{"id":36918,"date":"2019-10-31T22:14:43","date_gmt":"2019-10-31T19:14:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/bezopasnost-helm\/"},"modified":"2019-10-31T22:14:43","modified_gmt":"2019-10-31T19:14:43","slug":"bezopasnost-helm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/bezopasnost-helm","title":{"rendered":"Siguria Helm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>The essence of the story about the most popular package manager for Kubernetes could be depicted with emojis:<\/p>\n<ul>\n<li>a box \u2014 that's Helm (the most fitting representation in the latest Emoji release);<\/li>\n<li>a lock \u2014 security;<\/li>\n<li>a little person \u2014 solution to the problem.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/91099b372fd73bce94268563c3ee2c50.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIn reality, however, it will be a bit more complicated, and the story is full of technical details on how to <b>make Helm secure.<\/b>.<\/p>\n<ul>\n<li>Briefly, what is Helm, if you didn't know or forgot. What problems does it solve and where does it fit in the ecosystem.<\/li>\n<li>Let's look at the architecture of Helm. No discussion about security and how to make a tool or solution more secure can be without understanding the architecture of the component.<\/li>\n<li>Let's discuss the components of Helm.<\/li>\n<li>The most pressing question \u2014 the future \u2014 the new version of Helm 3.\u00a0<\/li>\n<\/ul>\n<p>\nEverything in this article pertains to Helm 2. This version is currently in production and is likely the one you are using now, and it contains security threats.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n<center><div class=\"youtube-placeholder\" data-id=\"_8zNTJ1_R5I\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/_8zNTJ1_R5I\/hqdefault.jpg\" alt=\"Luaj videon\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\n<strong>P\u00ebr fol\u00ebsin:<\/strong> Alexander Khayev (<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/allexx\/\" class=\"user_link\">allexx<\/a><\/noindex>) has been developing for 10 years, helping to improve content <noindex><a rel=\"nofollow\" href=\"https:\/\/conf.python.ru\/2019\">Moscow Python Conf++<\/a><\/noindex> and joined the committee <noindex><a rel=\"nofollow\" href=\"https:\/\/events.linuxfoundation.org\/events\/helm-summit-2019\/\">Helm Summit<\/a><\/noindex>. He currently works at Chainstack as a development lead \u2014 a hybrid role between a development manager and someone responsible for delivering final releases. This means he is right in the field, where everything happens from product creation to operation.<\/p>\n<p>Chainstack is a small, rapidly growing startup with the mission to allow clients to forget about infrastructure and the complexities of operating decentralized applications. The development team is based in Singapore. Don\u2019t ask Chainstack to sell or buy cryptocurrency, but suggest discussing enterprise blockchain frameworks, and they'll gladly respond.<\/p>\n<h2>Helm<\/h2>\n<p>\nIt is a package manager (charts) for Kubernetes. The clearest and most universal way to bring applications into a Kubernetes cluster.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/30c0fc1cc1c6ebde97c6e8ec1886ce9f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nThis is, of course, about a more structured and industrial approach than creating your own YAML manifests and writing small utilities.<\/p>\n<blockquote><p>Helm is the best that is currently available and popular.<\/p><\/blockquote>\n<p>\nWhy Helm? Primarily because it is backed by CNCF. Cloud Native is a large organization that is the parent company for Kubernetes projects, etcd, Fluentd, and others.<\/p>\n<p>Fakti tjet\u00ebr i r\u00ebnd\u00ebsish\u00ebm \u00ebsht\u00eb se Helm \u00ebsht\u00eb nj\u00eb projekt shum\u00eb popullor. Kur n\u00eb janar 2019 un\u00eb fillova t\u00eb mendoja se si ta b\u00ebja Helm t\u00eb sigurt, projekti kishte nj\u00eb mij\u00eb yje n\u00eb GitHub. Deri n\u00eb maj, numri i tyre ishte rritur n\u00eb 12 mij\u00eb.<\/p>\n<p>Shum\u00eb njer\u00ebz jan\u00eb t\u00eb interesuar p\u00ebr Helm, prandaj, edhe n\u00ebse ende nuk e p\u00ebrdorni, njohurit\u00eb mbi sigurin\u00eb e tij do t'ju vijn\u00eb n\u00eb ndihm\u00eb. <strong>Siguria \u00ebsht\u00eb e r\u00ebnd\u00ebsishme.<\/strong><\/p>\n<p>Ekipi kryesor i Helm mb\u00ebshtetet nga Microsoft Azure, dhe prandaj ky \u00ebsht\u00eb nj\u00eb projekt relativisht i q\u00ebndruesh\u00ebm n\u00eb krahasim me shum\u00eb t\u00eb tjer\u00eb. Dalja e Helm 3 Alpha 2 n\u00eb mes t\u00eb korrikut tregon se shum\u00eb njer\u00ebz po punojn\u00eb mbi projektin dhe se ata kan\u00eb d\u00ebshir\u00eb dhe energji p\u00ebr ta zhvilluar dhe p\u00ebrmir\u00ebsuar Helm.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/e53c8e64c3cf5eea3fbd9b0095b0f81e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHelm zgjidh disa probleme themelore n\u00eb menaxhimin e aplikacioneve n\u00eb Kubernetes.<\/p>\n<ul>\n<li>Packaging i aplikacioneve. Edhe nj\u00eb aplikacion si \"Hello, World\" n\u00eb WordPress p\u00ebrfaq\u00ebson disa sh\u00ebrbime, dhe d\u00ebshirohet q\u00eb ato t\u00eb paketohen s\u00eb bashku.<\/li>\n<li>Menaxhimi i kompleksitetit q\u00eb lind n\u00eb menaxhimin e k\u00ebtyre aplikacioneve.<\/li>\n<li>Jeta e nj\u00eb aplikacioni nuk p\u00ebrfundon pas instalimit ose publikimit t\u00eb tij. Ai vazhdon t\u00eb jetoj\u00eb, duhet t\u00eb p\u00ebrdit\u00ebsohet, dhe Helm ndihmon n\u00eb k\u00ebt\u00eb duke ofruar masat dhe politikat e duhura.<\/li>\n<\/ul>\n<p>\n<strong>Packaging<\/strong> \u00ebsht\u00eb organizuar n\u00eb nj\u00eb m\u00ebnyr\u00eb t\u00eb kuptueshme: ka metad\u00ebta q\u00eb i p\u00ebrputhen plot\u00ebsisht funksionimit t\u00eb menaxher\u00ebve t\u00eb zakonsh\u00ebm t\u00eb pakove p\u00ebr Linux, Windows ose MacOS. K\u00ebshtu, ka nj\u00eb depo, var\u00ebsi nga paketa t\u00eb ndryshme, metainformacione p\u00ebr aplikacionet, konfigurime, ve\u00e7ori t\u00eb konfigurimeve, indekse informacioni, etj. T\u00eb gjitha k\u00ebto Helm i lejon t\u00eb merren dhe p\u00ebrdoren p\u00ebr aplikacione.