Helm Kev Ruaj Ntseg

Lub ntsiab lus ntawm zaj dab neeg hais txog tus thawj tswj pob nrov tshaj plaws rau Kubernetes tuaj yeem piav qhia siv emoji:

• lub thawv yog Helm (uas yog qhov ze tshaj plaws rau qhov tseeb Emoji tso tawm);
• xauv - kev ruaj ntseg;
• tus txiv neej me yog qhov kev daws teeb meem.

Qhov tseeb, txhua yam yuav nyuaj me ntsis, thiab zaj dab neeg yog tag nrho ntawm cov lus qhia txog Yuav ua li cas kom Helm nyab xeeb.

• Luv luv dab tsi yog Helm yog tias koj tsis paub lossis tsis nco qab. Nws daws teeb meem dab tsi thiab nws nyob qhov twg hauv ecosystem.
• Cia peb saib ntawm Helm architecture. Tsis muaj kev sib tham txog kev ruaj ntseg thiab yuav ua li cas los ua ib qho cuab yeej lossis kev daws teeb meem kom ruaj ntseg yog ua tiav yam tsis tau nkag siab txog cov qauv ntawm cov khoom siv.
• Cia peb tham txog Helm Cheebtsam.
• Cov lus nug uas kub siab tshaj plaws yog yav tom ntej - qhov tshiab ntawm Helm 3. 

Txhua yam hauv tsab xov xwm no siv rau Helm 2. Cov version no yog tam sim no nyob rau hauv ntau lawm thiab feem ntau yuav yog qhov koj tab tom siv, thiab nws yog cov version uas muaj kev pheej hmoo ntawm kev ruaj ntseg.

Hais txog tus hais lus: Alexander Khayorov (ua allex) tau tsim los rau 10 xyoo, pab txhim kho cov ntsiab lus Moscow Python Conf++ thiab koom nrog pawg neeg Helm Summit. Tam sim no nws ua haujlwm ntawm Chainstack ua tus thawj coj kev txhim kho - qhov no yog kev sib txuas ntawm tus thawj tswj hwm kev txhim kho thiab tus neeg uas yog lub luag haujlwm xa tawm qhov kawg. Ntawd yog, nws yog nyob rau hauv kev sib ntaus sib tua, qhov twg txhua yam tshwm sim los ntawm kev tsim cov khoom lag luam rau nws txoj haujlwm.

Chainstack yog ib qho me me, nquag pib ua lag luam uas nws lub hom phiaj yog los ua kom cov neeg siv khoom tsis nco qab txog cov kev tsim kho vaj tse thiab kev nyuaj ntawm kev khiav hauj lwm kev lag luam; pab pawg txhim kho nyob hauv Singapore. Tsis txhob nug Chainstack muag lossis yuav cryptocurrency, tab sis muab tham txog kev lag luam blockchain lub hauv paus, thiab lawv yuav zoo siab teb koj.

Helm

Qhov no yog pob (daim duab) tus thawj coj rau Kubernetes. Txoj hauv kev yooj yim tshaj plaws thiab thoob ntiaj teb coj cov ntawv thov mus rau Kubernetes pawg.

Peb yog, tau kawg, tham txog kev tsim qauv thiab kev lag luam ntau dua li tsim koj tus kheej YAML manifests thiab sau cov khoom siv me me.

Helm yog qhov zoo tshaj plaws uas tam sim no muaj thiab nrov.

Vim li cas Helm? Feem ntau vim nws tau txais kev txhawb los ntawm CNCF. Huab Native yog ib lub koom haum loj thiab yog lub tuam txhab niam txiv rau cov haujlwm Kubernetes, thiab lwm yam, Fluentd thiab lwm yam.

Lwm qhov tseeb tseem ceeb yog Helm yog ib txoj haujlwm nrov heev. Thaum kuv pib tham txog yuav ua li cas kom Helm ruaj ntseg thaum Lub Ib Hlis 2019, qhov project muaj ntau txhiab hnub qub ntawm GitHub. Txog lub Tsib Hlis muaj 12 txhiab tus ntawm lawv.

Ntau tus neeg nyiam Helm, yog li txawm tias koj tsis siv nws, koj yuav tau txais txiaj ntsig los ntawm kev paub txog nws txoj kev ruaj ntseg. Kev nyab xeeb yog qhov tseem ceeb.

Pab pawg tub ntxhais Helm tau txais kev txhawb nqa los ntawm Microsoft Azure thiab yog li ntawd ib txoj haujlwm ruaj khov, tsis zoo li ntau lwm tus. Kev tso tawm Helm 3 Alpha 2 nyob rau nruab nrab Lub Xya Hli qhia tias muaj ntau tus neeg ua haujlwm ntawm qhov project, thiab lawv muaj lub siab xav thiab lub zog los tsim thiab txhim kho Helm.

Helm daws ob peb lub hauv paus teeb meem ntawm daim ntawv thov kev tswj hwm hauv Kubernetes.

• Daim ntawv thov ntim. Txawm tias ib daim ntawv thov zoo li "Nyob Zoo, Ntiaj Teb" ntawm WordPress twb muaj ntau yam kev pabcuam, thiab koj xav ntim lawv ua ke.
• Tswj qhov nyuaj uas tuaj nrog tswj cov ntawv thov no.
• Lub neej voj voog uas tsis xaus tom qab daim ntawv thov raug teeb tsa lossis xa mus. Nws tseem nyob, nws yuav tsum tau hloov kho, thiab Helm pab nrog qhov no thiab sim coj cov kev ntsuas thiab cov cai rau qhov no.

