Kia ora, e ngā kainoho o Habro! He mea nui a Kubernetes i roto i te pūnaha kapua hou. Mā tēnei hangarau ka pono, ka taea te whakawhanui, ka pakari hoki te marikotanga ipu. Ka whakamārama a John Arundel rāua ko Justin Domingus i te pūnaha Kubernetes, ā, ka whakaurua mai hoki ngā otinga kua whakamātauhia mō ngā raruraru o ia rā. I ia taahiraa, ka hangaia e koe tō ake tono kapua taketake, ka hangaia hoki te hanganga hei tautoko i a ia, ka whakatūria he taiao whanaketanga me tētahi pūnaha whakatinanatanga tonu hei āwhina i a koe i a koe e mahi ana i ngā tono ā muri ake nei.
• Tīmata ki ngā ipu me ngā Kubernetes mai i te tīmatanga—kāore he wheako o mua e hiahiatia ana. • Whakahaerehia ō ake taupū, whiriwhiria rānei he ratonga Kubernetes whakahaeretia mai i a Amazon, Google, me ētahi atu. • Whakamahia a Kubernetes hei whakahaere i te huringa ora o te ipu me te whakamahinga rauemi. • Arotauhia ngā taupū mō te utu, te mahi, te manawanui, te kaha, me te tauine. • Akohia ngā taputapu pai rawa atu hei whakawhanake, hei whakamātautau, me te whakatinana i ō tono. • Whakamahia ngā mahi pai rawa atu a te umanga mō te haumarutanga me te whakahaere. • Whakatūria ngā mātāpono DevOps puta noa i tō whakahaere hei āwhina i ō rōpū whakawhanake kia tere ake, kia tere ake, kia whai hua ake hoki.
Mā wai tēnei pukapuka?
He mea nui rawa atu tēnei pukapuka mā ngā kaimahi whakahaere e whakahaere ana i ngā tūmau, ngā tono, me ngā ratonga, tae atu ki ngā kaiwhakawhanake e hanga ana i ngā ratonga kapua hou, e heke ana rānei i ngā tono o nāianei ki Kubernetes me te kapua. Kaua e manukanuka, kāore he mōhiotanga o mua mō Kubernetes, mō ngā ipu rānei—mā mātou koe e ako ki ngā mea katoa.
Ka kitea hoki e ngā kaiwhakamahi Kubernetes mātau he nui ngā hua o tēnei pukapuka, e kapi ana i ngā kaupapa pēnei i te RBAC, te whakatinanatanga tonu, te whakahaere tūmataitinga, me te āheinga ki te tirotiro. Ko te tumanako ka kitea e koe tētahi mea whakamere i roto i ōna whārangi, ahakoa ō pūkenga me ō wheako.
He aha ngā pātai ka whakautua e te pukapuka?
I te wā e whakamahere ana, e tuhi ana hoki i tēnei pukapuka, i kōrero mātou mō ngā hangarau kapua me ngā Kubernetes me ngā rau tāngata, i kōrero hoki ki ngā kaiārahi ahumahi me ngā tohunga, tae atu ki ngā tauhou. Kei raro nei ētahi o ngā pātai i hiahia rātou kia whakautua i roto i tēnei pukapuka.
- "Kei te hiahia au ki te mōhio he aha me whakapau wā ahau ki tēnei hangarau. He aha ngā raruraru ka āwhina i ahau me taku tīma ki te whakaoti?"
- "He āhua whakamere te āhua o Kubernetes, engari he roa te wā e ako ai. Ehara i te mea uaua te whakatū i tētahi tauira māmā, engari he uaua te whakahaere me te whakatika hapa. E hiahia ana mātou ki te whakarongo ki ngā tohutohu pono mō te whakahaere a te tangata i ngā tautau Kubernetes i roto i ngā taiao o te ao tūturu, me ngā take ka tūpono pea mātou ki te tūtaki."
