Saka API na EKS a bayan VPN: tsarin ayyuka

Kunna wurin ƙarshe na sirri, tabbatar cewa kubectl ya isa gare shi, sannan rufe na jama'a. Littafin jagora na mataki-mataki tare da umarni da gwaje-gwaje tsakanin kowane mataki.

Sigar haɗari na wannan canji ita ce umarni ɗaya da ke juya wurin ƙarshe kuma ya kulle duk masu gudanarwa a lokaci ɗaya. Sigar lafiya tana barin duk hanyoyin biyu a buɗe, tana tabbatar da cewa na sirri yana aiki daga VPN, sannan kawai ta janye wurin ƙarshe na jama'a. Ka ɗauka akwai cluster da ya wanzu, rami da aka amince da shi zuwa VPC ɗinsa da kubeconfig da ke aiki tuni; aikin shine samun sirri ga API na Kubernetes, ba nodes na sirri ba kuma ba sabon tsarin izini ba. Kowane mataki a ƙasa yana da gwajin da za ka iya kasawa cikin aminci.

1. Yi lissafin wurin ƙarshe kuma ka riƙe hanyar dawowa

Rubuta halin yanzu kafin canza shi, gami da jerin CIDR na jama'a da aka yarda da su da ƙungiyar tsaro ta cluster. Waɗannan biyu ne za ka kwatanta da su lokacin da wani abu ya daina aiki, kuma jerin yarda shi ma hanyar dawowarka ce idan hanyar sirri ta zama ba daidai ba.

aws eks describe-cluster --region REGION --name CLUSTER \
  --query 'cluster.{endpoint:endpoint,public:resourcesVpcConfig.endpointPublicAccess,private:resourcesVpcConfig.endpointPrivateAccess,cidrs:resourcesVpcConfig.publicAccessCidrs}'

REGION da CLUSTER masu riƙe wuri ne a nan. Lura abin da tutar sirri ke karantawa yanzu, domin cluster da aka ƙirƙira tare da samun sirri da aka riga aka kunna yana buƙatar matakin farko daban da wanda bai taɓa samun sa ba. Riƙe aƙalla hanyar gudanarwa ɗaya da aka amince da ita a buɗe yayin sauyin; VPN da ya dogara da isar da cluster ɗin nan ba hanyar farfadowa ba ce.

2. Kunna samun sirri tare da hanyar cibiyar sadarwa a wurin

Kunna tutar shine rabin mai sauƙi. Ramin yana buƙatar hanya zuwa adiresoshin sirri na wurin ƙarshe, kuma ƙungiyar tsaro ta cluster tana buƙatar TCP 443 daga tushen da VPN ke gabatarwa a zahiri. Haɗin Client VPN, ƙofar site-to-site da VPC da aka haɗa duk suna iya gabatar da adiresoshin tushe daban-daban, don haka yi amfani da tsarin da ka tura maimakon kewayon sirri na gama-gari.

aws eks update-cluster-config --region REGION --name CLUSTER \
  --resources-vpc-config endpointPublicAccess=true,endpointPrivateAccess=true

aws eks describe-update --region REGION --name CLUSTER --update-id UPDATE_ID

Sabuntawa ba ta lokaci ɗaya take ba. Tambayi id ɗin sabuntawa har sai ya bayar da rahoton nasara maimakon jira ƙayyadadden adadin daƙiƙa ka yi zato. Bar zirga-zirgar nodes da jirgin sarrafawa su kaɗaici yayin da kake yin wannan: maye gurbin duk ƙungiyar tsaro ta cluster da doka don kwamfutar tafi-da-gidanka ita ce hanyar da jirgin bayanai mai aiki ke zama hatsari na biyu.

Takardun wuraren ƙarshe na EKS sun cancanci karatu gaba ɗaya sau ɗaya, domin sun ce samun sirri kawai na iya zuwa daga VPC ko hanyar sadarwar da aka haɗa. Wannan jumlar ita ce dukan dalilin da ya sa wannan ƙaura ke yiwuwa, kuma ita ma dalilin da ya sa mataki na gaba ya wanzu.

3. Tabbatar cewa tashar aiki ta yi amfani da hanyar sirri

Tare da kunna duka wuraren ƙarshe, kubectl get ns mai nasara baya tabbatar da komai game da wanda ya amsa. Warware sunan mai masaukin wurin ƙarshe kuma duba ko adireshin da ka samu na kewayon sirri ne ko na jama'a. Idan hanyar sadarwarka da aka haɗa ba ta samun hangen sirri ta DNS, umarnin zai yi nasara ta wurin ƙarshe na jama'a kuma za ka janye hanyar jama'a bisa shaidar ƙarya. Wannan ita ce hanya mafi yawa da wannan ƙaura ke ɓarna, kuma tana kama da nasara daidai.

nslookup HASH.gr7.REGION.eks.amazonaws.com
kubectl cluster-info
kubectl get ns --request-timeout=10s

Riƙe sunan mai masauki da tabbatar da takardar shaida daidai yadda suke. Sauya da IP na sirri a cikin kubeconfig da tsallake tabbatar da TLS ba shine ƙaurar da ka bayyana a rikodin canji ba, kuma zai sake kasawa a lokacin da wurin ƙarshe ya juya.

4. Janye samun jama'a da gangan

Da zarar an nuna hanyar sirri kuma an amince da tsarin farfadowa, rufe wurin ƙarshe na jama'a. Wannan canji ne na gaske ba hasashe ba, don haka gudanar da shi akan asusun da saitunan da kake nufi da gaske.

aws eks update-cluster-config --region REGION --name CLUSTER \
  --resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true

A yanayin sirri kawai, sunan DNS na jama'a yana warware zuwa adiresoshin sirri na wurin ƙarshe daga cikin VPC, don haka warwarewa da isa sun daina zama abu ɗaya. Duk abin da ya dogara da adireshin jama'a, gami da masu gudanar da CI ko kwamfutar tafi-da-gidanka a wata hanyar sadarwa, yanzu yana buƙatar hanyarsa ta shiga.

5. Riƙe manufar cibiyar sadarwa da manufar ganewa daban

Jerin CIDR na samun jama'a yana tafiyar da wurin ƙarshe na jama'a kawai. Bai takaita wurin ƙarshe na sirri ba, wanda a maimakon haka ƙungiyar tsaro ta cluster da manufar hanyar sadarwar da aka haɗa ke iyakance shi. Idan ka riƙe wurin ƙarshe na jama'a, dole ne jerin yardarsa ya dace da fitowar jama'a da abokan cinikin API da nodes ɗinka ke amfani da su a zahiri; adireshin tafkin VPN ba kasafai yake wannan tushe ba.

Babu ɗaya daga cikin waɗannan da ke canza IAM ko Kubernetes RBAC. Saitunan wurin ƙarshe aikin gudanarwa ne, kuma bai kamata talakawa su sami izinin sassauta iyaka kawai don isa API ba. Rubuta halin ƙarshe, kwanan wata da hanyar farfadowa a cikin littafin jagora, sannan gwada hanyar farfadowa sau ɗaya yayin da take da sauƙi.

Labarai masu alaƙa