<\/p>\n<p><strong>Menaxhimi i kompleksitetit<\/strong>. N\u00ebse keni shum\u00eb aplikacione t\u00eb ngjashme, do t\u00eb nevojitet parametrizimi. K\u00ebtu dalin modelet, por p\u00ebr t\u00eb mos shpikur nj\u00eb m\u00ebnyr\u00eb tuaj p\u00ebr t\u00eb krijuar modele, mund t\u00eb p\u00ebrdorni at\u00eb q\u00eb Helm ofron nga kutia.<\/p>\n<p><strong>Menaxhimi i ciklit t\u00eb jet\u00ebs s\u00eb aplikacionit<\/strong> \u2014 sipas mendimit tim, \u00ebsht\u00eb pyetja m\u00eb interesante dhe e pazgjidhur. Kjo \u00ebsht\u00eb arsyeja pse n\u00eb at\u00eb koh\u00eb un\u00eb i kam ardhur Helm. Na nevojitej t\u00eb monitoronim ciklin e jet\u00ebs s\u00eb aplikacionit, d\u00ebshironim t\u00eb transferonim CI\/CD dhe ciklet e aplikacioneve n\u00eb k\u00ebt\u00eb paradigm\u00eb.<\/p>\n<p>Helm lejon:<\/p>\n<ul>\n<li>t\u00eb menaxhoj\u00eb publikimet, introdukton konceptin e konfigurimit dhe rishikimeve;<\/li>\n<li>t\u00eb realizoj\u00eb rikthime me sukses;<\/li>\n<li>t\u00eb p\u00ebrdor\u00eb pika t\u00eb ndryshme n\u00eb ngjarje t\u00eb ndryshme;<\/li>\n<li>t\u00eb shtoj\u00eb kontroll t\u00eb m\u00ebtejsh\u00ebm p\u00ebr aplikacionet dhe t\u00eb reagoj\u00eb ndaj rezultateve t\u00eb tyre.<\/li>\n<\/ul>\n<p>\nP\u00ebr m\u00eb tep\u00ebr <strong>Helm ka \u00abbaterit\u00eb\u00bb<\/strong> \u2014 nj\u00eb sasi e madhe gj\u00ebrash t\u00eb shijshme q\u00eb mund t\u00eb p\u00ebrfshihen si plugina, duke e b\u00ebr\u00eb jet\u00ebn tuaj m\u00eb t\u00eb thjesht\u00eb. Pluginat mund t\u00eb shkruhen vet\u00eb, ato jan\u00eb t\u00eb izoluara mjaftuesh\u00ebm dhe nuk k\u00ebrkojn\u00eb nj\u00eb arkitektur\u00eb t\u00eb nd\u00ebrlikuar. N\u00ebse d\u00ebshironi t\u00eb realizoni di\u00e7ka, ju rekomandoj ta b\u00ebni si nj\u00eb plugin dhe pastaj ndoshta ta p\u00ebrfshini n\u00eb upstream.<\/p>\n<p>Helm mb\u00ebshtetet n\u00eb tre koncepte kryesore:<\/p>\n<ul>\n<li><strong>Chart Repo<\/strong> \u2014 p\u00ebrshkrimi dhe nj\u00eb mas\u00eb parametrizimi, e mundshme p\u00ebr manifestin tuaj.\u00a0<\/li>\n<li><strong>Konfigurimi<\/strong> \u2014 dometh\u00ebn\u00eb vlerat q\u00eb do t\u00eb aplikohen (tekst, vlera numerike dhe t\u00eb tjera).<\/li>\n<li><strong>Release<\/strong> p\u00ebrmbledh dy komponent\u00ebt e sip\u00ebrm dhe s\u00eb bashku ata shnd\u00ebrrohen n\u00eb Release. Rrelease-t mund t\u00eb versionohen, duke arritur k\u00ebshtu organizimin e ciklit t\u00eb jet\u00ebs: t\u00eb vogla n\u00eb momentin e instalimit dhe t\u00eb m\u00ebdha n\u00eb momentin e upgrade, downgrade apo rollback.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Arkitektura e Helm<\/h2>\n<p>\nN\u00eb diagramin konceptual \u00ebsht\u00eb reflektuar arkitektura e nivelit t\u00eb lart\u00eb t\u00eb Helm.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/c5cf54890682a3d6ca7a45021b5006a1.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00eb kujtohet q\u00eb Helm \u2014 \u00ebsht\u00eb di\u00e7ka q\u00eb lidhet me Kubernetes. Prandaj nuk mund t\u00eb anashkalojm\u00eb nj\u00eb klaster Kubernetes (drejtk\u00ebnd\u00ebshi). komponenti kube-apiserver ndodhet te masteri. Pa Helm kemi Kubeconfig. Helm sjell nj\u00eb utilitet t\u00eb vog\u00ebl binar, n\u00ebse mund ta quajm\u00eb ashtu, Helm CLI, i cili instalohet n\u00eb kompjuter, laptop, mainframe \u2014 n\u00eb \u00e7do gj\u00eb.<\/p>\n<p>Por kjo nuk \u00ebsht\u00eb e mjaftueshme. Helm ka nj\u00eb komponent server Tiller. Ai p\u00ebrfaq\u00ebson interesat e Helm brenda klasterit, \u00ebsht\u00eb nj\u00eb aplikacion i till\u00eb brenda klasterit Kubernetes, si \u00e7do aplikacion tjet\u00ebr.<\/p>\n<p>Komponenti tjet\u00ebr Chart Repo \u2014 \u00ebsht\u00eb nj\u00eb repository me chart-e. Ka nj\u00eb repository zyrtar, dhe mund t\u00eb ket\u00eb nj\u00eb repository privat t\u00eb kompanis\u00eb ose projektit.<\/p>\n<h3>Nd\u00ebrveprimi<\/h3>\n<p>\nT\u00eb shohim si interaktojn\u00eb komponent\u00ebt e arkitektur\u00ebs kur duam t\u00eb instalojm\u00eb nj\u00eb aplikacion me an\u00eb t\u00eb Helm.<\/p>\n<ul>\n<li>Ne themi <code>Helm install<\/code>, i drejtohemi repository-t (Chart Repo) dhe marrim Helm chart-in.<\/li>\n<\/ul>\n<p><\/p>\n<ul>\n<li>Utilitari Helm (Helm CLI) nd\u00ebrvepron me Kubeconfig, p\u00ebr t\u00eb gjetur se cilit klaster t'i drejtohet.\u00a0<\/li>\n<li>Pas marrjes s\u00eb k\u00ebtyre informacionit, utilitari i drejtohet Tiller, i cili ndodhet n\u00eb klasterin ton\u00eb, si nj\u00eb aplikacion.\u00a0<\/li>\n<li>Tiller i drejtohet Kube-apiserver, p\u00ebr t\u00eb realizuar veprime n\u00eb Kubernetes, p\u00ebr t\u00eb krijuar disa objekte (sh\u00ebrbime, pod-e, replika, sekrete etj.).<\/li>\n<\/ul>\n<p>\nM\u00eb pas do ta komplikohemi diagramin, p\u00ebr t\u00eb par\u00eb vektorin e sulmeve, t\u00eb cilave mund t'i n\u00ebnshtrohet e gjith\u00eb arkitektura e Helm n\u00eb p\u00ebrgjith\u00ebsi. Dhe pastaj do t\u00eb p\u00ebrpiqemi ta mbrojm\u00eb at\u00eb.<\/p>\n<h3>Vektori i sulmeve<\/h3>\n<p>\nVendi i par\u00eb potencialisht i dob\u00ebt \u2014 <strong>API e privilegjuar<\/strong>\u2014<strong>p\u00ebrdorues<\/strong>. N\u00eb kuad\u00ebr t\u00eb skem\u00ebs, ky \u00ebsht\u00eb nj\u00eb hacker q\u00eb ka fituar qasje administratori n\u00eb Helm CLI.<\/p>\n<p><strong>P\u00ebrdoruesi API pa privilegje<\/strong> po ashtu mund t\u00eb p\u00ebrb\u00ebj\u00eb nj\u00eb rrezik n\u00ebse ndodhet diku pran\u00eb. Nj\u00eb p\u00ebrdorues i till\u00eb do t\u00eb ket\u00eb nj\u00eb kontekst tjet\u00ebr, p\u00ebr shembull, ai mund t\u00eb jet\u00eb i regjistruar n\u00eb nj\u00eb namespace t\u00eb caktuar n\u00eb cil\u00ebsimet e Kubeconfig.<\/p>\n<p>Nj\u00eb nga vektor\u00ebt m\u00eb interesant\u00eb t\u00eb sulmit mund t\u00eb jet\u00eb procesi q\u00eb ndodhet brenda klasterit diku pran\u00eb Tiller dhe mund t\u00eb lidhet me t\u00eb. Kjo mund t\u00eb jet\u00eb nj\u00eb server web ose nj\u00eb mikrosh\u00ebrbim, i cili sheh mjedisin rrjetor t\u00eb klasterit.