🥇Tikulemba wogwiritsa ntchito Kubernetes pa Golang

Zindikirani. transl.: Othandizira ndi mapulogalamu othandizira a Kubernetes, opangidwa kuti azingochita zinthu zomwe zimachitika nthawi zonse pamagulu amagulu pakachitika zinthu zina. Talemba kale za ogwira ntchito mu nkhaniyi, kumene analankhula za malingaliro ndi mfundo zazikulu za ntchito yawo. Koma ngati zinthuzo zinali zowoneka bwino kuchokera kumbali yogwiritsira ntchito zida zokonzekera za Kubernetes, ndiye kuti kumasulira kwa nkhani yatsopano yomwe yaperekedwa tsopano ndi masomphenya a injiniya / DevOps omwe amadabwa ndi kukhazikitsidwa kwa wogwiritsa ntchito watsopano.

Ndinaganiza zolemba izi ndi chitsanzo chenicheni nditatha kuyesa kupeza zolemba pakupanga wogwiritsa ntchito Kubernetes, yemwe adadutsa pophunzira kachidindo.

Chitsanzo chomwe chidzafotokozedwe ndi ichi: mu gulu lathu la Kubernetes, aliyense Namespace ikuyimira malo a sandbox a timu, ndipo tinkafuna kuchepetsa mwayi wopezeka nawo kuti magulu azisewera m'mabokosi awoawo.

Mutha kukwaniritsa zomwe mukufuna popatsa wogwiritsa gulu lomwe lili RoleBinding ku specific Namespace и ClusterRole ndi ufulu wosintha. Kuyimira kwa YAML kudzawoneka motere:

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: kubernetes-team-1
  namespace: team-1
subjects:
- kind: Group
  name: kubernetes-team-1
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: edit
apiGroup: rbac.authorization.k8s.io

(rolebinding.yamlmu zofiira)

Pangani imodzi RoleBinding Mutha kuchita pamanja, koma mutatha kuwoloka chizindikiro chamalo zana, imakhala ntchito yotopetsa. Apa ndipamene ogwiritsira ntchito a Kubernetes amabwera mothandiza-amakulolani kuti muzitha kupanga zida za Kubernetes kutengera kusintha kwazinthu. M'malo mwathu tikufuna kupanga RoleBinding polenga Namespace.

Choyamba, tiyeni tifotokoze ntchito mainyomwe imapanga khwekhwe lofunikira kuti liyendetse chiganizocho kenako ndikuyitanira kuchitapo kanthu:

(Zindikirani. transl.: apa ndi pansipa ndemanga zomwe zili mu code zimamasuliridwa ku Russian. Kuphatikiza apo, indentation yasinthidwa kukhala mipata m'malo mwa [omwe akulimbikitsidwa mu Go] kuti azitha kuwerengeka bwino mkati mwa masanjidwe a Habr. Pambuyo pamndandanda uliwonse pali maulalo apachiyambi pa GitHub, pomwe ndemanga ndi ma tabu achingerezi amasungidwa.)

func main() {
  // Устанавливаем вывод логов в консольный STDOUT
  log.SetOutput(os.Stdout)

  sigs := make(chan os.Signal, 1) // Создаем канал для получения сигналов ОС
  stop := make(chan struct{})     // Создаем канал для получения стоп-сигнала

  // Регистрируем получение SIGTERM в канале sigs
  signal.Notify(sigs, os.Interrupt, syscall.SIGTERM, syscall.SIGINT) 

  // Goroutines могут сами добавлять себя в WaitGroup,
 // чтобы завершения их выполнения дожидались
  wg := &sync.WaitGroup{} 

  runOutsideCluster := flag.Bool("run-outside-cluster", false, "Set this flag when running outside of the cluster.")
  flag.Parse()
  // Создаем clientset для взаимодействия с кластером Kubernetes
  clientset, err := newClientSet(*runOutsideCluster)

  if err != nil {
    panic(err.Error())
  }

  controller.NewNamespaceController(clientset).Run(stop, wg)

  <-sigs // Ждем сигналов (до получения сигнала более ничего не происходит)
  log.Printf("Shutting down...")

  close(stop) // Говорим goroutines остановиться
  wg.Wait()   // Ожидаем, что все остановлено
}

(chachikulu.gomu zofiira)

Timachita izi:

Timakonza chogwirizira cha ma siginecha ena ogwiritsira ntchito kuti athetse opareshoni mwaulemu.
Timagwiritsa ntchito WaitGroupkuti muyimitse mwaulemu ma goroutines onse musanathe kugwiritsa ntchito.
Timapereka mwayi wopita kumagulu popanga clientset.
Yambitsani NamespaceController, momwe malingaliro athu onse adzapezeka.

