{"id":96065,"date":"2020-10-07T13:42:09","date_gmt":"2020-10-07T11:42:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/problema-umnoj-ochistki-obrazov-kontejnerov-i-eyo-reshenie-v-werf"},"modified":"2020-10-07T13:42:09","modified_gmt":"2020-10-07T11:42:09","slug":"problema-umnoj-ochistki-obrazov-kontejnerov-i-eyo-reshenie-v-werf","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/problema-umnoj-ochistki-obrazov-kontejnerov-i-eyo-reshenie-v-werf","title":{"rendered":"Probl\u00e9m \u201einteligentn\u00e9ho\u201c \u010distenia obrazov kontajnerov a jeho rie\u0161enie v werf","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Probl\u00e9m \u201einteligentn\u00e9ho\u201c \u010distenia obrazov kontajnerov a jeho rie\u0161enie v werf\" src=\"\/wp-content\/uploads\/2020\/10\/1410cea46bb8dcdc3ac06db11ed5a402.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u010cl\u00e1nok sa zaober\u00e1 problematikou \u010distenia obrazov, ktor\u00e9 sa hromadia v registroch kontajnerov (Docker Registry a jeho anal\u00f3gy) v re\u00e1li\u00e1ch modern\u00fdch CI\/CD pipeline pre cloud native aplik\u00e1cie doru\u010dovan\u00e9 v Kubernetes. Uveden\u00e9 s\u00fa hlavn\u00e9 krit\u00e9ri\u00e1 aktu\u00e1lnosti obrazov a vypl\u00fdvaj\u00face \u0165a\u017ekosti pri automatiz\u00e1cii \u010distenia, zachovan\u00ed miesta a uspokojovan\u00ed potrieb t\u00edmov. Nakoniec na pr\u00edklade konkr\u00e9tneho Open Source projektu uk\u00e1\u017eeme, ako je mo\u017en\u00e9 tieto \u0165a\u017ekosti prekon\u00e1va\u0165.<\/p>\n<h2>\u00davod<\/h2>\n<p>\nPo\u010det obrazov v registri kontajnerov m\u00f4\u017ee r\u00fdchlo narasta\u0165, zaberaj\u00fac viac miesta v \u00falo\u017eisku a t\u00fdm v\u00fdrazne zvy\u0161ova\u0165 jeho n\u00e1klady. Na kontrolu, obmedzenie alebo udr\u017eanie prijate\u013en\u00e9ho rastu miesta, ktor\u00e9 zaber\u00e1 registry, sa prij\u00edma:<\/p>\n<ol>\n<li>pou\u017e\u00edva\u0165 pevn\u00fd po\u010det tagov pre obrazy;<\/li>\n<li>nejak\u00fdm sp\u00f4sobom \u010disti\u0165 obrazy.<\/li>\n<\/ol>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nPrv\u00e9 obmedzenie je niekedy prijate\u013en\u00e9 pre mal\u00e9 t\u00edmy. Ak v\u00fdvoj\u00e1rom sta\u010dia st\u00e1le tagy (<code>latest<\/code>, <code>main<\/code>, <code>test<\/code>, <code>boris<\/code> a pod.), registry nebude zv\u00e4\u010d\u0161ova\u0165 objem a dlh\u00fd \u010das sa v\u00f4bec nebude treba zaobera\u0165 \u010disten\u00edm. Ve\u010f v\u0161etky neaktu\u00e1lne obrazy s\u00fa prepisovan\u00e9 a na \u010distenie jednoducho nezost\u00e1va pr\u00e1ca (v\u0161etko zabezpe\u010duje be\u017en\u00fd zbera\u010d odpadu).<\/p>\n<p>Napriek tomu, tak\u00fdto pr\u00edstup zna\u010dne obmedzuje v\u00fdvoj a zriedka sa aplikuje na modern\u00e9 CI\/CD projekty. Neoddelite\u013enou s\u00fa\u010das\u0165ou v\u00fdvoja sa stala <strong>automatiz\u00e1ciu<\/strong>, ktor\u00e1 umo\u017e\u0148uje ove\u013ea r\u00fdchlej\u0161ie testova\u0165, nasadzova\u0165 a doru\u010dova\u0165 nov\u00fa funkcionalitu pou\u017e\u00edvate\u013eom. Napr\u00edklad, vo v\u0161etk\u00fdch na\u0161ich projektoch sa pri ka\u017edom commite automaticky vytv\u00e1ra CI pipeline. V nej sa zostavuje obraz, testuje, nasadzuje v r\u00f4znych Kubernetes kont\u00farach na ladenie a zost\u00e1vaj\u00face kontroly, a ak je v\u0161etko v poriadku \u2014 zmeny sa dostan\u00fa k kone\u010dn\u00e9mu pou\u017e\u00edvate\u013eovi. A to u\u017e d\u00e1vno nie je rocket science, ale be\u017en\u00e1 rutina pre mnoh\u00fdch \u2014 pravdepodobne aj pre v\u00e1s, ak \u010d\u00edtate tento \u010dl\u00e1nok.