{"id":89143,"date":"2020-07-19T07:42:22","date_gmt":"2020-07-19T05:42:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm"},"modified":"2020-07-19T07:42:22","modified_gmt":"2020-07-19T05:42:22","slug":"avtogeneracziya-sekretov-v-helm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm","title":{"rendered":"Automatisch genereren van geheimen in Helm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Automatisch genereren van geheimen in Helm\" src=\"\/wp-content\/uploads\/2020\/07\/e2ba6ab1bf5b50c7cfcbf62d56ff15da.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Opdracht <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/containers\/\">Kubernetes aaS van Mail.ru<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/workfloplus\/reusing-auto-generated-helm-secrets-a7426403d4bb\">Ik heb een korte notitie vertaald<\/a><\/noindex> over hoe je automatisch Helm-secrets kunt genereren bij een update. Hieronder volgt de tekst van de auteur van het artikel \u2014 de technisch directeur van Intoware, een SaaS-oplossingenontwikkelaar. <\/p>\n<p>Containers zijn geweldig. In het begin was ik een tegenstander van containers (dat geef ik eerlijk toe), maar nu ben ik volledig voor het gebruik van deze technologie. Als je dit leest, hoop ik dat je succesvol de zee\u00ebn van Docker hebt bevaren, de voordelen van Kubernetes hebt ontdekt en je leven veel eenvoudiger hebt gemaakt met Helm.<\/p>\n<p>Er zijn echter sommige dingen die duidelijk moeilijker zijn dan ze zouden moeten zijn.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nHoe genereer je automatisch secrets bij een update?<\/p>\n<p>Een Kubernetes-secret is een resource die sleutel\/waarde-paren bevat die je in je code wilt gebruiken. Dit kunnen verbindingsstrengen voor databases, e-mailwachtwoorden, enzovoort zijn. Door secrets te gebruiken, cre\u00eber je een duidelijke scheiding tussen code en instellingen, waardoor je eenvoudig verschillende implementaties kunt configureren zonder de codebasis te wijzigen.<\/p>\n<p>Een veelvoorkomende situatie is wanneer twee modules moeten communiceren via een gemeenschappelijke sleutel. Niemand buiten het cluster zou deze sleutel moeten kennen, aangezien deze bedoeld is voor communicatie 'van de ene naar de andere' binnen het cluster.<\/p>\n<h2>Secrets aanmaken<\/h2>\n<p>\nOm een secret in Helm aan te maken, moet je doorgaans:<\/p>\n<ul>\n<li>de secret beschrijven in een waardenbestand;<\/li>\n<li>deze overschrijven tijdens het deployen;<\/li>\n<li>er binnen de deployment\/pod naar verwijzen;<\/li>\n<li>\u2026 winst!<\/li>\n<\/ul>\n<p>\nDit ziet er meestal ongeveer zo uit:<\/p>\n<pre><code class=\"plaintext\">apiVersion: v1\nkind: Secret\nmetadata:\n  name: mijn-super-awesome-api-key\ntype: Opaque\nstringData:\n  apiKey: {{ .Values.MyApiKeySecret | quote }}\n<\/code><\/pre>\n<p>\n<i>Een eenvoudige Kubernetes-secret die waarden uit values.yml gebruikt.<\/i><\/p>\n<p>Maar stel dat je je secret niet in het waardenbestand wilt opgeven.<\/p>\n<p>Er zijn veel scenario's waarbij een gemeenschappelijke sleutel nodig is voor de implementatie, die gegenereerd moet worden tijdens de installatie.<\/p>\n<p>In het bovenstaande voorbeeld van interactie tussen modules is het ongewenst om het secret buiten de implementatie te delen. Daarom is het zeer wenselijk dat Helm mechanismen heeft voor het automatisch aanmaken van een secret zonder dat het specifiek opgegeven hoeft te worden.<\/p>\n<h2>Hooks<\/h2>\n<p>\nHaken stellen die M\u00f6glichkeit bereit, Code an bestimmten Stellen im Installationsprozess auszuf\u00fchren. M\u00f6glicherweise gibt es eine Konfiguration, die nach der ersten Installation ausgef\u00fchrt werden muss, oder es muss eine Bereinigung durchgef\u00fchrt werden, bevor ein Update vorgenommen wird.<\/p>\n<p>Um unser Problem der Schl\u00fcsselgenerierung bei der Installation zu l\u00f6sen, sind vorinstallierte Haken ideal. Aber es gibt einen Haken: Sie k\u00f6nnen ein Geheimnis nicht automatisch einmal bei einem Update generieren. Die Haken werden bei jedem Update ausgef\u00fchrt.<\/p>\n<p>Wenn Sie Ihr Geheimnis generiert haben und Ihre erste Installation noch nicht erfolgt ist, h\u00f6ren Sie auf zu lesen, der vorinstallierte Haken ist perfekt f\u00fcr Sie.<\/p>\n<p>Aber wenn das Geheimnis Teil des Updates ist (vielleicht eine neue Funktion, die w\u00e4hrend der Installation nicht vorhanden war), so ist es bedauerlich, dass es nicht m\u00f6glich ist, einen vorinstallierten Haken zu erstellen, der nur einmal ausgef\u00fchrt wird.<\/p>\n<h2>Functies<\/h2>\n<p>\nDie Funktionen von Helm erm\u00f6glichen das Hinzuf\u00fcgen verschiedener Skripte in die Bereitstellungsskripte.<\/p>\n<pre><code class=\"plaintext\">apiVersion: v1\nkind: Secret\nmetadata:\n  name: my-super-awesome-api-key\ntype: Opaque\nstringData:\n  apiKey: {{ uuidv4 | quote }} #Generiere eine neue UUID und zitiere sie\n<\/code><\/pre>\n<p>\nIn diesem Beispiel ist der Wert des Secrets apiKey eine neue UUID, die w\u00e4hrend der Installation generiert wurde.<\/p>\n<p>Helm enth\u00e4lt eine wirklich umfangreiche Bibliothek von Funktionen, die erstaunliche GO-Template-Funktionen und die Sprig-Funktionsbibliothek verwenden, um anpassbare Bereitstellungen zu erstellen.<\/p>\n<h3>Die Lookup-Funktion<\/h3>\n<p>\nwurde in Helm 3.1 hinzugef\u00fcgt. <noindex><a rel=\"nofollow\" href=\"https:\/\/helm.sh\/docs\/chart_template_guide\/functions_and_pipelines\/\">Die Lookup-Funktion<\/a><\/noindex>, die es erm\u00f6glicht, eine vorhandene Bereitstellung abzufragen und:<\/p>\n<ul>\n<li>die Existenz von Ressourcen zu \u00fcberpr\u00fcfen;<\/li>\n<li>den Wert einer bestehenden Ressource zur weiteren Verwendung zur\u00fcckzugeben.