{"id":39016,"date":"2019-10-31T22:27:21","date_gmt":"2019-10-31T19:27:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/7-luchshih-praktik-po-ekspluatatsii-kontejnerov-po-versii-google\/"},"modified":"2019-10-31T22:27:21","modified_gmt":"2019-10-31T19:27:21","slug":"7-luchshih-praktik-po-ekspluatatsii-kontejnerov-po-versii-google","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/7-luchshih-praktik-po-ekspluatatsii-kontejnerov-po-versii-google","title":{"rendered":"7 best practices for container operations according to Google","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Sh\u00ebn. p\u00ebrkth.<\/b>: Autori i artikullit origjinal \u00ebsht\u00eb Th\u00e9o Chamley, arkitekt i zgjidhjeve t\u00eb cloud nga Google. N\u00eb k\u00ebt\u00eb publikim p\u00ebr blogun e Google Cloud, ai paraqet nj\u00eb p\u00ebrmbledhje t\u00eb shkurt\u00ebr nga nj\u00eb udh\u00ebzues m\u00eb i detajuar i kompanis\u00eb s\u00eb tij, t\u00eb quajtur \"Praktikat m\u00eb t\u00eb mira p\u00ebr operimin e kontejner\u00ebve<\/a><\/noindex>\u201c. N\u00eb t\u00eb, ekspert\u00ebt e Google kan\u00eb mbledhur praktikat m\u00eb t\u00eb mira p\u00ebr menaxhimin e kontejner\u00ebve n\u00eb kontekstin e p\u00ebrdorimit t\u00eb Google Kubernetes Engine dhe m\u00eb shum\u00eb, duke p\u00ebrfshir\u00eb nj\u00eb gam\u00eb t\u00eb gjer\u00eb temash: nga siguria deri te monitorimi dhe regjistrimi. Pra, cilat jan\u00eb praktikat m\u00eb t\u00eb r\u00ebnd\u00ebsishme n\u00eb pun\u00ebn me kontejner\u00ebt sipas mendimit t\u00eb Google?<\/i><\/p>\n

\"7<\/a><\/noindex><\/p>\n

Kubernetes Engine<\/a><\/noindex> (nj\u00eb sh\u00ebrbim i bazuar n\u00eb Kubernetes p\u00ebr t\u00eb drejtuar aplikacione t\u00eb kontejnerizuara n\u00eb Google Cloud \u2014 sh\u00ebnim i p\u00ebrkthyesit.<\/b>)<\/i> \u2014 \u00ebsht\u00eb nj\u00eb nga m\u00ebnyrat m\u00eb t\u00eb mira p\u00ebr t\u00eb drejtuar ngarkesa pune q\u00eb kan\u00eb nevoj\u00eb p\u00ebr shkall\u00ebzim. Kubernetes<\/a><\/noindex> do t\u00eb siguroj\u00eb funksionimin pa probleme t\u00eb shumic\u00ebs s\u00eb aplikacioneve, n\u00ebse jan\u00eb t\u00eb kontejnerizuara. Por n\u00ebse d\u00ebshironi q\u00eb aplikacioni t\u00eb jet\u00eb i leht\u00eb p\u00ebr t'u menaxhuar dhe d\u00ebshironi t\u00eb shfryt\u00ebzoni t\u00eb gjitha avantazhet e Kubernetes, \u00ebsht\u00eb e nevojshme t\u00eb ndiqni praktikat m\u00eb t\u00eb mira. Ato do ta thjeshtojn\u00eb operimin e aplikacionit, monitorimin dhe pastrimin e tij, si dhe do t\u00eb rrisin sigurin\u00eb.<\/p>\n

N\u00eb k\u00ebt\u00eb artikull do t\u00eb kalojm\u00eb n\u00ebp\u00ebr nj\u00eb list\u00eb t\u00eb asaj q\u00eb duhet t\u00eb dini dhe t\u00eb b\u00ebni p\u00ebr funksionimin efektiv t\u00eb kontejner\u00ebve n\u00eb Kubernetes. Ata q\u00eb d\u00ebshirojn\u00eb t\u00eb thellohen n\u00eb detaje duhet t\u00eb lexojn\u00eb materialin Praktikat m\u00eb t\u00eb mira p\u00ebr operimin e kontejner\u00ebve<\/a><\/noindex>, si dhe t\u00eb ken\u00eb parasysh postimin ton\u00eb m\u00eb t\u00eb hersh\u00ebm<\/a><\/noindex> p\u00ebr nd\u00ebrtimin e kontejner\u00ebve.<\/p>\n