<\/p>\n<p>Nj\u00eb variant ekzotik, por n\u00eb rritje t\u00eb popullaritetit, i sulmit \u00ebsht\u00eb i lidhur me Chart Repo. Nj\u00eb chart, e krijuar nga nj\u00eb autor i pandersh\u00ebm, mund t\u00eb p\u00ebrmbaj\u00eb resurse t\u00eb pasigurta, dhe ju do ta ekzekutoni at\u00eb duke e pranuar p\u00ebr t\u00eb v\u00ebrtet\u00eb. Ose ai mund t\u00eb z\u00ebvend\u00ebsoj\u00eb chart-in q\u00eb shkarkoni nga depoja zyrtare dhe, p\u00ebr shembull, t\u00eb krijoj\u00eb nj\u00eb burim n\u00eb form\u00eb politikash dhe t\u00eb rris\u00eb qasjen p\u00ebr veten.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/2828046feb9ba8413a1b0e8741b4c354.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00eb p\u00ebrpiqemi t\u00eb mbrojm\u00eb veten nga sulmet nga t\u00eb kat\u00ebr an\u00ebt dhe t\u00eb kuptojm\u00eb ku jan\u00eb k\u00ebto probleme n\u00eb arkitektur\u00ebn e Helm, dhe ku ndoshta nuk ka.<\/p>\n<p>T\u00eb zmadhojm\u00eb skem\u00ebn, t\u00eb shtojm\u00eb m\u00eb shum\u00eb elemente, por t\u00eb ruajm\u00eb t\u00eb gjitha komponent\u00ebt baz\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/4110898e79619b8546408c668c48da0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHelm CLI komunikon me Chart Repo, nd\u00ebrvepron me Kubeconfig, pune kalon n\u00eb klaster n\u00eb komponentin Tiller.<\/p>\n<p>Tiller paraqitet me dy objekte:<\/p>\n<ul>\n<li>Tiller-deploy svc, i cili ofron nj\u00eb sh\u00ebrbim;<\/li>\n<li>Tiller-deploy pod (n\u00eb skem\u00eb n\u00eb nj\u00eb eksemplar t\u00eb vet\u00ebm n\u00eb nj\u00eb replik\u00eb), n\u00eb t\u00eb cilin funksionon t\u00eb gjith\u00eb ngarkesa, e cila lidhet me klasterin.<\/li>\n<\/ul>\n<p>\nP\u00ebr nd\u00ebrveprimin p\u00ebrdoren protokolle dhe skema t\u00eb ndryshme. Nga pik\u00ebpamja e siguris\u00eb, ato q\u00eb na interesojn\u00eb m\u00eb shum\u00eb jan\u00eb:<\/p>\n<ul>\n<li>Mekanizmi me an\u00eb t\u00eb t\u00eb cilit Helm CLI lidhet me chart repo: cili \u00ebsht\u00eb protokolli, a ka autentikim dhe \u00e7far\u00eb mund t\u00eb b\u00ebjm\u00eb me k\u00ebt\u00eb.<\/li>\n<li>Protokolli me t\u00eb cilin Helm CLI, duke p\u00ebrdorur kubectl, komunikon me Tiller. Ky \u00ebsht\u00eb nj\u00eb server RPC, i instaluar brenda klasterit.<\/li>\n<li>Tiller vet\u00eb \u00ebsht\u00eb i aksesuesh\u00ebm p\u00ebr mikrosh\u00ebrbimet q\u00eb gjenden n\u00eb klaster dhe nd\u00ebrvepron me Kube-apiserver.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/19e7e085567f3bbb49746e6402926bd6.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDo t\u2019i diskutojm\u00eb t\u00eb gjitha k\u00ebto drejtime nj\u00eb nga nj\u00eb.<\/p>\n<h2>RBAC<\/h2>\n<p><\/p>\n<blockquote><p>\u00cbsht\u00eb e kot\u00eb t\u00eb flasim p\u00ebr ndonj\u00eb siguri t\u00eb Helm ose sh\u00ebrbimit tjet\u00ebr brenda klasterit, n\u00ebse RBAC nuk \u00ebsht\u00eb aktivizuar.<\/p><\/blockquote>\n<p>\nDuket se kjo nuk \u00ebsht\u00eb rekomandimi m\u00eb i ri, por jam i sigurt se shum\u00eb akoma nuk e kan\u00eb aktivizuar RBAC-in madje as n\u00eb prodhimin e tyre, sepse \u00ebsht\u00eb nj\u00eb proces i lodhsh\u00ebm dhe k\u00ebrkon shum\u00eb konfigurime. Megjithat\u00eb, ju inkurajoj ta b\u00ebni k\u00ebt\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/37ee8aeb2b331b75ea5569c0b114a756.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/rbac.dev\/\">https:\/\/rbac.dev\/<\/a><\/noindex> \u2014 avokati i uebit p\u00ebr RBAC. Aty \u00ebsht\u00eb mbledhur nj\u00eb num\u00ebr t\u00eb madh t\u00eb materialeve interesante, q\u00eb do t\u00eb ndihmojn\u00eb p\u00ebr konfigurimin e RBAC, do t\u00eb tregojn\u00eb pse \u00ebsht\u00eb i mir\u00eb dhe si mund t\u00eb jetosh me t\u00eb n\u00eb prodhim.<\/p>\n<p>Do t\u00eb p\u00ebrpiqem t\u00eb shpjegoj si funksionon Tiller dhe RBAC. Tiller punon brenda klasterit n\u00ebn nj\u00eb llogari sh\u00ebrbimi. N\u00eb p\u00ebrgjith\u00ebsi, n\u00ebse RBAC nuk \u00ebsht\u00eb konfiguruar, kjo do t\u00eb jet\u00eb super p\u00ebrdoruesi. N\u00eb konfigurimin baz\u00eb, Tiller do t\u00eb jet\u00eb administrator. Kjo \u00ebsht\u00eb arsyeja pse shpesh thuhen se Tiller \u00ebsht\u00eb nj\u00eb tunel SSH p\u00ebr klasterin tuaj. N\u00eb t\u00eb v\u00ebrtet\u00eb, \u00ebsht\u00eb k\u00ebshtu, prandaj mund t\u00eb p\u00ebrdorni nj\u00eb llogari sh\u00ebrbimi t\u00eb specializuar n\u00eb vend t\u00eb Llogaris\u00eb Sh\u00ebrbimore Default n\u00eb diagramin e m\u00ebsip\u00ebrm.<\/p>\n<p>Kur e inicializoni Helm, her\u00ebn e par\u00eb q\u00eb e instaloni n\u00eb server, mund t\u00eb caktoni nj\u00eb llogari sh\u00ebrbimi duke p\u00ebrdorur <code>--service-account<\/code>. Kjo do t\u00eb lejoj\u00eb p\u00ebrdorimin e nj\u00eb p\u00ebrdoruesi me nj\u00eb grup minimal t\u00eb t\u00eb drejtave. Megjithat\u00eb, do t\u00eb duhet t\u00eb krijoni nj\u00eb \"varg\": Role dhe RoleBinding.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/ec805cde756495cfd5c480ac40739c43.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMe keqardhje, Helm nuk do ta b\u00ebj\u00eb k\u00ebt\u00eb p\u00ebr ju. Ju ose administratori i klasterit tuaj Kubernetes duhet t\u00eb p\u00ebrgatisin paraprakisht nj\u00eb grup Role, RoleBinding p\u00ebr llogarin\u00eb sh\u00ebrbimi, p\u00ebr t'i kaluar Helm.<\/p>\n<p>Shqet\u00ebsimi \u00ebsht\u00eb \u2014 cila \u00ebsht\u00eb dallimi midis Role dhe ClusterRole? Dallimi q\u00ebndron n\u00eb faktin se ClusterRole funksionon p\u00ebr t\u00eb gjitha namespaces, n\u00eb kund\u00ebrshtim me Role dhe RoleBinding normal, t\u00eb cilat punojn\u00eb vet\u00ebm p\u00ebr nj\u00eb namespace t\u00eb specializuar. Mund t\u00eb konfiguroni politika si p\u00ebr t\u00eb gjith\u00eb klasterin edhe p\u00ebr \u00e7do namespace t\u00eb ve\u00e7ant\u00eb individualisht.