- "He pai ētahi tohutohu whaiaro. He maha rawa ngā kōwhiringa kei roto i te pūnaha Kubernetes hei whiriwhiri mā ngā tīma hou. Ina he maha ngā huarahi hei mahi i te mea kotahi, me pēhea e mōhio ai koe ko tēhea te mea pai rawa atu? Me pēhea e whiriwhiri ai koe?"
Ā, ko te pātai nui rawa atu pea:
- "Me pēhea taku whakamahi i a Kubernetes me te kore e whakararuraru i taku pakihi?"
Wāhanga: Whirihoranga me ngā Ahanoa Huna
He tino whai hua te āheinga ki te wehewehe i te arorau o tētahi taupānga Kubernetes mai i tōna whirihoranga (arā, ngā uara, ngā tautuhinga rānei ka rerekē pea i roto i te wā). Ko ngā uara whirihoranga ko ngā tawhā motuhake ki te taiao, ngā wāhitau DNS mō ngā ratonga tuatoru, me ngā tohu manatoko.
Ae, ka taea te whakanoho tika i ēnei mea katoa ki roto i te waehere, engari kāore tēnei huarahi i te tino ngāwari. Hei tauira, ko te whakarerekē i tētahi uara whirihoranga me hanga anō me te whakatū anō i tō waehere. He otinga pai ake ko te wehe i te whirihoranga mai i te waehere me te pānui mai i tētahi kōnae, i ngā taurangi taiao rānei.
He maha ngā huarahi rerekē a Kubernetes hei whakahaere i te whirihoranga. Tuatahi, ka taea e koe te tuku uara ki te tono mā roto i ngā taurangi taiao kua tohua i roto i te whakatakotoranga anga pod (tirohia te wāhanga "Ngā Taurangi Taiao" i te whārangi 192). Tuarua, ka taea te penapena tika i ngā raraunga whirihoranga ki Kubernetes mā te whakamahi i ngā mea ConfigMap me Secret.
I roto i tēnei upoko, ka tūhuratia ēnei mea me te taipitopito, ka tirohia hoki ētahi huarahi whai hua hei whakahaere i ngā raraunga whirihoranga me ngā raraunga tairongo mā te whakamahi i tētahi taupānga whakamātautau.
Te whakahou i ngā anga pod ina huri te whirihoranga
Whakaarohia kei a koe tētahi whakatinanatanga i roto i tō rōpū, ā, e hiahia ana koe ki te whakarerekē i ētahi uara i roto i tana ConfigMap. Mena kei te whakamahi koe i tētahi tūtohi Helm (tirohia "Helm: He Kaiwhakahaere Mōkihi mō Kubernetes" i te whārangi 102), ka taea e koe te kite aunoa i te huringa whirihoranga me te uta anō i ō pods mā te mahi auaha. Tāpirihia te tuhipoka e whai ake nei ki tō whakatakotoranga whakatinanatanga:
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") .
| sha256sum }}Kei roto i te tauira whakatinanatanga he arowhai o ngā tawhā whirihoranga: ki te huri ngā tawhā, ka whakahoutia te arowhai. Ki te whakahaere koe i te whakahau whakapai ake helm, ka kitea e Helm kua huri te whakatakotoranga whakatinanatanga, ā, ka tīmata anō i ngā pod katoa.
Ngā raraunga tairongo i roto i a Kubernetes
E mōhio ana tātou kei te whakaratohia e te mea ConfigMap tētahi tikanga ngāwari mō te penapena me te uru atu ki ngā raraunga whirihoranga i roto i tētahi rōpū. Heoi, kei roto i te nuinga o ngā tono ngā mōhiohio tairongo me ngā mōhiohio huna, pērā i ngā kupuhipa, ngā kī API rānei. Ahakoa e taea ana te penapena i ēnei mōhiohio ki roto i tētahi ConfigMap, ehara i te mea pai rawa atu.
Engari, kei a Kubernetes tētahi momo mea motuhake kua hangaia mō te penapena raraunga tairongo: ko te mea huna. Me titiro tātou ki tētahi tauira o te whakamahinga o tēnei mea i roto i tā tātou tono whakamātautau.