Hnab ntim khoom nws tau teeb tsa hauv txoj kev tseeb: muaj cov metadata tag nrho raws li kev ua haujlwm ntawm tus thawj tswj pob ib txwm muaj rau Linux, Windows lossis macOS. Ntawd yog, qhov chaw cia khoom, kev vam khom rau ntau lub pob, cov ntaub ntawv meta rau kev siv, kev teeb tsa, kev teeb tsa, cov ntaub ntawv indexing, thiab lwm yam. Helm tso cai rau koj kom tau txais thiab siv tag nrho cov no rau kev siv.

Kev tswj kev nyuaj. Yog tias koj muaj ntau daim ntawv thov ntawm tib hom, ces parameterization yog xav tau. Templates los ntawm qhov no, tab sis kom tsis txhob muaj los ntawm koj tus kheej txoj kev tsim cov qauv, koj tuaj yeem siv yam Helm muab tawm ntawm lub thawv.

Application Lifecycle Management - hauv kuv lub tswv yim, qhov no yog cov lus nug tseem ceeb tshaj plaws thiab tsis daws teeb meem. Qhov no yog vim li cas kuv thiaj tuaj rau Helm rov qab rau hnub. Peb yuav tsum tau ua tib zoo saib ntawm daim ntawv thov lub neej thiab xav txav peb CI / CD thiab daim ntawv thov mus rau qhov kev coj ua no.

Helm tso cai rau koj mus:

• tswj kev xa tawm, qhia txog lub tswv yim ntawm kev teeb tsa thiab kev kho dua tshiab;
• ua tiav rollback;
• siv hooks rau cov xwm txheej sib txawv;
• ntxiv daim ntawv thov kev kuaj xyuas ntxiv thiab teb rau lawv cov txiaj ntsig.

Tsis tas li ntawd Helm muaj "batteries" - Ntau cov khoom qab zib uas tuaj yeem suav nrog hauv daim ntawv ntawm plugins, ua kom koj lub neej yooj yim. Plugins tuaj yeem sau tau ntawm nws tus kheej, lawv nyob ib leeg thiab tsis tas yuav muaj kev sib haum xeeb. Yog tias koj xav siv qee yam, kuv pom zoo kom ua nws li plugin, thiab tom qab ntawd tejzaum nws suav nrog hauv cov dej ntws.

Helm yog nyob ntawm peb lub ntsiab lus tseem ceeb:

• Chart Repo - piav qhia thiab array ntawm parameterizations ua tau rau koj manifest. 
• Config -uas yog, qhov tseem ceeb uas yuav siv tau (cov ntawv nyeem, tus lej lej, thiab lwm yam).
• tso tawm sau ob lub ntsiab lus sab saud, thiab ua ke lawv tig mus rau Kev Tso Tawm. Kev tso tawm tuaj yeem hloov kho, yog li ua tiav lub voj voog lub neej: me me thaum lub sijhawm teeb tsa thiab loj thaum lub sijhawm hloov kho, txo qis lossis rov qab.

Helm architecture

Daim duab conceptually depicts lub high-theem architecture ntawm Helm.

Cia kuv ceeb toom rau koj tias Helm yog ib yam dab tsi cuam tshuam nrog Kubernetes. Yog li, peb tsis tuaj yeem ua yam tsis muaj Kubernetes pawg (lub kaum sab xis). Kube-apiserver tivthaiv nyob ntawm tus tswv. Yog tsis muaj Helm peb muaj Kubeconfig. Helm nqa ib qho me me binary, yog tias koj tuaj yeem hu nws tias, Helm CLI kev siv hluav taws xob, uas tau nruab rau hauv lub computer, laptop, mainframe - ntawm txhua yam.

Tab sis qhov no tsis txaus. Helm muaj cov khoom siv server hu ua Tiller. Nws sawv cev rau kev txaus siab ntawm Helm nyob rau hauv pawg; nws yog ib daim ntawv thov nyob rau hauv lub Kubernetes pawg, ib yam li lwm yam.

Cov khoom txuas ntxiv ntawm Chart Repo yog qhov chaw cia khoom nrog cov kab kos. Muaj ib qho chaw cia khoom, thiab tej zaum yuav muaj chaw cia khoom ntiag tug ntawm lub tuam txhab lossis qhov project.

Kev sib cuam tshuam

Cia peb saib yuav ua li cas cov khoom vaj tsev sib cuam tshuam thaum peb xav nruab ib daim ntawv thov siv Helm.

• Peb tab tom sib tham Helm install, nkag mus rau qhov chaw khaws cia (Chart Repo) thiab tau txais daim ntawv qhia Helm.

• Helm utility (Helm CLI) cuam tshuam nrog Kubeconfig txhawm rau txheeb xyuas seb pawg twg yuav tiv tauj. 
• Tau txais cov ntaub ntawv no, cov nqi hluav taws xob yog hais txog Tiller, uas nyob hauv peb pawg, raws li daim ntawv thov. 
• Tiller hu rau Kube-apiserver los ua haujlwm hauv Kubernetes, tsim qee yam khoom (kev pabcuam, pods, replicas, secrets, thiab lwm yam).

