{"id":89143,"date":"2020-07-19T07:42:22","date_gmt":"2020-07-19T05:42:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm"},"modified":"2020-07-19T07:42:22","modified_gmt":"2020-07-19T05:42:22","slug":"avtogeneracziya-sekretov-v-helm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm","title":{"rendered":"Autogerar segredos no Helm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Autogerar segredos no Helm\" src=\"\/wp-content\/uploads\/2020\/07\/e2ba6ab1bf5b50c7cfcbf62d56ff15da.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Time <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/containers\/\">Kubernetes aaS da Mail.ru<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/workfloplus\/reusing-auto-generated-helm-secrets-a7426403d4bb\">escreveu uma breve nota<\/a><\/noindex> sobre como gerar automaticamente segredos do Helm ao atualizar. A seguir, o texto do autor do artigo \u2014 o diretor t\u00e9cnico da Intoware, uma empresa desenvolvedora de solu\u00e7\u00f5es SaaS. <\/p>\n<p>Cont\u00eaineres s\u00e3o incr\u00edveis. No come\u00e7o, eu era um opositor dos cont\u00eaineres (\u00e9 constrangedor admitir), mas agora apoio totalmente o uso dessa tecnologia. Se voc\u00ea est\u00e1 lendo isso, espero que tenha navegado com sucesso pelos mares do Docker, percebido as vantagens do Kubernetes e facilitado sua vida com o Helm.<\/p>\n<p>No entanto, algumas coisas s\u00e3o claramente mais complexas do que deveriam ser.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nComo gerar segredos automaticamente durante a atualiza\u00e7\u00e3o?<\/p>\n<p>Um segredo do Kubernetes \u00e9 um recurso que cont\u00e9m pares chave\/valor que voc\u00ea deseja usar em seu c\u00f3digo. Isso pode incluir strings de conex\u00e3o de banco de dados, senhas de e-mail e assim por diante. Ao usar segredos, voc\u00ea cria uma clara divis\u00e3o entre o c\u00f3digo e as configura\u00e7\u00f5es, facilitando a configura\u00e7\u00e3o de diferentes implanta\u00e7\u00f5es sem alterar a base de c\u00f3digo.<\/p>\n<p>Uma situa\u00e7\u00e3o comum \u00e9 quando dois m\u00f3dulos devem interagir usando uma chave compartilhada. Ningu\u00e9m fora do cluster deve conhecer essa chave, pois \u00e9 destinada \u00e0 comunica\u00e7\u00e3o 'de um para outro' dentro do cluster.<\/p>\n<h2>Criando segredos<\/h2>\n<p>\nNormalmente, para criar um segredo no Helm, voc\u00ea precisa:<\/p>\n<ul>\n<li>descrever o segredo no arquivo de valores;<\/li>\n<li>sobrescrev\u00ea-lo no processo de implanta\u00e7\u00e3o;<\/li>\n<li>referenci\u00e1-lo dentro da implanta\u00e7\u00e3o\/pod;<\/li>\n<li>\u2026 lucro!<\/li>\n<\/ul>\n<p>\nNormalmente, isso se parece com:<\/p>\n<pre><code class=\"plaintext\">apiVersion: v1\nkind: Secret\nmetadata:\n  name: my-super-awesome-api-key\ntype: Opaque\nstringData:\n  apiKey: {{ .Values.MyApiKeySecret | quote }}\n<\/code><\/pre>\n<p>\n<i>Um segredo simples do Kubernetes, utilizando valores do values.yml<\/i><\/p>\n<p>Mas, suponha que voc\u00ea n\u00e3o queira especificar seu segredo no arquivo de valores.<\/p>\n<p>Existem muitas situa\u00e7\u00f5es em que uma chave compartilhada, que deve ser gerada durante a instala\u00e7\u00e3o, \u00e9 necess\u00e1ria para a implanta\u00e7\u00e3o.<\/p>\n<p>No exemplo acima, sobre a comunica\u00e7\u00e3o entre os m\u00f3dulos, \u00e9 indesej\u00e1vel compartilhar o segredo fora da implanta\u00e7\u00e3o. Portanto, \u00e9 altamente desej\u00e1vel que o Helm tenha mecanismos para criar automaticamente o segredo sem a necessidade de especific\u00e1-lo diretamente.<\/p>\n<h2>Hooks<\/h2>\n<p>\nOs hooks permitem executar c\u00f3digo em locais espec\u00edficos durante o processo de instala\u00e7\u00e3o. Pode haver uma tarefa de configura\u00e7\u00e3o que precisa ser executada ap\u00f3s a primeira instala\u00e7\u00e3o, ou pode ser necess\u00e1rio realizar uma limpeza antes de qualquer atualiza\u00e7\u00e3o.