Nyob zoo, cov neeg nyob hauv Habro! Kubernetes yog ib qho tseem ceeb ntawm lub ecosystem huab niaj hnub no. Cov thev naus laus zis no ua kom muaj kev ntseeg siab, kev nthuav dav, thiab kev ywj pheej rau kev ua haujlwm virtual ntawm lub thawv. John Arundel thiab Justin Domingus piav qhia txog Kubernetes ecosystem thiab qhia cov kev daws teeb meem uas tau ua pov thawj rau cov teeb meem txhua hnub. Kauj ruam zuj zus, koj yuav tsim koj daim ntawv thov huab-native thiab tsim cov hauv paus los txhawb nws, teeb tsa ib puag ncig kev txhim kho thiab cov kav dej xa mus tas li uas yuav pab koj thaum ua haujlwm rau cov ntawv thov yav tom ntej.
β’ Pib nrog cov thawv thiab Kubernetes txij thaum pib mus txog thaum kawgβtsis tas yuav muaj kev paub dhau los. β’ Khiav koj tus kheej cov pawg lossis xaiv cov kev pabcuam Kubernetes uas tswj hwm los ntawm Amazon, Google, thiab lwm tus. β’ Siv Kubernetes los tswj lub neej ntawm lub thawv thiab kev siv cov peev txheej. β’ Txhim kho cov pawg rau tus nqi, kev ua tau zoo, kev ywj pheej, peev xwm, thiab kev nthuav dav. β’ Kawm cov cuab yeej zoo tshaj plaws los tsim, sim, thiab xa koj cov ntawv thov. β’ Siv cov kev coj ua zoo tshaj plaws hauv kev lag luam rau kev ruaj ntseg thiab kev tswj hwm. β’ Tsim kom muaj cov ntsiab cai DevOps thoob plaws koj lub koom haum los pab koj cov pab pawg tsim kho kom yooj yim dua, ceev dua, thiab ua haujlwm tau zoo.
Phau ntawv no yog rau leej twg?
Phau ntawv no tshwj xeeb tshaj yog rau cov neeg ua haujlwm hauv kev tswj hwm uas muaj lub luag haujlwm rau cov servers, cov ntawv thov, thiab cov kev pabcuam, nrog rau cov neeg tsim khoom tsim cov kev pabcuam huab tshiab lossis tsiv cov ntawv thov uas twb muaj lawm mus rau Kubernetes thiab huab. Tsis txhob txhawj, tsis tas yuav muaj kev paub ua ntej txog Kubernetes lossis cov thawv - peb yuav qhia koj txhua yam.
Cov neeg siv Kubernetes uas muaj kev paub dhau los kuj yuav pom ntau yam tseem ceeb hauv phau ntawv no, uas qhia txog cov ncauj lus xws li RBAC, kev xa mus tas li, kev tswj hwm kev ceev ntiag tug, thiab kev soj ntsuam tob. Peb vam tias koj yuav pom qee yam txaus siab hauv nws cov nplooj ntawv, tsis hais koj cov txuj ci thiab kev paub dhau los.
Phau ntawv teb cov lus nug twg?
Thaum lub sijhawm npaj thiab sau phau ntawv no, peb tau tham txog cov thev naus laus zis huab thiab Kubernetes nrog ntau pua tus neeg, tham nrog cov thawj coj hauv kev lag luam thiab cov kws tshaj lij, nrog rau cov neeg tshiab kiag li. Hauv qab no yog qee cov lus nug uas lawv xav pom kom teb hauv phau ntawv no.
- "Kuv xav paub vim li cas kuv yuav tsum siv sijhawm rau hauv cov thev naus laus zis no. Nws yuav pab kuv thiab kuv pab neeg daws teeb meem dab tsi?"
- "Kubernetes zoo li nthuav, tab sis nws muaj qhov nkhaus kawm siab heev. Kev teeb tsa ib qho piv txwv yooj yim tsis nyuaj, tab sis kev tswj hwm thiab kev debugging ntxiv yog qhov nyuaj. Peb xav hnov ββββββcov lus qhia txhim khu kev qha txog li cas tib neeg tswj hwm Kubernetes clusters hauv qhov chaw tiag tiag thiab cov teeb meem twg peb yuav ntsib."
