00ed n\u00e1stroj pro vyhled\u00e1v\u00e1n\u00ed chart\u016f pro Prometheus a pro v\u0161echno, co se v\u00e1m l\u00edb\u00ed, z jednoho prost\u00e9ho d\u016fvodu \u2014 nen\u00ed to port\u00e1l, kde by se pohodln\u011b hledaly bal\u00ed\u010dky.<\/p>\n<p>Ale existuje slu\u017eba <noindex><a rel=\"nofollow\" href=\"https:\/\/hub.helm.sh\/\">hub.helm.sh<\/a><\/noindex>, pomoc\u00ed kter\u00e9 je hled\u00e1n\u00ed chart\u016f mnohem pohodln\u011bj\u0161\u00ed. Hlavn\u00ed je, \u017ee tam je mnohem v\u00edce extern\u00edch repozit\u00e1\u0159\u016f a dostupn\u00fdch t\u00e9m\u011b\u0159 800 chart\u016f. Nav\u00edc, m\u016f\u017eete p\u0159ipojit sv\u016fj repozit\u00e1\u0159, pokud z n\u011bjak\u00e9ho d\u016fvodu nechcete pos\u00edlat sv\u00e9 chartov\u00e9 soubory do stable.<\/p>\n<p>Vyzkou\u0161ejte hub.helm.sh a poj\u010fme ho spole\u010dn\u011b rozv\u00edjet. Tato slu\u017eba je pod projektem Helm a m\u016f\u017eete p\u0159isp\u011bt i do jeho UI, pokud jste front-end v\u00fdvoj\u00e1\u0159 a chcete jen zlep\u0161it vzhled.<\/p>\n<p>Chci je\u0161t\u011b upozornit na <strong>integraci Open Service Broker API<\/strong>. Zn\u00ed to slo\u017eit\u011b a nejasn\u011b, ale \u0159e\u0161\u00ed \u00fakoly, s nimi\u017e se ka\u017ed\u00fd pot\u00fdk\u00e1. Vysv\u011btl\u00edm to na jednoduch\u00e9m p\u0159\u00edkladu.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/3aeb7e0781e50a79b518f1056873f73a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00e1me Kubernetes cluster, ve kter\u00e9m chceme spustit klasickou aplikaci \u2014 WordPress. Obvykle pro plnou funk\u010dnost pot\u0159ebujeme datab\u00e1zi. Existuje mnoho r\u016fzn\u00fdch \u0159e\u0161en\u00ed, nap\u0159\u00edklad m\u016f\u017eeme spustit sv\u016fj stateful servis. To nen\u00ed p\u0159\u00edli\u0161 pohodln\u00e9, ale mnoho lid\u00ed to tak d\u011bl\u00e1.<\/p>\n<p>Jin\u00ed, nap\u0159\u00edklad my v Chainstack, pou\u017e\u00edvaj\u00ed spravovan\u00e9 datab\u00e1ze, jako je MySQL nebo PostgreSQL, pro servery. Proto m\u00e1me datab\u00e1zi n\u011bkde v cloudu.<\/p>\n<p>Ale vznik\u00e1 probl\u00e9m: mus\u00edme propojit na\u0161i slu\u017ebu s datab\u00e1z\u00ed, vytvo\u0159it flavor datab\u00e1ze, p\u0159edat p\u0159ihla\u0161ovac\u00ed \u00fadaje a n\u011bjak s nimi spravovat. To v\u0161e se obvykle d\u011bl\u00e1 ru\u010dn\u011b syst\u00e9mov\u00fdm administr\u00e1torem nebo v\u00fdvoj\u00e1\u0159em. A nen\u00ed \u017e\u00e1dn\u00fd probl\u00e9m, kdy\u017e je aplikac\u00ed m\u00e1lo. Kdy\u017e jich je hodn\u011b, pot\u0159ebujete kombin\u00e1tor. Takov\u00fd kombin\u00e1tor existuje \u2014 to je Service Broker. Umo\u017e\u0148uje pou\u017e\u00edt speci\u00e1ln\u00ed plugin na klastru ve\u0159ejn\u00e9ho cloudu a objedn\u00e1vat zdroje u poskytovatele prost\u0159ednictv\u00edm Brokeru, jako by to bylo API. Pro to lze pou\u017e\u00edt nativn\u00ed prost\u0159edky Kubernetes.<\/p>\n<p>Je to velmi jednoduch\u00e9. M\u016f\u017eete nap\u0159\u00edklad po\u017e\u00e1dat o Managed MySQL v Azure s z\u00e1kladn\u00edm tierem (to lze nastavit). S pou\u017eit\u00edm Azure API bude datab\u00e1ze vytvo\u0159ena a p\u0159ipravena k pou\u017eit\u00ed. Nebudete do toho muset zasahovat, za to odpov\u00edd\u00e1 plugin. Nap\u0159\u00edklad, OSBA (plugin Azure) vr\u00e1t\u00ed p\u0159ihla\u0161ovac\u00ed \u00fadaje do slu\u017eby a p\u0159ed\u00e1 je Helm. Budete moci pou\u017e\u00edvat WordPress s cloudov\u00fdm MySQL, ani\u017e byste se museli zab\u00fdvat spravovan\u00fdmi datab\u00e1zemi a starat se o stateful slu\u017eby uvnit\u0159.