<\/p>\n<p>Ke\u010f\u017ee odstr\u00e1nenie ch\u00fdb a v\u00fdvoj novej funkcionality prebieha paralelne, a vydania m\u00f4\u017eu prebieha\u0165 nieko\u013ekokr\u00e1t denne, je jasn\u00e9, \u017ee proces v\u00fdvoja je sprev\u00e1dzan\u00fd zna\u010dn\u00fdm po\u010dtom commitov, a teda \u2014 <strong>ve\u013ek\u00fdm po\u010dtom obrazov v registry<\/strong>. V d\u00f4sledku toho sa ostro st\u00e1va ot\u00e1zka organiz\u00e1cie efekt\u00edvneho \u010distenia registry, t.j. odstr\u00e1nenia neaktu\u00e1lnych obrazov.<\/p>\n<p>Ale ako v\u00f4bec ur\u010di\u0165, \u010di je obraz aktu\u00e1lny?<\/p>\n<h2>Krit\u00e9ri\u00e1 aktu\u00e1lnosti obrazov<\/h2>\n<p>\nV preva\u017enej v\u00e4\u010d\u0161ine pr\u00edpadov bud\u00fa hlavn\u00e9 krit\u00e9ri\u00e1 nasledovn\u00e9:<\/p>\n<p>1. Prv\u00e9 (najte obvious a najkritickej\u0161ie zo v\u0161etk\u00fdch) \u2014 s\u00fa to obrazy, ktor\u00e9 <strong>sa aktu\u00e1lne pou\u017e\u00edvaj\u00fa v Kubernetes<\/strong>. Odstr\u00e1nenie t\u00fdchto obrazov m\u00f4\u017ee vies\u0165 k v\u00e1\u017enym n\u00e1kladom v s\u00favislosti so zdr\u017ean\u00edm produkcie (napr\u00edklad, obrazy m\u00f4\u017eu by\u0165 potrebn\u00e9 pri replik\u00e1cii) alebo m\u00f4\u017eu zmarit \u00fasilie t\u00edmu, ktor\u00fd sa zaober\u00e1 laden\u00edm na nejak\u00fdch zretiach. <i>(Z tohto d\u00f4vodu sme dokonca vytvorili \u0161peci\u00e1lny <\/i><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/flant\/k8s-image-availability-exporter\"><i>Prometheus exporter<\/i><\/a><\/noindex><i>, ktor\u00fd sleduje absenciu tak\u00fdchto obrazov v akomko\u013evek Kubernetes klastri.)<\/i><\/p>\n<p>2. Druh\u00e9 (menej o\u010dividn\u00e9, ale tie\u017e ve\u013emi d\u00f4le\u017eit\u00e9 a op\u00e4\u0165 t\u00fdkaj\u00face sa prev\u00e1dzky) \u2014 s\u00fa to obrazy, ktor\u00e9 <strong>s\u00fa potrebn\u00e9 na n\u00e1vrat v pr\u00edpade zistenia v\u00e1\u017enych probl\u00e9mov<\/strong> v aktu\u00e1lnej verzii. Napr\u00edklad, v pr\u00edpade Helm to s\u00fa obrazy, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa v ulo\u017een\u00fdch verzi\u00e1ch vydania. (Mimochodom, predvolen\u00fd limit v Helmu je 256 rev\u00edzi\u00ed, ale \u0165a\u017eko poveda\u0165, \u010di naozaj niekto m\u00e1 potrebu uchov\u00e1va\u0165 <i>tak\u00e9ho<\/i> ve\u013ek\u00e9 mno\u017estvo verzi\u00ed?..) Nakoniec, uchov\u00e1vame verzie, aby sme ich mohli nesk\u00f4r pou\u017ei\u0165, teda \"n\u00e1vrat\" na ne v pr\u00edpade potreby.<\/p>\n<p>3. Tretie \u2014 <strong>potreby v\u00fdvoj\u00e1rov<\/strong>: v\u0161etky obrazy, ktor\u00e9 s\u00favisia s ich aktu\u00e1lnou pr\u00e1cou. Napr\u00edklad, ak posudzujeme PR, m\u00e1 zmysel ponecha\u0165 obraz, ktor\u00fd zodpoved\u00e1 posledn\u00e9mu commitu a, povedzme, predch\u00e1dzaj\u00facemu commitu: takto sa v\u00fdvoj\u00e1r m\u00f4\u017ee r\u00fdchlo vr\u00e1ti\u0165 k ak\u00e9muko\u013evek \u00falohe a pracova\u0165 s posledn\u00fdmi zmenami. <\/p>\n<p>4. \u0160tvrt\u00e9 \u2014 obrazy, ktor\u00e9 <strong>zodpovedaj\u00fa verzi\u00e1m na\u0161ej aplik\u00e1cie<\/strong>, t.j. s\u00fa kone\u010dn\u00fdm produktom: v1.0.0, 20.04.01, sierra a pod.