{"id":89143,"date":"2020-07-19T07:42:22","date_gmt":"2020-07-19T05:42:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm"},"modified":"2020-07-19T07:42:22","modified_gmt":"2020-07-19T05:42:22","slug":"avtogeneracziya-sekretov-v-helm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm","title":{"rendered":"Helmi saladuste automaatne genereerimine","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Helmi saladuste automaatne genereerimine\" src=\"\/wp-content\/uploads\/2020\/07\/e2ba6ab1bf5b50c7cfcbf62d56ff15da.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Meeskond <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/containers\/\">Kubernetes aaS Mail.ru-lt<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/workfloplus\/reusing-auto-generated-helm-secrets-a7426403d4bb\">T\u00f5lkisin l\u00fchikese m\u00e4rkuse<\/a><\/noindex> kuidas automaatselt genereerida Helm'i saladusi uuendamisel. Edasi on tekst artikli autorilt \u2014 Intoware'i tehniliselt direktorilt, SaaS-lahenduste arendajafirmalt. <\/p>\n<p>Konteinerid on vinge. Alguses olin konteinerite vastane (h\u00e4bi tunnistada), kuid n\u00fc\u00fcd toetangi t\u00e4ielikult selle tehnoloogia kasutamist. Kui sa seda loed, siis loodan, et oled edukalt sealsete Dockerite meredes navigeerinud, tunnustanud Kubernetes'e eeliseid ja teinud oma elu palju lihtsamaks Helm'iga.<\/p>\n<p>Siiski on m\u00f5ned asjad ilmselgelt keerulisemad, kui nad peaksid olema.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nKuidas automaatselt genereerida saladusi uuendamisel?<\/p>\n<p>Kubernetes'e saladus on ressurss, mis sisaldab v\u00f5tme\/v\u00e4\u00e4rtuse paare, mida soovite oma koodis kasutada. Need v\u00f5ivad olla andmebaasi \u00fchenduse stringid, e-posti paroolid jne. Kasutades saladusi, loote selge eraldi koodist ja seadistustest, mis v\u00f5imaldab kergesti konfigureerida erinevaid juurutusi ilma koodibaasi muutmata.<\/p>\n<p>Sageli esinev olukord, kus kaks moodulit peavad suhtlema \u00fchise v\u00f5tme kaudu. Keegi v\u00e4ljaspool klastrit ei tohiks seda v\u00f5tme teada, kuna see on m\u00f5eldud suhtlemiseks '\u00fchelt teisele' klastris.<\/p>\n<h2>Saladuste loomine<\/h2>\n<p>\nTavaliselt, et luua saladus Helm'is, tuleb:<\/p>\n<ul>\n<li>kirjeldada saladust v\u00e4\u00e4rtuste failis;<\/li>\n<li>\u00fcletada see juurutamise protsessis;<\/li>\n<li>viidata sellele juurutamises\/pod'is;<\/li>\n<li>\u2026 kasum!<\/li>\n<\/ul>\n<p>\nTavaliselt n\u00e4eb see v\u00e4lja umbes nii:<\/p>\n<pre><code class=\"plaintext\">apiVersion: v1\nkind: Secret\nmetadata:\n  name: my-super-awesome-api-key\ntype: Opaque\nstringData:\n  apiKey: {{ .Values.MyApiKeySecret | quote }}\n<\/code><\/pre>\n<p>\n<i>Lihtne Kubernetes'e saladus, mis kasutab v\u00e4\u00e4rtusi values.yml failist<\/i><\/p>\n<p>Aga oletame, et sa ei soovi oma saladust v\u00e4\u00e4rtuste failis n\u00e4idata.<\/p>\n<p>On palju olukordi, kus juurutamiseks on vajalik \u00fcldine v\u00f5ti, mis tuleb genereerida installimise ajal.<\/p>\n<p>Eelnevas n\u00e4ites moodulite vahelise suhtlemise osas ei ole soovitatav saladust jagada juurutamise v\u00e4lises teises. Seep\u00e4rast on v\u00e4ga oluline, et Helm'il oleks mehhanismid automaatseks saladuse loomiseks ilma selle otsese n\u00e4itamiseta.<\/p>\n<h2>Hook'id<\/h2>\n<p>\nHookid v\u00f5imaldavad koodi k\u00e4ivitada teatud kohtades paigaldamisprotsessi v\u00e4ltel. V\u00f5ib-olla on konfiguratsiooniteenus, mis tuleb k\u00e4ivitada p\u00e4rast esmast paigaldamist, v\u00f5i v\u00f5ib-olla tuleb enne igasuguste v\u00e4rskenduste tegemist midagi puhastada.