Hei tīmatanga, tirohia te whakaaturanga Kubernetes mō te mea Secret (tirohia hello-secret-env/k8s/secret.yaml):
apiVersion: v1
kind: Secret
metadata:
name: demo-secret
stringData:
magicWord: xyzzy
I tēnei tauira, ko te kī tūmataiti magicWord ko xyzzy (en.wikipedia.org/wiki/Xyzzy_(rorohiko)). He tino whai hua te kupu xyzzy i roto i te ao rorohiko. He rite ki te ConfigMap, ka taea e te mea Secret te pupuri i ngā kī me ngā uara maha. I konei, hei māmā ake, ka whakamahia e tātou tētahi takirua kī-uara kotahi anake.
Te Whakamahi i ngā Taonga Huna hei Taurangi Taiao
Pērā i te ConfigMap, ka taea te whakarite i tētahi mea Secret i roto i tētahi ipu hei taurangi taiao, hei kōnae rānei i runga i tana kōpae. I roto i te tauira e whai ake nei, ka tohaina e mātou te uara mai i te Secret ki tētahi taurangi taiao:
spec:
containers:
- name: demo
image: cloudnatived/demo:hello-secret-env
ports:
- containerPort: 8888
env:
- name: GREETING
valueFrom:
secretKeyRef:
name: demo-secret
key: magicWordWhakahaerehia te whakahau e whai ake nei i runga i te putunga whakaaturanga hei whakamahi i ngā whakaaturanga:
kubectl apply -f hello-secret-env/k8s/
deployment.extensions "demo" configured
secret "demo-secret" createdPērā i mua, tukuna te tauranga ā-rohe ki te deployment kia kite i te hua i roto i tō pūtirotiro:
kubectl port-forward deploy/demo 9999:8888
Forwarding from 127.0.0.1:9999 -> 8888
Forwarding from [::1]:9999 -> 8888I te whakatuwheratanga o tētahi wāhitau :9999/ me kite koe i ēnei e whai ake nei:
The magic word is "xyzzy"
Te tuhi i ngā mea ngaro ki ngā kōnae
I tēnei tauira, ka tāpirihia e mātou he mea ngaro ki te ipu hei kōnae. Kei roto i te kōpaki hello-secret-file o te putunga whakaaturanga te waehere.
Hei hono i te Secret hei kōnae, ka whakamahia e mātou te whakatinanatanga e whai ake nei:
spec:
containers:
- name: demo
image: cloudnatived/demo:hello-secret-file
ports:
- containerPort: 8888
volumeMounts:
- name: demo-secret-volume
mountPath: "/secrets/"
readOnly: true
volumes:
- name: demo-secret-volume
secret:
secretName: demo-secretPērā i te wāhanga "Te Waihanga i ngā Kōnae Whirihoranga mai i ngā Ahanoa ConfigMap" i te whārangi 240, ka waihangahia e mātou he rōrahi (i tēnei wā, demo-secret-volume) ka whakairihia ki te ipu i te wāhanga volumeMounts o te whakatakotoranga. Ka tohua e te āpure mountPath te /secrets, nō reira ka waihangahia e Kubernetes tētahi kōnae i roto i tēnei kōpaki mō ia takirua kī-uara kua tautuhia i roto i te ahanoa Secret.
I roto i tā mātou tauira, kotahi anake te takirua matua-uara kua tautuhia e mātou ko magicWord te ingoa, nō reira ka waihangahia e te whakaaturanga he kōnae pānui-anake kotahi /secrets/magicWord i roto i te ipu kei roto ngā raraunga tairongo.