<\/p>\n<p>NB: Ur\u010dit\u00e9 krit\u00e9ri\u00e1 tu boli formulovan\u00e9 na z\u00e1klade sk\u00fasenost\u00ed s interakciou desiatok t\u00edmov v\u00fdvoj\u00e1rov z r\u00f4znych spolo\u010dnost\u00ed. Samozrejme, v z\u00e1vislosti od \u0161pecif\u00edk v procesoch v\u00fdvoja a pou\u017e\u00edvan\u00e9 infra\u0161trukt\u00fary (napr\u00edklad, ak sa Kubernetes nepou\u017e\u00edva), sa tieto krit\u00e9ri\u00e1 m\u00f4\u017eu l\u00ed\u0161i\u0165. <\/p>\n<h2>Zhodnos\u0165 s krit\u00e9riami a existuj\u00face rie\u0161enia<\/h2>\n<p>\nPopul\u00e1rne slu\u017eby s container registry zvy\u010dajne pon\u00fakaj\u00fa svoje politiky \u010distenia obrazov: m\u00f4\u017eete ur\u010dova\u0165 podmienky, za ktor\u00fdch sa zna\u010dka odstr\u00e1ni z registry. Mo\u017enosti t\u00fdchto podmienok s\u00fa v\u0161ak obmedzen\u00e9 tak\u00fdmi parametrami, ako s\u00fa n\u00e1zvy, d\u00e1tum vytvorenia a po\u010det zna\u010diek*.<\/p>\n<p><i>* Z\u00e1vis\u00ed od konkr\u00e9tnych realiz\u00e1ci\u00ed registry kontajnerov. Zv\u00e1\u017eili sme mo\u017enosti nasleduj\u00facich rie\u0161en\u00ed: Azure CR, Docker Hub, ECR, GCR, GitHub Packages, GitLab Container Registry, Harbor Registry, JFrog Artifactory, Quay.io \u2014 k septembru 2020.<\/i><\/p>\n<p>Tak\u00e1to s\u00fastava parametrov je celkom dostato\u010dn\u00e1 na splnenie \u0161tvrt\u00e9ho krit\u00e9ria \u2014 to znamen\u00e1 vybera\u0165 obrazy, ktor\u00e9 zodpovedaj\u00fa verzi\u00e1m. Av\u0161ak na splnenie ostatn\u00fdch krit\u00e9ri\u00ed je potrebn\u00e9 zvoli\u0165 nejak\u00e9 kompromisn\u00e9 rie\u0161enie (bu\u010f pr\u00edsnej\u0161iu alebo, naopak, jemnej\u0161iu politiku) \u2014 v z\u00e1vislosti od o\u010dak\u00e1van\u00ed a finan\u010dn\u00fdch mo\u017enost\u00ed.<\/p>\n<p>Napr\u00edklad tretie krit\u00e9rium \u2014 s\u00favisiace s potrebami v\u00fdvoj\u00e1rov \u2014 m\u00f4\u017ee by\u0165 rie\u0161en\u00e9 organizovan\u00edm procesov vo vn\u00fatri t\u00edmov: \u0161pecifick\u00fdm pomen\u00favan\u00edm obrazov, veden\u00edm \u0161peci\u00e1lnych allow lists a vn\u00fatorn\u00fdch dohod. Ale nakoniec je to aj tak potrebn\u00e9 automatizova\u0165. A ak mo\u017enosti hotov\u00fdch rie\u0161en\u00ed nesta\u010dia, treba robi\u0165 nie\u010do vlastn\u00e9.<\/p>\n<p>Podobn\u00e1 situ\u00e1cia je aj s dvomi prv\u00fdmi krit\u00e9riami: nemo\u017eno ich splni\u0165 bez z\u00edskavania \u00fadajov z vonkaj\u0161ieho syst\u00e9mu \u2014 toho, v ktorom prebieha nasadzovanie aplik\u00e1ci\u00ed (v na\u0161om pr\u00edpade je to Kubernetes).<\/p>\n<h3>Ilustr\u00e1cia workflow v Gite<\/h3>\n<p>\nPredpokladajme, \u017ee pracujete pribli\u017ene pod\u013ea tejto sch\u00e9my v Gite:<\/p>\n<p><img decoding=\"async\" alt=\"Probl\u00e9m \u201einteligentn\u00e9ho\u201c \u010distenia obrazov kontajnerov a jeho rie\u0161enie v werf\" src=\"\/wp-content\/uploads\/2020\/10\/45c9bfb6755da1b4d6be05b51ab17429.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Ikonka hlavy na sch\u00e9me ozna\u010duje obrazy kontajnerov, ktor\u00e9 s\u00fa v s\u00fa\u010dasnosti nasaden\u00e9 v Kubernetes pre nejak\u00fdch pou\u017e\u00edvate\u013eov (koncov\u00fdch pou\u017e\u00edvate\u013eov, testova\u010dov, mana\u017e\u00e9rov at\u010f.) alebo s\u00fa pou\u017e\u00edvan\u00e9 v\u00fdvoj\u00e1rmi na ladenie a podobn\u00e9 \u00fa\u010dely.