Beka i-API ye-EKS Ngemuva kwe-VPN: Ukulandelana Kwemisebenzi

Nika amandla i-endpoint yangasese, fakazela ukuthi i-kubectl ifinyelele kuyo, bese uvala eyomphakathi. I-runbook yesinyathelo ngesinyathelo enemiyalo nokuhlolwa phakathi kwesinyathelo ngasinye.

Inguqulo eyingozi yalolu shintsho iwumyalo owodwa ophendula i-endpoint futhi uvale bonke abaphathi ngesikhathi esisodwa. Inguqulo ephephile igcina zombili izindlela zivuliwe, ifakazela ukuthi eyangasese iyasebenza kusukela ku-VPN, bese kuthi ngemva kwalokho ihoxise i-endpoint yomphakathi. Cabanga ukuthi kukhona iqoqo elikhona, ithuneli eligunyaziwe eliya ku-VPC yalo kanye ne-kubeconfig esivele isebenza; umsebenzi uwukufinyelela okwangasese ku-API ye-Kubernetes, hhayi ama-node angasese futhi hhayi imodeli entsha yezimvume. Isinyathelo ngasinye ngezansi sinokuhlolwa ongahluleka ngokuphephile kuso.

1. Bhala uhlu lwe-endpoint futhi gcina indlela yokubuyela emuva

Rekhoda isimo samanje ngaphambi kokusishintsha, kuhlanganise nohlu lwe-CIDR yomphakathi evunyelwe kanye neqembu lokuphepha leqoqo. Lezi ezimbili yizona ozoziqhathanisa lapho kukhona okungasa sasebenza, futhi uhlu oluvunyelwe futhi luyindlela yakho yokuhlehla uma umzila wangasese ubonakala ungalungile.

aws eks describe-cluster --region REGION --name CLUSTER \
  --query 'cluster.{endpoint:endpoint,public:resourcesVpcConfig.endpointPublicAccess,private:resourcesVpcConfig.endpointPrivateAccess,cidrs:resourcesVpcConfig.publicAccessCidrs}'

I-REGION ne-CLUSTER ziyizikhala zokugcwalisa lapha. Qaphela ukuthi ifulegi langasese lifunda ini manje, ngoba iqoqo elidalwe ngokufinyelela okwangasese kakade kunikwe amandla lidinga isinyathelo sokuqala esihlukile kunalelo elingakaze libe nakho. Gcina okungenani indlela eyodwa yokuphatha egunyaziwe ivuliwe phakathi nenguquko; i-VPN encike ekutheni kufinyeleleke iqoqo elifanayo akuyona indlela yokubuyisela.

2. Nika amandla ukufinyelela okwangasese lapho indlela yenethiwekhi isikhona

Ukushisa ifulegi ingxenye elula. Ithuneli lidinga umzila oya emakhelini angasese e-endpoint, futhi iqembu lokuphepha leqoqo lidinga i-TCP 443 kusukela kumthombo i-VPN ewethula ngempela. Ukuhlanganiswa kwe-Client VPN, isango le-site-to-site kanye ne-VPC ehlanganyelwe kungase kwethule amakheli omthombo ahlukene, ngakho sebenzisa imodeli oyisebenzisile esikhundleni sobubanzi obujwayelekile bangasese.

aws eks update-cluster-config --region REGION --name CLUSTER \
  --resources-vpc-config endpointPublicAccess=true,endpointPrivateAccess=true

aws eks describe-update --region REGION --name CLUSTER --update-id UPDATE_ID

Isibuyekezo asihambisani. Buza i-id yesibuyekezo kuze kube yilapho sibika impumelelo esikhundleni sokulinda inani elithile lamasekhondi bese ucabanga. Shiya ithrafikhi yama-node nendiza yokulawula ingenzi lutho ngenkathi wenza lokhu: ukushintsha lonke iqembu lokuphepha leqoqo ngomthetho we-laptop yakho iyona ndlela indiza yedatha esebenzayo eba ingozi yesibili.