Ki te whakamahia tēnei whakaaturanga i te ara kotahi ki te tauira o mua, me whiwhi koe i te hua ōrite:
The magic word is "xyzzy"
Te Pānui i ngā Mea Ngaro
I te wāhanga o mua, i whakamahia e tātou te whakahau kubectl describe hei whakaatu i ngā ihirangi o tētahi ConfigMap. Ka taea hoki e tātou te mahi i taua mea anō ki tētahi Secret?
kubectl describe secret/demo-secret
Name: demo-secret
Namespace: default
Labels: <none>
Annotations:
Type: Opaque
Data
====
magicWord: 5 bytesKia mōhio koe, kāore ngā raraunga tonu e whakaaturia. Ko ngā mea ngaro i roto i a Kubernetes he momo Opaque, arā, kāore ō rātou ihirangi e whakaaturia i roto i te putanga whakaahua kubectl, ngā rangitaki, i te pūwhakamutunga rānei, e ārai ana i te whakaaturanga tūpono o ngā mōhiohio tairongo.
Hei tiro i te putanga kua whakakōnaetia o ngā raraunga tairongo i roto i te hōputu YAML, whakamahia te whakahau kubectl get:
kubectl get secret/demo-secret -o yaml
apiVersion: v1
data:
magicWord: eHl6enk=
kind: Secret
metadata:
...
type: Opaquebase64
He aha tēnei mea eHl6enk=, he rerekē rawa atu i tō tātou uara taketake? He mea ngaro tēnei, kua whakakōwaetia ki roto i te base64. He kaupapa a Base64 mō te whakakōwae i ngā raraunga rua tauwhāiti hei aho pūāhua.
I te mea he rua pea ngā mōhiohio tairongo, ā, kāore e taea te tā (pērā i te kī whakamunatanga TLS), ka rongoatia ngā mea ngaro i te hōputu base64.
Ko te tuhinga beHl6enk= he putanga kua whakamāoritia ki te base64 o tā mātou kupu huna xyzzy. Ka taea e koe te manatoko i tēnei mā te whakahaere i te whakahau base64 --decode i te pūwhakamutunga:
echo "eHl6enk=" | base64 --decode
xyzzyNō reira, ahakoa ka tiakina koe e Kubernetes mai i te tukunga tūpono o ngā raraunga tairongo ki roto i tō pūnaha, ki roto rānei i ō kōnae takiuru, ki te mea he whakaaetanga pānui tāu mō ngā Mea Ngaro i roto i tētahi mokowā ingoa kua hoatu, ka taea e koe te tiki i aua raraunga i te hōputu base64 kātahi ka wetewete.
Ki te hiahia koe ki te whakakōwae i ētahi tuhinga ki roto i te base64 (hei tauira, ki te whakatakoto ki roto i te mea ngaro), whakamahia te whakahau base64 me te kore he tautohe:
echo xyzzy | base64
eHl6enkKTe urunga atu ki ngā mea ngaro
Ko wai ka taea te pānui me te whakatika i ngā mea ngaro? Ka whakatauhia tēnei e te RBAC, he tikanga whakahaere urunga (ka kōrerohia taipitopito i te wāhanga "Whakamōhiotanga ki te Mana Uru e Hangai ana ki te Tūranga" i te whārangi 258). Mena kei te whakamahi koe i tētahi rōpū kāore he RBAC, kāore rānei i whakahohea, ka taea e tētahi kaiwhakamahi, e tētahi ipu rānei te uru atu ki ō mea ngaro katoa (ka whakamāramahia e mātou i muri mai kāore koe e whai rōpū whakaputa kāore he RBAC).
Whakamunatanga raraunga kore mahi
Ā, me pēhea te hunga e whai urunga ana ki te pātengi raraunga etcd, te wāhi e rongoa ai a Kubernetes i ōna mōhiohio katoa? Ka taea e rātou te pānui i ngā raraunga tairongo me te kore whakaaetanga ki te pānui i ngā mea huna mā te API?
Mai i te putanga 1.7, ka tautoko a Kubernetes i te whakamunatanga raraunga kore mahi. Ko te tikanga o tēnei, ka rongoatia ngā mōhiohio tairongo i roto i te etcd ki te kōpae i roto i te āhua whakamuna, ā, kāore e taea te pānui ahakoa e te hunga whai urunga tika ki te pātengi raraunga. Me whai kī te tūmau API Kubernetes anake hei wetewete. Me whakahohe te whakamunatanga kore mahi i roto i tētahi rōpū kua whirihorahia tika.