<\/i><\/p>\n<p>\u010co sa stane, ak politiky \u010distenia umo\u017e\u0148uj\u00fa ponecha\u0165 (neodstr\u00e1ni\u0165) obrazy len <b>pod\u013ea zadan\u00fdch n\u00e1zvov tagov<\/b>?<\/p>\n<p><img decoding=\"async\" alt=\"Probl\u00e9m \u201einteligentn\u00e9ho\u201c \u010distenia obrazov kontajnerov a jeho rie\u0161enie v werf\" src=\"\/wp-content\/uploads\/2020\/10\/e57ff24cb818799d28e8eb006aea2eb5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZjavne, tak\u00fdto scen\u00e1r nikoho nepote\u0161\u00ed.<\/p>\n<p>\u010co sa zmen\u00ed, ak politiky umo\u017enia neodstra\u0148ova\u0165 obrazy <b>pod\u013ea zadan\u00e9ho \u010dasov\u00e9ho intervalu \/ po\u010dtu posledn\u00fdch commitov<\/b>?<\/p>\n<p><img decoding=\"async\" alt=\"Probl\u00e9m \u201einteligentn\u00e9ho\u201c \u010distenia obrazov kontajnerov a jeho rie\u0161enie v werf\" src=\"\/wp-content\/uploads\/2020\/10\/7743581e6e64affb0a207ee156c00f6e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u00fdsledok sa v\u00fdrazne zlep\u0161il, av\u0161ak st\u00e1le je \u010faleko od ide\u00e1lu. Predsa len m\u00e1me st\u00e1le v\u00fdvoj\u00e1rov, ktor\u00ed potrebuj\u00fa obrazy v registri (alebo dokonca nasaden\u00e9 v K8s) na ladenie ch\u00fdb...<\/p>\n<p>Zhrn\u00fa\u0165 situ\u00e1ciu na trhu: dostupn\u00e9 funkcie v registroch kontajnerov nepon\u00fakaj\u00fa dostato\u010dn\u00fa flexibilitu pri \u010disten\u00ed, a hlavn\u00e1 pr\u00ed\u010dina je \u2014 <strong>nedostatok mo\u017enosti interakcie s vonkaj\u0161\u00edm svetom<\/strong>Tak sa zd\u00e1, \u017ee t\u00edmy, ktor\u00e9 potrebuj\u00fa tak\u00fato flexibilitu, s\u00fa n\u00faten\u00e9 implementova\u0165 odstr\u00e1nenie obrazov \"z vonku\" pomocou Docker Registry API (alebo nativn\u00e9ho API pr\u00edslu\u0161nej implement\u00e1cie).<\/p>\n<p>H\u013eadali sme v\u0161ak univerz\u00e1lne rie\u0161enie, ktor\u00e9 by automatizovalo \u010distenie obrazov pre r\u00f4zne t\u00edmy vyu\u017e\u00edvaj\u00face r\u00f4zne registry\u2026<\/p>\n<h2>Na\u0161a cesta k univerz\u00e1lnemu \u010disten\u00edu obrazov<\/h2>\n<p>\nOdkia\u013e sa berie tak\u00e1 potreba? Je to t\u00fdm, \u017ee nie sme samostatn\u00e1 skupina v\u00fdvoj\u00e1rov, ale t\u00edm, ktor\u00fd obsluhuje viacer\u00e9 tak\u00e9to skupiny, pom\u00e1haj\u00faci komplexne rie\u0161i\u0165 ot\u00e1zky CI\/CD. A hlavn\u00fdm technick\u00fdm n\u00e1strojom na to je Open Source utilita. <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.werf.io\/\">werf<\/a><\/noindex>Jej osobitos\u0165 spo\u010d\u00edva v tom, \u017ee nevykon\u00e1va jedin\u00fa funkciu, ale sprev\u00e1dza procesy nepretr\u017eitej dod\u00e1vky na v\u0161etk\u00fdch etap\u00e1ch: od zostavenia a\u017e po nasadenie.<\/p>\n<p>Publikovanie v registry* obrazov (ihne\u010f po ich zostaven\u00ed) je zjavn\u00e1 funkcia takejto utilitky. A ke\u010f\u017ee sa obrazy ukladaj\u00fa na uchov\u00e1vanie, ak va\u0161e \u00falo\u017eisko nie je bezhrani\u010dn\u00e9, mus\u00edte sa postara\u0165 aj o ich n\u00e1sledn\u00e9 \u010distenie. O tom, ako sme v tom uspel, sp\u013a\u0148aj\u00fac v\u0161etky dan\u00e9 krit\u00e9ri\u00e1, sa bude hovori\u0165 \u010falej.<\/p>\n<p><i>* Hoci samotn\u00e9 registry m\u00f4\u017eu by\u0165 r\u00f4zne (Docker Registry, GitLab Container Registry, Harbor a pod.), ich pou\u017e\u00edvatelia sa stret\u00e1vaj\u00fa s t\u00fdmi ist\u00fdmi probl\u00e9mami. Univerz\u00e1lne rie\u0161enie v na\u0161om pr\u00edpade nez\u00e1vis\u00ed od implement\u00e1cie registry, ke\u010f\u017ee sa vykon\u00e1va mimo samotn\u00fdch registry a pon\u00faka rovnak\u00e9 spr\u00e1vanie pre v\u0161etk\u00fdch.