<\/p>\n<blockquote><p>M\u016f\u017eeme \u0159\u00edci, \u017ee Helm funguje jako lepidlo, kter\u00e9 na jedn\u00e9 stran\u011b umo\u017e\u0148uje nasazovat slu\u017eby a na druh\u00e9 stran\u011b spot\u0159ebov\u00e1vat zdroje cloudov\u00fdch poskytovatel\u016f.<\/p><\/blockquote>\n<p>\nM\u016f\u017eete napsat sv\u016fj vlastn\u00ed plugin a vyu\u017e\u00edt celou tuto historii on-premise. Pak budete m\u00edt zkr\u00e1tka sv\u016fj plugin pro podnikov\u00e9ho cloudov\u00e9ho poskytovatele. Doporu\u010duji vyzkou\u0161et takov\u00fd p\u0159\u00edstup, zejm\u00e9na pokud m\u00e1te velk\u00fd rozsah a chcete rychle nasadit dev, staging nebo celou infrastrukturu pro funkci. To zjednodu\u0161\u00ed \u017eivot va\u0161im operac\u00edm nebo DevOps.<\/p>\n<p>Dal\u0161\u00ed objev, kter\u00fd jsem ji\u017e zm\u00ednil, je <strong>plugin helm-gcs<\/strong>, kter\u00fd v\u00e1m umo\u017e\u0148uje pou\u017e\u00edvat Google buckets (objektov\u00e9 \u00falo\u017ei\u0161t\u011b) k ukl\u00e1d\u00e1n\u00ed Helm chart\u016f.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/30888c4f9b5dba14b87ba1e29e0ebed7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPot\u0159ebujete pouze \u010dty\u0159i p\u0159\u00edkazy k jeho pou\u017eit\u00ed:<\/p>\n<ol>\n<li>nainstalovat plugin;<\/li>\n<li>spustit jeho inicializaci;<\/li>\n<li>nastavit cestu k bucketu, kter\u00fd se nach\u00e1z\u00ed v gcp;<\/li>\n<li>publikovat grafy standardn\u00edm zp\u016fsobem.<\/li>\n<\/ol>\n<p>\nKouzlo spo\u010d\u00edv\u00e1 v tom, \u017ee se pou\u017eije nativn\u00ed metoda gcp pro autorizaci. M\u016f\u017eete pou\u017e\u00edt servisn\u00ed \u00fa\u010det, \u00fa\u010det v\u00fdvoj\u00e1\u0159e \u2014 cokoliv. Je to velmi pohodln\u00e9 a nevy\u017eaduje to \u017e\u00e1dn\u00e9 n\u00e1klady na provoz. Pokud jako j\u00e1 propagujete filozofii opsless, tak to bude velmi pohodln\u00e9, zejm\u00e9na pro mal\u00e9 t\u00fdmy.<\/p>\n<h2>Alternativy<\/h2>\n<p>\nHelm nen\u00ed jedin\u00fdm \u0159e\u0161en\u00edm pro spr\u00e1vu slu\u017eeb. Mnoho lid\u00ed m\u00e1 k tomu ot\u00e1zky, pravd\u011bpodobn\u011b proto rychle vznikla t\u0159et\u00ed verze. Samoz\u0159ejm\u011b existuj\u00ed alternativy.<\/p>\n<p>Mohou to b\u00fdt specializovan\u00e1 \u0159e\u0161en\u00ed jako Ksonnet nebo Metaparticle. M\u016f\u017eete pou\u017e\u00edt sv\u00e9 klasick\u00e9 n\u00e1stroje pro spr\u00e1vu infrastruktury (Ansible, Terraform, Chef atd.) pro stejn\u00e9 \u00fa\u010dely, o kter\u00fdch jsem mluvil.<\/p>\n<p>Nakonec existuje \u0159e\u0161en\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/operator-framework\">Operator Framework<\/a><\/noindex>, jeho\u017e popularita roste.<\/p>\n<blockquote><p>Operator Framework je hlavn\u00ed alternativou k Helmu, na kterou byste se m\u011bli zam\u011b\u0159it.<\/p><\/blockquote>\n<p>\nJe v\u00edce nativn\u00ed pro CNCF a Kubernetes, <strong>ale vstupn\u00ed prah je mnohem vy\u0161\u0161\u00ed<\/strong>, je pot\u0159eba v\u00edce programovat a m\u00e9n\u011b popisovat manifesty.<\/p>\n<p>Existuj\u00ed r\u016fzn\u00e9 dopl\u0148ky, jako je Draft, Scaffold. Tyto n\u00e1stroje v\u00fdrazn\u011b usnad\u0148uj\u00ed \u017eivot, nap\u0159\u00edklad v\u00fdvoj\u00e1\u0159\u016fm zjednodu\u0161uj\u00ed cyklus odes\u00edl\u00e1n\u00ed a spu\u0161t\u011bn\u00ed Helmu pro nasazen\u00ed testovac\u00edho prost\u0159ed\u00ed. Nazval bych je roz\u0161i\u0159ova\u010di mo\u017enost\u00ed.