<\/p>\n<p>Dhe duhet t\u00eb p\u00ebrmendet se RBAC lejon zgjidhjen e nj\u00eb problemi tjet\u00ebr t\u00eb madh. Shum\u00eb ankohet se Helm, fatkeq\u00ebsisht, nuk \u00ebsht\u00eb multitenancy (nuk mb\u00ebshtet shum\u00eb qiradh\u00ebnie). N\u00ebse disa ekipe konsumojn\u00eb klasterin dhe p\u00ebrdorin Helm, \u00ebsht\u00eb e pamundur n\u00eb thelb t\u00eb konfiguroni politika dhe t\u00eb kufizoni aksesin e tyre brenda k\u00ebtij klasteri, sepse ka nj\u00eb llogari sh\u00ebrbimi n\u00ebn t\u00eb cilin funksionon Helm, dhe ai krijon t\u00eb gjith\u00eb burimet brenda klasterit nga ajo, e cila ndonj\u00ebher\u00eb \u00ebsht\u00eb shum\u00eb e pak\u00ebndshme. Kjo \u00ebsht\u00eb e v\u00ebrtet\u00eb \u2014 si vet\u00eb skedari binar, ashtu edhe procesi, <strong>Helm Tiller nuk ka asnj\u00eb koncept p\u00ebr multitenancy.<\/strong>.<\/p>\n<p>Megjithat\u00eb, ka nj\u00eb m\u00ebnyr\u00eb t\u00eb shk\u00eblqyer q\u00eb lejon t\u00eb lansoni Tiller n\u00eb klaster disa her\u00eb. Me k\u00ebt\u00eb nuk ka asnj\u00eb problem, Tiller mund t\u00eb fillohet n\u00eb \u00e7do namespace. K\u00ebshtu, mund t\u00eb shfryt\u00ebzoni RBAC, Kubeconfig si kontekst, dhe t\u00eb kufizoni aksesin n\u00eb Helm t\u00eb ve\u00e7ant\u00eb.<\/p>\n<p>Kjo do t\u00eb duket k\u00ebshtu.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/eae922c7b5e1422fb51667364ed79e0a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr shembull, ka dy Kubeconfig me kontekst p\u00ebr ekipe t\u00eb ndryshme (dy namespace): Ekipi X p\u00ebr ekipin e zhvilluesve dhe klust\u00ebr admini. Klust\u00ebri admin ka Tiller t\u00eb gjer\u00eb, i cili ndodhet n\u00eb hap\u00ebsir\u00ebn Kube-system namespace, p\u00ebrkat\u00ebsisht nj\u00eb service-account t\u00eb avancuar. Dhe nj\u00eb namespace t\u00eb ve\u00e7ant\u00eb p\u00ebr ekipin e zhvilluesve, ata do t\u00eb mund t\u00eb publikojn\u00eb sh\u00ebrbimet e tyre n\u00eb nj\u00eb namespace t\u00eb ve\u00e7ant\u00eb.<\/p>\n<p>Kjo \u00ebsht\u00eb nj\u00eb qasje e mir\u00eb, Tiller nuk \u00ebsht\u00eb aq i keq p\u00ebr buxhetin tuaj. Kjo \u00ebsht\u00eb nj\u00eb nga zgjidhjet m\u00eb t\u00eb shpejta.<\/p>\n<blockquote><p>Mos hezitoni t\u00eb konfiguroni ve\u00e7mas Tiller dhe t\u00eb jepni Kubeconfig me kontekst p\u00ebr ekipin, p\u00ebr nj\u00eb zhvillues t\u00eb ve\u00e7ant\u00eb ose p\u00ebr ambientet: Dev, Staging, Production (\u00ebsht\u00eb e dyshimt\u00eb q\u00eb gjith\u00e7ka t\u00eb jet\u00eb n\u00eb nj\u00eb klust\u00ebr, megjithat\u00eb, \u00ebsht\u00eb e mundur t\u00eb b\u00ebhet k\u00ebshtu).<\/p><\/blockquote>\n<p>\nDuke vazhduar historin\u00eb ton\u00eb, do t\u00eb kalojm\u00eb nga RBAC dhe do t\u00eb flasim p\u00ebr ConfigMaps.<\/p>\n<h3>ConfigMaps<\/h3>\n<p>\nHelm p\u00ebrdor ConfigMaps si nj\u00eb magazin\u00eb t\u00eb dh\u00ebnash. Kur flisnim p\u00ebr arkitektur\u00ebn, atje nuk kishte baz\u00eb t\u00eb dh\u00ebnash n\u00eb t\u00eb cil\u00ebn ruheshin informacionet p\u00ebr publikimet, konfigurimet, rikthimet etj. P\u00ebr k\u00ebt\u00eb p\u00ebrdoren ConfigMaps.<\/p>\n<p>Problemi kryesor me ConfigMaps \u00ebsht\u00eb i njohur \u2014 ato nuk jan\u00eb t\u00eb sigurta n\u00eb parim, n\u00eb to <strong>nuk mund t\u00eb ruhen t\u00eb dh\u00ebnat sensitive<\/strong>. Flitet p\u00ebr gjith\u00e7ka q\u00eb nuk duhet t\u00eb kaloj\u00eb m\u00eb tej sh\u00ebrbimit, si\u00e7 jan\u00eb fjal\u00ebkalimet. M\u00ebnyra m\u00eb natyrale p\u00ebr Helm tani \u00ebsht\u00eb t\u00eb kaloj\u00eb nga p\u00ebrdorimi i ConfigMaps n\u00eb sekrete.<\/p>\n<p>Kjo b\u00ebhet shum\u00eb leht\u00eb. Rregulloni konfigurimin e Tiller dhe tregoni se magazina do t\u00eb jen\u00eb sekretet. At\u00ebher\u00eb p\u00ebr \u00e7do publikim do t\u00eb merrni jo ConfigMap, por nj\u00eb sekret.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/7fd12bfbed5c6c8111a5126c2ab9f853.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMund t\u00eb kund\u00ebrshtoni se vet\u00eb sekretet jan\u00eb nj\u00eb koncept i \u00e7uditsh\u00ebm, dhe kjo nuk \u00ebsht\u00eb shum\u00eb e sigurt. Megjithat\u00eb, duhet kuptuar se k\u00ebto jan\u00eb t\u00eb menaxhuara nga zhvilluesit e Kubernetes. Q\u00eb nga versioni 1.10, dmth. p\u00ebr nj\u00eb koh\u00eb t\u00eb gjat\u00eb, ka mund\u00ebsi, t\u00eb pakt\u00ebn n\u00eb cloud publik, t\u00eb lidhni magazin\u00ebn e duhur p\u00ebr ruajtjen e sekretet. Tani ekipi po punon p\u00ebr t\u00eb ofruar akses m\u00eb t\u00eb mir\u00eb n\u00eb sekretet, p\u00ebr pods t\u00eb ve\u00e7anta ose entitete t\u00eb tjera.<\/p>\n<blockquote><p>Magazina Helm \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb kaloj\u00eb n\u00eb sekrete, dhe ato n\u00eb m\u00ebnyr\u00eb t\u00eb centralizuar t\u00eb sigurohen.<\/p><\/blockquote>\n<p>\nSigurisht, do t\u00eb mbetet nj\u00eb <strong>kufizim p\u00ebr ruajtjen e t\u00eb dh\u00ebnave n\u00eb 1 MB<\/strong>. Helm p\u00ebrdor k\u00ebtu etcd si nj\u00eb ruajtje t\u00eb shp\u00ebrndar\u00eb p\u00ebr ConfigMaps. Aty menduan se kjo \u00ebsht\u00eb nj\u00eb cop\u00eb e p\u00ebrshtatshme t\u00eb dh\u00ebnash p\u00ebr riplikime etj. N\u00eb lidhje me k\u00ebt\u00eb ka nj\u00eb diskutim interesant n\u00eb Reddit, rekomandoj ta k\u00ebrkoni k\u00ebt\u00eb lexim arg\u00ebtues p\u00ebr fundjav\u00eb ose ta lexoni p\u00ebrmbledhjen. <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/helm\/helm\/issues\/1413\">k\u00ebtu<\/a><\/noindex>.<\/p>\n<h3>Repo Chart<\/h3>\n<p>\nChartet jan\u00eb m\u00eb socialisht t\u00eb ndjeshme dhe mund t\u00eb b\u00ebhen burim i \"Njeriut n\u00eb mes\", ve\u00e7an\u00ebrisht n\u00ebse p\u00ebrdorni nj\u00eb zgjidhje t\u00eb stokut. N\u00eb radh\u00eb t\u00eb par\u00eb, \u00ebsht\u00eb fjala p\u00ebr repozitat q\u00eb publikohen p\u00ebrmes HTTP.<\/p>\n<blockquote><p>Padyshim, duhet t\u00eb publikoni Helm Repo p\u00ebrmes HTTPS \u2014 kjo \u00ebsht\u00eb opsioni m\u00eb i mir\u00eb dhe nuk kushton shum\u00eb.<\/p><\/blockquote>\n<p>\nKujdesi p\u00ebr <strong>mekanizmi i n\u00ebnshkrimeve t\u00eb chart-eve<\/strong>. Teknologjia \u00ebsht\u00eb jasht\u00ebzakonisht e thjesht\u00eb. \u00cbsht\u00eb e nj\u00ebjta gj\u00eb q\u00eb p\u00ebrdorni n\u00eb GitHub, nj\u00eb makineri PGP e zakonshme me \u00e7el\u00ebsa publik\u00eb dhe privat\u00eb. Konfiguroni dhe do t\u00eb jeni t\u00eb sigurt, duke pasur \u00e7el\u00ebsat e nevojsh\u00ebm dhe duke n\u00ebnshkruar gjith\u00e7ka q\u00eb \u00ebsht\u00eb v\u00ebrtet chart-i juaj.