<\/p>\n<p>Meie probleemi lahendamiseks, kus paigaldamisel genereeritakse v\u00f5tme, sobivad ideaalselt eelinstallimise hookid. Kuid on \u00fcks pisiasi: te ei saa automaatselt \u00fche korra salajast genereerida v\u00e4rskendamise k\u00e4igus. Hookid toimivad iga v\u00e4rskenduse k\u00e4igus.<\/p>\n<p>Kuid kui olete juba oma salajase v\u00f5tme genereerinud ja teie esmane paigaldamine pole veel toimunud, siis l\u00f5petage lugemine, eelinstallimise hook sobib teile ideaalselt.<\/p>\n<p>Kuid kui saladus on osa v\u00e4rskendusest (v\u00f5ib-olla uue funktsiooni osas, mida paigaldamise ajal polnud), siis on kahju, et ei saa luua eelinstallimise hooki, mis toimiks vaid korra.<\/p>\n<h2>Funktsioonid<\/h2>\n<p>\nHelmi funktsioonid v\u00f5imaldavad lisada erinevaid skripte paigaldusstsenaariumitesse.<\/p>\n<pre><code class=\"plaintext\">apiVersion: v1\nkind: Secret\nmetadata:\n  name: my-super-awesome-api-key\ntype: Opaque\nstringData:\n  apiKey: {{ uuidv4 | quote }} #Genereerige uus UUID ja tsiteerige see\n<\/code><\/pre>\n<p>\nSelles n\u00e4ites on apiKey saladuse v\u00e4\u00e4rtus uus UUID, mis on genereeritud paigalduse k\u00e4igus.<\/p>\n<p>Helm sisaldab t\u00f5eliselt ulatuslikku funktsioonide raamatukogu, mis kasutab GO mallide h\u00e4mmastavaid funktsioone ja Sprigi funktsiooniraamatukogu kohandatud paigalduste loomiseks.<\/p>\n<h3>Funktsioon Lookup<\/h3>\n<p>\nHelm 3.1 toob sisse <noindex><a rel=\"nofollow\" href=\"https:\/\/helm.sh\/docs\/chart_template_guide\/functions_and_pipelines\/\">funktsiooni Lookup<\/a><\/noindex>, mis v\u00f5imaldab p\u00e4rida olemasolevat deploy'd ja:<\/p>\n<ul>\n<li>kontrollida ressursi olemasolu;<\/li>\n<li>tagastada olemasoleva ressursi v\u00e4\u00e4rtuse edasiseks kasutamiseks.<\/li>\n<\/ul>\n<p>\nKasutades neid kahte v\u00f5imalust, saame luua \u00fchekordselt d\u00fcnaamiliselt genereeritud salajase!<\/p>\n<pre><code class=\"plaintext\"># 1. \u0417\u0430\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u0430 \u0438 \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 $secret\n{{- $secret := (lookup &quot;v1&quot; &quot;Secret&quot; .Release.Namespace &quot;some-awesome-secret&quot; -}}\napiVersion: v1\nkind: Secret\nmetadata:\n  name: some-awesome-secret\ntype: Opaque\n\n# 2. \u0415\u0441\u043b\u0438 \u0441\u0435\u043a\u0440\u0435\u0442 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442, \u0432\u0437\u044f\u0442\u044c \u0435\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043a\u0430\u043a apiKey (\u0441\u0435\u043a\u0440\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 Base64, \u0442\u0430\u043a \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043a\u043b\u044e\u0447 &quot;data&quot;)\n{{ if $secret -}}\ndata:\n  apiKey: {{ $secret.data.apiKey }}\n\n# 3. \u0415\u0441\u043b\u0438 \u0441\u0435\u043a\u0440\u0435\u0442 \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u2014 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0435\u0433\u043e (\u0432 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 &quot;stringData&quot;, \u0442\u0430\u043a \u043a\u0430\u043a \u0431\u0443\u0434\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435)!\n{{ else -}}\nstringData:\n  apiKey: {{ uuidv4 | quote }}\n{{ end }}\n<\/code><\/pre>\n<p>\nIga kord, kui serverile rakendatakse uus v\u00e4rskendus, genereerib Helm kas uue salajase v\u00e4\u00e4rtuse (kui saladust veel ei ole) v\u00f5i kordab olemasoleva v\u00e4\u00e4rtuse kasutamist.<\/p>\n<p>Edu!