Imibhalo ye-endpoint ze-EKS ifanele ifundwe ngokuphelele kanye, ngoba ithi ukufinyelela kokwangasese kuphela kungavela ku-VPC noma kunethiwekhi exhunyiwe. Lowo musho uyisizathu sonke sokuthi lolu hambo lungenzeka, futhi uyisizathu sokuthi isinyathelo esilandelayo sikhona.

3. Fakazela ukuthi isiteshi sokusebenza sisebenzise umzila wangasese

Njengoba zombili iziphetho zivuliwe, i-kubectl get ns ephumelelayo ayifakazeli lutho mayelana nokuthi iyiphi ephendulile. Xazulula igama lomsingathi we-endpoint bese uhlola ukuthi ikheli olitholile lingelobubanzi bangasese noma bomphakathi. Uma inethiwekhi yakho exhunyiwe ingayitholi imbonakalo yangasese nge-DNS, umyalo uzophumelela nge-endpoint yomphakathi futhi uzohoxisa umzila womphakathi ngobufakazi bamanga. Le yiye indlela ejwayeleke kakhulu yokuthi lolu hambo lungahambi kahle, futhi kubukeka kufana nempumelelo.

nslookup HASH.gr7.REGION.eks.amazonaws.com
kubectl cluster-info
kubectl get ns --request-timeout=10s

Gcina igama lomsingathi nokuqinisekiswa kwesitifiketi kunjalo njengoba kunjalo. Ukushintsha nge-IP yangasese ku-kubeconfig nokweqa ukuqinisekiswa kwe-TLS akulona uhambo oluchazwe encwadini yoshintsho, futhi kuzohluleka futhi ngesikhathi i-endpoint ijika.

4. Hoxisa ukufinyelela komphakathi ngamabomu

Lapho umzila wangasese usubonisiwe futhi inqubo yokubuyisela isigunyaziwe, vala i-endpoint yomphakathi. Lolu ushintsho lwangempela hhayi umboniso, ngakho lusebenzise kwi-akhawunti nezilungiselelo ozihlosile ngempela.

aws eks update-cluster-config --region REGION --name CLUSTER \
  --resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true

Kumodi yokwangasese kuphela, igama le-DNS lomphakathi lixazululwa laya emakhelini angasese e-endpoint kusukela ngaphakathi kwe-VPC, ngakho ukuxazulula nokufinyeleleka akuseyona into eyodwa. Noma yini ebethembele ekhelini lomphakathi, kuhlanganise nama-CI runner noma i-laptop kwenye inethiwekhi, manje idinga indlela yayo yokungena.

5. Gcina inqubomgomo yenethiwekhi neyenqubomgomo yobunikazi zihlukene

Uhlu lwe-CIDR lokufinyelela komphakathi lulawula i-endpoint yomphakathi kuphela. Aluvimbeli i-endpoint yangasese, okuyiyona evinjelwa iqembu lokuphepha leqoqo kanye nenqubomgomo yenethiwekhi exhunyiwe. Uma ugcina i-endpoint yomphakathi, uhlu lwayo oluvunyelwe kufanele luhambisane nokuphuma komphakathi okusetshenziswa ngempela amaklayenti e-API nama-node akho; ikheli ledamu le-VPN akuvamile ukuba ngumthombo lowo.

Akukho kulokhu okushintsha i-IAM noma i-Kubernetes RBAC. Izilungiselelo ze-endpoint ziyisenzo sokuphatha, futhi abasebenzisi abajwayelekile akufanele bathole imvume yokukhulula umngcele ukuze bafinyelele i-API kuphela. Bhala isimo sokugcina, usuku nendlela yokubuyisela ku-runbook, bese uhlola indlela yokubuyisela kanye ngenkathi iselula.

Izihloko ezihlobene