1. P\u00ebrdorni mekanizmat natyror\u00eb t\u00eb kontejner\u00ebve p\u00ebr regjistrimin<\/h2>\n

\nN\u00ebse aplikacioni \u00ebsht\u00eb i drejtuar n\u00eb nj\u00eb grup Kubernetes, p\u00ebr regjistrimin nuk nevojitet shum\u00eb. Nj\u00eb sistem i centralizuar i regjistrimit, p\u00ebr t\u00eb cilin ndoshta tashm\u00eb \u00ebsht\u00eb i integruar n\u00eb grupe, p\u00ebrgjigjet p\u00ebr k\u00ebt\u00eb n\u00eb rastin e p\u00ebrdorimit t\u00eb Kubernetes Engine Stackdriver Logging<\/a><\/noindex>. (Sh\u00ebn. p\u00ebrkth.<\/b>: Nd\u00ebrsa p\u00ebr nj\u00eb instalim t\u00eb vet\u00eb-kontrolluar Kubernetes, rekomandojm\u00eb t\u00eb shikoni zgjidhjen ton\u00eb me burim t\u00eb hapur \u2014 loghouse<\/a><\/noindex>.)<\/i> Mos e kompliko jet\u00ebn dhe p\u00ebrdor mekanizmat natyror\u00eb t\u00eb regjistrimit t\u00eb kontejner\u00ebve. Shkruani regjistrat n\u00eb stdout dhe stderr \u2014 ato do t\u00eb merren automatikisht, ruhen, dhe indeksohen.<\/p>\n

N\u00ebse d\u00ebshironi, mund t\u00eb shkruani gjithashtu regjistrat n\u00eb formatin JSON<\/a><\/noindex>. Ky qasje do t\u00eb lejoj\u00eb q\u00eb t\u00eb shtoni leht\u00ebsisht metadatat. Dhe s\u00eb bashku me to, n\u00eb Stackdriver Logging do t\u00eb ket\u00eb mund\u00ebsi k\u00ebrkimi n\u00eb regjistrat duke p\u00ebrdorur k\u00ebto metadata.<\/p>\n

2. Sigurohuni q\u00eb kontejner\u00ebt jan\u00eb stateless dhe t\u00eb pandryshuesh\u00ebm<\/h2>\n

\nP\u00ebr funksionimin e sakt\u00eb t\u00eb konteiner\u00ebve n\u00eb klasterin Kubernetes, ato duhet t\u00eb jen\u00eb stateless dhe immutable. Kur k\u00ebto kushte plot\u00ebsohen, Kubernetes do t\u00eb jet\u00eb n\u00eb gjendje t\u00eb kryej\u00eb pun\u00ebn e tij, duke krijuar dhe shkat\u00ebrruar entitete t\u00eb aplikacionit kur dhe ku nevojitet.<\/p>\n

Stateless<\/i> do t\u00eb thot\u00eb se \u00e7do gjendje (t\u00eb dh\u00ebna t\u00eb q\u00ebndrueshme t\u00eb \u00e7do lloji) ruhen jasht\u00eb konteinerit. P\u00ebr k\u00ebt\u00eb, n\u00eb var\u00ebsi t\u00eb nevojave, mund t\u00eb angazhohen lloje t\u00eb ndryshme t\u00eb ruajtjeve t\u00eb jashtme: Ruajtja n\u00eb Re<\/a><\/noindex>, Disku i Q\u00ebndruesh\u00ebm<\/a><\/noindex>, Redis<\/a><\/noindex>, Cloud SQL<\/a><\/noindex> apo baza t\u00eb tjera t\u00eb dh\u00ebnash t\u00eb menaxhuara. (Sh\u00ebn. p\u00ebrkth.<\/b>: M\u00eb shum\u00eb rreth k\u00ebsaj mund t\u00eb lexoni gjithashtu n\u00eb artikullin ton\u00eb \"Operator\u00ebt p\u00ebr Kubernetes: si t\u00eb ekzekutoni aplikacione stateful<\/a><\/noindex>\u00bb.)<\/i><\/p>\n