<\/p>\n<p>Tady je n\u00e1zorn\u00fd graf o tom, kde co le\u017e\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost Helm\" src=\"\/wp-content\/uploads\/2019\/08\/81a8236c975d5e1649acaaa7989c27ba.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa ose x je \u00farove\u0148 va\u0161\u00ed osobn\u00ed kontroly nad d\u011bn\u00edm, na ose y \u2014 \u00farove\u0148 nativnosti Kubernetes. Helm verze 2 je n\u011bkde uprost\u0159ed. Verze 3 nep\u0159in\u00e1\u0161\u00ed dramatick\u00e9 zm\u011bny, ale zlep\u0161uje jak kontrolu, tak i \u00farove\u0148 nativnosti. K \u0159e\u0161en\u00edm typu Ksonnet se doporu\u010duje pod\u00edvat, i kdy\u017e zaost\u00e1vaj\u00ed za Helm 2. Samoz\u0159ejm\u011b, v\u00e1\u0161 konfigura\u010dn\u00ed mana\u017eer bude pod va\u0161\u00ed kontrolou, ale nen\u00ed zcela nativn\u00ed pro Kubernetes.<\/p>\n<p>Operator Framework je zcela nativn\u00ed pro Kubernetes a umo\u017e\u0148uje spravovat ho mnohem elegantn\u011bji a d\u016fkladn\u011bji (ale nezapom\u00ednejme na vstupn\u00ed \u00farove\u0148). Sp\u00ed\u0161e to vyhovuje specializovan\u00e9 aplikaci a vytvo\u0159en\u00ed jej\u00edho managementu, ne\u017e masov\u00e9mu stroji pro balen\u00ed velk\u00e9ho mno\u017estv\u00ed aplikac\u00ed pomoc\u00ed Helmu.<\/p>\n<p>Roz\u0161i\u0159ova\u010de prost\u011b m\u00edrn\u011b zlep\u0161uj\u00ed kontrolu, dopl\u0148uj\u00ed workflow nebo zjednodu\u0161uj\u00ed CI\/CD pipelines.<\/p>\n<h2>Budoucnost Helmu<\/h2>\n<p>\nDobr\u00e1 zpr\u00e1va je, \u017ee se objevuje Helm 3. Ji\u017e vy\u0161la alfa verze 3.0.0-alpha.2, kterou si m\u016f\u017eete vyzkou\u0161et. Je dostate\u010dn\u011b stabiln\u00ed, ale funk\u010dnost je zat\u00edm omezen\u00e1.<\/p>\n<p>K \u010demu je Helm 3? V prvn\u00ed \u0159ad\u011b se jedn\u00e1 o <strong>vymizen\u00ed Tillera<\/strong>, jako\u017eto komponentu. To je, jak u\u017e ch\u00e1pete, obrovsk\u00fd krok vp\u0159ed, proto\u017ee z pohledu bezpe\u010dnosti architektury se v\u0161e zjednodu\u0161uje.<\/p>\n<p>Kdy\u017e se vytv\u00e1\u0159el Helm 2, a to bylo za dob Kubernetes 1.8 nebo dokonce d\u0159\u00edve, mnoho koncepc\u00ed bylo nezral\u00fdch. Nap\u0159\u00edklad koncept CRD se nyn\u00ed aktivn\u011b implementuje a Helm bude <strong>pou\u017e\u00edvat CRD<\/strong>, aby uchov\u00e1val struktury. Bude mo\u017en\u00e9 pou\u017e\u00edvat pouze klienta a nemus\u00edte m\u00edt serverovou \u010d\u00e1st. Odpov\u00eddaj\u00edc\u00edm zp\u016fsobem m\u016f\u017eete pou\u017e\u00edvat nativn\u00ed p\u0159\u00edkazy Kubernetes pro pr\u00e1ci se strukturami a zdroji. To je obrovsk\u00fd krok vp\u0159ed.<\/p>\n<p>Objev\u00ed se <strong>podpora nativn\u00edch repozit\u00e1\u0159\u016f OCI<\/strong> (Open Container Initiative). To je obrovsk\u00e1 iniciativa a pro Helm je zaj\u00edmav\u00e1 p\u0159edev\u0161\u00edm pro um\u00eds\u0165ov\u00e1n\u00ed vlastn\u00edch chart\u016f. Dokonce i Docker Hub podporuje mnoho standard\u016f OCI. Nemohu p\u0159edpov\u011bd\u011bt, ale je mo\u017en\u00e9, \u017ee klasick\u00e9 poskytovatele Docker repozit\u00e1\u0159\u016f za\u010dnou nab\u00edzet mo\u017enost um\u00edstit sv\u00e9 Helm chart.<\/p>\n<p>Sporn\u00e1 ot\u00e1zka pro m\u011b je <strong>podpora Lua<\/strong>, jako \u0161ablonovac\u00edho engine pro psan\u00ed skript\u016f. Nejsem velk\u00fdm fanou\u0161kem Lua, ale to bude zcela voliteln\u00e1 mo\u017enost. Ov\u011b\u0159il jsem to t\u0159ikr\u00e1t \u2014 pou\u017eit\u00ed Lua nebude povinn\u00e9. Tak\u017ee kdo chce, m\u016f\u017ee pou\u017e\u00edt Lua, kdo m\u00e1 r\u00e1d Go \u2014 p\u0159ipojte se k na\u0161emu obrovsk\u00e9mu t\u00e1boru a pou\u017eijte go-tmpl pro to.