<\/p>\n<p>Para resolver nosso problema de adicionar a chave gerada durante a instala\u00e7\u00e3o, os hooks pr\u00e9-instalados s\u00e3o ideais. Mas h\u00e1 um detalhe: voc\u00ea n\u00e3o pode gerar um segredo automaticamente ao atualizar. Os hooks funcionar\u00e3o a cada atualiza\u00e7\u00e3o.<\/p>\n<p>Se voc\u00ea gerou seu segredo e sua primeira instala\u00e7\u00e3o ainda n\u00e3o ocorreu, ent\u00e3o pare de ler, o hook pr\u00e9-instalado \u00e9 perfeito para voc\u00ea.<\/p>\n<p>Mas se o segredo faz parte da atualiza\u00e7\u00e3o (talvez uma nova funcionalidade que n\u00e3o existia durante a instala\u00e7\u00e3o), \u00e9 frustrante que n\u00e3o seja poss\u00edvel criar um hook pr\u00e9-instalado que funcione apenas uma vez.<\/p>\n<h2>Fun\u00e7\u00f5es<\/h2>\n<p>\nAs fun\u00e7\u00f5es do Helm permitem adicionar diversos elementos de script aos cen\u00e1rios de implanta\u00e7\u00e3o.<\/p>\n<pre><code class=\"plaintext\">apiVersion: v1\nkind: Secret\nmetadata:\n  name: my-super-awesome-api-key\ntype: Opaque\nstringData:\n  apiKey: {{ uuidv4 | quote }} #Gere um novo UUID e o coloque entre aspas\n<\/code><\/pre>\n<p>\nNeste exemplo, o valor do segredo apiKey ser\u00e1 um novo UUID gerado durante a instala\u00e7\u00e3o.<\/p>\n<p>O Helm inclui uma ampla biblioteca de fun\u00e7\u00f5es que utiliza incr\u00edveis recursos de templates do GO e a biblioteca de fun\u00e7\u00f5es Sprig para criar implanta\u00e7\u00f5es personalizadas.<\/p>\n<h3>Fun\u00e7\u00e3o Lookup<\/h3>\n<p>\nNo Helm 3.1, foi adicionada <noindex><a rel=\"nofollow\" href=\"https:\/\/helm.sh\/docs\/chart_template_guide\/functions_and_pipelines\/\">a fun\u00e7\u00e3o Lookup<\/a><\/noindex>, que permite consultar uma implanta\u00e7\u00e3o existente e:<\/p>\n<ul>\n<li>verificar a exist\u00eancia de recursos;<\/li>\n<li>retornar o valor de um recurso existente para uso posterior.<\/li>\n<\/ul>\n<p>\nUsando ambas essas capacidades, podemos criar um segredo din\u00e2mico gerado uma \u00fanica vez!<\/p>\n<pre><code class=\"plaintext\"># 1. \u0417\u0430\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u0430 \u0438 \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 $secret\n{{- $secret := (lookup &quot;v1&quot; &quot;Secret&quot; .Release.Namespace &quot;some-awesome-secret&quot; -}}\napiVersion: v1\nkind: Secret\nmetadata:\n  name: some-awesome-secret\ntype: Opaque\n\n# 2. \u0415\u0441\u043b\u0438 \u0441\u0435\u043a\u0440\u0435\u0442 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442, \u0432\u0437\u044f\u0442\u044c \u0435\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043a\u0430\u043a apiKey (\u0441\u0435\u043a\u0440\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 Base64, \u0442\u0430\u043a \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043a\u043b\u044e\u0447 &quot;data&quot;)\n{{ if $secret -}}\ndata:\n  apiKey: {{ $secret.data.apiKey }}\n\n# 3. \u0415\u0441\u043b\u0438 \u0441\u0435\u043a\u0440\u0435\u0442 \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u2014 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0435\u0433\u043e (\u0432 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 &quot;stringData&quot;, \u0442\u0430\u043a \u043a\u0430\u043a \u0431\u0443\u0434\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435)!\n{{ else -}}\nstringData:\n  apiKey: {{ uuidv4 | quote }}\n{{ end }}\n<\/code><\/pre>\n<p>\nSempre que uma nova atualiza\u00e7\u00e3o \u00e9 aplicada ao servidor, o Helm ir\u00e1 ou gerar um novo valor para o segredo (se o segredo ainda n\u00e3o existir), ou reutilizar o valor existente.<\/p>\n<p>Sucesso!