Tom ntej no, peb yuav ua rau daim duab nyuaj kom pom qhov kev tawm tsam vector uas tag nrho Helm architecture tag nrho tuaj yeem raug nthuav tawm. Thiab tom qab ntawd peb yuav sim tiv thaiv nws.

Attack vector

Thawj qhov muaj peev xwm tsis muaj zog yog muaj cai API-tus neeg siv. Raws li ib feem ntawm lub tswv yim, qhov no yog ib tug neeg nyiag nkas uas tau txais admin nkag mus rau Helm CLI.

Cov neeg siv API tsis muaj cai kuj tuaj yeem ua rau muaj kev phom sij yog tias nws nyob ib puag ncig. Xws li tus neeg siv yuav muaj cov ntsiab lus sib txawv, piv txwv li, nws tuaj yeem kho tau hauv ib pawg npe chaw nyob hauv Kubeconfig chaw.

Qhov kev tawm tsam zoo tshaj plaws yuav yog cov txheej txheem uas nyob hauv ib pawg nyob ze ntawm Tiller thiab tuaj yeem nkag mus rau nws. Qhov no tuaj yeem yog lub web server lossis microservice uas pom lub network ib puag ncig ntawm pawg.

Ib qho txawv, tab sis nce nrov, tawm tsam variant suav nrog Chart Repo. Ib daim duab uas tsim los ntawm tus kws sau ntawv tsis paub zoo yuav muaj cov khoom siv tsis zoo, thiab koj yuav ua kom tiav los ntawm kev coj nws ntawm kev ntseeg. Lossis nws tuaj yeem hloov daim duab uas koj rub tawm los ntawm lub chaw khaws ntaub ntawv thiab, piv txwv li, tsim cov peev txheej hauv daim ntawv ntawm cov cai thiab nce nws txoj kev nkag mus.

Cia peb sim tiv thaiv kev tawm tsam los ntawm tag nrho plaub sab thiab txheeb xyuas qhov twg muaj teeb meem hauv Helm architecture, thiab qhov twg, tej zaum, tsis muaj.

Cia peb nthuav daim duab, ntxiv cov ntsiab lus ntxiv, tab sis khaws tag nrho cov ntsiab lus tseem ceeb.

Lub Helm CLI sib txuas lus nrog Daim Ntawv Qhia Repo, cuam tshuam nrog Kubeconfig, thiab kev ua haujlwm raug xa mus rau pawg mus rau Tiller tivthaiv.

Tiller yog sawv cev los ntawm ob yam khoom:

• Tiller-deploy svc, uas nthuav tawm ib qho kev pabcuam;
• Tiller-deploy pod (nyob rau hauv daim duab nyob rau hauv ib daim qauv ntawm ib tug replica), uas tag nrho cov load khiav, uas nkag mus rau hauv pawg.

Cov txheej txheem sib txawv thiab cov txheej txheem yog siv rau kev sib cuam tshuam. Los ntawm kev saib xyuas kev ruaj ntseg, peb txaus siab tshaj plaws hauv:

• Lub tshuab uas Helm CLI nkag mus rau daim ntawv qhia repo: dab tsi raws tu qauv, puas muaj kev lees paub thiab yuav ua li cas nrog nws.
• Cov txheej txheem los ntawm Helm CLI, siv kubectl, sib txuas lus nrog Tiller. Qhov no yog RPC server ntsia hauv pawg.
• Tiller nws tus kheej nkag mus rau microservices uas nyob hauv pawg thiab cuam tshuam nrog Kube-apiserver.

Cia peb tham txog tag nrho cov cheeb tsam no nyob rau hauv kev txiav txim.

RBAC

Tsis muaj ib qho ntsiab lus hais txog kev ruaj ntseg rau Helm lossis lwm yam kev pabcuam hauv pawg tshwj tsis yog RBAC tau qhib.

Nws zoo nkaus li qhov no tsis yog qhov kev pom zoo tshiab, tab sis kuv paub tseeb tias ntau tus neeg tseem tsis tau qhib RBAC txawm tias nyob rau hauv kev tsim khoom, vim tias nws muaj ntau qhov fuss thiab ntau yam yuav tsum tau teeb tsa. Txawm li cas los xij, kuv txhawb kom koj ua qhov no.

https://rbac.dev/ - Tus kws lij choj lub vev xaib rau RBAC. Nws muaj ntau cov ntaub ntawv nthuav dav uas yuav pab koj teeb tsa RBAC, qhia tias yog vim li cas nws thiaj li zoo thiab yuav ua li cas nyob nrog nws hauv kev tsim khoom.

Kuv mam li sim piav qhia seb Tiller thiab RBAC ua haujlwm li cas. Tiller ua haujlwm hauv pawg hauv qab ib qho kev pabcuam nyiaj txiag. Feem ntau, yog tias RBAC tsis teeb tsa, qhov no yuav yog tus superuser. Hauv kev teeb tsa yooj yim, Tiller yuav yog tus tswj hwm. Qhov no yog vim li cas nws feem ntau hais tias Tiller yog SSH qhov rau koj pawg. Qhov tseeb, qhov no yog qhov tseeb, yog li koj tuaj yeem siv cov kev pabcuam tshwjxeeb tshwj xeeb tsis yog Default Service Account hauv daim duab saum toj no.

