Kungani i-kubectl isebenza nge-VPN kodwa i-AKS iyeke ukukhulisa

Ufaka ikheli lomphakathi le-VPN yasehhovisi ohlwini olugunyaziwe lweseva ye-AKS API, futhi i-kubectl iyasebenza. Ngemuva kweviki elilodwa ukukhuliswa kwe-node pool kuyahluleka, umsebenzi we-CI awukwazi ukufinyelela iqoqo, futhi ingosi ibonisa iphutha elingakhulumi lutho ngamabanga e-IP. Akekho oshintshe uhlu olugunyaziwe. Ukulawula okukuvule kuyisihlungi se-IP somphakathi phambi kweseva ye-API, futhi asazi ukuthi ngubani oshayayo, sazi kuphela ukuthi ucingo luvela kukuphi ikheli. I-VPN iyikheli elilodwa phakathi kwamanye ambalwa iqoqo eliwadingayo, futhi akuvamisile ukuthi iyona ephuka kuqala.

Uhlu olugunyaziwe luhambisana nekheli, hhayi umuntu

--api-server-authorized-ip-ranges yamukela amabhulokhi e-CIDR, hhayi abasebenzisi noma amaqembu. Lapho isicelo sonjiniyela sishiya iseva ye-VPN siya e-Azure, ikheli lomthombo kuseva ye-API iwukuphuma komphakathi kweseva ye-VPN. Ngakho-ke wonke umuntu kuleyo VPN wabelana ngokufakiwe okukodwa, futhi noma ubani ongaphandle kwe-VPN wenqatshwa ngisho ngaphambi kokuthi ukuqinisekiswa kwenzeke.

Lokho kusho futhi ukuthi okufakiwe kuvumela abantu abaningi kunalokho obukuhlosile. Usosayensi wezokwakha onokufinyelela kwi-VPN, ikhompyutha ephathekayo yomuntu siqu kuleyo concentrator, kanye ne-akhawunti eduniwe konke kuvela kukho okufanayo. Ukugunyazwa kweqoqo akukashintshi, ngakho-ke ukulawulwa kokufinyelela okususelwe endimeni kusaqoka ukuthi umshayi angenza ini, kodwa uhlu olugunyaziwe akusona isilawuli sobunikazi futhi akufanele lichazwe kanjalo nanini.

Into ephuka kuqala ngokuvamile akusiyo i-kubectl

Uhlu olugunyaziwe lusebenza endaweni yokugcina yomphakathi yeseva ye-API, ngakho-ke noma yini engaphandle kwamakheli okuwabhalile iyeka ukusebenza ngokushesha. Izisulu ezisobala iyihhovisi lesibili elingenayo indlela ye-VPN, umgijimi we-CI kumshini wokuhamba ophethwe, kanye nekhompyutha ephathekayo ekhohliwe ukuxhuma. Lezi kulula ukuzibona ngoba kunomuntu olindile.

Icala elingasobala kakhulu ukuzenzakalela okuqhutshwa yi-Azure noma amathuluzi akho. Eminye imisebenzi eqalwa yiplatifomu ifinyelela iseva ye-API isuka kumakheli angewona i-VPN yakho, futhi lapho enye yazo iqala ukuhluleka ngokushesha ngemuva kokuqiniswa kohlu, isikhathi siyisikhombisi. Ungacabangi ukuthi uhlu luphelele ngoba ukufinyelela okusebenzisanayo kuyasebenza; hlola ukuthi isici sidinga ini esifundeni sakho nokubhalisela kwakho ngaphambi kokuphetha ngokuthi iqoqo liphukile.

Uphawu lokuhluleka luyasiza. Uma isicelo singafinyeleli ekuqinisekisweni, yisihlungi. Uma siqinisekiswa bese sithola iphutha lemvume, isihlungi senze umsebenzi waso futhi inkinga isekulawulweni kokufinyelela okususelwe endimeni, uhlu olugunyaziwe olungayithinti nanini.