<\/p>\n<p>P\u00ebr m\u00eb tep\u00ebr, <strong>Klienti Helm mb\u00ebshtet TLS<\/strong> (jo n\u00eb kuptimin HTTP t\u00eb serverit, por TLS t\u00eb nd\u00ebrsjell\u00eb). Ju mund t\u00eb p\u00ebrdorni \u00e7el\u00ebsat e serverit dhe klientit p\u00ebr t\u00eb komunikuar. T\u00eb them sinqerisht, nuk e p\u00ebrdor nj\u00eb mekaniz\u00ebm t\u00eb till\u00eb p\u00ebr shkak t\u00eb mosdashjes p\u00ebr certifikatat e nd\u00ebrsjella. N\u00eb parim, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/helm\/chartmuseum\">chartmuseum<\/a><\/noindex> \u2014 instrumenti kryesor p\u00ebr publikimin e Helm Repo p\u00ebr Helm 2 \u2014 mb\u00ebshtet gjithashtu basic auth. Mund t\u00eb p\u00ebrdorni basic auth, n\u00ebse \u00ebsht\u00eb m\u00eb e leht\u00eb dhe m\u00eb e qet\u00eb.<\/p>\n<p>Ka gjithashtu nj\u00eb plugin <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hayorov\/helm-gcs\">helm-gcs<\/a><\/noindex>, i cili lejon t\u00eb vendosni Chart Repos n\u00eb Google Cloud Storage. Kjo \u00ebsht\u00eb mjaft e p\u00ebrshtatshme, funksionon shk\u00eblqyesh\u00ebm dhe \u00ebsht\u00eb mjaft e sigurt, sepse p\u00ebrdoren t\u00eb gjitha mekanizmat e p\u00ebrshkruar.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/6a72bfd96c7eb0e2fdd7bcbf128e6433.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00ebse aktivizoni HTTPS ose TLS, p\u00ebrdorni mTLS, lidhni basic auth, p\u00ebr t\u00eb ulur edhe m\u00eb shum\u00eb rreziqet, do t\u00eb keni nj\u00eb kanal t\u00eb sigurt komunikimi midis Helm CLI dhe Chart Repo.<\/p>\n<h3>gRPC API<\/h3>\n<p>\nHapi tjet\u00ebr \u00ebsht\u00eb shum\u00eb i r\u00ebnd\u00ebsish\u00ebm \u2014 t\u00eb sigurohet Tiller, i cili ndodhet n\u00eb klas\u00ebr dhe \u00ebsht\u00eb, nga nj\u00ebra an\u00eb, server, nga ana tjet\u00ebr \u2014 ai vet gjithashtu k\u00ebrkon n\u00eb komponent\u00ebt e tjer\u00eb dhe p\u00ebrpiqet t\u00eb paraqitet si dikush tjet\u00ebr.<\/p>\n<p>Si\u00e7 e kam th\u00ebn\u00eb, Tiller \u00ebsht\u00eb nj\u00eb sh\u00ebrbim q\u00eb ekspozon gRPC, Klienti Helm i qaset atij p\u00ebrmes gRPC. N\u00eb m\u00ebnyr\u00eb t\u00eb paracaktuar, natyrisht, TLS \u00ebsht\u00eb i \u00e7aktivizuar. Pse \u00ebsht\u00eb b\u00ebr\u00eb kjo \u2014 \u00ebsht\u00eb nj\u00eb pyetje diskutimi, mua m\u00eb duket q\u00eb t\u00eb thjeshtoj\u00eb konfigurimin n\u00eb fillim.<\/p>\n<blockquote><p>P\u00ebr produksion dhe madje edhe p\u00ebr staging, rekomandoj t\u00eb aktivizoni TLS n\u00eb gRPC.<\/p><\/blockquote>\n<p>\nSipas mendimit tim, ndryshe nga mTLS p\u00ebr chartet, k\u00ebtu \u00ebsht\u00eb e p\u00ebrshtatshme dhe b\u00ebhet shum\u00eb leht\u00eb \u2014 krijoni infrastruktur\u00ebn PQI, krijoni nj\u00eb certifikat\u00eb, nisni Tiller, transmetoni certifikat\u00ebn gjat\u00eb inicializimit. Pas k\u00ebsaj, mund t\u00eb kryeni t\u00eb gjitha komandat Helm, duke u identifikuar me certifikat\u00ebn e krijuar dhe \u00e7el\u00ebsin privat.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/ed55b9a465ed1278b272c52c90b2b345.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00ebshtu, do t\u00eb siguroni veten nga t\u00eb gjitha k\u00ebrkesat ndaj Tiller nga jasht\u00eb klasterit.<\/p>\n<p>K\u00ebshtu, ne e siguruam kanal lidhjeje me Tiller, tashm\u00eb diskutuam RBAC dhe rregulluam t\u00eb drejtat e Kubernetes apiserver, zvog\u00ebluam domenin me t\u00eb cilin ai mund t\u00eb interagoj\u00eb.<\/p>\n<h2>Helmi i mbrojtur<\/h2>\n<p>\nLe t\u00eb shikojm\u00eb skem\u00ebn p\u00ebrfundimtare. Kjo \u00ebsht\u00eb e nj\u00ebjta arkitektur\u00eb me t\u00eb nj\u00ebjtat shigjeta.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/6672e254ad93b917f57794e1619a572e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00eb gjitha lidhjet tani mund t\u00eb vizatohen me ngjyr\u00eb t\u00eb gjelb\u00ebr:<\/p>\n<ul>\n<li>p\u00ebr Chart Repo p\u00ebrdorim TLS ose mTLS dhe autentifikim bazik;<\/li>\n<li>mTLS p\u00ebr Tiller, dhe ai \u00ebsht\u00eb vendosur si nj\u00eb sh\u00ebrbim gRPC me TLS, p\u00ebrdorim certifikatat;<\/li>\n<li>n\u00eb klaster p\u00ebrdoret nj\u00eb llogari sh\u00ebrbimi e specializuar me Role dhe RoleBinding.\u00a0<\/li>\n<\/ul>\n<p>\nNe e siguruan duksh\u00ebm klasterin, por dikush i men\u00e7ur tha:<\/p>\n<blockquote><p>\u00abZgjidhja absolutisht e sigurt mund t\u00eb jet\u00eb vet\u00ebm nj\u00eb \u2014 nj\u00eb kompjuter i fikur, i cili ndodhet n\u00eb nj\u00eb kuti betoni dhe ruhet nga ushtar\u00eb\u00bb.<\/p><\/blockquote>\n<p>\nKa m\u00ebnyra t\u00eb ndryshme p\u00ebr manipulimin e t\u00eb dh\u00ebnave dhe gjetjen e vektor\u00ebve t\u00eb rinj t\u00eb sulmit. Megjithat\u00eb, jam i sigurt se k\u00ebto rekomandime do t\u00eb lejojn\u00eb implementimin e nj\u00eb standardi baz\u00eb t\u00eb siguris\u00eb industriale.<\/p>\n<h2>Bonusi<\/h2>\n<p>\nKjo pjes\u00eb nuk i p\u00ebrket drejtp\u00ebrdrejt siguris\u00eb, por gjithashtu do t\u00eb jet\u00eb e dobishme. Do t\u00eb tregoj disa gj\u00ebra interesante, p\u00ebr t\u00eb cilat pak njer\u00ebz din\u00eb. P\u00ebr shembull, si t\u00eb k\u00ebrkoni chartet \u2014 zyrtare dhe jozyrtare.<\/p>\n<p>In the repository <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/helm\/charts\">github.com\/helm\/charts<\/a><\/noindex> tani ka rreth 300 chart dhe dy rrjedha: stable dhe incubator. Ai q\u00eb kontribuon e di mir\u00eb sa e v\u00ebshtir\u00eb \u00ebsht\u00eb t\u00eb kalosh nga incubator n\u00eb stable, dhe sa e leht\u00eb \u00ebsht\u00eb t\u00eb dal\u00ebsh nga stable. Megjithat\u00eb, kjo nuk \u00ebsht\u00eb instrumenti m\u00eb i mir\u00eb p\u00ebr t\u00eb k\u00ebrkuar chartet p\u00ebr Prometheus dhe gjith\u00e7ka q\u00eb ju p\u00eblqen, p\u00ebr nj\u00eb arsye t\u00eb thjesht\u00eb \u2014 nuk \u00ebsht\u00eb nj\u00eb portal ku \u00ebsht\u00eb e leht\u00eb t\u00eb k\u00ebrkosh paketat.<\/p>\n<p>Por ka nj\u00eb sh\u00ebrbim <noindex><a rel=\"nofollow\" href=\"https:\/\/hub.helm.sh\/\">hub.helm.sh<\/a><\/noindex>, me ndihm\u00ebn e t\u00eb cilit \u00ebsht\u00eb shum\u00eb m\u00eb e leht\u00eb t\u00eb gjeni chartet. E r\u00ebnd\u00ebsishmja \u00ebsht\u00eb se ka shum\u00eb m\u00eb tep\u00ebr repozita t\u00eb jashtme dhe jan\u00eb n\u00eb dispozicion gati 800 chart. P\u00ebrve\u00e7 k\u00ebsaj, mund t\u00eb lidhni repozit\u00eb tuaj, n\u00ebse p\u00ebr ndonj\u00eb arsye nuk d\u00ebshironi t\u00eb d\u00ebrgoni chartet tuaja n\u00eb stable.