<\/i><\/p>\n<p>Napriek tomu, \u017ee pou\u017e\u00edvame werf ako pr\u00edklad implement\u00e1cie, d\u00fafame, \u017ee pou\u017eit\u00e9 pr\u00edstupy bud\u00fa u\u017eito\u010dn\u00e9 aj in\u00fdm t\u00edmom, ktor\u00e9 sa stretli s podobn\u00fdmi \u0165a\u017ekos\u0165ami.<\/p>\n<p>Tak sme sa pustili do <i>extern\u00e9ho<\/i> realizovania mechanizmu na \u010distenie obrazov \u2014 namiesto t\u00fdch mo\u017enost\u00ed, ktor\u00e9 u\u017e s\u00fa zabudovan\u00e9 v registroch pre kontajnery. Prv\u00fdm krokom bolo vyu\u017eitie Docker Registry API na vytvorenie t\u00fdch ist\u00fdch primit\u00edvnych polit\u00edk po\u010dtu zna\u010diek a \u010dasu ich vytvorenia (spom\u00ednan\u00fdch vy\u0161\u0161ie). K nim bol pridan\u00fd <strong>allow list na z\u00e1klade obrazov pou\u017e\u00edvan\u00fdch v nasadenej infra\u0161trukt\u00fare<\/strong>, t.j. Kubernetes. Pre to posledn\u00e9 sta\u010dilo cez Kubernetes API prech\u00e1dza\u0165 v\u0161etky nasaden\u00e9 zdroje a z\u00edska\u0165 zoznam hodn\u00f4t. <code>obr\u00e1zok<\/code>.<\/p>\n<p>Tak\u00e9to trivi\u00e1lne rie\u0161enie uzatvorilo najkritickej\u0161\u00ed probl\u00e9m (krit\u00e9rium \u010d. 1), ale bolo len za\u010diatkom na\u0161ej cesty k zlep\u0161eniu mechanizmu \u010distenia. Nasleduj\u00facim \u2014 a ove\u013ea zauj\u00edmavej\u0161\u00edm \u2014 krokom bolo rie\u0161enie <strong>prepoji\u0165 publikovan\u00e9 obrazy s hist\u00f3riou Git<\/strong>.<\/p>\n<h3>Sch\u00e9my zna\u010dkovania<\/h3>\n<p>\nNa za\u010diatok sme zvolili pr\u00edstup, pri ktorom kone\u010dn\u00fd obraz mus\u00ed uchov\u00e1va\u0165 potrebn\u00e9 inform\u00e1cie na \u010distenie, a vybudovali sme proces na z\u00e1klade sch\u00e9m zna\u010dkovania. Pri publikovan\u00ed obrazu si pou\u017e\u00edvate\u013e vyberal ur\u010dit\u00e9 ozna\u010denie (<code>git-branch<\/code>, <code>git-commit<\/code> alebo <code>git-tag<\/code>) a pou\u017e\u00edval zodpovedaj\u00facu hodnotu. V CI syst\u00e9moch sa nastavenie t\u00fdchto hodn\u00f4t vykon\u00e1valo automaticky na z\u00e1klade premenn\u00fdch prostredia. V podstate <strong>kone\u010dn\u00fd obraz bol prepojen\u00fd s konkr\u00e9tnym Git primit\u00edvom<\/strong>, uchov\u00e1vaj\u00face potrebn\u00e9 \u00fadaje na \u010distenie v \u0161t\u00edtkoch.<\/p>\n<p>V r\u00e1mci tak\u00e9ho pr\u00edstupu vznikla sada polit\u00edk, ktor\u00e1 umo\u017e\u0148ovala pou\u017e\u00edva\u0165 Git ako jedin\u00fd zdroj pravdy:<\/p>\n<ul>\n<li>Pri odstr\u00e1nen\u00ed vetvy\/tagu v Gite sa automaticky odstr\u00e1nili aj s\u00favisiace obrazy v registry.<\/li>\n<li>Po\u010det obrazov s\u00favisiacich s Git tagmi a commitmi bolo mo\u017en\u00e9 regulova\u0165 po\u010dtom tagov pou\u017eit\u00fdch v zvolenej sch\u00e9me a \u010dasom vytvorenia s\u00favisiaceho commitu.<\/li>\n<\/ul>\n<p>\nV z\u00e1sade, v\u00fdsledn\u00e1 implement\u00e1cia uspokojovala na\u0161e potreby, ale \u010doskoro n\u00e1s \u010dakal nov\u00fd v\u00fdzva. Ide o to, \u017ee po\u010das pou\u017e\u00edvania sch\u00e9m zna\u010dkovania na Git primit\u00edvoch sme narazili na nieko\u013eko nedostatkov. <i>(Ke\u010f\u017ee ich opis presahuje r\u00e1mec tohto \u010dl\u00e1nku, v\u0161etk\u00fdch zauj\u00edmaj\u00facich sa poz\u00fdvame na podrobnosti <\/i><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/495112\/\"><i>tu<\/i><\/a><\/noindex><i>.)