Thaum koj pib Helm thiab nruab nws ntawm tus neeg rau zaub mov thawj zaug, koj tuaj yeem teeb tsa tus account siv --service-account. Qhov no yuav tso cai rau koj siv tus neeg siv nrog yam tsawg kawg nkaus uas yuav tsum tau muaj cov cai. Muaj tseeb, koj yuav tau tsim xws li "garland": Lub luag hauj lwm thiab RoleBinding.

Hmoov tsis zoo, Helm yuav tsis ua qhov no rau koj. Koj lossis koj tus thawj tswj hwm Kubernetes yuav tsum tau npaj cov Txheej Txheem thiab RoleBindings rau kev pabcuam-tus account ua ntej txhawm rau hla Helm.

Cov lus nug tshwm sim - Dab tsi yog qhov txawv ntawm Lub Luag Haujlwm thiab ClusterRole? Qhov txawv yog tias ClusterRole ua haujlwm rau txhua qhov chaw npe, tsis zoo li Cov Haujlwm li niaj zaus thiab RoleBindings, uas tsuas yog ua haujlwm rau lub npe tshwj xeeb. Koj tuaj yeem teeb tsa cov cai rau tag nrho pawg thiab tag nrho cov npe chaw, lossis kho tus kheej rau txhua lub npe ntawm tus kheej.

Nws tsim nyog hais tias RBAC daws lwm qhov teeb meem loj. Muaj coob tus neeg yws tias Helm, hmoov tsis, tsis yog multitenancy (tsis txhawb multitenancy). Yog tias ob peb pab neeg haus ib pawg thiab siv Helm, nws tsis yooj yim sua kom teeb tsa cov cai thiab txwv lawv txoj kev nkag mus rau hauv pawg no, vim tias muaj qee qhov kev pabcuam hauv qab uas Helm khiav, thiab nws tsim tag nrho cov peev txheej hauv pawg los ntawm hauv qab nws. , uas qee zaum tsis yooj yim heev. Qhov no muaj tseeb - zoo li cov ntaub ntawv binary nws tus kheej, zoo li cov txheej txheem, Helm Tiller tsis muaj lub tswv yim ntawm multitenancy.

Txawm li cas los xij, muaj txoj hauv kev zoo uas tso cai rau koj khiav Tiller ntau zaus hauv pawg. Tsis muaj teeb meem nrog qhov no, Tiller tuaj yeem tsim tawm hauv txhua lub npe. Yog li, koj tuaj yeem siv RBAC, Kubeconfig ua cov ntsiab lus, thiab txwv kev nkag mus rau Helm tshwj xeeb.

Nws yuav zoo li no.

Piv txwv li, muaj ob lub Kubeconfigs nrog cov ntsiab lus rau cov pab pawg sib txawv (ob lub npe): X Pab Pawg rau pawg txhim kho thiab pawg tswj hwm. Pawg admin muaj nws tus kheej dav Tiller, uas yog nyob rau hauv Kube-system namespace, ib qho kev pabcuam zoo tshaj-tus account. Thiab ib lub npe tshwj xeeb rau pab pawg txhim kho, lawv yuav tuaj yeem xa lawv cov kev pabcuam rau lub npe tshwj xeeb.

Qhov no yog txoj hauv kev ua haujlwm, Tiller tsis yog lub zog tshaib plab uas nws yuav cuam tshuam rau koj cov peev nyiaj. Qhov no yog ib qho ntawm cov kev daws teeb meem ceev.

Xav tias dawb los teeb tsa Tiller cais thiab muab Kubeconfig nrog cov ntsiab lus rau pab pawg, rau tus tsim tshwj xeeb lossis rau ib puag ncig: Dev, Staging, Production (nws tsis ntseeg tias txhua yam yuav nyob ntawm tib pawg, txawm li cas los xij, qhov no tuaj yeem ua tiav).

Txuas ntxiv peb zaj dab neeg, cia peb hloov ntawm RBAC thiab tham txog ConfigMaps.

ConfigMaps

Helm siv ConfigMaps ua nws cov ntaub ntawv khaws cia. Thaum peb tham txog architecture, tsis muaj cov ntaub ntawv nyob qhov twg uas yuav khaws cov ntaub ntawv hais txog kev tshaj tawm, kev teeb tsa, rollbacks, thiab lwm yam. ConfigMaps yog siv rau qhov no.

Qhov teeb meem tseem ceeb nrog ConfigMaps paub - lawv tsis muaj kev nyab xeeb hauv txoj cai; Nws yog tsis yooj yim sua kom khaws cov ntaub ntawv rhiab heev. Peb tab tom tham txog txhua yam uas yuav tsum tsis txhob mus dhau qhov kev pabcuam, piv txwv li, passwords. Txoj hauv kev zoo tshaj plaws rau Helm tam sim no yog hloov los ntawm kev siv ConfigMaps mus rau qhov zais cia.

Qhov no ua tau yooj yim heev. Override qhov Tiller teeb tsa thiab qhia meej tias qhov chaw cia yuav yog qhov zais cia. Tom qab ntawd rau txhua qhov kev xa tawm koj yuav tsis tau txais ConfigMap, tab sis zais cia.