<\/p>\n<p>Provo hub.helm.sh dhe le t\u00eb zhvillojm\u00eb s\u00eb bashku. Ky sh\u00ebrbim \u00ebsht\u00eb n\u00ebn projektin Helm, dhe mund t\u00eb kontribuoni edhe n\u00eb UI-n\u00eb e tij, n\u00ebse jeni frontend dhe d\u00ebshironi thjesht t\u00eb p\u00ebrmir\u00ebsoni pamjen.<\/p>\n<p>D\u00ebshiroj gjithashtu t\u00eb t\u00ebrheq v\u00ebmendjen tuaj mbi <strong>sh\u00ebrbimet Open Service Broker API<\/strong>. Duket e r\u00ebnd\u00eb dhe e paqart\u00eb, por zgjidh probleme me t\u00eb cilat t\u00eb gjith\u00eb p\u00ebrballen. Do ta shpjegoj me nj\u00eb shembull t\u00eb thjesht\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/3aeb7e0781e50a79b518f1056873f73a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKa nj\u00eb kajstrer Kubernetes, n\u00eb t\u00eb cilin d\u00ebshirojm\u00eb t\u00eb lan\u00e7ojm\u00eb nj\u00eb aplikacion klasik \u2014 WordPress. Zakonisht, p\u00ebr funksionalitet t\u00eb plot\u00eb nevojitet nj\u00eb baz\u00eb t\u00eb dh\u00ebnash. Ka shum\u00eb zgjidhje t\u00eb ndryshme, p\u00ebr shembull, mund t\u00eb lan\u00e7ojm\u00eb sh\u00ebrbimin ton\u00eb statefull. Kjo nuk \u00ebsht\u00eb shum\u00eb e p\u00ebrshtatshme, por shum\u00eb njer\u00ebz e b\u00ebjn\u00eb k\u00ebshtu.<\/p>\n<p>T\u00eb tjer\u00ebt, p\u00ebr shembull, ne n\u00eb Chainstack, p\u00ebrdorin baza t\u00eb dh\u00ebnash t\u00eb menaxhuara, si MySQL ose PostgreSQL, p\u00ebr server\u00ebt. Prandaj, baza jon\u00eb e t\u00eb dh\u00ebnave ndodhet diku n\u00eb re.<\/p>\n<p>Por lind problemi: duhet t\u00eb lidhim sh\u00ebrbimin ton\u00eb me baz\u00ebn e t\u00eb dh\u00ebnave, t\u00eb krijojm\u00eb favorin e baz\u00ebs s\u00eb t\u00eb dh\u00ebnave, t\u00eb kalojm\u00eb kredencialet dhe t\u00eb menaxhojm\u00eb gjith\u00e7ka. T\u00eb gjitha k\u00ebto zakonisht b\u00ebhen manualisht nga nj\u00eb administrator sistemi ose zhvillues. Nuk ka ndonj\u00eb problem kur ka pak aplikacione. Kur ka shum\u00eb, duhet nj\u00eb kombajn. Ka nj\u00eb kombajn t\u00eb till\u00eb \u2014 \u00ebsht\u00eb Sh\u00ebrbimi Broker. Ai lejon p\u00ebrdorimin e nj\u00eb plani t\u00eb ve\u00e7ant\u00eb p\u00ebr kajstrin e qelqit publik dhe t\u00eb porosis\u00eb resurse nga ofruesi p\u00ebrmes Broker-it, sikur t\u00eb ishte API. P\u00ebr k\u00ebt\u00eb mund t\u00eb p\u00ebrdoren mjete native t\u00eb Kubernetes.<\/p>\n<p>\u00cbsht\u00eb shum\u00eb e thjesht\u00eb. Mund t\u00eb k\u00ebrkoni, p\u00ebr shembull, Managed MySQL n\u00eb Azure me tier themelor (kjo mund t\u00eb konfigurohet). Duke p\u00ebrdorur API-n\u00eb Azure, baza do t\u00eb krijohet dhe p\u00ebrgatitet p\u00ebr p\u00ebrdorim. Nuk do ju nevojitet t\u00eb nd\u00ebrhyni n\u00eb k\u00ebt\u00eb, p\u00ebr k\u00ebt\u00eb kujdeset plaga. P\u00ebr shembull, OSBA (plugin Azure) do t\u00eb kthej\u00eb kredencialet n\u00eb sh\u00ebrbim, dhe do t'i kaloj\u00eb Helm-it. Ju do t\u00eb jeni n\u00eb gjendje t\u00eb p\u00ebrdorni WordPress me MySQL n\u00eb re, pa u marr\u00eb fare me bazat e dh\u00ebnash t\u00eb menaxhuara dhe pa u shqet\u00ebsuar p\u00ebr sh\u00ebrbimet statefull brenda.<\/p>\n<blockquote><p>Mund t\u00eb thuhet se Helm vepron si nj\u00eb lidh\u00ebs, i cili nga nj\u00ebra an\u00eb mund\u00ebson shp\u00ebrndarjen e sh\u00ebrbimeve, dhe nga ana tjet\u00ebr \u2014 konsumimin e resurseve t\u00eb ofruesve t\u00eb reve.<\/p><\/blockquote>\n<p>\nMund t\u00eb shkruani plagin tuaj dhe ta p\u00ebrdorni gjith\u00eb k\u00ebt\u00eb histori on-premise. At\u00ebher\u00eb do t\u00eb keni thjesht plagin tuaj p\u00ebr ofruesin e Cloud-it korporativ. Un\u00eb rekomandoj ta provoni k\u00ebt\u00eb qasje, ve\u00e7an\u00ebrisht n\u00ebse keni nj\u00eb shkall\u00eb t\u00eb madhe dhe d\u00ebshironi t\u00eb lan\u00e7oni shpejt zhvillimin, testimin ose t\u00ebr\u00eb infrastruktur\u00ebn p\u00ebr nj\u00eb ve\u00e7ori. Kjo do ta thjeshtoj\u00eb jet\u00ebn p\u00ebr operacionet tuaja ose DevOps.<\/p>\n<p>Nj\u00eb zbulim tjet\u00ebr q\u00eb e kam p\u00ebrmendur tashm\u00eb \u00ebsht\u00eb <strong>plagini helm-gcs<\/strong>, q\u00eb lejon p\u00ebrdorimin e Google-buckets (hap\u00ebsira e objektit) p\u00ebr t\u00eb ruajtur Helm-charts.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/30888c4f9b5dba14b87ba1e29e0ebed7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDuhet vet\u00ebm kat\u00ebr komanda p\u00ebr t\u00eb filluar ta p\u00ebrdorni at\u00eb:<\/p>\n<ol>\n<li>t\u00eb instaloni plugin-in;<\/li>\n<li>ta inicializoni at\u00eb;<\/li>\n<li>cakto nj\u00eb rrug\u00eb p\u00ebr bucket, q\u00eb ndodhet n\u00eb gcp;<\/li>\n<li>publikoni chart-et n\u00eb m\u00ebnyr\u00ebn standarde.<\/li>\n<\/ol>\n<p>\nE bukura \u00ebsht\u00eb se do t\u00eb p\u00ebrdoret nj\u00eb metod\u00eb natyrale e gcp p\u00ebr autorizim. Ju mund t\u00eb p\u00ebrdorni nj\u00eb llogari sh\u00ebrbimi, llogari t\u00eb zhvilluesit - \u00e7far\u00ebdo q\u00eb t\u00eb doni. Kjo \u00ebsht\u00eb shum\u00eb e leht\u00eb dhe nuk kushton asgj\u00eb p\u00ebr operim. N\u00ebse ju, si edhe un\u00eb, promovoni filozofin\u00eb opsless, at\u00ebher\u00eb kjo do t\u00eb jet\u00eb shum\u00eb e p\u00ebrshtatshme, ve\u00e7an\u00ebrisht p\u00ebr ekipet e vogla.<\/p>\n<h2>Alternativat<\/h2>\n<p>\nHelm - nuk \u00ebsht\u00eb zgjidhja e vetme p\u00ebr menaxhimin e sh\u00ebrbimeve. Ka shum\u00eb pyetje rreth tij, ndoshta p\u00ebr k\u00ebt\u00eb arsye versi i tret\u00eb erdhi kaq shpejt. Sigurisht, ka alternativa.<\/p>\n<p>Mund t\u00eb jen\u00eb zgjidhje t\u00eb specializuara, si Ksonnet ose Metaparticle. Ju mund t\u00eb p\u00ebrdorni mjetet tuaja klasike t\u00eb menaxhimit t\u00eb infrastruktur\u00ebs (Ansible, Terraform, Chef etj.) p\u00ebr t\u00eb nj\u00ebjtat q\u00ebllime q\u00eb p\u00ebrmenda.<\/p>\n<p>N\u00eb fund, ka nj\u00eb zgjidhje <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/operator-framework\">Operator Framework<\/a><\/noindex>, e cila \u00ebsht\u00eb n\u00eb rritje t\u00eb popullaritetit.