{"id":36918,"date":"2019-10-31T22:14:43","date_gmt":"2019-10-31T19:14:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/bezopasnost-helm\/"},"modified":"2019-10-31T22:14:43","modified_gmt":"2019-10-31T19:14:43","slug":"bezopasnost-helm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bezopasnost-helm","title":{"rendered":"Helm dro\u0161\u012bba","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>St\u0101sta b\u016bt\u012bba par popul\u0101r\u0101ko pakot\u0146u p\u0101rvaldnieku Kubernetes var\u0113tu tikt att\u0113lota ar emojiem:<\/p>\n<ul>\n<li>kaste \u2014 tas ir Helm (tas ir vispiem\u0113rot\u0101kais, kas ir jaun\u0101kaj\u0101 Emoji laidien\u0101);<\/li>\n<li>atsevi\u0161\u0137a atsl\u0113ga \u2014 dro\u0161\u012bba;<\/li>\n<li>cilv\u0113ci\u0146\u0161 \u2014 probl\u0113mas risin\u0101jums.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/91099b372fd73bce94268563c3ee2c50.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPaties\u012bb\u0101 viss b\u016bs nedaudz sare\u017e\u0123\u012bt\u0101k, un st\u0101sts ir pilns ar tehniskiem s\u012bkumiem par to, <b>k\u0101 izveidot dro\u0161u Helm<\/b>.<\/p>\n<ul>\n<li>\u012bsi par to, kas ir Helm, ja j\u016bs to nezin\u0101t vai esat aizmirsu\u0161i. K\u0101das probl\u0113mas tas risina un kur tas atrodas ekosist\u0113m\u0101.<\/li>\n<li>Apskat\u012bsim Helma arhitekt\u016bru. Nekur sarun\u0101s par dro\u0161\u012bbu un to, k\u0101 padar\u012bt r\u012bku vai risin\u0101jumu dro\u0161\u0101ku, nevar iztikt bez komponentu arhitekt\u016bras izpratnes.<\/li>\n<li>Apspried\u012bsim Helm komponentus.<\/li>\n<li>Visaktu\u0101l\u0101k\u0101 t\u0113ma \u2014 n\u0101kotne \u2014 jaun\u0101 Helm 3 versija.\u00a0<\/li>\n<\/ul>\n<p>\nViss \u0161aj\u0101 rakst\u0101 attiecas uz Helm 2. \u0160\u012b versija pa\u0161laik atrodas ra\u017eo\u0161an\u0101 un, visticam\u0101k, to j\u016bs \u0161obr\u012bd izmantojat, un \u0161aj\u0101 versij\u0101 ir dro\u0161\u012bbas apdraud\u0113jumi.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n<center><div class=\"youtube-placeholder\" data-id=\"_8zNTJ1_R5I\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/_8zNTJ1_R5I\/hqdefault.jpg\" alt=\"Atska\u0146ot video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\n<strong>Par run\u0101t\u0101ju:<\/strong> Aleksandrs H\u0101jorovs (<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/allexx\/\" class=\"user_link\">allexx<\/a><\/noindex>) jau 10 gadus str\u0101d\u0101 izstr\u0101d\u0113, pal\u012bdz uzlabot saturu <noindex><a rel=\"nofollow\" href=\"https:\/\/conf.python.ru\/2019\">Moscow Python Conf++<\/a><\/noindex> un pievienoj\u0101s komitejai <noindex><a rel=\"nofollow\" href=\"https:\/\/events.linuxfoundation.org\/events\/helm-summit-2019\/\">Helm Summit<\/a><\/noindex>. Pa\u0161laik str\u0101d\u0101 Chainstack k\u0101 izstr\u0101des vad\u012bt\u0101js \u2014 tas ir hibr\u012bds starp izstr\u0101des vad\u012bt\u0101ju un personu, kas atbild par gal\u012bgo laidienu pieg\u0101di. Proti, vi\u0146\u0161 ir tie\u0161i tur, kur notiek viss no produkta rad\u012b\u0161anas l\u012bdz t\u0101 ekspluat\u0101cijai.<\/p>\n<p>Chainstack ir neliels, akt\u012bvi augo\u0161s jaunuz\u0146\u0113mums, kura uzdevums ir dot klientiem iesp\u0113ju aizmirst par infrastrukt\u016bru un decentraliz\u0113tu lietojumprogrammu p\u0101rvald\u012b\u0161anas sare\u017e\u0123\u012bjumiem, izstr\u0101des komanda atrodas Singap\u016br\u0101. Neprasiet Chainstack p\u0101rdot vai ieg\u0101d\u0101ties kriptoval\u016btu, bet pied\u0101v\u0101jiet run\u0101t par uz\u0146\u0113mumu blok\u0137\u0113\u017eu ietvariem, un vi\u0146i ar prieku atbild\u0113s.<\/p>\n<h2>Helm<\/h2>\n<p>\nTas ir pakot\u0146u (chartu) p\u0101rvaldnieks Kubernetes. Visvienk\u0101r\u0161\u0101kais un univers\u0101l\u0101kais veids, k\u0101 pied\u0101v\u0101t lietojumprogrammas Kubernetes kop\u0101.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/30c0fc1cc1c6ebde97c6e8ec1886ce9f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nRuna, protams, ir par struktur\u0113t\u0101ku un r\u016bpniecisk\u0101ku pieeju, nevis savu YAML manifestu izveidi un mazu util\u012btu rakst\u012b\u0161anu.<\/p>\n<blockquote><p>Helm ir lab\u0101kais, kas \u0161obr\u012bd pieejams un popul\u0101rs.<\/p><\/blockquote>\n<p>\nK\u0101p\u0113c Helm? Pirmk\u0101rt, t\u0101p\u0113c, ka to atbalsta CNCF. Cloud Native ir liela organiz\u0101cija, kas ir m\u0101tes uz\u0146\u0113mums projektiem Kubernetes, etcd, Fluentd un citiem.<\/p>\n<p>V\u0113l viens svar\u012bgs fakts, Helm ir \u013coti popul\u0101rs projekts. Kad 2019. gada janv\u0101r\u012b es s\u0101kotn\u0113ji pl\u0101noju run\u0101t par to, k\u0101 padar\u012bt Helm dro\u0161u, projektam bija t\u016bkstotis zvaig\u017e\u0146u GitHub. L\u012bdz maijam to skaits pieauga l\u012bdz 12 t\u016bksto\u0161iem.<\/p>\n<p>Daudzi interes\u0113jas par Helm, t\u0101p\u0113c, pat ja j\u016bs to v\u0113l neizmantojat, jums noder\u0113s zin\u0101\u0161anas par t\u0101s dro\u0161\u012bbu. <strong>Dro\u0161\u012bba ir svar\u012bga.<\/strong><\/p>\n<p>Helm galven\u0101 komanda tiek atbalst\u012bta ar Microsoft Azure, t\u0101p\u0113c tas ir diezgan stabils projekts, sal\u012bdzinot ar daudziem citiem. Helm 3 Alpha 2 izn\u0101k\u0161ana j\u016blija vid\u016b liecina, ka pie projekta str\u0101d\u0101 diezgan daudz cilv\u0113ku, un vi\u0146iem ir v\u0113lme un sp\u0113ks att\u012bst\u012bt un uzlabot Helm.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/e53c8e64c3cf5eea3fbd9b0095b0f81e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHelm risina vair\u0101kus pamatprobl\u0113mas aplik\u0101ciju p\u0101rvald\u012bb\u0101 Kubernetes.