Immutable<\/i> do t\u00eb thot\u00eb se konteineri nuk do t\u00eb modifikohet gjat\u00eb jet\u00ebs s\u00eb tij: nuk ka p\u00ebrdit\u00ebsime, patches, ndryshime n\u00eb konfiguracion. N\u00ebse ju nevojitet t\u00eb p\u00ebrdit\u00ebsoni kodin e aplikacionit ose t\u00eb aplikoni nj\u00eb patch, krijoni nj\u00eb imazh t\u00eb ri dhe depozitoni at\u00eb. Rekomandohet t\u00eb nxirreni konfiguracionin e konteinerit (porta p\u00ebr d\u00ebgjim, opsionet e mjedisit ekzekutiv etj.) jasht\u00eb \u2014 n\u00eb Sekretet<\/a><\/noindex> dhe ConfigMaps<\/a><\/noindex>. Ato mund t\u00eb p\u00ebrdit\u00ebsohen pa pasur nevoj\u00eb t\u00eb krijoni nj\u00eb imazh t\u00eb ri t\u00eb konteinerit. P\u00ebr krijimin e thjesht\u00eb t\u00eb pipeline-ve p\u00ebr nd\u00ebrtimin e imazheve mund t\u00eb p\u00ebrdorni Cloud Build<\/a><\/noindex>. (Sh\u00ebn. p\u00ebrkth.<\/b>: Ne p\u00ebr k\u00ebto q\u00ebllime p\u00ebrdorim mjetin Open Source dapp<\/a><\/noindex>.)<\/i><\/p>\n

\"7
\nShembulli i p\u00ebrdit\u00ebsimit t\u00eb konfiguracionit t\u00eb Deployment n\u00eb Kubernetes duke p\u00ebrdorur ConfigMap, t\u00eb montuar n\u00eb pod p\u00ebr si nj\u00eb konfigurim<\/i><\/p>\n

3. Shmangni konteiner\u00ebt me privilegje<\/h2>\n

\nNuk e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u045a\u0438 aplikacione n\u00ebn root n\u00eb server\u00ebt tuaj, apo jo? N\u00ebse nj\u00eb k\u00ebrc\u00ebnues arrin t\u00eb dep\u00ebrtoj\u00eb n\u00eb aplikacion, ai do t\u00eb ket\u00eb akses me t\u00eb drejtat root. T\u00eb nj\u00ebjtat argumente jan\u00eb t\u00eb vlefshme edhe p\u00ebr t\u00eb mos drejtuar kontejner\u00eb me privilegje. N\u00ebse \u00ebsht\u00eb e nevojshme t\u00eb ndryshoni konfigurimet n\u00eb host, mund t'i jepni kontejnerit specifike. capabilities<\/i> p\u00ebrmes opsionit securityContext<\/code><\/a><\/noindex> n\u00eb Kubernetes. N\u00ebse nevojitet t\u00eb ndryshoni sysctls<\/i>, Kubernetes ka nj\u00eb annotim t\u00eb ve\u00e7ant\u00eb<\/a><\/noindex> p\u00ebr k\u00ebt\u00eb. N\u00eb p\u00ebrgjith\u00ebsi, p\u00ebrpiquni t\u00eb p\u00ebrdorni sa m\u00eb shum\u00eb init-<\/a><\/noindex> dhe konteiner\u00eb sidecar p\u00ebr kryerjen e operacioneve t\u00eb tilla me privilegje. Ata nuk kan\u00eb nevoj\u00eb p\u00ebr aksesim p\u00ebr asnj\u00eb trafik t\u00eb brendsh\u00ebm apo t\u00eb jasht\u00ebm.<\/p>\n

N\u00ebse ju menaxhoni klasterin, mund t\u00eb p\u00ebrdorni Pod Security Policy<\/a><\/noindex> p\u00ebr kufizimet n\u00eb p\u00ebrdorimin e konteiner\u00ebve me privilegje.<\/p>\n

4. Shmangni ekzekutimin n\u00ebn root<\/h2>\n

\nU p\u00ebrmend\u00ebn tashm\u00eb kontejner\u00ebt me privilegje, por do t\u00eb ishte edhe m\u00eb mir\u00eb, n\u00ebse p\u00ebrve\u00e7 k\u00ebsaj, nuk do t\u00eb drejtoni aplikacione n\u00ebn root brenda kontejnerit. N\u00ebse nj\u00eb k\u00ebrc\u00ebnues gjen nj\u00eb vulnerabilitet t\u00eb larg\u00ebt n\u00eb aplikacionin me t\u00eb drejta root q\u00eb mund\u00ebson ekzekutimin e kodit, ai mund t\u00eb dal\u00eb nga kufijt\u00eb e kontejnerit p\u00ebrmes nj\u00eb vulnerabiliteti ende t\u00eb panjohur dhe t\u00eb fitoj\u00eb root-in n\u00eb host.<\/p>\n