<\/i> Preto, po rozhodnut\u00ed prechod na efekt\u00edvnej\u0161\u00ed pr\u00edstup k zna\u010dkovaniu (ozna\u010dkovanie na z\u00e1klade obsahu), sme museli prehodnoti\u0165 aj implement\u00e1ciu \u010distenia obrazov.<\/p>\n<h3>Nov\u00fd algoritmus<\/h3>\n<p>\nPre\u010do? Pri ozna\u010dovan\u00ed na z\u00e1klade obsahu ka\u017ed\u00fd tag m\u00f4\u017ee predstavova\u0165 mno\u017estvo commitov v Gite. Pri \u010disten\u00ed obrazov u\u017e nemo\u017eno vych\u00e1dza\u0165 <i>iba<\/i> z commitu, na ktorom bol nov\u00fd tag pridan\u00fd do rejestru.<\/p>\n<p>Pre nov\u00fd algoritmus \u010distenia bolo rozhodnut\u00e9 opusti\u0165 sch\u00e9my zna\u010dkovania a vybudova\u0165 <strong>proces na meta-obr\u00e1zkoch<\/strong>, z ktor\u00fdch ka\u017ed\u00fd uchov\u00e1va spojenie z:<\/p>\n<ul>\n<li>commitu, na ktorom sa vykonala publik\u00e1cia (pri\u010dom nez\u00e1le\u017e\u00ed, \u010di bol pridan\u00fd, zmenen\u00fd alebo zostal rovnak\u00fd obraz v registri kontajnerov);<\/li>\n<li>a n\u00e1\u0161ho vn\u00fatorn\u00e9ho identifik\u00e1tora, zodpovedaj\u00faceho zostaven\u00e9mu obrazu.<\/li>\n<\/ul>\n<p>\nIn\u00fdmi slovami, bola zabezpe\u010den\u00e1 <strong>v\u00e4zba publikovan\u00fdch tagov na commit v Git<\/strong>.<\/p>\n<h3>Koncov\u00e1 konfigur\u00e1cia a v\u0161eobecn\u00fd algoritmus<\/h3>\n<p>\nPou\u017e\u00edvate\u013eom pri konfigur\u00e1cii \u010distenia sa spr\u00edstupnili politiky, na z\u00e1klade ktor\u00fdch sa vykon\u00e1va v\u00fdber aktu\u00e1lnych obrazov. Ka\u017ed\u00e1 tak\u00e1 politika sa definuje:<\/p>\n<ul>\n<li>mno\u017estvom referenci\u00ed, teda Git-tagmi alebo Git-branchami, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa pri skenovan\u00ed;<\/li>\n<li>a limitom h\u013eadan\u00fdch obrazov pre ka\u017ed\u00fa referenciu z mno\u017estva.<\/li>\n<\/ul>\n<p>\nNa ilustr\u00e1ciu \u2014 takto vypad\u00e1 konfigur\u00e1cia polit\u00edk pod\u013ea predvolen\u00fdch nastaven\u00ed:<\/p>\n<pre><code class=\"plaintext\">cleanup:\n  keepPolicies:\n  - references:\n      tag: \\\/.*\\\/\\\n      limit:\n        last: 10\n  - references:\n      branch: \\\/.*\\\/\\\n      limit:\n        last: 10\n        in: 168h\n        operator: And\n    imagesPerReference:\n      last: 2\n      in: 168h\n      operator: And\n  - references:  \n      branch: \\\/^(main|staging|production)$\\\/\\\n    imagesPerReference:\n      last: 10\n<\/code><\/pre>\n<p>\nTak\u00e1to konfigur\u00e1cia obsahuje tri politiky, ktor\u00e9 zodpovedaj\u00fa nasleduj\u00facim pravidl\u00e1m:<\/p>\n<ol>\n<li>Uchova\u0165 obraz pre 10 posledn\u00fdch Git-tagov (pod\u013ea d\u00e1tumu vytvorenia tagu).<\/li>\n<li>Uchova\u0165 nie viac ako 2 obrazy, publikovan\u00e9 za posledn\u00fd t\u00fd\u017ede\u0148, pre nie viac ako 10 vetiev s aktivitou za posledn\u00fd t\u00fd\u017ede\u0148.<\/li>\n<li>Uchova\u0165 po 10 obrazov pre vetvy <code>main<\/code>, <code>staging<\/code> a <code>produkciu<\/code>.<\/li>\n<\/ol>\n<p>\nKoncov\u00fd algoritmus spo\u010d\u00edva v nasleduj\u00facich krokoch:<\/p>\n<ul>\n<li>Z\u00edskanie manifestov z container registry.