<\/p>\n<ul>\n<li>Aplik\u0101cijas iepako\u0161ana. Pat t\u0101da aplik\u0101cija k\u0101 \"Hello, World\" uz WordPress jau satur vair\u0101kus pakalpojumus, un tos v\u0113las iepakot kop\u0101.<\/li>\n<li>Sare\u017e\u0123\u012bjumu p\u0101rvald\u012bba, kas rodas no \u0161o aplik\u0101ciju mened\u017ementa.<\/li>\n<li>Dz\u012bves cikls, kas nebeidzas p\u0113c aplik\u0101cijas instal\u0113\u0161anas vai izvieto\u0161anas. T\u0101 turpin\u0101s dz\u012bvot, to ir j\u0101atjaunina, un \u0161aj\u0101 pal\u012bdz Helm, cen\u0161oties sniegt pareizos pas\u0101kumus un politikas.<\/li>\n<\/ul>\n<p>\n<strong>Iepako\u0161ana<\/strong> ir organiz\u0113ta saprotam\u0101 veid\u0101: ir metadati, kas piln\u012bb\u0101 atbilst parast\u0101 pakot\u0146u p\u0101rvaldnieka darb\u012bbai Linux, Windows vai MacOS. Tas ir, repozitorijs, atkar\u012bbas no da\u017e\u0101d\u0101m pakotn\u0113m, metainform\u0101cija aplik\u0101cij\u0101m, iestat\u012bjumi, konfigur\u0101cijas \u012bpatn\u012bbas, inform\u0101cijas indeks\u0113\u0161ana utt. Viss \u0161is Helm \u013cauj ieg\u016bt un izmantot aplik\u0101cij\u0101m.<\/p>\n<p><strong>Sare\u017e\u0123\u012bjumu p\u0101rvald\u012bba<\/strong>. Ja jums ir daudz l\u012bdz\u012bgu aplik\u0101ciju, tad nepiecie\u0161ama parametriz\u0101cija. No t\u0101 izriet \u0161abloni, ta\u010du, lai neizdom\u0101tu savu veidu, k\u0101 izveidot \u0161ablonus, var izmantot to, ko Helm pied\u0101v\u0101 tie\u0161i no izn\u0101k\u0161anas br\u012b\u017ea.<\/p>\n<p><strong>Aplik\u0101ciju dz\u012bves cikla mened\u017ements<\/strong> \u2014 manupr\u0101t, tas ir interesant\u0101kais un joproj\u0101m neatrisin\u0101tais jaut\u0101jums. T\u0101p\u0113c, k\u0101d\u0113\u013c es savulaik piev\u0113rsos Helm. Mums bija j\u0101kontrol\u0113 aplik\u0101cijas dz\u012bves cikls, m\u0113s v\u0113l\u0113j\u0101mies p\u0101rvietot savu CI\/CD un aplik\u0101ciju ciklus \u0161aj\u0101 paradigmas.<\/p>\n<p>Helm \u013cauj:<\/p>\n<ul>\n<li>p\u0101rvald\u012bt izvieto\u0161anas, ievie\u0161ot konfigur\u0101cijas un rev\u012bzijas j\u0113dzienus;<\/li>\n<li>veiksm\u012bgi veikt atgrie\u0161anu;<\/li>\n<li>izmantot pielikumu da\u017e\u0101diem notikumiem;<\/li>\n<li>pievienot papildu p\u0101rbaudes aplik\u0101cij\u0101m un rea\u0123\u0113t uz to rezult\u0101tiem.<\/li>\n<\/ul>\n<p>\nTurkl\u0101t <strong>Helm ir \"baterijas\"<\/strong> \u2014 milz\u012bgs daudzums gar\u0161\u012bgu lietu, ko var iek\u013caut k\u0101 spraud\u0146us, vienk\u0101r\u0161ojot savu dz\u012bvi. Spraud\u0146us var rakst\u012bt pa\u0161i, tie ir pietiekami izol\u0113ti un neprasa realiz\u0101cijas arhitekt\u016bru. Ja v\u0113laties kaut ko \u012bstenot, es ieteiktu to veikt k\u0101 spraudni, p\u0113c tam iesp\u0113jams iek\u013caut t\u0101l\u0101kaj\u0101 att\u012bst\u012bb\u0101.<\/p>\n<p>Helm pamatojas uz trim galvenaj\u0101m koncept\u0113m:<\/p>\n<ul>\n<li><strong>Chart Repo<\/strong> \u2014 apraksts un parametriz\u0101cijas mas\u012bvs, kas iesp\u0113jams j\u016bsu manifestam.\u00a0<\/li>\n<li><strong>Konfigur\u0101cija<\/strong> \u2014 tas ir, v\u0113rt\u012bbas, kas tiks piem\u0113rotas (teksts, skaitlisk\u0101s v\u0113rt\u012bbas utt.).<\/li>\n<li><strong>Izlaidums<\/strong> apvieno divus aug\u0161\u0113jos komponentus, un kop\u0101 tie p\u0101rv\u0113r\u0161as par Release. Izlaidumus var versiju p\u0101rvald\u012bt, t\u0101d\u0113j\u0101di nodro\u0161inot dz\u012bves cikla organiz\u0113\u0161anu: nelielu uzst\u0101d\u012b\u0161anas br\u012bd\u012b un lielu atjaunin\u0101\u0161anas, atgrie\u0161anas vai atpaka\u013cgaitas br\u012bd\u012b.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Helm arhitekt\u016bra<\/h2>\n<p>\nDiagramm\u0101 konceptu\u0101li att\u0113lota augsta l\u012bme\u0146a Helm arhitekt\u016bra.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/c5cf54890682a3d6ca7a45021b5006a1.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAtg\u0101dinu, ka Helm ir saist\u012bts ar Kubernetes. T\u0101p\u0113c mums nav iztikt bez Kubernetes klastera (taisnst\u016bris). Komponents kube-apiserver atrodas uz master. Bez Helm mums ir Kubeconfig. Helm pieg\u0101d\u0101 vienu mazu bin\u0101ro util\u012btu, ja var t\u0101 teikt, Helm CLI, kas tiek uzst\u0101d\u012bta dator\u0101, kl\u0113pjdator\u0101, galvenaj\u0101 ier\u012bc\u0113 \u2014 visur.<\/p>\n<p>Bet \u0161\u012b nav pietiekami. Helm ir servera komponents Tiller. Tas p\u0101rst\u0101v Helm intereses klaster\u012b, tas ir t\u0101ds pats lietojums klaster\u012b Kubernetes k\u0101 jebkur\u0161 cits.<\/p>\n<p>N\u0101kamais komponents Chart Repo \u2014 repozitorijs ar chartiem. Ir ofici\u0101ls repozitorijs, un var b\u016bt priv\u0101ts uz\u0146\u0113muma vai projekta repozitorijs.<\/p>\n<h3>Sadarb\u012bba<\/h3>\n<p>\nApskat\u012bsim, k\u0101 saskaras arhitekt\u016bras komponenti, kad v\u0113lamies uzst\u0101d\u012bt lietojumprogrammu ar Helm.<\/p>\n<ul>\n<li>M\u0113s sak\u0101m <code>Helm install<\/code>, m\u0113s piek\u013c\u016bstam repozitorijam (Chart Repo) un sa\u0146emam Helm chart.<\/li>\n<\/ul>\n<p><\/p>\n<ul>\n<li>Helm util\u012bts (Helm CLI) mijiedarbojas ar Kubeconfig, lai noskaidrotu, uz kuru klasteri v\u0113rsties.\u00a0<\/li>\n<li>Sa\u0146emot \u0161o inform\u0101ciju, util\u012bts v\u0113r\u0161as pie Tiller, kas ir m\u016bsu klaster\u012b, jau k\u0101 lietojums.\u00a0<\/li>\n<li>Tiller v\u0113r\u0161as pie Kube-apiserver, lai veiktu darb\u012bbas Kubernetes, izveidotu da\u017eus objektus (servisi, podi, replikas, slepen\u012bbas utt.).