Tsopano tikusowa maziko a logic, ndipo kwa ife iyi ndi yomwe yatchulidwa NamespaceController:

// NamespaceController следит через Kubernetes API за изменениями
// в пространствах имен и создает RoleBinding для конкретного namespace.
type NamespaceController struct {
  namespaceInformer cache.SharedIndexInformer
  kclient           *kubernetes.Clientset
}

// NewNamespaceController создает новый NewNamespaceController
func NewNamespaceController(kclient *kubernetes.Clientset) *NamespaceController {
  namespaceWatcher := &NamespaceController{}

  // Создаем информер для слежения за Namespaces
  namespaceInformer := cache.NewSharedIndexInformer(
    &cache.ListWatch{
      ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
        return kclient.Core().Namespaces().List(options)
      },
      WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
        return kclient.Core().Namespaces().Watch(options)
      },
    },
    &v1.Namespace{},
    3*time.Minute,
    cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
  )

  namespaceInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
    AddFunc: namespaceWatcher.createRoleBinding,
  })

  namespaceWatcher.kclient = kclient
  namespaceWatcher.namespaceInformer = namespaceInformer

  return namespaceWatcher
}

(controller.gomu zofiira)

Apa tikukonzekera SharedIndexInformer, yomwe idzachita bwino (pogwiritsa ntchito cache) kudikirira kusintha kwa mayina (werengani zambiri za odziwitsa m'nkhaniyo "Kodi Kubernetes scheduler imagwira ntchito bwanji?"- pafupifupi. kumasulira). Pambuyo pake timagwirizanitsa EventHandler kwa wodziwitsa, kuti powonjezera dzina (Namespace) ntchito imatchedwa createRoleBinding.

Chotsatira ndikutanthauzira ntchitoyi createRoleBinding:

func (c *NamespaceController) createRoleBinding(obj interface{}) {
  namespaceObj := obj.(*v1.Namespace)
  namespaceName := namespaceObj.Name

  roleBinding := &v1beta1.RoleBinding{
    TypeMeta: metav1.TypeMeta{
      Kind:       "RoleBinding",
      APIVersion: "rbac.authorization.k8s.io/v1beta1",
    },
    ObjectMeta: metav1.ObjectMeta{
      Name:      fmt.Sprintf("ad-kubernetes-%s", namespaceName),
      Namespace: namespaceName,
    },
    Subjects: []v1beta1.Subject{
      v1beta1.Subject{
        Kind: "Group",
        Name: fmt.Sprintf("ad-kubernetes-%s", namespaceName),
      },
    },
    RoleRef: v1beta1.RoleRef{
      APIGroup: "rbac.authorization.k8s.io",
        Kind:     "ClusterRole",
        Name:     "edit",
    },
  }

  _, err := c.kclient.Rbac().RoleBindings(namespaceName).Create(roleBinding)

  if err != nil {
    log.Println(fmt.Sprintf("Failed to create Role Binding: %s", err.Error()))
  } else {
    log.Println(fmt.Sprintf("Created AD RoleBinding for Namespace: %s", roleBinding.Name))
  }
}

(controller.gomu zofiira)

Timapeza dzina la dzina ngati obj ndikusintha kukhala chinthu Namespace. Kenako timafotokozera RoleBinding, kutengera fayilo ya YAML yomwe yatchulidwa koyambirira, pogwiritsa ntchito chinthu chomwe chaperekedwa Namespace ndi kulenga RoleBinding. Pomaliza, timalemba ngati chilengedwecho chinapambana.

Ntchito yomaliza kufotokozedwa ndi Run:

// Run запускает процесс ожидания изменений в пространствах имён
// и действия в соответствии с этими изменениями.
func (c *NamespaceController) Run(stopCh <-chan struct{}, wg *sync.WaitGroup) {
  // Когда эта функция завершена, пометим как выполненную
  defer wg.Done()

  // Инкрементируем wait group, т.к. собираемся вызвать goroutine
  wg.Add(1)

  // Вызываем goroutine
  go c.namespaceInformer.Run(stopCh)

  // Ожидаем получения стоп-сигнала
  <-stopCh
}

(controller.gomu zofiira)

Apa tikulankhula WaitGroupkuti tiyambitse goroutine ndiyeno kuyimba namespaceInformer, zomwe zafotokozedwa kale. Chizindikiro choyimitsa chikafika, chidzathetsa ntchitoyi, dziwitsani WaitGroup, yomwe siinagwirenso ntchito, ndipo ntchitoyi idzatuluka.

Zambiri pakumanga ndi kuyendetsa mawu awa pagulu la Kubernetes zitha kupezeka mkati nkhokwe pa GitHub.

Ndizo kwa wogwiritsa ntchito yemwe amalenga RoleBinding liti Namespace mu gulu la Kubernetes, okonzeka.

Source: www.habr.com

Kulemba wogwiritsa ntchito Kubernetes ku Golang

Kuwonjezera ndemanga kuletsa reply