Akha lonke uhlu ngomyalo owodwa

Ipharamitha yokubuyekeza ishintsha lonke uhlu esikhundleni sokwengeza okufakiwe, ngakho-ke umyalo ophethe ikheli le-VPN kuphela ulahla ngokuthule konke okunye obekukhona. Qala ngokufunda inani lamanje, ligcine, bese uthumela inhlanganisela:

az aks show -g rg-app -n aks-prod \
  --query apiServerAccessProfile.authorizedIpRanges -o tsv

az aks update -g rg-app -n aks-prod \
  --api-server-authorized-ip-ranges 203.0.113.10/32,198.51.100.0/24

Sebenzisa i-IP yomphakathi egciniwe yeseva ye-VPN ngaphambi kokuthembela kulokhu. Ikheli eliguqukayo liyashintsha lapho uxhuma kabusha, futhi zonke izinguquko zivalela ithimba ngokuthule ngaphandle kweqoqo kuze kube umuntu ubuyekeza uhlu esuka kunethiwekhi esavunyelwe. Uma unamaphuzu amabili okuphuma e-VPN okokungafuneki, bhalisa womabili, ngoba isihlungi asinawo umqondo wendlela ekhethiwe.

Hlela ushintsho ukuze umzamo wokuqala ovunyelwe ube wukuhlolwa futhi. Memezela uhlu olusha, lusebenzise, bese uxhuma kusuka kwi-VPN ngokushesha; ukwenza ngokulandelana okuphambene kushiya isikhathi lapho kungekho muntu ongafinyelela iseva ye-API ukulungisa iphutha lokuthayipha kubhulokhi le-CIDR.

Okungakaze kuhlanganiswe uhlu olugunyaziwe

Akwenzi iseva ye-API ibe yeyimfihlo. Iqoqo eliyimfihlo lisebenzisa indawo yokugcina eyimfihlo ne-DNS eyimfihlo, futhi uhlu lwamabanga agunyaziwe akusona isilawuli esithatha indawo yalokho. Futhi akushintshi okungenziwa umshayi ovunyelwe, ngakho-ke i-kubeconfig yomphathi eputshukile isasebenza kusuka kunoma yikuphi ikheli elivunyelwe. Thatha ubufakazi njengomngcele wokuphepha futhi uhlu njengolunye usizo lwenethiwekhi.

Akuhlangene nokuthwala umsebenzi. Ama-Pods nama-Services ayaqhubeka esebenza ngohlu luvuliwe, futhi ukufinyelela uhlelo lokusebenza nge-VPN kuyinkinga ehlukile: i-Service ene-IP yeqoqo kuphela isadinga isilinganisi somthwalo sangaphakathi, i-ingress noma i-port-forward ngaphambi kokuthi ikhompyutha ephathekayo iyivule. Ukuhlanganisa lezi zakhiwo ezimbili kukhiqiza ithikithi loshintsho elithi linciphisa abathuthukisi kodwa empeleni alinciphisi lutho ezinhlelweni zokusebenza.

Qinisekisa kuzinhlangothi zombili, bese wenza umsebenzi owodwa wangempela

Hlola ngeklayenti elisha kwi-VPN nangeklayenti elingaphandle kwayo. Umzamo wangaphandle kufanele wenqatshwe kuseva ye-API, hhayi ekuxazululweni kwamagama; uma igama lingaxazululeki, uhlola i-DNS futhi awufundanga lutho ngesihlungi. Bese wenza umsebenzi ongesiwo ucingo lwe-kubectl olusebenzisanayo, njengokukhulisa i-node pool noma ukuhlola ukuthuthukiswa, futhi qinisekisa ukuthi uyaphela esikhundleni sokucabanga ukuthi uzophelela.

Gcina inani lohlu lwangaphambilini elibhaliwe eduze koshintsho, futhi ufunde kabusha inani elisebenzayo ngemuva kokubuyekeza esikhundleni sokuthemba umyalo owathayiphiwe. idokhumenti ye-AKS mayelana namabanga e-IP agunyaziwe ibala amapharamitha asekelwayo kanye nezidingo zeplatifomu ezisohlelweni olufanayo, futhi lena ingxenye izincazelo eziningi zamathikithi ezishiya ngaphandle.