<\/li>\n<\/ul>\n<p>\nT\u0101l\u0101k m\u0113s sare\u017e\u0123\u012bsim sh\u0113mu, lai redz\u0113tu uzbrukumu virzienu, kam var tikt pak\u013cauta visa Helm arhitekt\u016bra kopum\u0101. P\u0113c tam cent\u012bsimies to aizsarg\u0101t.<\/p>\n<h3>Uzbrukuma virziens<\/h3>\n<p>\nPirmais potenci\u0101li v\u0101jais punkts \u2014 <strong>privile\u0123\u0113ts API<\/strong>&#8212;<strong>lietot\u0101js<\/strong>. Sh \u0441\u0445\u0435\u043c\u0101 ir hakeris, kuram ir administrat\u012bvas piek\u013cuves ties\u012bbas Helm CLI.<\/p>\n<p><strong>Nepak\u013cauts API lietot\u0101js<\/strong> ar\u012b var rad\u012bt draudus, ja atrodas tuvum\u0101. \u0160\u0101dai lietot\u0101jam b\u016bs cits konteksts, piem\u0113ram, vi\u0146\u0161 var b\u016bt fiks\u0113ts vien\u0101 namespace klaster\u012b Kubeconfig iestat\u012bjumos.<\/p>\n<p>Visinteresant\u0101kais uzbrukuma virziens var\u0113tu b\u016bt process, kas atrodas klaster\u012b kaut kur tuvum\u0101 pie Tiller un var tam piek\u013c\u016bt. Tas var b\u016bt t\u012bmek\u013ca serveris vai mikroserviss, kas redz klastera t\u012bkla vidi.<\/p>\n<p>Ekzotisks, bet arvien popul\u0101r\u0101ks uzbrukuma variants ir saist\u012bts ar Chart Repo. \u010carts, ko ir izveidojis negod\u012bgs autors, var satur\u0113t nedro\u0161u resursu, un tu to izpild\u012bsi, pie\u0146emot to par paties\u012bbu. Vai ar\u012b vi\u0146\u0161 var nomain\u012bt \u010dartu, ko tu lejupiel\u0101d\u0113 no ofici\u0101l\u0101s kr\u0101tuves, un, piem\u0113ram, izveidot resursu veid\u0101 politiku un paaugstin\u0101t savu piek\u013cuvi.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/2828046feb9ba8413a1b0e8741b4c354.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u0113\u0123in\u0101sim aizsarg\u0101ties no uzbrukumiem no vis\u0101m \u010detr\u0101m pus\u0113m un saprast, kur ir probl\u0113mas Helm arhitekt\u016br\u0101 un kur iesp\u0113jams t\u0101s nav.<\/p>\n<p>Pietuvosim sh\u0113mu, pievienojot vair\u0101k elementu, bet saglab\u0101jot visas pamatkomponentes.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/4110898e79619b8546408c668c48da0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHelm CLI sazin\u0101s ar Chart Repo, mijiedarbojas ar Kubeconfig, darbs tiek nodots klasterim komponentam Tiller.<\/p>\n<p>Tiller ir att\u0113lots ar diviem objektiem:<\/p>\n<ul>\n<li>Tiller-deploy svc, kas izveido noteiktu servisu;<\/li>\n<li>Tiller-deploy pod (shem\u0101 vien\u0101 eksempl\u0101r\u0101 vien\u0101 replik\u0101), uz kura darbojas visa slodze un kas v\u0113r\u0161as pie klastera.<\/li>\n<\/ul>\n<p>\nMijiedarb\u012bbai tiek izmantoti da\u017e\u0101di protokoli un sh\u0113mas. No dro\u0161\u012bbas viedok\u013ca mums visinteresant\u0101kie ir:<\/p>\n<ul>\n<li>Meh\u0101nisms, ar kuru Helm CLI v\u0113r\u0161as pie chart repo: k\u0101ds protokols, vai ir autentifik\u0101cija un ko ar to var dar\u012bt.<\/li>\n<li>Protokols, ar kuru Helm CLI, izmantojot kubectl, sazin\u0101s ar Tiller. Tas ir RPC serveris, kas uzst\u0101d\u012bts klaster\u012b.<\/li>\n<li>Pats Tiller ir pieejams mikroservisiem, kas atrodas klaster\u012b un mijiedarbojas ar Kube-apiserver.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/19e7e085567f3bbb49746e6402926bd6.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nApspried\u012bsim visus \u0161os virzienus sec\u012bgi.<\/p>\n<h2>RBAC<\/h2>\n<p><\/p>\n<blockquote><p>Bezj\u0113dz\u012bgi ir run\u0101t par jebk\u0101du Helm vai cita pakalpojuma dro\u0161\u012bbu klaster\u012b, ja RBAC nav iesl\u0113gts.<\/p><\/blockquote>\n<p>\nIzskat\u0101s, ka tas nav pa\u0161laik aktu\u0101ls ieteikums, bet esmu p\u0101rliecin\u0101ts, ka daudzi joproj\u0101m nav iesl\u0113gu\u0161i RBAC pat ra\u017eo\u0161an\u0101, jo tas ir liels darbs un nepiecie\u0161ams daudz visu konfigur\u0113t. Tom\u0113r aicinu to izdar\u012bt.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/37ee8aeb2b331b75ea5569c0b114a756.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/rbac.dev\/\">https:\/\/rbac.dev\/<\/a><\/noindex> \u2014 advok\u0101ts vietne RBAC. Tur ir daudz interesantu materi\u0101lu, kas pal\u012bdz\u0113s iestat\u012bt RBAC, par\u0101d\u012bs, k\u0101p\u0113c tas ir labs un k\u0101 ar to visp\u0101r dz\u012bvot ra\u017eo\u0161an\u0101.<\/p>\n<p>M\u0113\u0123in\u0101\u0161u izskaidrot, k\u0101 darbojas Tiller un RBAC. Tiller darbojas klaster\u012b zem k\u0101da pakalpojuma konta. Parasti, ja RBAC nav iestat\u012bts, tas b\u016bs superlietot\u0101js. Pamatkonfigur\u0101cij\u0101 Tiller b\u016bs admins. T\u0101p\u0113c bie\u017ei saka, ka Tiller ir SSH tunelis uz j\u016bsu klasteri. Paties\u012bb\u0101 tas t\u0101 ir, t\u0101p\u0113c var izmantot atsevi\u0161\u0137u specializ\u0113tu pakalpojuma kontu viet\u0101 Default Service Account iepriek\u0161\u0113j\u0101 sh\u0113m\u0101.<\/p>\n<p>Kad j\u016bs inicializ\u0113jat Helm, pirmo reizi to instal\u0113jot server\u012b, varat nor\u0101d\u012bt pakalpojuma kontu, izmantojot <code>--service-account<\/code>. Tas \u013caus izmantot lietot\u0101ju ar minim\u0101li nepiecie\u0161amo ties\u012bbu kopumu. Tom\u0113r, n\u0101ksies izveidot t\u0101du \"virteni\": Role un RoleBinding.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/ec805cde756495cfd5c480ac40739c43.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDiem\u017e\u0113l, Helm to par jums neizdar\u012bs. Jums vai j\u016bsu Kubernetes klastera administratoram iepriek\u0161 j\u0101p\u0101rtrauc Role un RoleBinding komplekts pakalpojuma kontam, lai nodotu Helm.