<\/p>\n<blockquote><p>Operator Framework - alternativa kryesore ndaj Helm, q\u00eb duhet t'i kushtoni v\u00ebmendje.<\/p><\/blockquote>\n<p>\nEsht\u00eb m\u00eb natyrale p\u00ebr CNCF dhe Kubernetes, <strong>por prag hyrjeje \u00ebsht\u00eb shum\u00eb m\u00eb i lart\u00eb<\/strong>, k\u00ebrkohet m\u00eb shum\u00eb programim dhe m\u00eb pak p\u00ebrshkrim t\u00eb manifest\u00ebve.<\/p>\n<p>Ka dodat t\u00eb ndryshme, si Draft, Scaffold. Ato e leht\u00ebsojn\u00eb shum\u00eb jet\u00ebn, p\u00ebr shembull, p\u00ebr zhvilluesit q\u00eb e thjeshtojn\u00eb ciklin e d\u00ebrgimit dhe lan\u00e7imit t\u00eb Helm p\u00ebr implikimin e mjedisit testues. Un\u00eb do t'i quaja ato zgjerues t\u00eb mund\u00ebsive.<\/p>\n<p>Ja nj\u00eb grafik ilustruese ku \u00ebsht\u00eb \u00e7do gj\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria Helm\" src=\"\/wp-content\/uploads\/2019\/08\/81a8236c975d5e1649acaaa7989c27ba.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo n\u00eb boshtin horizontal \u00ebsht\u00eb niveli juaj i kontrollit personal mbi at\u00eb q\u00eb ndodh, n\u00eb boshtin vertikal \u00ebsht\u00eb niveli natyralitetit t\u00eb Kubernetes. Helm versioni 2 \u00ebsht\u00eb diku n\u00eb mes. N\u00eb versionin 3 nuk \u00ebsht\u00eb ndjesh\u00ebm m\u00eb mir\u00eb, por kontrolli dhe niveli i natyralitetit jan\u00eb p\u00ebrmir\u00ebsuar. Zgjidhjet e nivelit Ksonnet akoma bien short n\u00eb Helm 2. Sidoqoft\u00eb, ato meritojn\u00eb t\u00eb shihen, q\u00eb t\u00eb dini se \u00e7far\u00eb tjet\u00ebr ka n\u00eb k\u00ebt\u00eb bot\u00eb. Sigurisht, menaxheri juaj i konfigurimeve do t\u00eb jet\u00eb n\u00ebn kontrollin tuaj, por asgj\u00ebshtu nuk \u00ebsht\u00eb natyral p\u00ebr Kubernetes.<\/p>\n<p>Operator Framework \u00ebsht\u00eb plot\u00ebsisht natyral p\u00ebr Kubernetes dhe lejon menaxhimin e tij n\u00eb m\u00ebnyr\u00eb m\u00eb elegante dhe m\u00eb t\u00eb detajuar (por mos haroni p\u00ebr nivelin e hyrjes). M\u00eb shum\u00eb p\u00ebr k\u00ebt\u00eb \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm p\u00ebr aplikacione t\u00eb specializuara dhe krijimin e menaxhimit p\u00ebr to, n\u00eb vend t\u00eb nj\u00eb kombajni masiv p\u00ebr paketimin e nj\u00eb numri t\u00eb madh aplikacionesh p\u00ebrmes Helm.<\/p>\n<p>Zgjeruesit p\u00ebrmir\u00ebsojn\u00eb pak kontrollet, plot\u00ebsojn\u00eb flux-in e pun\u00ebs ose i shkurtuese k\u00ebndet e pipeline-ve CI\/CD.<\/p>\n<h2>E ardhmja e Helm<\/h2>\n<p>\nLajmi i mir\u00eb \u00ebsht\u00eb se Helm 3 po del. Versioni alfa i Helm 3.0.0-alpha.2 tani \u00ebsht\u00eb n\u00eb dispozicion p\u00ebr t'u provuar. Ai \u00ebsht\u00eb mjaft stabil, por funksionaliteti \u00ebsht\u00eb ende i kufizuar.<\/p>\n<p>Pse \u00ebsht\u00eb e nevojshme Helm 3? Para s\u00eb gjithash, kjo \u00ebsht\u00eb nj\u00eb histori p\u00ebr <strong>zhdukjen e Tiller<\/strong>, si komponent. Kjo, si\u00e7 e kuptoni, \u00ebsht\u00eb nj\u00eb hap i madh p\u00ebrpara, sepse nga pik\u00ebpamja e siguris\u00eb s\u00eb arkitektur\u00ebs, gjith\u00e7ka b\u00ebhet m\u00eb e thjesht\u00eb.<\/p>\n<p>Kur u krijua Helm 2, ndodhi gjat\u00eb koh\u00ebs s\u00eb Kubernetes 1.8 ose madje m\u00eb her\u00ebt, shum\u00eb koncepte ishin t\u00eb pjekura. P\u00ebr shembull, koncepti i CRD tani \u00ebsht\u00eb duke u zbatuar me intensitet, dhe Helm do t\u00eb <strong>p\u00ebrdor\u00eb CRD<\/strong>, p\u00ebr t\u00eb ruajtur strukturat. Do t\u00eb jet\u00eb e mundur t\u00eb p\u00ebrdoren vet\u00ebm klienti dhe t\u00eb mos mbahet pjesa server. Prandaj, do t\u00eb p\u00ebrdoren komandat native t\u00eb Kubernetes p\u00ebr t\u00eb punuar me strukturat dhe burimet. Ky \u00ebsht\u00eb nj\u00eb hap i madh p\u00ebrpara.<\/p>\n<p>Do t\u00eb ket\u00eb <strong>mb\u00ebshtetje p\u00ebr depot native OCI<\/strong> (Open Container Initiative). Kjo \u00ebsht\u00eb nj\u00eb iniciativ\u00eb e madhe, dhe helm \u00ebsht\u00eb ve\u00e7an\u00ebrisht e interesuar p\u00ebr t\u00eb vendosur chart-et e veta. Arrin deri n\u00eb pik\u00ebn q\u00eb, p\u00ebr shembull, Docker Hub mb\u00ebshtet shum\u00eb standarde OCI. Nuk e parashikoj, por ndoshta ofruesit klasik\u00eb t\u00eb depot Docker do t\u00eb fillojn\u00eb t\u00eb ofrojn\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb vendosur chart-et e Helm-it tuaj.<\/p>\n<p>Nj\u00eb histori e diskutueshme p\u00ebr mua \u00ebsht\u00eb <strong>mb\u00ebshtetja p\u00ebr Lua<\/strong>, si nj\u00eb motor templating p\u00ebr shkruarjen e skripteve. Un\u00eb nuk jam nj\u00eb fans i madh i Lua-s, por kjo do t\u00eb jet\u00eb nj\u00eb mund\u00ebsi plot\u00ebsuese. E kam verifikuar tri her\u00eb - p\u00ebrdorimi i Lua-s nuk do t\u00eb jet\u00eb i detyruesh\u00ebm. Pra, ata q\u00eb duan mund t\u00eb p\u00ebrdorin Lua, ata q\u00eb preferojn\u00eb Go - bashkohuni me kampin ton\u00eb t\u00eb madh dhe p\u00ebrdorni go-tmpl p\u00ebr k\u00ebt\u00eb.<\/p>\n<p>M\u00eb n\u00eb fund, gj\u00ebja q\u00eb m\u00eb mungonte me siguri ishte <strong>shfaqja e skem\u00ebs dhe validimi i tipeve t\u00eb t\u00eb dh\u00ebnave<\/strong>. Nuk do t\u00eb ket\u00eb m\u00eb probleme me int ose string, nuk do t\u00eb jet\u00eb e nevojshme t\u00eb rrotullohet zero n\u00eb dy cita. Do t\u00eb shfaqet nj\u00eb skem\u00eb JSONS, e cila do t\u00eb lejoj\u00eb t\u00eb p\u00ebrshkruaj\u00eb qart\u00eb k\u00ebt\u00eb p\u00ebr vlerat.<\/p>\n<p>Do t\u00eb rishikohet shum\u00eb <strong>modeli i motivuar nga ngjarjet<\/strong>. Ai tashm\u00eb \u00ebsht\u00eb p\u00ebrshkruar konceptualisht. Shikoni n\u00eb deg\u00ebn Helm 3 dhe do t\u00eb shihni se sa shum\u00eb ngjarje, hook-e dhe gj\u00ebra t\u00eb tjera jan\u00eb shtuar, t\u00eb cilat do t\u00eb thjeshtojn\u00eb dhe, nga ana tjet\u00ebr, do t\u00eb shtojn\u00eb kontroll mbi proceset e depozitimeve dhe reagimet ndaj tyre.<\/p>\n<p>Helm 3 do t\u00eb jet\u00eb m\u00eb i thjesht\u00eb, m\u00eb i sigurt dhe m\u00eb interesant, jo sepse nuk na p\u00eblqen Helm 2, por sepse Kubernetes po b\u00ebhet m\u00eb i avancuar. Prandaj, Helm mund t\u00eb p\u00ebrdor\u00eb arritjet e Kubernetes dhe t\u00eb krijoj\u00eb menaxher\u00eb t\u00eb shk\u00eblqyer p\u00ebr Kubernetes.