M\u00ebnyra m\u00eb e mir\u00eb p\u00ebr t\u00eb shmangur k\u00ebt\u00eb \u00ebsht\u00eb, mbi t\u00eb gjitha, t\u00eb mos drejtoni asgj\u00eb n\u00ebn root. P\u00ebr k\u00ebt\u00eb, mund t\u00eb p\u00ebrdorni direktiv\u00ebn USER<\/code> n\u00eb Dockerfile<\/code> ose runAsUser<\/code> n\u00eb Kubernetes. Administratori i klasterit gjithashtu mund ta konfiguroj\u00eb nj\u00eb sjellje t\u00eb detyrueshme duke p\u00ebrdorur Pod Security Policy<\/a><\/noindex>.<\/p>\n

5. B\u00ebni aplikacionin t\u00eb leht\u00eb p\u00ebr monitorim<\/h2>\n

\nSi\u00e7 \u00ebsht\u00eb regjistrimi, monitorimi \u00ebsht\u00eb nj\u00eb pjes\u00eb e pandashme e menaxhimit t\u00eb aplikacionit. Nj\u00eb zgjidhje e njohur p\u00ebr monitorimin n\u00eb komunitetin Kubernetes \u00ebsht\u00eb Prometheus<\/a><\/noindex> \u2014 nj\u00eb sistem q\u00eb zbulon automatikisht pod-\u00ebt dhe sh\u00ebrbimet q\u00eb k\u00ebrkojn\u00eb monitorim. (Sh\u00ebn. p\u00ebrkth.<\/b>: Shih gjithashtu raportin ton\u00eb t\u00eb detajuar<\/a><\/noindex> n\u00eb lidhje me monitorimin p\u00ebrmes Prometheus dhe Kubernetes.)<\/i> Stackdriver<\/a><\/noindex> \u00ebsht\u00eb n\u00eb gjendje t\u00eb monitoroj\u00eb klasteret Kubernetes dhe p\u00ebrfshin versionin e tij t\u00eb Prometheus p\u00ebr monitorimin e aplikacioneve.<\/p>\n

\"7
\nPaneli i monitorimit Kubernetes n\u00eb Stackdriver<\/i><\/p>\n

Prometheus pret q\u00eb aplikacioni t\u00eb jap\u00eb metrikat n\u00eb nj\u00eb HTTP endpoint. P\u00ebr k\u00ebt\u00eb, jan\u00eb t\u00eb disponueshme bibliotekat klient t\u00eb Prometheus<\/a><\/noindex>. I nj\u00ebjti format po ashtu p\u00ebrdoret nga mjete t\u00eb tjera si OpenCensus<\/a><\/noindex> dhe Istio<\/a><\/noindex>.<\/p>\n

6. B\u00ebni t\u00eb disponuesh\u00ebm gjendjen sh\u00ebndet\u00ebsore t\u00eb aplikacionit<\/h2>\n

\nMenaxhimi i aplikacionit n\u00eb prodhim ndihmohet nga aft\u00ebsia e tij p\u00ebr t\u00eb raportuar gjendjen e tij t\u00ebr\u00eb sistemit. A \u00ebsht\u00eb aplikacioni i nisur? A \u00ebsht\u00eb ai n\u00eb rregull? A \u00ebsht\u00eb i gatsh\u00ebm p\u00ebr t\u00eb pranuar trafik? Si po sillet? M\u00ebnyra m\u00eb e zakonshme p\u00ebr t\u00eb zgjidhur k\u00ebt\u00eb problem \u00ebsht\u00eb t\u00eb implementoni kontrollet e sh\u00ebndetit (health checks)<\/i>. Kubernetes ka dy lloje t\u00eb tyre: liveness dhe readiness probes<\/a><\/noindex>.<\/p>\n