<\/p>\n<p>Rod\u0101s jaut\u0101jums \u2014 k\u0101da ir at\u0161\u0137ir\u012bba starp Role un ClusterRole? At\u0161\u0137ir\u012bba ir t\u0101, ka ClusterRole darbojas visiem namespaces, at\u0161\u0137ir\u012bb\u0101 no parastajiem Role un RoleBinding, kas str\u0101d\u0101 tikai konkr\u0113tam namespace. Varat izveidot politikas gan visam klasterim un visiem namespaces, gan individu\u0101li katram namespace atsevi\u0161\u0137i.<\/p>\n<p>J\u0101atz\u012bm\u0113, ka RBAC \u013cauj atrisin\u0101t v\u0113l vienu lielu probl\u0113mu. Daudzi s\u016bdzas, ka Helm, diem\u017e\u0113l, nav multitenancy (neatbalsta daudz\u012bpa\u0161umties\u012bbas). Ja vair\u0101kas komandas izmanto klasteri un izmanto Helm, nav iesp\u0113jams iestat\u012bt politikas un ierobe\u017eot to piek\u013cuvi \u0161\u012b klastera ietvaros, jo ir k\u0101ds pakalpojuma konts, no kura str\u0101d\u0101 Helm, un tas izveido visus resursus klaster\u012b no \u0161\u012b konta, kas da\u017ereiz ir \u013coti ne\u0113rti. Tas tie\u0161\u0101m t\u0101 ir \u2014 k\u0101 pa\u0161am bin\u0101rajam failam, k\u0101 procesam, <strong>Helm Tiller nezina par multitenancy<\/strong>.<\/p>\n<p>Tom\u0113r ir br\u012bni\u0161\u0137\u012bgs veids, k\u0101 palai\u017eot Tiller klaster\u012b vair\u0101kas reizes. Ar to nav nek\u0101du probl\u0113mu, Tiller var palaist katr\u0101 namespace. T\u0101d\u0113j\u0101di j\u016bs varat izmantot RBAC, Kubeconfig k\u0101 kontekstu un ierobe\u017eot piek\u013cuvi specializ\u0113tajam Helm.<\/p>\n<p>Tas izskat\u012bsies \u0161\u0101di.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/eae922c7b5e1422fb51667364ed79e0a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPiem\u0113ram, ir divi Kubeconfig ar kontekstu da\u017e\u0101d\u0101m komand\u0101m (divi namespace): X komanda izstr\u0101d\u0101t\u0101jiem un administratoru klasteris. Administratoru klasterim ir sava pla\u0161a Tiller versija, kas atrodas Kube-system namespace, l\u012bdz ar to tam ir attiec\u012bga service-account. Un atsevi\u0161\u0137s namespace izstr\u0101d\u0101t\u0101ju komandai, kas var\u0113s izvietot savus pakalpojumus speci\u0101l\u0101 namespace.<\/p>\n<p>\u0160\u012b ir str\u0101d\u0101jo\u0161a pieeja, Tiller nav tik izsalkusi, lai tas var\u0113tu b\u016btiski ietekm\u0113t j\u016bsu bud\u017eetu. Tas ir viens no \u0101trajiem risin\u0101jumiem.<\/p>\n<blockquote><p>Ne\u0161aubieties atsevi\u0161\u0137i konfigur\u0113t Tiller un sniegt Kubeconfig ar kontekstu komandai, konkr\u0113tam izstr\u0101d\u0101t\u0101jam vai videi: Dev, Staging, Production (ir ap\u0161aublems, ka viss b\u016bs vien\u0101 klaster\u012b, tom\u0113r t\u0101 dar\u012bt var).<\/p><\/blockquote>\n<p>\nTurpinot m\u016bsu st\u0101stu, p\u0101riesim no RBAC un parun\u0101sim par ConfigMaps.<\/p>\n<h3>ConfigMaps<\/h3>\n<p>\nHelm izmanto ConfigMaps k\u0101 datu glab\u0101tuvi. Kad m\u0113s run\u0101j\u0101m par arhitekt\u016bru, tur nebija nevienas datu b\u0101zes, kur\u0101 tiktu glab\u0101ta inform\u0101cija par laidieniem, konfigur\u0101cij\u0101m, atgrie\u0161an\u0101s procesiem utt. Tam tiek izmantoti ConfigMaps.<\/p>\n<p>Pamatprobl\u0113ma ar ConfigMaps ir zin\u0101ma \u2014 tie b\u016bt\u012bb\u0101 nav dro\u0161i, tie satur <strong>nevar glab\u0101t sensit\u012bvos datus<\/strong>. Run\u0101jam par visu, kas nedr\u012bkst nok\u013c\u016bt t\u0101l\u0101k par pakalpojumu, piem\u0113ram, parol\u0113m. Tagad Helm vispareiz\u0101kais veids ir p\u0101riet no ConfigMaps izmanto\u0161anas uz slepeniem datiem.<\/p>\n<p>To paveikt ir \u013coti vienk\u0101r\u0161i. J\u016bs p\u0101rrakstat Tiller iestat\u012bjumus un nor\u0101dat, ka glab\u0101tuve b\u016bs slepenie dati. T\u0101d\u0101 gad\u012bjum\u0101 katra izpilde sniegs nevis ConfigMap, bet nosl\u0113pumu.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/7fd12bfbed5c6c8111a5126c2ab9f853.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJ\u016bs varat iebilst, ka pa\u0161i slepenie dati ir d\u012bvaina koncepcija un tas nav p\u0101r\u0101k dro\u0161i. Tom\u0113r, ir svar\u012bgi saprast, ka to dara pa\u0161i Kubernetes izstr\u0101d\u0101t\u0101ji. S\u0101kot ar versiju 1.10, t.i., sal\u012bdzino\u0161i sen, ir iesp\u0113ja, vismaz publiskajos m\u0101ko\u0146os, pievienot pareizo glab\u0101\u0161anu nosl\u0113pumu glab\u0101\u0161anai. Pa\u0161laik komanda str\u0101d\u0101 pie t\u0101, lai v\u0113l lab\u0101k nodro\u0161in\u0101tu piek\u013cuvi nosl\u0113pumiem, atsevi\u0161\u0137iem podiem vai cit\u0101m entit\u0101t\u0113m.<\/p>\n<blockquote><p>Helm glab\u0101\u0161ana lab\u0101k j\u0101p\u0101rv\u0113r\u0161 par nosl\u0113pumiem, un tos savuk\u0101rt j\u0101nodro\u0161ina centraliz\u0113ti.<\/p><\/blockquote>\n<p>\nProtams, paliks <strong>ierobe\u017eojums datu glab\u0101\u0161anai 1 MB<\/strong>. Helm \u0161eit izmanto etcd k\u0101 sadal\u012btu kr\u0101tuvi ConfigMaps. Tur uzskat\u012bja, ka t\u0101 ir piem\u0113rota datu da\u013ca replik\u0101cij\u0101m utt. Par \u0161o ir interesants apsprie\u0161anas temats Reddit, iesaku to atrast un izlas\u012bt vai izlas\u012bt kopsavilkumu br\u012bvdien\u0101s. <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/helm\/helm\/issues\/1413\">\u0161eit<\/a><\/noindex>.<\/p>\n<h3>Chart Repos<\/h3>\n<p>\nChart'i ir visvair\u0101k soci\u0101li neaizsarg\u0101ti un var k\u013c\u016bt par 'Man in the middle' avotu, \u012bpa\u0161i, ja tiek izmantota noliktavas risin\u0101jums. Pirmaj\u0101 k\u0101rt\u0101 runa ir par repozitorijiem, kas ir pieejami pa HTTP.<\/p>\n<blockquote><p>Noteikti j\u0101izsaka Helm Repo pa HTTPS \u2014 tas ir lab\u0101kais variants un maks\u0101 l\u0113ti.