Koj tuaj yeem sib cav tias kev zais lawv tus kheej yog lub tswv yim coj txawv txawv thiab tsis muaj kev nyab xeeb heev. Txawm li cas los xij, nws tsim nyog nkag siab tias Kubernetes tus tsim tawm lawv tus kheej ua qhov no. Pib los ntawm version 1.10, i.e. Rau qee lub sijhawm tam sim no, nws tau ua tau, tsawg kawg hauv cov huab huab, los txuas qhov tseeb cia khaws cia zais cia. Tam sim no pab neeg no tab tom ua haujlwm rau txoj hauv kev zoo dua los faib kev nkag mus rau cov ntaub ntawv zais cia, cov pods ntawm tus kheej, lossis lwm qhov chaw.

Nws yog qhov zoo dua los hloov chaw Cia Helm mus rau qhov tsis pub lwm tus paub, thiab lawv, dhau los, tau ruaj ntseg hauv nruab nrab.

Tau kawg nws yuav nyob twj ywm cov ntaub ntawv cia txwv ntawm 1 MB. Helm ntawm no siv lwm yam raws li faib cia rau ConfigMaps. Thiab nyob ntawd lawv tau txiav txim siab tias qhov no yog cov ntaub ntawv tsim nyog rau kev rov ua dua, thiab lwm yam. Muaj kev sib tham nthuav txog qhov no ntawm Reddit, Kuv pom zoo kom nrhiav qhov kev nyeem ntawv lom zem no rau hnub so lossis nyeem cov ntawv rho tawm S, SѓS,.

Chart Repos

Cov kab kos yog qhov muaj kev sib raug zoo tshaj plaws thiab tuaj yeem dhau los ua "Tus txiv neej nyob hauv nruab nrab", tshwj xeeb tshaj yog tias koj siv cov kev daws teeb meem. Ua ntej tshaj plaws, peb tab tom tham txog cov chaw khaws cia uas nthuav tawm ntawm HTTP.

Koj twv yuav raug hu yuav tsum nthuav tawm Helm Repo hla HTTPS - qhov no yog qhov kev xaiv zoo tshaj plaws thiab pheej yig.

Xyuam xim rau daim ntawv kos npe mechanism. Lub tshuab yog yooj yim li ntuj raug txim. Qhov no yog tib yam uas koj siv ntawm GitHub, lub tshuab PGP tsis tu ncua nrog cov yuam sij pej xeem thiab ntiag tug. Teeb tsa thiab nco ntsoov, muaj cov yuam sij tsim nyog thiab kos npe txhua yam, tias qhov no yog koj daim ntawv qhia tiag tiag.

Tsis tas li, Helm tus neeg siv khoom txhawb nqa TLS (tsis yog hauv server-sab HTTP kev nkag siab, tab sis kev sib nrig sib TLS). Koj tuaj yeem siv tus neeg rau zaub mov thiab tus neeg siv khoom yuam sij txhawm rau sib txuas lus. Ua kom ncaj ncees, kuv tsis siv cov txheej txheem zoo li no vim kuv tsis nyiam daim ntawv pov thawj sib tw. Hauv paus, chartmuseum - cov cuab yeej tseem ceeb rau kev teeb tsa Helm Repo rau Helm 2 - kuj txhawb kev lees paub yooj yim. Koj tuaj yeem siv cov ntawv pov thawj yooj yim yog tias nws yooj yim dua thiab ntsiag to.

Kuj tseem muaj lub plugin pem gcs, uas tso cai rau koj los tuav Chart Repos ntawm Google Cloud Storage. Qhov no yog qhov yooj yim heev, ua haujlwm zoo thiab muaj kev nyab xeeb heev, vim tias tag nrho cov txheej txheem piav qhia tau rov ua dua tshiab.

Yog tias koj qhib HTTPS lossis TLS, siv mTLS, thiab ua kom cov ntawv pov thawj yooj yim kom txo qis kev pheej hmoo ntxiv, koj yuav tau txais kev sib txuas lus ruaj ntseg nrog Helm CLI thiab Chart Repo.

gRPC API

Cov kauj ruam tom ntej yog qhov tseem ceeb heev - kom ruaj ntseg Tiller, uas nyob hauv pawg thiab yog, ntawm ib sab, tus neeg rau zaub mov, ntawm qhov tod tes, nws tus kheej nkag mus rau lwm yam khoom thiab sim ua txuj ua ib tus neeg.

Raws li kuv twb tau hais lawm, Tiller yog ib qho kev pabcuam uas nthuav tawm gRPC, tus neeg siv Helm tuaj rau nws ntawm gRPC. Los ntawm lub neej ntawd, tau kawg, TLS yog neeg xiam. Yog vim li cas qhov no tau ua tiav yog ib lo lus nug debatable, nws zoo li kuv yuav yooj yim rau kev teeb tsa thaum pib.

Rau ntau lawm thiab txawm staging, kuv pom zoo kom qhib TLS ntawm gRPC.

Hauv kuv lub tswv yim, tsis zoo li mTLS rau kab kos, qhov no yog qhov tsim nyog ntawm no thiab ua tiav yooj yim heev - tsim PQI infrastructure, tsim daim ntawv pov thawj, tso Tiller, hloov daim ntawv pov thawj thaum pib. Tom qab ntawd, koj tuaj yeem ua tiav tag nrho Helm cov lus txib, nthuav qhia koj tus kheej nrog cov ntawv pov thawj tsim thiab tus yuam sij ntiag tug.