- "Qee cov lus qhia uas koj xav tau yuav pab tau. Lub Kubernetes ecosystem muaj ntau txoj kev xaiv rau cov pab pawg tshiab xaiv. Thaum muaj ntau txoj hauv kev los ua tib yam, koj yuav paub li cas tias qhov twg zoo tshaj? Koj xaiv li cas?"
Thiab tej zaum lo lus nug tseem ceeb tshaj plaws:
- "Kuv yuav siv Kubernetes li cas yam tsis cuam tshuam kuv txoj kev lag luam?"
Cov Lus Qhia: Kev Teeb tsa thiab Cov Khoom Zais Cia
Lub peev xwm cais cov logic ntawm daim ntawv thov Kubernetes los ntawm nws qhov kev teeb tsa (piv txwv li, txhua tus nqi lossis qhov chaw uas yuav hloov pauv raws sijhawm) muaj txiaj ntsig zoo heev. Cov nqi teeb tsa feem ntau suav nrog cov kev teeb tsa ib puag ncig, cov chaw nyob DNS rau cov kev pabcuam thib peb, thiab cov ntaub ntawv pov thawj.
Tau kawg, tag nrho cov no tuaj yeem muab tso ncaj qha rau hauv cov lej, tab sis txoj hauv kev no tsis yooj ywm txaus. Piv txwv li, kev hloov tus nqi teeb tsa yuav xav tau kev tsim kho dua tshiab thiab rov siv koj cov lej. Ib qho kev daws teeb meem zoo dua yuav yog cais qhov kev teeb tsa ntawm cov lej thiab nyeem nws ntawm cov ntaub ntawv lossis cov hloov pauv ib puag ncig.
Kubernetes muab ntau txoj hauv kev sib txawv los tswj kev teeb tsa. Ua ntej, koj tuaj yeem xa cov nqi mus rau daim ntawv thov ntawm cov hloov pauv ib puag ncig uas tau teev tseg hauv cov lus qhia ntawm lub plhaub pod (saib ntu "Environment Variables" ntawm nplooj ntawv 192). Qhov thib ob, cov ntaub ntawv teeb tsa tuaj yeem khaws cia ncaj qha hauv Kubernetes siv ConfigMap thiab Secret objects.
Hauv tshooj no, peb yuav tshawb nrhiav cov khoom no kom meej thiab saib qee txoj hauv kev siv tau zoo los tswj kev teeb tsa thiab cov ntaub ntawv rhiab heev siv daim ntawv thov demo.
Hloov kho cov plhaub pod thaum hloov pauv kev teeb tsa
Xav txog koj muaj kev xa tawm hauv koj pawg thiab xav hloov qee qhov nqi hauv nws ConfigMap. Yog tias koj siv daim ntawv qhia Helm (saib "Helm: Tus Thawj Coj Pob Khoom rau Kubernetes" ntawm nplooj ntawv 102), koj tuaj yeem ntes tau qhov kev hloov pauv teeb tsa thiab rov qab thauj koj cov pods nrog qhov ua kom zoo nkauj. Ntxiv cov lus piav qhia hauv qab no rau koj cov lus qhia xa tawm:
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") .
| sha256sum }}Tus qauv xa tawm tam sim no muaj cov checksum ntawm cov kev teeb tsa: yog tias cov kev hloov pauv, cov checksum yuav raug hloov kho tshiab. Yog tias koj khiav cov lus txib helm upgrade, Helm yuav pom tias cov lus qhia xa tawm tau hloov pauv thiab rov pib dua txhua lub pods.
Cov ntaub ntawv rhiab heev hauv Kubernetes
Peb twb paub lawm tias ConfigMap khoom muab ib txoj hauv kev yooj ywm rau kev khaws cia thiab nkag mus rau cov ntaub ntawv teeb tsa hauv ib pawg. Txawm li cas los xij, feem ntau cov ntawv thov muaj cov ntaub ntawv rhiab heev thiab zais cia, xws li passwords lossis API keys. Txawm hais tias khaws cov ntaub ntawv no hauv ConfigMap ua tau, nws tsis zoo tagnrho.
Hloov chaw, Kubernetes muaj ib hom khoom tshwj xeeb uas tsim los rau kev khaws cov ntaub ntawv rhiab heev: Secret. Cia peb saib ib qho piv txwv ntawm yuav ua li cas cov khoom no tuaj yeem siv rau hauv peb daim ntawv thov demo.