<\/p><\/blockquote>\n<p>\nL\u016bdzu, \u0146emiet v\u0113r\u0101 <strong>chart'u parakstu meh\u0101nisms<\/strong>. Tehnolo\u0123ija ir neticami vienk\u0101r\u0161a. Tas ir tas pats, ko j\u016bs izmantojat GitHub \u2014 parasta PGP ma\u0161\u012bnerija ar publiskajiem un priv\u0101tajiem atsl\u0113g\u0101m. Iestatiet to un b\u016bsit p\u0101rliecin\u0101ti, ka, ja jums ir nepiecie\u0161am\u0101s atsl\u0113gas un parakst\u0101t visu, tas patie\u0161\u0101m ir j\u016bsu charts.<\/p>\n<p>Turkl\u0101t, <strong>Helm klients atbalsta TLS<\/strong> (nevis HTTP servera pus\u0113, bet abpus\u0113jo TLS). J\u016bs varat izmantot servera un klienta atsl\u0113gas, lai sazin\u0101tos. J\u0101atz\u012bst, es \u0161\u0101du meh\u0101nismu neizmantoju, jo man nepat\u012bk abpus\u0113jie sertifik\u0101ti. Princip\u0101, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/helm\/chartmuseum\">chartmuseum<\/a><\/noindex> \u2014 galvenais r\u012bks Helm Repo izveidei Helm 2 \u2014 atbalsta ar\u012b pamata autentific\u0113\u0161anu. Varat izmantot pamata autentific\u0113\u0161anu, ja tas ir \u0113rt\u0101k un dro\u0161\u0101k.<\/p>\n<p>Ir ar\u012b spraudnis <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hayorov\/helm-gcs\">helm-gcs<\/a><\/noindex>, kas \u013cauj izvietot Chart Repos Google Cloud Storage. Tas ir diezgan \u0113rti, lieliski darbojas un ir pietiekami dro\u0161i, jo tiek utiliz\u0113ti visi aprakst\u012btie meh\u0101nismi.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/6a72bfd96c7eb0e2fdd7bcbf128e6433.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJa iesl\u0113dzat HTTPS vai TLS, izmantojat mTLS un piesl\u0113dzat pamata autentific\u0113\u0161anu, lai v\u0113l vair\u0101k samazin\u0101tu riskus, ieg\u016bsiet dro\u0161u komunik\u0101cijas kan\u0101lu starp Helm CLI un Chart Repo.<\/p>\n<h3>gRPC API<\/h3>\n<p>\nN\u0101kamais solis ir \u013coti atbild\u012bgs \u2014 nodro\u0161in\u0101t Tiller, kas atrodas klaster\u012b un ir, no vienas puses, serveris, no otras puses \u2014 pats piek\u013c\u016bst citiem komponentiem un cen\u0161as sevi nodot par k\u0101du citu.<\/p>\n<p>K\u0101 jau teicu, Tiller ir pakalpojums, kas izvada gRPC, Helm klients tam piek\u013c\u016bst, izmantojot gRPC. Noklus\u0113juma iestat\u012bjumos, protams, TLS ir izsl\u0113gts. K\u0101p\u0113c t\u0101 ir izdar\u012bts \u2014 t\u0101 ir diskusijas t\u0113ma, man \u0161\u0137iet, ka lai atvieglotu iestat\u012b\u0161anu s\u0101kum\u0101.<\/p>\n<blockquote><p>Produkcijai un pat staging ieteiktu iesl\u0113gt TLS uz gRPC.<\/p><\/blockquote>\n<p>\nManupr\u0101t, at\u0161\u0137ir\u012bb\u0101 no mTLS diagramm\u0101m, \u0161eit tas ir piem\u0113rots un tiek dar\u012bts \u013coti vienk\u0101r\u0161i \u2014 \u0123ener\u0113jat PQI infrastrukt\u016bru, izveidojat sertifik\u0101tu, uzs\u0101kat Tiller un nododat sertifik\u0101tu inicializ\u0113\u0161anas laik\u0101. P\u0113c tam varat izpild\u012bt visas Helm komandas, iepaz\u012bstinot ar \u0123ener\u0113to sertifik\u0101tu un priv\u0101to atsl\u0113gu.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/ed55b9a465ed1278b272c52c90b2b345.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u0101d\u0113j\u0101di j\u016bs pasarg\u0101siet sevi no vis\u0101m izsaukumiem uz Tiller no \u0101rpuses no klastera.<\/p>\n<p>T\u0101tad, m\u0113s esam pasarg\u0101ju\u0161i savienojumu ar Tiller, jau apspried\u0101m RBAC un noregul\u0113j\u0101m Kubernetes apiserveru ties\u012bbas, samazin\u0101j\u0101m dom\u0113nu, ar kuru tas var mijiedarboties.<\/p>\n<h2>Aizsarg\u0101tais Helm<\/h2>\n<p>\nApskat\u012bsim gal\u012bgo sh\u0113mu. T\u0101 ir t\u0101 pati arhitekt\u016bra ar t\u0101m pa\u0161\u0101m bult\u0101m.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/6672e254ad93b917f57794e1619a572e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVisas savienojumus tagad dro\u0161i varam uzz\u012bm\u0113t za\u013c\u0101 kr\u0101s\u0101:<\/p>\n<ul>\n<li>Chart Repo izmantojam TLS vai mTLS un pamata autentifik\u0101ciju;<\/li>\n<li>mTLS Tiller, kas ir izveidots k\u0101 gRPC pakalpojums ar TLS, izmantojam sertifik\u0101tus;<\/li>\n<li>klaster\u012b tiek izmantots speci\u0101ls pakalpojumu konts ar lomu un RoleBinding.\u00a0<\/li>\n<\/ul>\n<p>\nM\u0113s iev\u0113rojami esam pasarg\u0101ju\u0161i klasteri, bet k\u0101ds gudrs cilv\u0113ks teica:<\/p>\n<blockquote><p>\u00abAbsol\u016bti dro\u0161a risin\u0101juma var b\u016bt tikai viens \u2014 izsl\u0113gts dators, kas atrodas beton\u0101 kast\u0113 un kuru sarg\u0101 kareivji\u00bb.<\/p><\/blockquote>\n<p>\nIr da\u017e\u0101di veidi, k\u0101 manipul\u0113t datus un atrast jaunus uzbrukumu vektorus. Tom\u0113r esmu p\u0101rliecin\u0101ts, ka \u0161ie ieteikumi \u013caus \u012bstenot pamata r\u016bpniecisko dro\u0161\u012bbas standartu.<\/p>\n<h2>Bonuss<\/h2>\n<p>\n\u0160\u012b da\u013ca tie\u0161i neskar dro\u0161\u012bbu, bet b\u016bs ar\u012b noder\u012bga. Par\u0101d\u012b\u0161u da\u017eas interesantas lietas, par kur\u0101m maz cilv\u0113ku zina. Piem\u0113ram, k\u0101 mekl\u0113t diagrammas \u2014 ofici\u0101l\u0101s un neofici\u0101l\u0101s.<\/p>\n<p>Repozitorij\u0101 <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/helm\/charts\">github.com\/helm\/charts<\/a><\/noindex> \u0161obr\u012bd ir ap 300 diagramm\u0101m un divi straumi: stable un incubator. Tas, kur\u0161 piedal\u0101s, lieliski zina, cik gr\u016bti ir iek\u013c\u016bt no incubator uz stable, un cik viegli ir izkrist no stable. Tom\u0113r tas nav lab\u0101kais r\u012bks, lai mekl\u0113tu diagrammas Prometheus un visu, kas jums pat\u012bk, vienk\u0101r\u0161a iemesla d\u0113\u013c \u2014 tas nav ports, kur\u0101 \u0113rti mekl\u0113t pakotnes.