🥇Sibhala i-opharetha ye-Kubernetes ku-Golang

Qaphela. transl.: Ama-Opharetha ayi-software eyisiza ye-Kubernetes, edizayinelwe ukwenza ngokuzenzakalelayo ukuqaliswa kwezenzo ezijwayelekile ezintweni zeqoqo lapho izehlakalo ezithile zenzeka. Sesike sabhala mayelana nama-opharetha ku lesi sihloko, lapho babekhuluma khona ngemibono nezimiso eziyisisekelo zomsebenzi wabo. Kodwa uma lokho kwaziswa bekukumbono ovela ohlangothini lokusebenzisa izingxenye esezilungile ze-Kubernetes, khona-ke ukuhunyushwa kwesihloko esisha esihlongozwayo manje sekuwumbono wonjiniyela/unjiniyela we-DevOps odidwe ukuqaliswa komsebenzi omusha.

Nginqume ukubhala lokhu okuthunyelwe ngesibonelo sempilo yangempela ngemva kwemizamo yami yokuthola imibhalo ekudaleni u-opharetha we-Kubernetes, odlule ekufundeni ikhodi.

Isibonelo esizochazwa yilesi: kuqoqo lethu le-Kubernetes, ngalinye Namespace imele indawo yebhokisi lesihlabathi leqembu, futhi besifuna ukukhawulela ukufinyelela kuzo ukuze amaqembu akwazi ukudlala kumabhokisi awo esanti kuphela.

Ungakwazi ukufeza okufunayo ngokunikeza umsebenzisi iqembu elinalo RoleBinding ukuze ucacise Namespace и ClusterRole ngamalungelo okuhlela. Ukumelwa kwe-YAML kuzobukeka kanje:

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: kubernetes-team-1
  namespace: team-1
subjects:
- kind: Group
  name: kubernetes-team-1
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: edit
apiGroup: rbac.authorization.k8s.io

(indima.yaml, ku okuluhlaza)

Dala eyodwa RoleBinding Ungakwenza mathupha, kodwa ngemva kokuwela uphawu lwezikhala zamagama eziyikhulu, kuba umsebenzi oyisicefe. Kulapho o-opharetha be-Kubernetes besiza khona—bakuvumela ukuthi wenze ngokuzenzakalelayo ukudalwa kwezinsiza ze-Kubernetes ngokusekelwe ezinguqukweni zezinsiza. Esimeni sethu sifuna ukudala RoleBinding ngenkathi udala Namespace.

Okokuqala, ake sichaze umsebenzi mainokwenza isethaphu edingekayo ukuze iqalise isitatimende bese ibiza isenzo sesitatimende:

(Qaphela. transl.: lapha nangezansi amazwana kukhodi ahunyushwa ngesiRashiya. Ngaphezu kwalokho, ukuhlehlisa kulungiselwe ezikhaleni esikhundleni samathebhu [okunconywe kokuthi Go] ngenjongo yokufunda kangcono ngaphakathi kwesakhiwo se-Habr. Ngemva kokufakwa kuhlu ngakunye kukhona izixhumanisi kokwangempela ku-GitHub, lapho kugcinwa khona amazwana namathebhu olimi lwesiNgisi.)

func main() {
  // Устанавливаем вывод логов в консольный STDOUT
  log.SetOutput(os.Stdout)

  sigs := make(chan os.Signal, 1) // Создаем канал для получения сигналов ОС
  stop := make(chan struct{})     // Создаем канал для получения стоп-сигнала

  // Регистрируем получение SIGTERM в канале sigs
  signal.Notify(sigs, os.Interrupt, syscall.SIGTERM, syscall.SIGINT) 

  // Goroutines могут сами добавлять себя в WaitGroup,
 // чтобы завершения их выполнения дожидались
  wg := &sync.WaitGroup{} 

  runOutsideCluster := flag.Bool("run-outside-cluster", false, "Set this flag when running outside of the cluster.")
  flag.Parse()
  // Создаем clientset для взаимодействия с кластером Kubernetes
  clientset, err := newClientSet(*runOutsideCluster)

  if err != nil {
    panic(err.Error())
  }

  controller.NewNamespaceController(clientset).Run(stop, wg)

  <-sigs // Ждем сигналов (до получения сигнала более ничего не происходит)
  log.Printf("Shutting down...")

  close(stop) // Говорим goroutines остановиться
  wg.Wait()   // Ожидаем, что все остановлено
}

(main.hamba, ku okuluhlaza)

Senza lokhu okulandelayo:

Silungiselela isibambi samasiginali athile wesistimu yokusebenza ukuze sibangele ukunqanyulwa okuhle kwesisebenzisi.
Sisebenzisa WaitGroupukumisa kahle zonke izindlela ngaphambi kokunqamula uhlelo.
Sinikeza ukufinyelela kuqoqo ngokudala clientset.
Yethula NamespaceController, lapho yonke i-logic yethu izotholakala khona.