<\/p>\n<p>Nakonec to, co mi ur\u010dit\u011b chyb\u011blo, je <strong>existence sch\u00e9matu a validace datov\u00fdch typ\u016f<\/strong>. U\u017e nebudou probl\u00e9my s int nebo string, nebude pot\u0159eba obalovat nula do dvojit\u00fdch uvozovek. Objev\u00ed se JSON schema, kter\u00e9 umo\u017en\u00ed jasn\u011b to popsat pro values.<\/p>\n<p>Bude velmi siln\u011b p\u0159epracov\u00e1na <strong>model z pohledu ud\u00e1lost\u00ed<\/strong>. Ji\u017e byla konceptu\u00e1ln\u011b pops\u00e1na. Pod\u00edvejte se do v\u011btve Helm 3 a uvid\u00edte, kolik ud\u00e1lost\u00ed, hook\u016f a jin\u00e9ho bylo p\u0159id\u00e1no, co velmi zjednodu\u0161\u00ed a na druhou stranu p\u0159id\u00e1 kontrolu nad pr\u016fb\u011bhem nasazov\u00e1n\u00ed a reakcemi na n\u011b.<\/p>\n<p>Helm 3 bude jednodu\u0161\u0161\u00ed, bezpe\u010dn\u011bj\u0161\u00ed a zaj\u00edmav\u011bj\u0161\u00ed ne proto, \u017ee bychom nem\u011bli r\u00e1di Helm 2, ale proto\u017ee Kubernetes se st\u00e1v\u00e1 pokro\u010dilej\u0161\u00edm. Odpov\u00eddaj\u00edc\u00edm zp\u016fsobem m\u016f\u017ee Helm vyu\u017e\u00edvat poznatky Kubernetes a vytv\u00e1\u0159et na n\u011bm vynikaj\u00edc\u00ed spr\u00e1vce pro Kubernetes.<\/p>\n<blockquote><p>Dal\u0161\u00ed dobrou zpr\u00e1vou je, \u017ee na <noindex><a rel=\"nofollow\" href=\"https:\/\/devopsconf.io\/moscow\/2019\">DevOpsConf<\/a><\/noindex> Alexandr Chajerov pov\u00ed, <noindex><a rel=\"nofollow\" href=\"https:\/\/devopsconf.io\/moscow\/2019\/abstracts\/5564\">zda mohou b\u00fdt kontejnery bezpe\u010dn\u00e9?<\/a><\/noindex> P\u0159ipom\u00edn\u00e1me, \u017ee konference o integraci proces\u016f v\u00fdvoje, testov\u00e1n\u00ed a provozu se kon\u00e1 v Moskv\u011b <strong>30. z\u00e1\u0159\u00ed a 1. \u0159\u00edjna<\/strong>. Do 20. srpna je je\u0161t\u011b mo\u017en\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/conf.ontico.ru\/lectures\/propose\/?conference=dc2019-moscow\">podat p\u0159\u00edsp\u011bvek<\/a><\/noindex> a pod\u011blit se o sv\u00e9 zku\u0161enosti s \u0159e\u0161en\u00edm <noindex><a rel=\"nofollow\" href=\"https:\/\/devopsconf.io\/moscow\/2019\/articles\/917\">jedn\u00e9 z mnoha<\/a><\/noindex> \u00faloh DevOps p\u0159\u00edstupu.<\/p>\n<p>Sledujte novinky a d\u011bn\u00ed konference na <noindex><a rel=\"nofollow\" href=\"http:\/\/eepurl.com\/bN_0E1\">newsletteru<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/DevOpsConfChannel\">telegramov\u00e9m kan\u00e1lu<\/a><\/noindex>.<\/p><\/blockquote>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/oleg-bunin\/blog\/462665\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u0443\u0442\u044c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430 \u043e \u0441\u0430\u043c\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0434\u043b\u044f Kubernetes \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043c\u043e\u0434\u0436\u0438: \u043a\u043e\u0440\u043e\u0431\u043a\u0430 \u2014 \u044d\u0442\u043e Helm (\u044d\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0435, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Emoji); \u0437\u0430\u043c\u043e\u043a \u2014 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c; \u0447\u0435\u043b\u043e\u0432\u0435\u0447\u0435\u043a \u2014 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b. \u041d\u0430 \u0441\u0430\u043c\u043e\u043c \u0436\u0435 \u0434\u0435\u043b\u0435, \u0432\u0441\u0435 \u0431\u0443\u0434\u0435\u0442 \u043d\u0435\u043c\u043d\u043e\u0436\u0435\u0447\u043a\u043e \u0441\u043b\u043e\u0436\u043d\u0435\u0435, \u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437 \u043f\u043e\u043b\u043e\u043d \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0441\u0434\u0435\u043b\u0430\u0442\u044c Helm \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27661,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36918","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u0443\u0442\u044c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430 \u043e \u0441\u0430\u043c\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0434\u043b\u044f Kubernetes \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043c\u043e\u0434\u0436\u0438: \u043a\u043e\u0440\u043e\u0431\u043a\u0430 \u2014 \u044d\u0442\u043e Helm (\u044d\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0435, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Emoji);.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bezopasnost-helm\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Helm | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u0443\u0442\u044c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430 \u043e \u0441\u0430\u043c\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0434\u043b\u044f Kubernetes \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043c\u043e\u0434\u0436\u0438: \u043a\u043e\u0440\u043e\u0431\u043a\u0430 \u2014 \u044d\u0442\u043e Helm (\u044d\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0435, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Emoji);.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bezopasnost-helm\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:14:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:14:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bezpe\u010dnost Helm | ProHoster","description":"Podstatu vypr\u00e1v\u011bn\u00ed o nejpopul\u00e1rn\u011bj\u0161\u00edm bal\u00ed\u010dkov\u00e9m spr\u00e1vci pro Kubernetes by bylo mo\u017en\u00e9 vyj\u00e1d\u0159it pomoc\u00ed emoji: krabice \u2014 to je Helm (to je nejvhodn\u011bj\u0161\u00ed, co m\u00e1me v posledn\u00edm vyd\u00e1n\u00ed Emoji);","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bezopasnost-helm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Helm | ProHoster","og:description":"\u0421\u0443\u0442\u044c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430 \u043e \u0441\u0430\u043c\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0434\u043b\u044f Kubernetes \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043c\u043e\u0434\u0436\u0438: \u043a\u043e\u0440\u043e\u0431\u043a\u0430 \u2014 \u044d\u0442\u043e Helm (\u044d\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0435, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Emoji);.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bezopasnost-helm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:43+00:00","article:modified_time":"2019-10-31T19:14:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36918","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:36:25","updated":"2026-01-22 05:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=36918"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36918\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/27661"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=36918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=36918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=36918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}