<\/p>\n<p>Bet ir pakalpojums <noindex><a rel=\"nofollow\" href=\"https:\/\/hub.helm.sh\/\">hub.helm.sh<\/a><\/noindex>, ar kura pal\u012bdz\u012bbu atrast diagrammas ir daudz \u0113rt\u0101k. Svar\u012bg\u0101kais ir tas, ka tur ir daudz vair\u0101k \u0101r\u0113jo repozitoriju un pieejams gandr\u012bz 800 diagrammu. Plus, j\u016bs varat pievienot savu repozitoriju, ja k\u0101du iemeslu d\u0113\u013c nev\u0113laties nos\u016bt\u012bt savas diagrammas uz stable.<\/p>\n<p>Pats h hub.helm.sh un att\u012bst\u012bsim to kop\u0101. \u0160is pakalpojums ir Helm projekta ietvaros, un j\u016bs varat ieguld\u012bt pat t\u0101 lietot\u0101ja saskarn\u0113, ja esat frontend izstr\u0101d\u0101t\u0101js un vienk\u0101r\u0161i v\u0113laties uzlabot vizu\u0101lo izskatu.<\/p>\n<p>V\u0113l\u0113tos piev\u0113rst j\u016bsu uzman\u012bbu <strong>Open Service Broker API integr\u0101cijai<\/strong>. Izklaus\u0101s sare\u017e\u0123\u012bti un neskaidri, bet tas risina uzdevumus, ar kuriem visi saskaras. Izskaidro\u0161u ar vienk\u0101r\u0161u piem\u0113ru.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/3aeb7e0781e50a79b518f1056873f73a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIr Kubernetes klasteris, kur\u0101 v\u0113lamies palaist klasisku lietojumprogrammu \u2014 WordPress. Parasti, lai nodro\u0161in\u0101tu pilnu funkcionalit\u0101ti, nepiecie\u0161ama datub\u0101ze. Ir daudz da\u017e\u0101du risin\u0101jumu, piem\u0113ram, var palaist savu stateful pakalpojumu. Tas nav \u013coti \u0113rti, bet daudzi t\u0101 r\u012bkojas.<\/p>\n<p>Citi, piem\u0113ram, m\u0113s Chainstack, izmanto p\u0101rvald\u012btas datub\u0101zes, piem\u0113ram, MySQL vai PostgreSQL serveriem. T\u0101p\u0113c m\u016bsu datub\u0101zes atrodas kaut kur m\u0101ko\u0146os.<\/p>\n<p>Bet rodas probl\u0113ma: nepiecie\u0161ams savienot m\u016bsu pakalpojumu ar datub\u0101zi, izveidot datub\u0101zes flavor, nodot akredit\u0101cijas datus un kaut k\u0101 p\u0101rvald\u012bt to. To parasti veic manu\u0101li sist\u0113mas administrators vai izstr\u0101d\u0101t\u0101js. Un nav nek\u0101das probl\u0113mas, kad ir maz aplik\u0101ciju. Kad to ir daudz, ir nepiecie\u0161ams kombains. \u0160\u0101ds kombains past\u0101v \u2014 tas ir Service Broker. Tas \u013cauj izmantot \u012bpa\u0161u spraudni klasterim, kas atrodas publiskaj\u0101 m\u0101ko\u0146\u0101, un pas\u016bt\u012bt resursus no pakalpojumu sniedz\u0113ja caur Broker, it k\u0101 tas b\u016btu API. \u0160im nol\u016bkam var izmantot Kubernetes nativ\u0101s iesp\u0113jas.<\/p>\n<p>Tas ir \u013coti vienk\u0101r\u0161i. Var piepras\u012bt, piem\u0113ram, Managed MySQL Azure ar pamata pakalpojumu (to var konfigur\u0113t). Izmantojot Azure API, datub\u0101ze tiks izveidota un sagatavota lieto\u0161anai. Jums nav j\u0101iejaucas, to p\u0101rvalda spraudnis. Piem\u0113ram, OSBA (Azure spraudnis) atgriez\u012bs akredit\u0101cijas datus pakalpojumam un p\u0101rs\u016bt\u012bs to Helm. J\u016bs varat izmantot WordPress ar m\u0101ko\u0146a MySQL, nemaz nenodarbojoties ar p\u0101rvald\u012bt\u0101m datub\u0101z\u0113m un neuztraucoties par stateful pakalpojumiem iek\u0161pus\u0113.<\/p>\n<blockquote><p>Var teikt, ka Helm ir l\u012bme, kas no vienas puses \u013cauj izvietot pakalpojumus, bet no otras \u2014 pat\u0113r\u0113t m\u0101ko\u0146u pakalpojumu sniedz\u0113ju resursus.<\/p><\/blockquote>\n<p>\nVarat izstr\u0101d\u0101t savu spraudni un izmantot visu \u0161o st\u0101stu on-premise. Tad jums vienk\u0101r\u0161i b\u016bs sava spraud\u0146a uz\u0146\u0113muma Cloud pakalpojumu sniedz\u0113jam. Es iesaku izm\u0113\u0123in\u0101t \u0161o pieeju, \u012bpa\u0161i, ja jums ir liela m\u0113roga projekti un v\u0113laties \u0101tri izv\u0113rst att\u012bst\u012bbas, iepriek\u0161\u0113jo vai visu infrastrukt\u016bru k\u0101dai funkcijai. Tas atvieglos dz\u012bvi j\u016bsu oper\u0101ciju vai DevOps komand\u0101m.<\/p>\n<p>V\u0113l viena atraduma iesp\u0113ja, ko jau piemin\u0113ju \u2014 tas ir <strong>spraudnis helm-gcs<\/strong>, kas \u013cauj izmantot Google-buckets (objektu kr\u0101tuve), lai glab\u0101tu Helm diagrammas.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/30888c4f9b5dba14b87ba1e29e0ebed7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIr nepiecie\u0161amas tikai \u010detras komandas, lai s\u0101ktu to izmantot:<\/p>\n<ol>\n<li>instal\u0113t papla\u0161in\u0101jumu;<\/li>\n<li>s\u0101kt t\u0101 lieto\u0161anu;<\/li>\n<li>uzst\u0101d\u012bt ce\u013cu uz bucket, kas atrodas gcp;<\/li>\n<li>public\u0113t diagrammas standarta veid\u0101.<\/li>\n<\/ol>\n<p>\nSkaistums sl\u0113pjas taj\u0101, ka tiks izmantota nativa gcp autentifik\u0101cija. J\u016bs varat izmantot pakalpojuma kontu, izstr\u0101d\u0101t\u0101ja kontu \u2014 visu, ko vien v\u0113laties. Tas ir \u013coti \u0113rti un izmaks\u0101 praktiski neko. Ja j\u016bs, t\u0101pat k\u0101 es, atbalst\u0101t opsless filozofiju, tad tas b\u016bs \u013coti noder\u012bgi, \u012bpa\u0161i maziem komand\u0101m.<\/p>\n<h2>Alternat\u012bvas<\/h2>\n<p>\nHelm nav vien\u012bgais risin\u0101jums pakalpojumu p\u0101rvald\u012b\u0161anai. Tam ir daudz jaut\u0101jumu, iesp\u0113jams, tie\u0161i t\u0101p\u0113c tik \u0101tri par\u0101d\u012bj\u0101s tre\u0161\u0101 versija. Protams, ir alternat\u012bvas.<\/p>\n<p>Tas var\u0113tu b\u016bt gan speci\u0101li risin\u0101jumi, piem\u0113ram, Ksonnet vai Metaparticle. J\u016bs varat izmantot savus klasiskos infrastrukt\u016bras p\u0101rvald\u012bbas l\u012bdzek\u013cus (Ansible, Terraform, Chef u.c.) tiem pa\u0161iem m\u0113r\u0137iem, par kuriem es run\u0101ju.<\/p>\n<p>Visbeidzot, ir risin\u0101jums <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/operator-framework\">Operator Framework<\/a><\/noindex>, kura popularit\u0101te pieaug.