Manje sidinga isisekelo se-logic, futhi esimweni sethu lesi yisona esishiwo NamespaceController:

// NamespaceController следит через Kubernetes API за изменениями
// в пространствах имен и создает RoleBinding для конкретного namespace.
type NamespaceController struct {
  namespaceInformer cache.SharedIndexInformer
  kclient           *kubernetes.Clientset
}

// NewNamespaceController создает новый NewNamespaceController
func NewNamespaceController(kclient *kubernetes.Clientset) *NamespaceController {
  namespaceWatcher := &NamespaceController{}

  // Создаем информер для слежения за Namespaces
  namespaceInformer := cache.NewSharedIndexInformer(
    &cache.ListWatch{
      ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
        return kclient.Core().Namespaces().List(options)
      },
      WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
        return kclient.Core().Namespaces().Watch(options)
      },
    },
    &v1.Namespace{},
    3*time.Minute,
    cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc},
  )

  namespaceInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
    AddFunc: namespaceWatcher.createRoleBinding,
  })

  namespaceWatcher.kclient = kclient
  namespaceWatcher.namespaceInformer = namespaceInformer

  return namespaceWatcher
}

(isilawuli.hamba, ku okuluhlaza)

Lapha silungisa SharedIndexInformer, okuzokwenza ngempumelelo (usebenzisa inqolobane) ilinde izinguquko ezikhaleni zamagama (funda kabanzi mayelana nezimpimpi esihlokweni esithi "Isebenza kanjani i-Kubernetes scheduler?"- cishe. ukuhumusha). Ngemva kwalokhu sixhuma EventHandler kumpimpi, ukuze kuthi lapho wengeza indawo yegama (Namespace) umsebenzi ubizwa createRoleBinding.

Isinyathelo esilandelayo ukuchaza lo msebenzi createRoleBinding:

func (c *NamespaceController) createRoleBinding(obj interface{}) {
  namespaceObj := obj.(*v1.Namespace)
  namespaceName := namespaceObj.Name

  roleBinding := &v1beta1.RoleBinding{
    TypeMeta: metav1.TypeMeta{
      Kind:       "RoleBinding",
      APIVersion: "rbac.authorization.k8s.io/v1beta1",
    },
    ObjectMeta: metav1.ObjectMeta{
      Name:      fmt.Sprintf("ad-kubernetes-%s", namespaceName),
      Namespace: namespaceName,
    },
    Subjects: []v1beta1.Subject{
      v1beta1.Subject{
        Kind: "Group",
        Name: fmt.Sprintf("ad-kubernetes-%s", namespaceName),
      },
    },
    RoleRef: v1beta1.RoleRef{
      APIGroup: "rbac.authorization.k8s.io",
        Kind:     "ClusterRole",
        Name:     "edit",
    },
  }

  _, err := c.kclient.Rbac().RoleBindings(namespaceName).Create(roleBinding)

  if err != nil {
    log.Println(fmt.Sprintf("Failed to create Role Binding: %s", err.Error()))
  } else {
    log.Println(fmt.Sprintf("Created AD RoleBinding for Namespace: %s", roleBinding.Name))
  }
}

(isilawuli.hamba, ku okuluhlaza)

Sithola indawo yegama njenge obj bese uyiguqulela entweni Namespace. Bese sichaza RoleBinding, ngokusekelwe kufayela le-YAML okukhulunywe ngalo ekuqaleni, kusetshenziswa into enikeziwe Namespace kanye nokudala RoleBinding. Ekugcineni, sibhala ukuthi ngabe ukudalwa kuphumelele yini.

Umsebenzi wokugcina ozochazwa ngu Run:

// Run запускает процесс ожидания изменений в пространствах имён
// и действия в соответствии с этими изменениями.
func (c *NamespaceController) Run(stopCh <-chan struct{}, wg *sync.WaitGroup) {
  // Когда эта функция завершена, пометим как выполненную
  defer wg.Done()

  // Инкрементируем wait group, т.к. собираемся вызвать goroutine
  wg.Add(1)

  // Вызываем goroutine
  go c.namespaceInformer.Run(stopCh)

  // Ожидаем получения стоп-сигнала
  <-stopCh
}

(isilawuli.hamba, ku okuluhlaza)

Lapha siyakhuluma WaitGroupukuthi sethula i-goroutine bese siyafona namespaceInformer, okuye kwachazwa ngaphambilini. Lapho isignali yokumisa ifika, izoqeda umsebenzi, yazisa WaitGroup, engasasetshenziswa, futhi lo msebenzi uzophuma.

Ulwazi mayelana nokwakha nokusebenzisa lesi sitatimende kuqoqo le-Kubernetes lungatholakala ku amakhosombe ku-GitHub.

Lokho kungenxa yomsebenzisi odalayo RoleBinding nini Namespace ku-cluster ye-Kubernetes, ilungile.

Source: www.habr.com

Kubhalelwa u-opharetha we-Kubernetes ngesi-Golang

Engeza amazwana Отменить ответ