Riba:
- Ikon fahimtar ainihin abubuwa (Pod, Deployment, Service, ConfigMap, Asirin, Sunan sararin samaniya) da falsafar fayyace na Kubernetes da kuma samar da tabbataccen bayyananniyar bayanan wucin gadi
- Ikon yin bayyanar da shirye don samarwa kuma amintacce tare da iyakokin albarkatu, binciken lafiya (bincike), ƙayyadaddun alamun hoto da kunkuntar RBAC
- Ikon tabbatar da mahallin daidai kafin aiwatarwa da kuma amfani da horo mai bushewa tare da bushe-gudu / bambance-bambance
Yana da sauƙi don gudanar da akwati ɗaya. Amma kafa tsarin da ke yada ɗaruruwan kwantena a cikin ɗimbin sabobin, yana sake farawa ta atomatik lokacin da ɗayansu ya faɗo, ya maimaita shi lokacin da nauyin ya ƙaru, kuma yana sabunta shi tare da raguwar lokaci? Wannan ƙungiyar makaɗa ce, kuma madaidaitan kayan aikin masana'antu shine Kubernetes (K8s a takaice) - dandamali wanda ke turawa ta atomatik, ma'auni, da sarrafa kwantena a cikin tari. Kubernetes yana da ƙarfi amma hadaddun: duk abin da aka ayyana ta dogayen, fayilolin YAML masu hankali - wanda ake kira bayyanannu. Wannan shine inda AI ke ba da numfashin iska; Tare da mahallin da ya dace, yana fitar da waɗannan abubuwan da sauri kuma yana warware kurakuran su masu ban mamaki.
Amma a cikin Kubernetes, bayyanar da ba daidai ba tana nufin gazawa gabaɗayan sabis ɗin, yin ƙima ba daidai ba, ko barin rauni. Alhakin ku ne fahimtar da tabbatar da kowace bayyana abubuwan da AI ke samarwa - musamman kafin kubectl ya yi amfani.
Kubernetes ainihin abubuwa
Don duba Kubernetes, ya kamata ku san manyan dabaru:
- Pod: Karamin naúrar aiki; Ya ƙunshi kwantena ɗaya ko da yawa. Gabaɗaya, ba a amfani da Pod kai tsaye, amma ana amfani da abubuwan iyaye waɗanda ke sarrafa shi.
- Ƙaddamarwa: Yana bayyana adadin kwafin aikace-aikacen zai gudana, wane hoton zai yi amfani da shi, da yadda za a sabunta shi. Idan Pod ya fadi zai sake ƙirƙira shi ta atomatik.
- Sabis: Yana ba da ƙayyadadden adireshin cibiyar sadarwa da daidaita nauyin kaya zuwa kwas ɗin; Duk da cewa kwas ɗin suna zuwa suna tafiya, adireshin shiga ba ya canzawa.
- ConfigMap da Asirin: Yana kiyaye ƙimar sanyi da bayanan sirri daban daga Pods. ConfigMap don saitunan saiti ne, Sirrin yana don ƙima masu mahimmanci.
- Wurin Suna: Yankin da ke rarraba da keɓance albarkatu cikin hikima (misali dev, prod).
- Ƙaddamarwa: Ƙa'idar ƙa'idar da ke jagorantar zirga-zirgar HTTP daga duniyar waje zuwa ayyuka a cikin tari.
Helm shine "mai sarrafa fakiti" na Kubernetes: yana ba ku damar yin samfuri mai maimaitawa (charts) kuma shigar da su tare da ƙima daban-daban a cikin mahalli daban-daban tare da umarni ɗaya. AI yana samar da duka ɗanyen bayyanar da ginshiƙi na Helm.
Me yasa abubuwa suke da yawa? Saboda ainihin falsafar Kubernetes na bayyanawa: kuna ayyana "yadda kuke son tsarin ya kasance a ƙarshe" (misali "ko da yaushe kuna da kwafi 3 na wannan aikace-aikacen da ke gudana"), yayin da Kubernetes ke ci gaba da matsar da halin yanzu kusa da wannan yanayin da ake so. Idan Pod ya mutu, yana haifar da sabo; idan kumburi ya sauka, yana motsa aikin zuwa wani kumburi. Abin da ya sa bayyanuwar ba umarnin "yi", amma "bari ya kasance kamar wannan" girke-girke. Yin la'akari da wannan bambanci yana da mahimmanci lokacin karanta abubuwan da AI ke samarwa: kowane yanki yana bayyana ɓangaren yanayin da ake so na tsarin. Yankin da ba daidai ba yana nufin Kubernetes yana aiki zuwa ga manufa mara kyau - kuma wannan burin yana da shiru, ana aiwatar da shi akai-akai.