Txoj kev no koj yuav tiv thaiv koj tus kheej los ntawm txhua qhov kev thov rau Tiller los ntawm sab nraud pawg.

Yog li, peb tau ruaj ntseg kev sib txuas channel rau Tiller, peb twb tau tham txog RBAC thiab kho cov cai ntawm Kubernetes apiserver, txo cov npe uas nws tuaj yeem cuam tshuam.

Tiv thaiv Helm

Cia peb saib daim duab kawg. Nws yog tib yam architecture nrog tib tus xub.

Tag nrho cov kev sib txuas tam sim no tuaj yeem muaj kev nyab xeeb hauv ntsuab:

• rau Daim Ntawv Qhia Repo peb siv TLS lossis mTLS thiab cov ntawv pov thawj yooj yim;
• mTLS rau Tiller, thiab nws tau nthuav tawm raws li kev pabcuam gRPC nrog TLS, peb siv daim ntawv pov thawj;
• pawg siv cov nyiaj pabcuam tshwj xeeb nrog Lub Luag Haujlwm thiab RoleBinding. 

Peb tau ruaj ntseg rau pawg, tab sis ib tug neeg ntse hais tias:

"Muaj tsuas yog ib qho kev nyab xeeb nkaus xwb - lub khoos phis tawj hloov pauv, uas nyob rau hauv lub thawv pob zeb thiab raug saib xyuas los ntawm cov tub rog."

Muaj ntau txoj hauv kev los tswj cov ntaub ntawv thiab nrhiav cov vectors tshiab. Txawm li cas los xij, kuv ntseeg siab tias cov lus pom zoo no yuav ua tiav cov qauv kev lag luam yooj yim rau kev nyab xeeb.

Nyiaj Tswb

Qhov no tsis yog ncaj qha ntsig txog kev ruaj ntseg, tab sis kuj tseem yuav pab tau. Kuv mam li qhia koj qee yam nthuav uas tsawg tus neeg paub txog. Piv txwv li, yuav ua li cas nrhiav cov kab kos - official thiab unofficial.

Nyob rau hauv lub repository github.com/helm/charts Tam sim no muaj txog 300 kab kos thiab ob txoj kab: ruaj khov thiab incubator. Txhua tus neeg uas koom nrog paub zoo kawg nkaus tias nws nyuaj npaum li cas kom tau txais los ntawm lub tshuab nqus tsev kom ruaj khov, thiab yooj yim npaum li cas nws yuav ya tawm ntawm qhov ruaj khov. Txawm li cas los xij, qhov no tsis yog lub cuab yeej zoo tshaj plaws los tshawb nrhiav cov kab kos rau Prometheus thiab lwm yam uas koj nyiam, rau ib qho laj thawj yooj yim - nws tsis yog lub portal uas koj tuaj yeem yooj yim nrhiav cov pob.

Tab sis muaj kev pabcuam hub.helm.sh, uas ua rau nws yooj yim dua los nrhiav cov kab kos. Qhov tseem ceeb tshaj plaws, muaj ntau qhov chaw cia khoom sab nraud thiab yuav luag 800 qhov ntxim nyiam muaj. Ntxiv rau, koj tuaj yeem txuas koj lub chaw cia khoom yog tias vim qee yam koj tsis xav xa koj cov kab kos kom ruaj khov.

Sim hub.helm.sh thiab cia peb txhim kho nws ua ke. Qhov kev pabcuam no yog nyob rau hauv Helm project, thiab koj tuaj yeem pab txhawb rau nws cov UI yog tias koj yog tus tsim tawm pem hauv ntej thiab tsuas yog xav txhim kho cov tsos.

Kuv kuj xav kom koj mloog Qhib Kev Pabcuam Broker API kev koom ua ke. Nws suab cumbersome thiab tsis meej, tab sis nws daws teeb meem uas txhua leej txhua tus ntsib. Cia kuv piav nrog ib qho piv txwv yooj yim.

Muaj Kubernetes pawg uas peb xav khiav ib daim ntawv thov classic - WordPress. Feem ntau, cov ntaub ntawv yuav tsum muaj rau kev ua haujlwm puv ntoob. Muaj ntau ntau txoj kev daws teeb meem, piv txwv li, koj tuaj yeem tso koj tus kheej cov kev pabcuam hauv lub xeev. Qhov no tsis yooj yim heev, tab sis ntau tus neeg ua nws.

Lwm tus, zoo li peb ntawm Chainstack, siv cov ntaub ntawv tswj hwm zoo li MySQL lossis PostgreSQL rau lawv cov servers. Tias yog vim li cas peb cov databases nyob rau hauv ib qho chaw hauv huab.

Tab sis muaj teeb meem tshwm sim: peb yuav tsum txuas peb cov kev pabcuam nrog cov ntaub ntawv, tsim cov ntaub ntawv tsw qab, hloov cov ntawv pov thawj thiab qee yam tswj nws. Tag nrho cov no feem ntau yog ua manually los ntawm tus thawj tswj hwm lossis tus tsim tawm. Thiab tsis muaj teeb meem thaum muaj ob peb daim ntawv thov. Thaum muaj ntau ntawm lawv, koj xav tau kev sib xyaw. Muaj xws li ib tug harvester - nws yog Service Broker. Nws tso cai rau koj siv lub plugin tshwj xeeb rau pej xeem huab huab thiab xaj cov peev txheej los ntawm tus kws kho mob los ntawm Broker, zoo li nws yog API. Txhawm rau ua qhov no, koj tuaj yeem siv cov cuab yeej Kubernetes ib txwm muaj.

