{"id":89143,"date":"2020-07-19T07:42:22","date_gmt":"2020-07-19T05:42:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm"},"modified":"2020-07-19T07:42:22","modified_gmt":"2020-07-19T05:42:22","slug":"avtogeneracziya-sekretov-v-helm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm","title":{"rendered":"Automatisk generering af hemmeligheder i Helm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Automatisk generering af hemmeligheder i Helm\" src=\"\/wp-content\/uploads\/2020\/07\/e2ba6ab1bf5b50c7cfcbf62d56ff15da.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Kommandoen <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/containers\/\">Kubernetes aaS fra Mail.ru<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/workfloplus\/reusing-auto-generated-helm-secrets-a7426403d4bb\">oversatte en kort bem\u00e6rkning<\/a><\/noindex> om hvordan man automatisk genererer Helm-hemmeligheder ved opdatering. Her er teksten fra forfatteren af artiklen \u2014 teknisk direkt\u00f8r hos Intoware, en virksomhed, der udvikler SaaS-l\u00f8sninger. <\/p>\n<p>Containere er fantastiske. I starten var jeg modstander af containere (det er pinligt at indr\u00f8mme), men nu st\u00f8tter jeg fuldt ud brugen af denne teknologi. Hvis du l\u00e6ser dette, s\u00e5 h\u00e5ber jeg, du har sejlet sikkert gennem Docker-havene, indset fordelene ved Kubernetes og gjort dit liv meget lettere med Helm.<\/p>\n<p>Men nogle ting er tydeligvis sv\u00e6rere, end de b\u00f8r v\u00e6re.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nHvordan automatisk generere hemmeligheder ved opdatering?<\/p>\n<p>En Kubernetes-hemmelighed er en ressource, der indeholder n\u00f8gle\/v\u00e6rdi-par, som du \u00f8nsker at bruge i din kode. Det kan v\u00e6re forbindelsesstrenge til databaser, e-mailadgangskoder og s\u00e5 videre. Ved at bruge hemmeligheder skaber du en klar adskillelse mellem kode og konfiguration, hvilket g\u00f8r det nemt at konfigurere forskellige implementeringer uden at \u00e6ndre kodebasen.<\/p>\n<p>En almindelig situation, n\u00e5r to moduler skal interagere ved hj\u00e6lp af en f\u00e6lles n\u00f8gle. Ingen uden for klusteret skal kende denne n\u00f8gle, da den er beregnet til kommunikation \"fra den ene til den anden\" inden for klusteret.<\/p>\n<h2>Oprettelse af hemmeligheder<\/h2>\n<p>\nNormalt, for at oprette en hemmelighed i Helm, skal du:<\/p>\n<ul>\n<li>beskrive hemmeligheden i en v\u00e6rdifil;<\/li>\n<li>override den under implementeringen;<\/li>\n<li>henvise til den inden for implementeringen\/poden;<\/li>\n<li>\u2026 profit!<\/li>\n<\/ul>\n<p>\nNormalt ser det cirka s\u00e5ledes ud:<\/p>\n<pre><code class=\"plaintext\">apiVersion: v1\nkind: Secret\nmetadata:\n  name: my-super-awesome-api-key\ntype: Opaque\nstringData:\n  apiKey: {{ .Values.MyApiKeySecret | quote }}\n<\/code><\/pre>\n<p>\n<i>En enkel Kubernetes-hemmelighed, der bruger v\u00e6rdier fra values.yml<\/i><\/p>\n<p>Men lad os sige, at du ikke \u00f8nsker at angive din hemmelighed i v\u00e6rdifilen.<\/p>\n<p>Der er mange scenarier, hvor en f\u00e6lles n\u00f8gle, der skal genereres under installationen, er n\u00f8dvendig for implementeringen.<\/p>\n<p>I det tidligere eksempel med interaktionen mellem modulerne er det u\u00f8nsket at dele hemmeligheden uden for implementeringen. Derfor er det meget \u00f8nskeligt, at Helm har mekanismer til automatisk at oprette hemmeligheden uden at skulle angive den direkte.<\/p>\n<h2>Hooks<\/h2>\n<p>\nHooks giver mulighed for at k\u00f8re kode p\u00e5 bestemte tidspunkter under installationsprocessen. M\u00e5ske er der en konfigurationsopgave, der skal k\u00f8res efter den f\u00f8rste installation, eller m\u00e5ske er det n\u00f8dvendigt at udf\u00f8re en oprydning f\u00f8r enhver opdatering.<\/p>\n<p>For at l\u00f8se vores problem med at tilf\u00f8je en n\u00f8gle, der genereres ved installation, er pre-install hooks ideelle. Men der er et problem: Du kan ikke automatisk generere en hemmelighed \u00e9n gang ved opdatering. Hooks vil fungere ved hver opdatering.<\/p>\n<p>Men hvis du har genereret din hemmelighed, og din f\u00f8rste installation endnu ikke har fundet sted, s\u00e5 stop med at l\u00e6se, for en pre-install hook vil v\u00e6re perfekt for dig.<\/p>\n<p>Men hvis hemmeligheden er en del af opdateringen (m\u00e5ske en ny funktion, der ikke fandtes under installationen), er det \u00e6rgerligt, at du ikke kan oprette en pre-install hook, der kun fungerer \u00e9n gang.<\/p>\n<h2>Functions<\/h2>\n<p>\nHelm-funktioner giver mulighed for at tilf\u00f8je forskellige script-elementer til deployments scripts.<\/p>\n<pre><code class=\"plaintext\">apiVersion: v1\nkind: Secret\nmetadata:\n  name: my-super-awesome-api-key\ntype: Opaque\nstringData:\n  apiKey: {{ uuidv4 | quote }} #Generer et nyt UUID og s\u00e6t det i citationstegn\n<\/code><\/pre>\n<p>\nI dette eksempel vises det, at v\u00e6rdien af hemmeligheden apiKey vil v\u00e6re et nyt UUID, genereret under installationen.<\/p>\n<p>Helm inkluderer et virkelig omfattende bibliotek af funktioner, der bruger de fantastiske GO-skabelonfunktioner og Sprig-funktionsbiblioteket til at skabe tilpassede deployment.<\/p>\n<h3>Lookup-funktion<\/h3>\n<p>\nLookup-funktionen blev tilf\u00f8jet i Helm 3.1 <noindex><a rel=\"nofollow\" href=\"https:\/\/helm.sh\/docs\/chart_template_guide\/functions_and_pipelines\/\">lookup-funktion<\/a><\/noindex>, der giver mulighed for at foresp\u00f8rge eksisterende deploys og:<\/p>\n<ul>\n<li>tjekke eksistensen af ressourcer;<\/li>\n<li>returnere v\u00e6rdien af en eksisterende ressource til senere brug.