<\/li>\n<\/ul>\n<p>\nIndem wir beide M\u00f6glichkeiten nutzen, k\u00f6nnen wir ein einmalig dynamisch generiertes Geheimnis erstellen!<\/p>\n<pre><code class=\"plaintext\"># 1. \u0417\u0430\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u0430 \u0438 \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 $secret\n{{- $secret := (lookup &quot;v1&quot; &quot;Secret&quot; .Release.Namespace &quot;some-awesome-secret&quot; -}}\napiVersion: v1\nkind: Secret\nmetadata:\n  name: some-awesome-secret\ntype: Opaque\n\n# 2. \u0415\u0441\u043b\u0438 \u0441\u0435\u043a\u0440\u0435\u0442 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442, \u0432\u0437\u044f\u0442\u044c \u0435\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043a\u0430\u043a apiKey (\u0441\u0435\u043a\u0440\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 Base64, \u0442\u0430\u043a \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043a\u043b\u044e\u0447 &quot;data&quot;)\n{{ if $secret -}}\ndata:\n  apiKey: {{ $secret.data.apiKey }}\n\n# 3. \u0415\u0441\u043b\u0438 \u0441\u0435\u043a\u0440\u0435\u0442 \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u2014 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0435\u0433\u043e (\u0432 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 &quot;stringData&quot;, \u0442\u0430\u043a \u043a\u0430\u043a \u0431\u0443\u0434\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435)!\n{{ else -}}\nstringData:\n  apiKey: {{ uuidv4 | quote }}\n{{ end }}\n<\/code><\/pre>\n<p>\nJedes Mal, wenn ein neues Update auf den Server angewendet wird, wird Helm entweder einen neuen Wert f\u00fcr das Geheimnis generieren (wenn das Geheimnis noch nicht existiert) oder den bestehenden Wert wiederverwenden.<\/p>\n<p>Veel succes!<\/p>\n<p><strong>Wat verder te lezen over dit onderwerp<\/strong>:<\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/tri-urovnya-avtomasshtabirovaniya-v-kubernetes-kak-ikh-effektivno-ispolzovat\">Drie niveaus van autoscaling in Kubernetes en hoe deze effectief te gebruiken<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/490362\/\">Kubernetes in de geest van piraterij met een implementatiesjabloon<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tele.click\/k8s_mail\">Onze kanaal Rondom Kubernetes op Telegram<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Bron: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/507376\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u0430\u043d\u0434\u0430 Kubernetes aaS \u043e\u0442 Mail.ru \u043f\u0435\u0440\u0435\u0432\u0435\u043b\u0430 \u043a\u043e\u0440\u043e\u0442\u043a\u0443\u044e \u0437\u0430\u043c\u0435\u0442\u043a\u0443 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u043a\u0440\u0435\u0442\u044b Helm \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438. \u0414\u0430\u043b\u0435\u0435 \u0442\u0435\u043a\u0441\u0442 \u043e\u0442 \u0430\u0432\u0442\u043e\u0440\u0430 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0430 Intoware, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438-\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 SaaS-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u041a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u2014 \u044d\u0442\u043e \u043a\u0440\u0443\u0442\u043e. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u044f \u0431\u044b\u043b \u043f\u0440\u043e\u0442\u0438\u0432\u043d\u0438\u043a\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 (\u0441\u0442\u044b\u0434\u043d\u043e \u043f\u0440\u0438\u0437\u043d\u0430\u0442\u044c\u0441\u044f), \u043d\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u044f \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0442\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438. \u0415\u0441\u043b\u0438 \u0432\u044b \u0447\u0438\u0442\u0430\u0435\u0442\u0435 \u044d\u0442\u043e, \u0442\u043e, \u043d\u0430\u0434\u0435\u044e\u0441\u044c, \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u043b\u0430\u0432\u0430\u043b\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":89144,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-89143","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u0430\u043d\u0434\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"nl_NL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0432\u0442\u043e\u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u0432 Helm | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u0430\u043d\u0434\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-19T05:42:22+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-19T05:42:22+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Automatische Generierung von Geheimnissen in Helm | ProHoster","description":"Opdracht","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0432\u0442\u043e\u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u0432 Helm | ProHoster","og:description":"\u041a\u043e\u043c\u0430\u043d\u0434\u0430","og:url":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-19T05:42:22+00:00","article:modified_time":"2020-07-19T05:42:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"89143","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:15:24","updated":"2022-10-05 12:06:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/89143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=89143"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/89143\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media\/89144"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=89143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=89143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=89143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}