Nws yooj yim heev. Koj tuaj yeem nug, piv txwv li, Tswj MySQL hauv Azure nrog lub hauv paus qib (qhov no tuaj yeem teeb tsa). Siv Azure API, cov ntaub ntawv yuav raug tsim thiab npaj siv. Koj tsis tas yuav cuam tshuam nrog qhov no, lub plugin yog lub luag haujlwm rau qhov no. Piv txwv li, OSBA (Azure plugin) yuav xa rov qab daim ntawv pov thawj rau qhov kev pabcuam thiab xa mus rau Helm. Koj yuav tuaj yeem siv WordPress nrog huab MySQL, tsis cuam tshuam nrog cov ntaub ntawv tswj hwm txhua qhov thiab tsis txhawj xeeb txog cov kev pabcuam hauv lub xeev.

Peb tuaj yeem hais tias Helm ua raws li cov kua nplaum uas, ntawm ib sab, tso cai rau koj xa cov kev pabcuam, thiab ntawm qhov tod tes, siv cov peev txheej ntawm cov chaw pabcuam huab.

Koj tuaj yeem sau koj tus kheej plugin thiab siv tag nrho zaj dab neeg ntawm qhov chaw. Tom qab ntawd koj yuav tsuas muaj koj tus kheej plugin rau tus neeg muab kev pabcuam huab. Kuv pom zoo kom sim ua qhov kev qhia no, tshwj xeeb tshaj yog tias koj muaj qhov loj me thiab xav kom sai sai siv dev, staging, lossis tag nrho cov txheej txheem rau ib qho tshwj xeeb. Qhov no yuav ua rau lub neej yooj yim dua rau koj cov haujlwm lossis DevOps.

Lwm qhov pom uas kuv twb hais lawm yog helm-gcs plugin, uas tso cai rau koj siv Google-buckets (khoom cia khoom) khaws Helm kab kos.

Koj tsuas yog xav tau plaub cov lus txib kom pib siv nws:

1. nruab lub plugin;
2. pib nws;
3. teeb txoj hauv kev mus rau lub thoob, uas nyob hauv gcp;
4. luam tawm cov kab kos raws li tus qauv.

Qhov kev zoo nkauj yog tias haiv neeg gcp txoj kev yuav raug siv rau kev tso cai. Koj tuaj yeem siv tus as-qhauj pabcuam, tus account tsim tawm, txhua yam koj xav tau. Nws yooj yim heev thiab tsis muaj nqi rau kev khiav lag luam. Yog tias koj, zoo li kuv, txhawb kev xav opsless, ces qhov no yuav yooj yim heev, tshwj xeeb tshaj yog rau cov pab pawg me.

Lwm yam

Helm tsis yog tib txoj kev tswj xyuas kev daws teeb meem xwb. Muaj ntau cov lus nug txog nws, uas yog tej zaum yog vim li cas lub thib peb version tshwm sai sai. Tau kawg muaj lwm txoj hauv kev.

Cov no tuaj yeem yog cov kev daws teeb meem tshwj xeeb, piv txwv li, Ksonnet lossis Metaparticle. Koj tuaj yeem siv koj cov cuab yeej tswj vaj huam sib luag classic (Ansible, Terraform, Kws ua zaub mov, thiab lwm yam) rau tib lub hom phiaj uas kuv tau tham txog.

Thaum kawg muaj kev daws teeb meem Operator Framework, uas nws muaj koob meej loj hlob.

Operator Framework yog lwm txoj hauv kev Helm sab saum toj los xav txog.

Nws yog ntau haiv neeg rau CNCF thiab Kubernetes, tab sis qhov thaiv kev nkag mus yog ntau dua, koj yuav tsum tau program ntau dua thiab piav qhia txog qhov tshwm sim tsawg dua.

Muaj ntau yam addons, xws li Draft, Scaffold. Lawv ua kom lub neej yooj yim dua, piv txwv li, lawv ua kom yooj yim rau lub voj voog ntawm kev xa thiab xa tawm Helm rau cov neeg tsim khoom kom xa mus rau qhov chaw sim. Kuv yuav hu lawv ua tus muaj hwj chim.

Ntawm no yog ib daim ntawv qhia pom qhov twg txhua yam nyob.

Ntawm qhov x-axis yog qib ntawm koj tus kheej tswj hwm qhov tshwm sim, ntawm y-axis yog qib ntawm haiv neeg ntawm Kubernetes. Helm version 2 ntog qhov twg hauv nruab nrab. Hauv version 3, tsis yog loj heev, tab sis ob qho tib si tswj thiab qib ntawm haiv neeg tau raug txhim kho. Kev daws teeb meem ntawm qib Ksonnet tseem qis dua txawm tias Helm 2. Txawm li cas los xij, lawv tsim nyog saib kom paub tias muaj dab tsi hauv ntiaj teb no. Tau kawg, koj tus thawj tswj hwm kev teeb tsa yuav nyob hauv koj txoj kev tswj hwm, tab sis nws tsis yog ib txwm nyob rau Kubernetes.