<\/p>\n<p><strong>O que mais ler sobre o assunto<\/strong>:<\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/tri-urovnya-avtomasshtabirovaniya-v-kubernetes-kak-ikh-effektivno-ispolzovat\">Tr\u00eas n\u00edveis de autoescala no Kubernetes e como us\u00e1-los de forma eficaz<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/490362\/\">Kubernetes no esp\u00edrito da pirataria com um modelo de implementa\u00e7\u00e3o<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tele.click\/k8s_mail\">Nosso canal Ao Redor do Kubernetes no Telegram<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/507376\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u0430\u043d\u0434\u0430 Kubernetes aaS \u043e\u0442 Mail.ru \u043f\u0435\u0440\u0435\u0432\u0435\u043b\u0430 \u043a\u043e\u0440\u043e\u0442\u043a\u0443\u044e \u0437\u0430\u043c\u0435\u0442\u043a\u0443 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u043a\u0440\u0435\u0442\u044b Helm \u043f\u0440\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438. \u0414\u0430\u043b\u0435\u0435 \u0442\u0435\u043a\u0441\u0442 \u043e\u0442 \u0430\u0432\u0442\u043e\u0440\u0430 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0430 Intoware, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438-\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 SaaS-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u041a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u2014 \u044d\u0442\u043e \u043a\u0440\u0443\u0442\u043e. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u044f \u0431\u044b\u043b \u043f\u0440\u043e\u0442\u0438\u0432\u043d\u0438\u043a\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 (\u0441\u0442\u044b\u0434\u043d\u043e \u043f\u0440\u0438\u0437\u043d\u0430\u0442\u044c\u0441\u044f), \u043d\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u044f \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0442\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438. \u0415\u0441\u043b\u0438 \u0432\u044b \u0447\u0438\u0442\u0430\u0435\u0442\u0435 \u044d\u0442\u043e, \u0442\u043e, \u043d\u0430\u0434\u0435\u044e\u0441\u044c, \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u043b\u0430\u0432\u0430\u043b\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":89144,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-89143","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u0430\u043d\u0434\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0432\u0442\u043e\u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u0432 Helm | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u0430\u043d\u0434\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-19T05:42:22+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-19T05:42:22+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Autogera\u00e7\u00e3o de segredos no Helm | ProHoster","description":"Time","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0432\u0442\u043e\u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044f \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u0432 Helm | ProHoster","og:description":"\u041a\u043e\u043c\u0430\u043d\u0434\u0430","og:url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/avtogeneracziya-sekretov-v-helm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-19T05:42:22+00:00","article:modified_time":"2020-07-19T05:42:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"89143","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:15:24","updated":"2022-10-05 12:06:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/89143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=89143"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/89143\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/89144"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=89143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=89143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=89143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}