<\/li>\n<\/ul>\n<p>\nVed at bruge begge disse funktioner kan vi oprette en engangs dynamisk genereret hemmelighed!<\/p>\n<pre><code class=\"plaintext\"># 1. \u0417\u0430\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u0430 \u0438 \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 $secret\n{{- $secret := (lookup &quot;v1&quot; &quot;Secret&quot; .Release.Namespace &quot;some-awesome-secret&quot; -}}\napiVersion: v1\nkind: Secret\nmetadata:\n  name: some-awesome-secret\ntype: Opaque\n\n# 2. \u0415\u0441\u043b\u0438 \u0441\u0435\u043a\u0440\u0435\u0442 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442, \u0432\u0437\u044f\u0442\u044c \u0435\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043a\u0430\u043a apiKey (\u0441\u0435\u043a\u0440\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 Base64, \u0442\u0430\u043a \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043a\u043b\u044e\u0447 &quot;data&quot;)\n{{ if $secret -}}\ndata:\n  apiKey: {{ $secret.data.apiKey }}\n\n# 3. \u0415\u0441\u043b\u0438 \u0441\u0435\u043a\u0440\u0435\u0442 \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u2014 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0435\u0433\u043e (\u0432 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 &quot;stringData&quot;, \u0442\u0430\u043a \u043a\u0430\u043a \u0431\u0443\u0434\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435)!\n{{ else -}}\nstringData:\n  apiKey: {{ uuidv4 | quote }}\n{{ end }}\n<\/code><\/pre>\n<p>\nHver gang en ny opdatering anvendes p\u00e5 serveren, vil Helm enten generere en ny v\u00e6rdi for hemmeligheden (hvis hemmeligheden endnu ikke eksisterer) eller genbruge den eksisterende v\u00e6rdi.<\/p>\n<p>Held og lykke!<\/p>\n<p><strong>Andre artikler om emnet<\/strong>:<\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/tri-urovnya-avtomasshtabirovaniya-v-kubernetes-kak-ikh-effektivno-ispolzovat\">Tre niveauer af automatisk skalering i Kubernetes, og hvordan man bruger dem effektivt<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/490362\/\">Kubernetes i pirat\u00e5nd med en implementeringsskabelon<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tele.click\/k8s_mail\">Vores kanal Omkring Kubernetes p\u00e5 Telegram<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/507376\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u0430\u043d\u0434\u0430 Kubernetes aaS \u043e\u0442 Mail.ru \u043f\u0435\u0440\u0435\u0432\u0435\u043b\u0430 \u043a\u043e\u0440\u043e\u0442\u043a\u0443\u044e \u0437\u0430\u043c\u0435\u0442\u043a\u0443 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u043a\u0440\u0435\u0442\u044b Helm \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438. \u0414\u0430\u043b\u0435\u0435 \u0442\u0435\u043a\u0441\u0442 \u043e\u0442 \u0430\u0432\u0442\u043e\u0440\u0430 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0430 Intoware, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438-\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 SaaS-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u041a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u2014 \u044d\u0442\u043e \u043a\u0440\u0443\u0442\u043e. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u044f \u0431\u044b\u043b \u043f\u0440\u043e\u0442\u0438\u0432\u043d\u0438\u043a\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 (\u0441\u0442\u044b\u0434\u043d\u043e \u043f\u0440\u0438\u0437\u043d\u0430\u0442\u044c\u0441\u044f), \u043d\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u044f \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0442\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438. \u0415\u0441\u043b\u0438 \u0432\u044b \u0447\u0438\u0442\u0430\u0435\u0442\u0435 \u044d\u0442\u043e, \u0442\u043e, \u043d\u0430\u0434\u0435\u044e\u0441\u044c, \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u043b\u0430\u0432\u0430\u043b\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":89144,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-89143","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u0430\u043d\u0434\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0432\u0442\u043e\u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u0432 Helm | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u0430\u043d\u0434\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-19T05:42:22+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-19T05:42:22+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Auto-generering af hemmeligheder i Helm | ProHoster","description":"Kommandoen","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0432\u0442\u043e\u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u0432 Helm | ProHoster","og:description":"\u041a\u043e\u043c\u0430\u043d\u0434\u0430","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-19T05:42:22+00:00","article:modified_time":"2020-07-19T05:42:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"89143","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:15:24","updated":"2022-10-05 12:06:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/89143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=89143"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/89143\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/89144"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=89143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=89143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=89143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}