<\/li>\n<li>Vyl\u00fa\u010denie obrazov, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa v Kubernetes, preto\u017ee tie u\u017e boli vopred vybran\u00e9, dotazom na K8s API.<\/li>\n<li>Skenovanie Git-historie a vyl\u00fa\u010denie obrazov pod\u013ea zadan\u00fdch polit\u00edk.<\/li>\n<li>Odstr\u00e1nenie zost\u00e1vaj\u00facich obrazov.<\/li>\n<\/ul>\n<p>\nVr\u00e1tiac sa k na\u0161ej ilustr\u00e1cii, tu je, \u010do dostaneme s werf:<\/p>\n<p><img decoding=\"async\" alt=\"Probl\u00e9m \u201einteligentn\u00e9ho\u201c \u010distenia obrazov kontajnerov a jeho rie\u0161enie v werf\" src=\"\/wp-content\/uploads\/2020\/10\/c453092dca23860a0dda604843845507.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAv\u0161ak, aj ke\u010f nevyu\u017e\u00edvate werf, podobn\u00fd pr\u00edstup k pokro\u010dil\u00e9mu \u010distenia obrazov \u2014 v jednej alebo druhej implement\u00e1cii (pod\u013ea preferovan\u00e9ho pr\u00edstupu k tagovaniu obrazov) \u2014 m\u00f4\u017ee by\u0165 aplikovan\u00fd aj v in\u00fdch syst\u00e9moch\/n\u00e1strojoch. Sta\u010d\u00ed si pam\u00e4ta\u0165 na tie probl\u00e9my, ktor\u00e9 sa objavuj\u00fa, a n\u00e1js\u0165 tie mo\u017enosti vo va\u0161om stacku, ktor\u00e9 umo\u017e\u0148uj\u00fa integrova\u0165 ich rie\u0161enie najhlad\u0161ie. D\u00fafame, \u017ee cesta, ktorou sme pre\u0161li, pom\u00f4\u017ee nahliadnu\u0165 aj na v\u00e1\u0161 konkr\u00e9tny pr\u00edpad s nov\u00fdmi detailmi a my\u0161lienkami.<\/p>\n<h2>Z\u00e1ver<\/h2>\n<p><\/p>\n<ul>\n<li>Sk\u00f4r \u010di nesk\u00f4r sa s probl\u00e9mom preplnenia registry stret\u00e1va v\u00e4\u010d\u0161ina t\u00edmov. <\/li>\n<li>Pri h\u013eadan\u00ed rie\u0161en\u00ed je najprv potrebn\u00e9 ur\u010di\u0165 krit\u00e9ri\u00e1 aktu\u00e1lnosti obrazu.<\/li>\n<li>N\u00e1stroje pon\u00fakan\u00e9 popul\u00e1rnymi slu\u017ebami container registry umo\u017e\u0148uj\u00fa ve\u013emi jednoduch\u00e9 \u010distenie, ktor\u00e9 nezoh\u013ead\u0148uje \"vonkaj\u0161\u00ed svet\": obrazy pou\u017e\u00edvan\u00e9 v Kubernetes a osobitosti pracovn\u00fdch procesov v t\u00edme.<\/li>\n<li>Flexibiln\u00fd a efekt\u00edvny algoritmus by mal ma\u0165 predstavu o CI\/CD procesoch a operova\u0165 nie len s \u00fadajmi Docker obrazov.<\/li>\n<\/ul>\n<p><\/p>\n<h2>P.S.<\/h2>\n<p>\nPre\u010d\u00edtajte si tie\u017e na na\u0161om blogu:<\/p>\n<ul>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/495112\/\">Tagovanie na z\u00e1klade obsahu vo werf: pre\u010do a ako to funguje?<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/476646\/\">3-way merge v werf: nasadenie v Kubernetes s Helm \u201ena steroidoch\u201c<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/465131\/\">Podpora monorepo a multirepo vo werf a ak\u00fd m\u00e1 s\u00favis s Docker Registry<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/493170\/\">Vydanie werf 1.1: vylep\u0161enia v zostavova\u010di dnes a pl\u00e1ny do bud\u00facnosti<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/522024\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0442\u0438\u043a\u0430 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u043e\u0431\u0440\u0430\u0437\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043a\u0430\u043f\u043b\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u0440\u0435\u0435\u0441\u0442\u0440\u0430\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 (Docker Registry \u0438 \u0435\u0433\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0430\u0445) \u0432 \u0440\u0435\u0430\u043b\u0438\u044f\u0445 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 CI\/CD-\u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d\u043e\u0432 \u0434\u043b\u044f cloud native-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 Kubernetes. \u041f\u0440\u0438\u0432\u0435\u0434\u0435\u043d\u044b \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043a\u0440\u0438\u0442\u0435\u0440\u0438\u0438 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0438 \u0432\u044b\u0442\u0435\u043a\u0430\u044e\u0449\u0438\u0435 \u0438\u0437 \u043d\u0438\u0445 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0447\u0438\u0441\u0442\u043a\u0438, \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043c\u0435\u0441\u0442\u0430 \u0438 \u0443\u0434\u043e\u0432\u043b\u0435\u0442\u0432\u043e\u0440\u0435\u043d\u0438\u044f \u043f\u043e\u0442\u0440\u0435\u0431\u043d\u043e\u0441\u0442\u044f\u043c \u043a\u043e\u043c\u0430\u043d\u0434. \u041d\u0430\u043a\u043e\u043d\u0435\u0446, \u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e Open Source-\u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u044d\u0442\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":96066,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-96065","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/problema-umnoj-ochistki-obrazov-kontejnerov-i-eyo-reshenie-v-werf\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u00ab\u0443\u043c\u043d\u043e\u0439\u00bb \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438 \u0435\u0451 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 werf | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/problema-umnoj-ochistki-obrazov-kontejnerov-i-eyo-reshenie-v-werf\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-07T11:42:09+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-07T11:42:09+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Probl\u00e9m \u201einteligentn\u00e9ho\u201c \u010distenia obrazov kontajnerov a jeho rie\u0161enie v werf | ProHoster","description":"V \u010dl\u00e1nku sa rozober\u00e1.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/problema-umnoj-ochistki-obrazov-kontejnerov-i-eyo-reshenie-v-werf","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u00ab\u0443\u043c\u043d\u043e\u0439\u00bb \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438 \u0435\u0451 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 werf | ProHoster","og:description":"\u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/problema-umnoj-ochistki-obrazov-kontejnerov-i-eyo-reshenie-v-werf","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-07T11:42:09+00:00","article:modified_time":"2020-10-07T11:42:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96065","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:52:24","updated":"2022-10-01 08:58:07","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/96065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=96065"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/96065\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/96066"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=96065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=96065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=96065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}