<\/p>\n<blockquote><p>Operator Framework ir galven\u0101 alternat\u012bva Helm, uz kuru vajadz\u0113tu piev\u0113rst uzman\u012bbu.<\/p><\/blockquote>\n<p>\nTas ir daudz nativ\u0101ks CNCF un Kubernetes, <strong>bet iebrauk\u0161anas slogs ir daudz augst\u0101ks<\/strong>, nepiecie\u0161ams vair\u0101k programm\u0113t un maz\u0101k aprakst\u012bt manifektus.<\/p>\n<p>Ir da\u017e\u0101di papildin\u0101jumi, piem\u0113ram, Draft, Scaffold. Tie \u013coti atvieglo dz\u012bvi, piem\u0113ram, izstr\u0101d\u0101t\u0101jiem vienk\u0101r\u0161o s\u016bt\u012b\u0161anas un palai\u0161anas procesu Helm test\u0113\u0161anas vides izvieto\u0161anai. Es tos sauktu par pilnveidot\u0101jiem.<\/p>\n<p>Te ir vizu\u0101ls grafiks par to, kur kas atrodas.<\/p>\n<p><img decoding=\"async\" alt=\"Helm dro\u0161\u012bba\" src=\"\/wp-content\/uploads\/2019\/08\/81a8236c975d5e1649acaaa7989c27ba.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nUz x ass ir j\u016bsu person\u012bg\u0101 kontroles l\u012bmenis p\u0101r notieko\u0161o, uz y ass \u2014 Kubernetes nativit\u0101tes l\u012bmenis. Helm 2 versija atrodas kaut kur pa vidu. Versij\u0101 3 nav nekas kolos\u0101ls, bet gan uzlabota gan kontrole, gan nativit\u0101te. Ksonnet l\u012bme\u0146a risin\u0101jumi joproj\u0101m ir zem Helm 2. Tom\u0113r uz tiem ir v\u0113rts paskat\u012bties, lai zin\u0101tu, kas v\u0113l ir \u0161aj\u0101 pasaul\u0113. Protams, j\u016bsu konfigur\u0101cijas mened\u017eeris b\u016bs j\u016bsu kontrol\u0113, bet tam nav nek\u0101das nativit\u0101tes attiec\u012bb\u0101 uz Kubernetes.<\/p>\n<p>Operator Framework ir piln\u012bb\u0101 dabisks Kubernetes un \u013cauj to p\u0101rvald\u012bt daudz eleganti un r\u016bp\u012bgi (bet atcer\u0113simies par piek\u013cuves l\u012bmeni). Dr\u012bz\u0101k tas der\u0113s specializ\u0113tai lietotnei un t\u0101s vad\u012bbas izveidei, nevis masveida kombainam, kas iepakos milz\u012bgu skaitu lietot\u0146u, izmantojot Helm.<\/p>\n<p>Papla\u0161in\u0101jumi vienk\u0101r\u0161i nedaudz uzlabo kontroli, papildina darba pl\u016bsmu vai samazina CI\/CD pipelines st\u016brus.<\/p>\n<h2>Helm n\u0101kotne<\/h2>\n<p>\nLaba zi\u0146a ir t\u0101, ka par\u0101d\u0101s Helm 3. Jau ir izn\u0101cis Helm 3.0.0-alpha.2 alfa versijas izlaidums, to var izm\u0113\u0123in\u0101t. Tas ir pietiekami stabils, bet funkcionalit\u0101te pagaid\u0101m ir ierobe\u017eota.<\/p>\n<p>K\u0101p\u0113c nepiecie\u0161ams Helm 3? Vispirms jau tas ir st\u0101sts par <strong>Tiller izzu\u0161anu<\/strong>, k\u0101 komponenta. Tas, k\u0101 jau saprotat, ir milz\u012bgs solis uz priek\u0161u, jo arhitekt\u016bras dro\u0161\u012bbas zi\u0146\u0101 viss tiek vienk\u0101r\u0161ots.<\/p>\n<p>Kad tika izveidots Helm 2, tas bija Kubernetes 1.8 vai pat agr\u0101ku laiku, daudzas koncepcijas bija nenobriedu\u0161as. Piem\u0113ram, CRD koncepcija pa\u0161laik tiek akt\u012bvi ieviesta, un Helm izmantos <strong>CRD<\/strong>, lai uzglab\u0101tu strukt\u016bras. B\u016bs iesp\u0113jams izmantot tikai klientu un nevajadz\u0113s tur\u0113t servera da\u013cu. T\u0101d\u0113j\u0101di b\u016bs iesp\u0113jams izmantot viet\u0113j\u0101s Kubernetes komandas darbam ar strukt\u016br\u0101m un resursiem. Tas ir milz\u012bgs solis uz priek\u0161u.<\/p>\n<p>Par\u0101d\u012bsies <strong>atbalsts viet\u0113jiem OCI repozitorijiem<\/strong> (Open Container Initiative). T\u0101 ir milz\u012bga iniciat\u012bva, un Helm tas ir interesanti vispirms, lai izvietotu savus chartus. Tas sasniedz to, ka, piem\u0113ram, Docker Hub atbalsta daudzus OCI standartus. Es nenodro\u0161inu, bet iesp\u0113jams, klasiskie Docker repozitoriju sniedz\u0113ji s\u0101ks pied\u0101v\u0101t iesp\u0113jas izvietot savus Helm chartus.<\/p>\n<p>Str\u012bd\u012bga t\u0113ma man ir <strong>Lua atbalsts<\/strong>, k\u0101 templating engine skriptu rakst\u012b\u0161anai. Es neesmu liels Lua fans, bet t\u0101 b\u016bs piln\u012bgi opcion\u0101la iesp\u0113ja. Es to esmu p\u0101rbaud\u012bjis tr\u012bs reizes - Lua izmanto\u0161ana neb\u016bs oblig\u0101ta. T\u0101p\u0113c, kas to v\u0113las, var\u0113s izmantot Lua, bet kuriem pat\u012bk Go - pievienojieties m\u016bsu lielajai grupai un izmantojiet go-tmpl \u0161im m\u0113r\u0137im.<\/p>\n<p>Beidzot tas, ko es tie\u0161\u0101m gaid\u012bju - <strong>schemas par\u0101d\u012b\u0161an\u0101s un datu tipu valid\u0101cija<\/strong>. Vairs neb\u016bs probl\u0113mu ar int vai string, neb\u016bs j\u0101noliek nulle divos p\u0113di\u0146\u0101s. Par\u0101d\u012bsies JSONS sh\u0113ma, kas \u013caus to skaidri aprakst\u012bt v\u0113rt\u012bb\u0101m.<\/p>\n<p>Tiks \u013coti b\u016btiski p\u0101rstr\u0101d\u0101ta <strong>notikumu virz\u012bt\u0101 modelis<\/strong>. T\u0101 jau ir konceptu\u0101li aprakst\u012bta. Apskatiet Helm 3 sada\u013cu, un redz\u0113siet, cik daudz jaunu notikumu, \u0101\u0137u un citu elementu ir pievienots, kas iev\u0113rojami atvieglo un, no otras puses, \u013cauj lab\u0101k kontrol\u0113t izvieto\u0161anas procesus un reakcijas uz tiem.<\/p>\n<p>Helm 3 b\u016bs vienk\u0101r\u0161\u0101ks, dro\u0161\u0101ks un interesant\u0101ks nevis t\u0101p\u0113c, ka mums nepat\u012bk Helm 2, bet t\u0101p\u0113c, ka Kubernetes k\u013c\u016bst arvien progres\u012bv\u0101ks. Attiec\u012bgi, Helm var izmantot Kubernetes izstr\u0101des priek\u0161roc\u012bbas un rad\u012bt lieliskus mened\u017eerus Kubernetes platformai.<\/p>\n<blockquote><p>V\u0113l viena laba zi\u0146a ir t\u0101, ka <noindex><a rel=\"nofollow\" href=\"https:\/\/devopsconf.io\/moscow\/2019\">DevOpsConf<\/a><\/noindex> Aleksandrs Haj\u0101rovs past\u0101st\u012bs, <noindex><a rel=\"nofollow\" href=\"https:\/\/devopsconf.io\/moscow\/2019\/abstracts\/5564\">vai konteineri var b\u016bt dro\u0161i?