Ka taea e koe te tirotiro mēnā kei te mahi te whakamunatanga kore mahi i roto i tō rōpū penei:
kubectl describe pod -n kube-system -l component=kube-apiserver |grep encryption
--experimental-encryption-provider-config=...Ki te kore koe e kite i te haki experimental-encryption-provider-config, kāore te whakamunatanga kore mahi e whakahohea. Ina whakamahi koe i te Google Kubernetes Engine, i ētahi atu ratonga whakahaere Kubernetes rānei, ka whakamunatia ō raraunga mā te whakamahi i tētahi tikanga rerekē, nō reira ka ngaro te haki. Tirohia me tō kaiwhakarato Kubernetes kia kite mēnā kua whakamunatia ngā ihirangi etcd.
Te rokiroki i ngā raraunga muna
Tērā ētahi rauemi Kubernetes kāore e tika kia mukua mai i te rōpū, pērā i ngā mea huna tino tairongo. Ka taea e koe te ārai i te mukunga o tētahi rauemi mā te whakamahi i tētahi tuhipoka i whakaratohia e te kaiwhakahaere Helm:
kind: Secret
metadata:
annotations:
"helm.sh/resource-policy": keepNgā Rautaki Whakahaere Ahanoa Ngaro
I te tauira o te wāhanga o mua, i tiakina ngā raraunga tairongo mai i te urunga kore mana i muri tonu i te rongoatanga ki roto i te rōpū. Heoi, i rongoatia ki roto i te tuhinga māori i roto i ngā kōnae whakaaturanga.
Kaua rawa e waiho ngā mōhiohio tairongo ki roto i ngā kōnae i raro i te mana whakahaere putanga. Nā, me pēhea e taea ai e koe te whakahaere me te penapena haumaru i aua mōhiohio i mua i te whakatinanatanga ki tētahi taupū Kubernetes?
Ka taea e koe te whiriwhiri i ngā taputapu, i ngā rautaki rānei e hiahia ana koe ki te whakamahi hei whakahaere i ngā raraunga tairongo i roto i ō taupānga, engari me whakautu tonu e koe ēnei pātai e whai ake nei.
- Kei hea te wāhi hei penapena i ngā raraunga tairongo kia tino wātea ai?
- Me pēhea te whakarite kia wātea ngā raraunga tairongo ki ō taupānga e hohe ana?
- Me aha ō taupānga ina whakakapi, ina whakatika rānei koe i ngā raraunga tairongo?
Mo nga kaituhi
Hoani Ārundel He kaitohutohu ia, e 30 tau te roa o tana wheako ki te umanga rorohiko. He maha āna pukapuka kua tuhia, ā, he maha āna kamupene e mahi ana i te ao whānui, e tohutohu ana i a rātou mō ngā hanganga kapua-taketake me Kubernetes. I a ia e wātea ana, he pai ki a ia te ngaru, he pūkenga pupuhi pū, ā, he kaitākaro piano ia hei kaitākaro tauhou. E noho ana ia i tētahi whare iti ataahua i Cornwall, Ingarangi.
Justin Domingus — he miihini whakahaere pūnaha e mahi ana i roto i te taiao DevOps me Kubernetes me ngā hangarau kapua. He pai ki a ia te noho i waho, te inu kawhe, te hopu pāpaka, me te mahi i te rorohiko. E noho ana ia i Seattle, Washington, me tana ngeru ataahua me tana wahine me tana hoa pai rawa atu, a Adrienne.
» Ka kitea etahi atu korero mo te pukapuka i
»
»
Mo Khabrozhiteley 25% hekenga ma te whakamahi coupon - Kubernetes
Ina utua te putanga pepa o te pukapuka, ka tukuna he pukapuka hiko ma te imeera.
Source: will.com