<\/p>\n<blockquote><p>Nj\u00eb lajm tjet\u00ebr i mir\u00eb \u00ebsht\u00eb se <noindex><a rel=\"nofollow\" href=\"https:\/\/devopsconf.io\/moscow\/2019\">DevOpsConf<\/a><\/noindex> Aleksand\u00ebr Hajerov do t\u00eb flas\u00eb, <noindex><a rel=\"nofollow\" href=\"https:\/\/devopsconf.io\/moscow\/2019\/abstracts\/5564\">n\u00ebse kontejner\u00ebt mund t\u00eb jen\u00eb t\u00eb sigurt?<\/a><\/noindex> Kujtojm\u00eb, kongresi p\u00ebr integrimin e proceseve t\u00eb zhvillimit, testimit dhe operimit do t\u00eb zhvillohet n\u00eb Mosk\u00eb <strong>m\u00eb 30 shtator dhe 1 tetor<\/strong>. Deri m\u00eb 20 gusht ende mund t\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/conf.ontico.ru\/lectures\/propose\/?conference=dc2019-moscow\">paraqit nj\u00eb raport<\/a><\/noindex> dhe t\u00eb flas\u00eb p\u00ebr p\u00ebrvoj\u00ebn e tij n\u00eb zgjidhjen <noindex><a rel=\"nofollow\" href=\"https:\/\/devopsconf.io\/moscow\/2019\/articles\/917\">nj\u00eb prej shum\u00eb<\/a><\/noindex> problemeve t\u00eb qasjes DevOps.<\/p>\n<p>P\u00ebrCheckpointet e kongresit dhe lajmet ndiqni n\u00eb <noindex><a rel=\"nofollow\" href=\"http:\/\/eepurl.com\/bN_0E1\">kanalin<\/a><\/noindex> dhe <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/DevOpsConfChannel\">kanalin telegram<\/a><\/noindex>.<\/p><\/blockquote>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/oleg-bunin\/blog\/462665\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u0443\u0442\u044c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430 \u043e \u0441\u0430\u043c\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0434\u043b\u044f Kubernetes \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043c\u043e\u0434\u0436\u0438: \u043a\u043e\u0440\u043e\u0431\u043a\u0430 \u2014 \u044d\u0442\u043e Helm (\u044d\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0435, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Emoji); \u0437\u0430\u043c\u043e\u043a \u2014 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c; \u0447\u0435\u043b\u043e\u0432\u0435\u0447\u0435\u043a \u2014 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b. \u041d\u0430 \u0441\u0430\u043c\u043e\u043c \u0436\u0435 \u0434\u0435\u043b\u0435, \u0432\u0441\u0435 \u0431\u0443\u0434\u0435\u0442 \u043d\u0435\u043c\u043d\u043e\u0436\u0435\u0447\u043a\u043e \u0441\u043b\u043e\u0436\u043d\u0435\u0435, \u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437 \u043f\u043e\u043b\u043e\u043d \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0441\u0434\u0435\u043b\u0430\u0442\u044c Helm \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27661,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36918","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u0443\u0442\u044c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430 \u043e \u0441\u0430\u043c\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0434\u043b\u044f Kubernetes \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043c\u043e\u0434\u0436\u0438: \u043a\u043e\u0440\u043e\u0431\u043a\u0430 \u2014 \u044d\u0442\u043e Helm (\u044d\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0435, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Emoji);.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/bezopasnost-helm\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Helm | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u0443\u0442\u044c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430 \u043e \u0441\u0430\u043c\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0434\u043b\u044f Kubernetes \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043c\u043e\u0434\u0436\u0438: \u043a\u043e\u0440\u043e\u0431\u043a\u0430 \u2014 \u044d\u0442\u043e Helm (\u044d\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0435, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Emoji);.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/bezopasnost-helm\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:14:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:14:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Siguria e Helm | ProHoster","description":"Thelbi i tregimit p\u00ebr menaxherin m\u00eb t\u00eb popullarizuar t\u00eb paketave p\u00ebr Kubernetes mund t\u00eb p\u00ebrshkruhet me ndihm\u00ebn e emoji: kuti \u2014 kjo \u00ebsht\u00eb Helm (kjo \u00ebsht\u00eb m\u00eb e p\u00ebrshtatshme q\u00eb ka n\u00eb versionin m\u00eb t\u00eb fundit t\u00eb Emoji);","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/bezopasnost-helm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Helm | ProHoster","og:description":"\u0421\u0443\u0442\u044c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430 \u043e \u0441\u0430\u043c\u043e\u043c \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0434\u043b\u044f Kubernetes \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0437\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043c\u043e\u0434\u0436\u0438: \u043a\u043e\u0440\u043e\u0431\u043a\u0430 \u2014 \u044d\u0442\u043e Helm (\u044d\u0442\u043e \u0441\u0430\u043c\u043e\u0435 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0435, \u0447\u0442\u043e \u0435\u0441\u0442\u044c \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Emoji);.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/bezopasnost-helm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:43+00:00","article:modified_time":"2019-10-31T19:14:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36918","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:36:25","updated":"2026-01-22 05:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/36918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=36918"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/36918\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/27661"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=36918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=36918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=36918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}