<\/a><\/noindex> Atg\u0101din\u0101m, ka konferenc\u0113 par izstr\u0101des, test\u0113\u0161anas un ekspluat\u0101cijas procesu integr\u0101ciju notiks Maskav\u0101 <strong>30. septembr\u012b un 1. oktobr\u012b.<\/strong>. L\u012bdz 20. augustam v\u0113l var <noindex><a rel=\"nofollow\" href=\"https:\/\/conf.ontico.ru\/lectures\/propose\/?conference=dc2019-moscow\">iesniegt zi\u0146ojumu<\/a><\/noindex> un dal\u012bties ar savu pieredzi risin\u0101\u0161an\u0101 <noindex><a rel=\"nofollow\" href=\"https:\/\/devopsconf.io\/moscow\/2019\/articles\/917\">vien\u0101 no daudzij\u0101m<\/a><\/noindex> DevOps pieejas uzdevumiem.<\/p>\n<p>Seko l\u012bdzi konferences jaunumiem un zi\u0146\u0101m <noindex><a rel=\"nofollow\" href=\"http:\/\/eepurl.com\/bN_0E1\">jaunumu sarakst\u0101<\/a><\/noindex> un <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/DevOpsConfChannel\">telegrama kan\u0101l\u0101.<\/a><\/noindex>.<\/p><\/blockquote>\n<p>Avots: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/oleg-bunin\/blog\/462665\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u0443\u0442\u044c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430 \u043e \u0441\u0430\u043c\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0434\u043b\u044f Kubernetes \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043c\u043e\u0434\u0436\u0438: \u043a\u043e\u0440\u043e\u0431\u043a\u0430 \u2014 \u044d\u0442\u043e Helm (\u044d\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0435, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Emoji); \u0437\u0430\u043c\u043e\u043a \u2014 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c; \u0447\u0435\u043b\u043e\u0432\u0435\u0447\u0435\u043a \u2014 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b. \u041d\u0430 \u0441\u0430\u043c\u043e\u043c \u0436\u0435 \u0434\u0435\u043b\u0435, \u0432\u0441\u0435 \u0431\u0443\u0434\u0435\u0442 \u043d\u0435\u043c\u043d\u043e\u0436\u0435\u0447\u043a\u043e \u0441\u043b\u043e\u0436\u043d\u0435\u0435, \u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437 \u043f\u043e\u043b\u043e\u043d \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0441\u0434\u0435\u043b\u0430\u0442\u044c Helm \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27661,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36918","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u0443\u0442\u044c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430 \u043e \u0441\u0430\u043c\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0434\u043b\u044f Kubernetes \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043c\u043e\u0434\u0436\u0438: \u043a\u043e\u0440\u043e\u0431\u043a\u0430 \u2014 \u044d\u0442\u043e Helm (\u044d\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0435, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Emoji);.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bezopasnost-helm\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Helm | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u0443\u0442\u044c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430 \u043e \u0441\u0430\u043c\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0434\u043b\u044f Kubernetes \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043c\u043e\u0434\u0436\u0438: \u043a\u043e\u0440\u043e\u0431\u043a\u0430 \u2014 \u044d\u0442\u043e Helm (\u044d\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0435, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Emoji);.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bezopasnost-helm\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:14:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:14:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Helm dro\u0161\u012bba | ProHoster","description":"Visu par popul\u0101r\u0101ko pakot\u0146u mened\u017eeri Kubernetes var\u0113tu att\u0113lot ar emocijz\u012bm\u0113m: kaste \u2014 tas ir Helm (tas ir vispiem\u0113rot\u0101kais, kas ir jaun\u0101kaj\u0101 Emoji izlai\u0161an\u0101);","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bezopasnost-helm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Helm | ProHoster","og:description":"\u0421\u0443\u0442\u044c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430 \u043e \u0441\u0430\u043c\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0434\u043b\u044f Kubernetes \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043c\u043e\u0434\u0436\u0438: \u043a\u043e\u0440\u043e\u0431\u043a\u0430 \u2014 \u044d\u0442\u043e Helm (\u044d\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0435, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Emoji);.","og:url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/bezopasnost-helm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:43+00:00","article:modified_time":"2019-10-31T19:14:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36918","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:36:25","updated":"2026-01-22 05:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/36918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=36918"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/36918\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media\/27661"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=36918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=36918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=36918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}