Ua ntej, saib daim ntawv qhia Kubernetes rau qhov khoom zais (saib hello-secret-env/k8s/secret.yaml):
apiVersion: v1
kind: Secret
metadata:
name: demo-secret
stringData:
magicWord: xyzzy
Hauv qhov piv txwv no, tus yuam sij ntiag tug magicWord yog xyzzy (en.wikipedia.org/wiki/Xyzzy_(computing)). Lo lus xyzzy feem ntau muaj txiaj ntsig zoo hauv ntiaj teb kev suav lej. Zoo ib yam li ConfigMap, ib yam khoom zais tuaj yeem tuav ntau tus yuam sij thiab tus nqi. Ntawm no, rau kev yooj yim, peb yuav siv tsuas yog ib khub yuam sij-tus nqi.
Siv Cov Khoom Zais Cia ua Cov Hloov Pauv Ib puag ncig
Ib yam li ConfigMap, ib yam khoom zais cia tuaj yeem muaj nyob hauv ib lub thawv ua ib qho chaw hloov pauv lossis ua cov ntaub ntawv ntawm nws lub disk. Hauv qhov piv txwv hauv qab no, peb yuav muab tus nqi los ntawm ib qho zais cia rau ib qho chaw hloov pauv:
spec:
containers:
- name: demo
image: cloudnatived/demo:hello-secret-env
ports:
- containerPort: 8888
env:
- name: GREETING
valueFrom:
secretKeyRef:
name: demo-secret
key: magicWordKhiav cov lus txib hauv qab no ntawm qhov chaw khaws ntaub ntawv demo kom siv cov manifests:
kubectl apply -f hello-secret-env/k8s/
deployment.extensions "demo" configured
secret "demo-secret" createdIb yam li ua ntej, xa mus rau qhov chaw nres nkoj hauv zos mus rau qhov kev xa tawm kom pom qhov tshwm sim hauv koj tus browser:
kubectl port-forward deploy/demo 9999:8888
Forwarding from 127.0.0.1:9999 -> 8888
Forwarding from [::1]:9999 -> 8888Thaum qhib ib qho chaw nyob :9999/ koj yuav tsum pom cov hauv qab no:
The magic word is "xyzzy"
Sau cov khoom zais cia rau cov ntaub ntawv
Hauv qhov piv txwv no, peb yuav txuas ib yam khoom zais cia rau hauv lub thawv ua ib daim ntawv. Cov lej nyob hauv daim nplaub tshev hello-secret-file ntawm lub chaw khaws ntaub ntawv demo.
Yuav txuas qhov Secret ua ib daim ntawv, peb yuav siv cov kev xa tawm hauv qab no:
spec:
containers:
- name: demo
image: cloudnatived/demo:hello-secret-file
ports:
- containerPort: 8888
volumeMounts:
- name: demo-secret-volume
mountPath: "/secrets/"
readOnly: true
volumes:
- name: demo-secret-volume
secret:
secretName: demo-secretIb yam li hauv ntu "Tsim Cov Ntaub Ntawv Teeb Tsa los ntawm ConfigMap Objects" ntawm nplooj ntawv 240, peb tsim ib lub ntim (hauv qhov no, demo-secret-volume) thiab mount nws rau hauv lub thawv hauv ntu volumeMounts ntawm qhov kev qhia tshwj xeeb. Lub teb mountPath qhia meej /secrets, yog li Kubernetes yuav tsim ib daim ntawv hauv daim nplaub tshev no rau txhua tus khub tseem ceeb-tus nqi txhais hauv Secret object.
Hauv peb qhov piv txwv, peb tau txhais tsuas yog ib khub key-value hu ua magicWord, yog li ntawd daim ntawv qhia yuav tsim ib daim ntawv nyeem nkaus xwb /secrets/magicWord hauv lub thawv uas muaj cov ntaub ntawv rhiab heev.