P\u00ebr liveness probe (kontrolli i jetes\u00ebs)<\/i> aplikacioni duhet t\u00eb ket\u00eb nj\u00eb HTTP endpoint q\u00eb kthen nj\u00eb p\u00ebrgjigje \"200 OK\" n\u00ebse ai funksionon dhe var\u00ebsit\u00eb e tij kryesore jan\u00eb t\u00eb k\u00ebnaqura. P\u00ebr readiness probe (kontrolli i gatishm\u00ebris\u00eb p\u00ebr sh\u00ebrbim)<\/i> aplikacioni duhet t\u00eb ket\u00eb nj\u00eb endpoint tjet\u00ebr HTTP q\u00eb kthen p\u00ebrgjigjen \"200 OK\", n\u00ebse aplikacioni \u00ebsht\u00eb n\u00eb nj\u00eb gjendje t\u00eb sh\u00ebndetshme, hapat e inicializimit jan\u00eb kryer dhe \u00e7do k\u00ebrkes\u00eb korrekte nuk shkakton nj\u00eb gabim. Kubernetes do t\u00eb drejtoj\u00eb trafikun n\u00eb kontejner vet\u00ebm kur aplikacioni \u00ebsht\u00eb i gatsh\u00ebm sipas k\u00ebtyre kontrollimeve. Dy endpoint mund t\u00eb bashkohen, n\u00ebse nuk ka ndryshim midis gjendjeve t\u00eb jetueshm\u00ebris\u00eb (liveness) dhe gatishm\u00ebris\u00eb (readiness).<\/p>\n

M\u00eb shum\u00eb rreth k\u00ebsaj mund t\u00eb lexoni n\u00eb artikullin p\u00ebrkat\u00ebs nga Sandeep Dinesh, Avokat i Zhvillimit n\u00eb Google: \"Praktikat m\u00eb t\u00eb mira t\u00eb Kubernetes: Cil\u00ebsimi i kontrolleve t\u00eb sh\u00ebndetit me kontrollet e gatishm\u00ebris\u00eb dhe jet\u00ebsis\u00eb<\/a><\/noindex>\u00bb.<\/p>\n

7. Zgjidhni kujdes me versionin e imazhit<\/h2>\n

\nShumica e imazheve publike dhe private p\u00ebrdorin nj\u00eb sistem etiketimi, t\u00eb ngjash\u00ebm me at\u00eb t\u00eb p\u00ebrshkruar n\u00eb Praktikat m\u00eb t\u00eb Mira p\u00ebr Nd\u00ebrtime t\u00eb Kontejner\u00ebve<\/a><\/noindex>. N\u00ebse imazhi aplikon nj\u00eb sistem q\u00eb \u00ebsht\u00eb i af\u00ebrt me versionimin semantik<\/a><\/noindex>, \u00ebsht\u00eb e nevojshme t\u00eb merret parasysh specifikimi i etiketimit. P\u00ebr shembull, etiketa latest<\/code> mund t\u00eb l\u00ebviz\u00eb shpesh nga nj\u00eb imazh n\u00eb nj\u00eb tjet\u00ebr \u2014 nuk mund t\u00eb mb\u00ebshteteni n\u00eb t\u00eb, n\u00ebse ju nevojiten nd\u00ebrtime dhe instalime t\u00eb parashikueshme dhe t\u00eb riprodhueshme.<\/p>\n

Mund t\u00eb p\u00ebrdorni etiket\u00ebn X.Y.Z<\/code> ((ato pothuajse gjithmon\u00eb mbeten t\u00eb pandryshuara), megjithat\u00eb n\u00eb k\u00ebt\u00eb rast mbani n\u00ebn kontroll t\u00eb gjitha patch-\u00ebt dhe p\u00ebrdit\u00ebsimet p\u00ebr imazhin. N\u00ebse imazhi q\u00eb po p\u00ebrdorni ka etiket\u00ebn X.Y<\/code>, kjo \u00ebsht\u00eb nj\u00eb mund\u00ebsi e mir\u00eb e nj\u00eb mesatare t\u00eb arsyeshme. Duke e zgjedhur at\u00eb, automatikisht merrni patch-et dhe, nj\u00ebkoh\u00ebsisht, mb\u00ebshteteni n\u00eb nj\u00eb version stabil t\u00eb aplikacionit.<\/p>\n

P.S. nga p\u00ebrkthyesi<\/h2>\n

\nLexoni gjithashtu n\u00eb blogun ton\u00eb:<\/p>\n