Tus Txheej Txheem Tus Txheej Txheem yog ib txwm nyob rau Kubernetes thiab tso cai rau koj tswj hwm nws ntau dua elegantly thiab scrupulously (tab sis nco ntsoov txog qib nkag). Hloov chaw, qhov no yog qhov tsim nyog rau daim ntawv thov tshwj xeeb thiab kev tsim kev tswj hwm rau nws, tsis yog lub tshuab sau qoob loo rau ntim ntau daim ntawv thov siv Helm.

Extenders tsuas yog txhim kho kev tswj me ntsis, ntxiv rau kev ua haujlwm, lossis txiav cov ces kaum ntawm CI / CD cov kav dej.

Lub neej yav tom ntej ntawm Helm

Cov xov xwm zoo yog tias Helm 3 tab tom los, alpha version ntawm Helm 3.0.0-alpha.2 twb tau tso lawm, koj tuaj yeem sim nws. Nws yog qhov ruaj khov heev, tab sis kev ua haujlwm tseem txwv.

Vim li cas koj thiaj xav tau Helm 3? Ua ntej tshaj plaws, qhov no yog ib zaj dab neeg txog ploj ntawm Tiller, raws li ib feem. Qhov no, raws li koj twb tau nkag siab lawm, yog ib kauj ruam loj heev rau pem hauv ntej, vim hais tias los ntawm qhov kev pom ntawm kev ruaj ntseg ntawm lub architecture, txhua yam yog yooj yim.

Thaum Helm 2 tau tsim, uas nyob ib puag ncig lub sijhawm Kubernetes 1.8 lossis txawm tias ntxov dua, ntau lub tswv yim tsis paub qab hau. Piv txwv li, lub tswv yim CRD tam sim no tau ua kom nquag plias, thiab Helm yuav siv CRDkhaws cov qauv. Nws yuav siv tau tsuas yog tus neeg siv khoom thiab tsis tuav lub server. Raws li, siv ib txwm Kubernetes cov lus txib los ua haujlwm nrog cov qauv thiab cov peev txheej. Qhov no yog ib kauj ruam loj rau pem hauv ntej.

Yuav tshwm kev them nyiaj yug rau haiv neeg OCI repositories (Open Container Initiative). Qhov no yog ib qho kev pib loj, thiab Helm txaus siab feem ntau txhawm rau txhawm rau tshaj tawm nws cov kab kos. Nws los txog rau qhov uas, piv txwv li, Docker Hub txhawb ntau tus qauv OCI. Kuv tsis twv, tab sis tej zaum classic Docker repository cov chaw muab kev pab yuav pib muab sijhawm rau koj los tuav koj cov kab kos Helm.

Cov lus tsis sib haum xeeb rau kuv yog Lus txhawb, raws li lub cav template rau kev sau ntawv. Kuv tsis yog tus kiv cua loj ntawm Lua, tab sis qhov no yuav yog qhov kev xaiv ua tiav. Kuv tshawb xyuas qhov no 3 zaug - siv Lua yuav tsis tsim nyog. Yog li ntawd, cov neeg uas xav kom muaj peev xwm siv Lua, cov uas nyiam Go, koom nrog peb lub camp loj thiab siv go-tmpl rau qhov no.

Thaum kawg, qhov kuv tau ploj lawm yog schema tshwm sim thiab cov ntaub ntawv hom validation. Yuav tsis muaj teeb meem ntxiv nrog int lossis hlua, tsis tas yuav qhwv xoom hauv ob nqe lus. JSONS schema yuav tshwm sim uas yuav tso cai rau koj piav qhia meej qhov no rau qhov muaj nuj nqis.

Yuav ua haujlwm hnyav heev kev tshwm sim-tsav qauv. Nws twb tau piav qhia txog kev xav. Saib ntawm Helm 3 ceg, thiab koj yuav pom ntau npaum li cas cov xwm txheej thiab hooks thiab lwm yam tau ntxiv, uas yuav yooj yim heev thiab, ntawm qhov tod tes, ntxiv kev tswj hwm cov txheej txheem xa tawm thiab kev cuam tshuam rau lawv.

Helm 3 yuav yooj yim dua, nyab xeeb dua, thiab lom zem dua, tsis yog vim peb tsis nyiam Helm 2, tab sis vim Kubernetes tau dhau los ua ntau dua. Raws li, Helm tuaj yeem siv cov kev txhim kho ntawm Kubernetes thiab tsim cov thawj coj zoo rau Kubernetes ntawm nws.

Lwm qhov xov xwm zoo yog qhov ntawd DevOpsConf Alexander Khayorov yuav qhia rau koj, cov thawv tuaj yeem ruaj ntseg? Cia peb nco ntsoov koj tias lub rooj sib tham ntawm kev sib koom ua ke ntawm kev txhim kho, kev sim thiab kev ua haujlwm yuav muaj nyob rau hauv Moscow Cuaj hlis 30 thiab Kaum Hli 1. Koj tseem tuaj yeem ua nws kom txog thaum Lub Yim Hli 20th xa tsab ntawv ceeb toom thiab qhia peb txog koj qhov kev paub nrog kev daws teeb meem ib ntawm ntau Cov haujlwm ntawm DevOps mus kom ze.

Ua raws li lub rooj sib tham kuaj xyuas thiab xov xwm ntawm tsab ntawv xov xwm и xov tooj cua channel.

Tau qhov twg los: www.hab.com