Yog koj siv daim ntawv qhia no tib yam li hauv qhov piv txwv dhau los, koj yuav tsum tau txais tib yam txiaj ntsig:
The magic word is "xyzzy"
Nyeem cov khoom zais cia
Hauv seem dhau los, peb tau siv cov lus txib kubectl piav qhia los tso saib cov ntsiab lus ntawm ConfigMap. Peb puas ua tau tib yam nrog Secret?
kubectl describe secret/demo-secret
Name: demo-secret
Namespace: default
Labels: <none>
Annotations:
Type: Opaque
Data
====
magicWord: 5 bytesThov nco ntsoov tias cov ntaub ntawv nws tus kheej tsis raug nthuav tawm. Cov khoom zais cia hauv Kubernetes yog hom Opaque, txhais tau tias lawv cov ntsiab lus tsis raug tso tawm hauv kubectl piav qhia cov zis, cov cav, lossis lub davhlau ya nyob twg, tiv thaiv kev tshaj tawm cov ntaub ntawv rhiab heev.
Yog xav saib cov ntaub ntawv rhiab heev uas tau encoded hauv hom ntawv YAML, siv cov lus txib kubectl get:
kubectl get secret/demo-secret -o yaml
apiVersion: v1
data:
magicWord: eHl6enk=
kind: Secret
metadata:
...
type: Opaquepuag 64
Qhov eHl6enk= no yog dab tsi, txawv kiag li ntawm peb tus nqi qub? Nws yog ib qho khoom zais cia, encoded hauv base64. Base64 yog ib txoj kev rau encoding arbitrary binary data ua ib txoj hlua cim.
Vim tias cov ntaub ntawv rhiab heev yuav yog binary thiab tsis tuaj yeem luam tawm (zoo li qhov teeb meem nrog tus yuam sij encryption TLS), Cov khoom zais cia yeej ib txwm khaws cia rau hauv hom ntawv base64.
Cov ntawv nyeem beHl6enk= yog ib qho version uas siv base64-encoded ntawm peb lo lus zais xyzzy. Koj tuaj yeem xyuas qhov no los ntawm kev khiav cov lus txib base64 --decode hauv lub davhlau ya nyob twg:
echo "eHl6enk=" | base64 --decode
xyzzyYog li, thaum Kubernetes tiv thaiv koj los ntawm kev muab cov ntaub ntawv rhiab heev tso rau hauv koj lub davhlau ya nyob twg lossis cov ntaub ntawv cav, yog tias koj tau nyeem cov kev tso cai ntawm Secrets hauv ib qho chaw muab, koj tuaj yeem khaws cov ntaub ntawv ntawd hauv hom ntawv base64 thiab tom qab ntawd txiav txim siab nws.
Yog tias koj xav tau encode qee cov ntawv hauv base64 (piv txwv li, muab tso rau hauv Secret), siv cov lus txib base64 yam tsis muaj kev sib cav:
echo xyzzy | base64
eHl6enkKNkag mus rau cov khoom zais cia
Leej twg nyeem tau thiab hloov kho cov khoom zais cia? Qhov no yog txiav txim siab los ntawm RBAC, ib qho kev tswj hwm kev nkag mus (tau tham txog ntau yam hauv ntu "Kev Taw Qhia rau Kev Tswj Xyuas Kev Nkag Mus Raws Li Lub Luag Haujlwm" ntawm nplooj ntawv 258). Yog tias koj siv ib pawg tsis muaj RBAC lossis tsis muaj nws qhib, tag nrho koj cov khoom zais cia tuaj yeem nkag mus rau txhua tus neeg siv lossis lub thawv (peb yuav piav qhia tom qab tias koj yuav tsum tsis txhob muaj ib pawg tsim khoom yam tsis muaj RBAC).
Kev siv passive data encryption
Ua li cas rau cov neeg uas muaj kev nkag mus rau hauv etcd database, qhov chaw Kubernetes khaws tag nrho nws cov ntaub ntawv? Lawv puas tuaj yeem nyeem cov ntaub ntawv rhiab heev yam tsis tau kev tso cai nyeem cov khoom zais cia ntawm API?
Pib nrog version 1.7, Kubernetes txhawb nqa passive data encryption. Qhov no txhais tau tias cov ntaub ntawv rhiab heev hauv etcd khaws cia rau ntawm disk hauv daim ntawv encrypted thiab tsis tuaj yeem nyeem los ntawm cov neeg uas muaj kev nkag mus rau lub database ncaj qha. Kev decryption xav tau tus yuam sij uas tsuas yog Kubernetes API server muaj. Passive encryption yuav tsum tau qhib rau hauv ib pawg teeb tsa zoo.