<\/p>\n<p><strong>Mida veel selle kohta lugeda<\/strong>:<\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/tri-urovnya-avtomasshtabirovaniya-v-kubernetes-kak-ikh-effektivno-ispolzovat\">Kubernetes'is on kolm automaatskaalumise taset ja kuidas neid t\u00f5husalt kasutada<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/490362\/\">\ud83e\udd47Kuidas rahulikult magada, kui teil on pilveteenus: peamised arhitektuuri n\u00f5uanded | ProHoster<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tele.click\/k8s_mail\">Meie Tee Kuberneetes kanal Telegrmis<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/507376\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u0430\u043d\u0434\u0430 Kubernetes aaS \u043e\u0442 Mail.ru \u043f\u0435\u0440\u0435\u0432\u0435\u043b\u0430 \u043a\u043e\u0440\u043e\u0442\u043a\u0443\u044e \u0437\u0430\u043c\u0435\u0442\u043a\u0443 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u043a\u0440\u0435\u0442\u044b Helm \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438. \u0414\u0430\u043b\u0435\u0435 \u0442\u0435\u043a\u0441\u0442 \u043e\u0442 \u0430\u0432\u0442\u043e\u0440\u0430 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0430 Intoware, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438-\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 SaaS-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u041a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u2014 \u044d\u0442\u043e \u043a\u0440\u0443\u0442\u043e. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u044f \u0431\u044b\u043b \u043f\u0440\u043e\u0442\u0438\u0432\u043d\u0438\u043a\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 (\u0441\u0442\u044b\u0434\u043d\u043e \u043f\u0440\u0438\u0437\u043d\u0430\u0442\u044c\u0441\u044f), \u043d\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u044f \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0442\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438. \u0415\u0441\u043b\u0438 \u0432\u044b \u0447\u0438\u0442\u0430\u0435\u0442\u0435 \u044d\u0442\u043e, \u0442\u043e, \u043d\u0430\u0434\u0435\u044e\u0441\u044c, \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u043b\u0430\u0432\u0430\u043b\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":89144,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-89143","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u0430\u043d\u0434\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0432\u0442\u043e\u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u0432 Helm | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u0430\u043d\u0434\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-19T05:42:22+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-19T05:42:22+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Salajaste automaatne genereerimine Helm | ProHoster","description":"Meeskond","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0432\u0442\u043e\u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u0432 Helm | ProHoster","og:description":"\u041a\u043e\u043c\u0430\u043d\u0434\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-19T05:42:22+00:00","article:modified_time":"2020-07-19T05:42:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"89143","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:15:24","updated":"2022-10-05 12:06:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/89143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=89143"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/89143\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/89144"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=89143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=89143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=89143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}