Koj tuaj yeem tshawb xyuas seb passive encryption puas ua haujlwm hauv koj lub cluster raws li hauv qab no:
kubectl describe pod -n kube-system -l component=kube-apiserver |grep encryption
--experimental-encryption-provider-config=...Yog tias koj tsis pom tus chij experimental-encryption-provider-config, passive encryption tsis tau qhib. Thaum siv Google Kubernetes Engine lossis lwm yam kev pabcuam tswj hwm Kubernetes, koj cov ntaub ntawv raug encrypted siv lwm txoj hauv kev, yog li tus chij yuav ploj lawm. Tshawb xyuas nrog koj tus neeg muab kev pabcuam Kubernetes kom pom tias cov ntsiab lus etcd puas tau encrypted.
Kev khaws cov ntaub ntawv zais cia
Muaj qee cov peev txheej Kubernetes uas yuav tsum tsis txhob raug rho tawm ntawm pawg, xws li cov khoom zais uas rhiab heev. Koj tuaj yeem tiv thaiv cov peev txheej kom tsis txhob raug rho tawm siv cov lus piav qhia los ntawm tus thawj tswj Helm:
kind: Secret
metadata:
annotations:
"helm.sh/resource-policy": keepCov Tswv Yim Tswj Xyuas Khoom Zais Cia
Hauv qhov piv txwv los ntawm ntu dhau los, cov ntaub ntawv rhiab heev tau raug tiv thaiv los ntawm kev nkag mus tsis raug cai tam sim ntawd tom qab khaws cia rau hauv pawg. Txawm li cas los xij, nws tau khaws cia ua cov ntawv yooj yim hauv cov ntaub ntawv manifest.
Koj yuav tsum tsis txhob muab cov ntaub ntawv rhiab heev tso rau hauv cov ntaub ntawv uas nyob hauv qab kev tswj hwm version. Yog li koj yuav ua li cas thiaj tswj tau thiab khaws cov ntaub ntawv no kom ruaj ntseg ua ntej xa mus rau Kubernetes cluster?
Koj tuaj yeem xaiv cov cuab yeej lossis cov tswv yim uas koj xav siv los tswj cov ntaub ntawv rhiab heev hauv koj cov ntawv thov, tab sis koj tseem yuav tsum teb tsawg kawg yog cov lus nug hauv qab no.
- Yuav khaws cov ntaub ntawv rhiab heev qhov twg kom nws muaj siv tau ntau?
- Yuav ua li cas thiaj ua rau cov ntaub ntawv rhiab heev siv tau rau koj cov ntawv thov uas siv tau?
- Yuav tsum muaj dab tsi tshwm sim rau koj cov apps thaum koj hloov lossis kho cov ntaub ntawv rhiab heev?
Hais txog cov neeg sau ntawv
John Arundel Nws yog ib tug kws pab tswv yim uas muaj 30 xyoo ntawm kev paub hauv kev lag luam computer. Nws tau sau ntau phau ntawv thiab ua haujlwm nrog ntau lub tuam txhab thoob ntiaj teb, qhia lawv txog kev siv huab-native infrastructure thiab Kubernetes. Thaum nws muaj sijhawm seem, nws nyiam surfing, yog ib tug kws tua phom zoo, thiab ua si piano ua ib tug neeg tsis paub ua si. Nws nyob hauv ib lub tsev zoo nkauj hauv Cornwall, tebchaws Askiv.
Justin Domingos β ib tug kws ua haujlwm tswj hwm lub kaw lus ua haujlwm hauv DevOps ib puag ncig nrog Kubernetes thiab cov thev naus laus zis huab. Nws nyiam siv sijhawm sab nraum zoov, haus kas fes, ntes ntses, thiab ua haujlwm ntawm lub khoos phis tawj. Nws nyob hauv Seattle, Washington, nrog nws tus miv zoo kawg nkaus thiab tus poj niam zoo tshaj plaws thiab tus phooj ywg zoo tshaj plaws, Adrienne.
Β» Xav paub ntau ntxiv txog phau ntawv tuaj yeem nrhiav tau ntawm
Β»
Β»
Rau Khabrozhiteley 25% luv nqi siv daim coupon - Kubernetes
Thaum them nyiaj ntawm daim ntawv version ntawm phau ntawv, ib phau ntawv hluav taws xob yuav raug xa los ntawm e-mail.
Tau qhov twg los: www.hab.com