Tukwici: A cikin Kubernetes, kayan aikin gwaji mafi mahimmanci shine kubectl apply --dry-run=server -f file.yaml: yana nuna ko uwar garken zai karɓa da abin da za a yi ba tare da yin amfani da bayyanar ba. Tabbatar da gudanar da bushe-gudu da kubectl diff kafin amfani da bayyananniyar samfur.
Mataki-mataki: Ƙirƙirar bayyanawa tare da AI
- Bayyana aikace-aikacen da buƙata. Sunan hoto, tashar jiragen ruwa, kwafi nawa, iyakokin albarkatu (CPU/memory).
- Neman Aikewa + Sabis. Yawancin lokaci ana buƙatar duka biyu tare.
- Saita daban da sirri. Saituna zuwa ConfigMap, ƙididdiga masu mahimmanci ga Asirin.
- Ƙara duban lafiya. livenessProbe (shin yana raye) da shirye-shiryenProbe (Shin yana shirye don zirga-zirga) suna da mahimmanci.
- Saita iyakacin albarkatu. Ba tare da buƙatun / iyakoki ba Pod na iya cinye gabaɗayan kumburi.
- Tabbatar da '--bushe-run' da 'diff', sannan a shafa. Na farko a cikin sunan gwaji.
Tsaro: Kubernetes takamaiman hatsarori
- Sirrin ba sirri bane - kawai tushe64. Kubernetes Asirin abu tushe64 yana ɓoye ƙima; Wannan ba boye-boye bane, ana iya warware shi cikin sauki. Don sirrin sirri na gaskiya, ana buƙatar ɓoye ɓoye da sauransu da vault na waje (Vault, mai sarrafa sirrin gajimare). Kada ku taɓa yin sirrin da ke bayyana kai tsaye ga Git (akwai mafita ga wannan kamar Sirri da aka rufe / Sirri na waje).
- Saita iyakacin albarkatu. Pod ba tare da iyaka ba zai iya rushe kullin gaba ɗaya tare da ɗigon ƙwaƙwalwa.
- Mafi ƙarancin iko (RBAC). Tare da Ikon Samun Mahimmancin Matsayi, kowane sabis/mai amfani yana da izini kawai da yake buƙata. AI wani lokacin yana ba da babban cluster-admin; rage wannan.
- Kar a yi amfani da alamar hoton 'sabon'. Ba ku san wane sigar ke gudana ba kuma ba za ku iya mirgine shi ba.
Tsanaki: share kubectl ko aikace-aikacen da ba daidai ba na iya lalata turawa kai tsaye. Tabbatar tabbatar da wane sunan sunan da kuke ciki (kubectl config current-context) kafin gudanar da umarni; Ayyukan haɗari wani bala'i ne na kowa a cikin mahallin samarwa.
Raw bayyanuwar vs. Helm tebur
ma'auni
Raw YAML bayyananne
Tsarin Helm
Shigarwa
kubectl amfani -f
shigar hula
Multimedia (dev/prod)
Kwafi-manna, kuskuren kuskure
ginshiƙi ɗaya, ƙima daban-daban.yaml
Siga/juyawa
da hannu
sauki tare da kwalkwali rollback
Hanyar koyo
ƙananan
matsakaici
yaushe
Ƙananan, muhalli guda ɗaya
Multi-kafofin watsa labarai, maimaituwar sabis
uku mini lokuta
Case 1 - sirrin sabis ɗin da ya fado. Wani Pod yana sake yin aiki akai-akai (CrashLoopBackOff). Ƙungiyar ta ba da rajistan ayyukan da bayyanawa ga AI; AI ta nuna cewa ba a taɓa ɗaukar Pod "a shirye" ba saboda shirye-shiryen yana kallon tashar jiragen ruwa mara kyau. Sun gyara tashar jiragen ruwa, sabis ɗin ya zama barga a cikin mintuna 10. Ƙirƙirar wannan dangantakar da hannu na iya ɗaukar sa'o'i.
Case 2 - rashin saita iyaka ya karya kulli. Babu iyaka a cikin Tushen; Yayyowar ƙwaƙwalwar ajiya ta kumbura Pod ɗin kuma ya faɗo gabaɗayan kumburin, yana saukar da sabis ɗin makwabta kuma. Bayan abin da ya faru, sun sanya AI ta ce "ƙara madaidaicin buƙatun CPU / ƙwaƙwalwar ajiya da iyaka ga duk abubuwan da aka tura" kuma sun sanya shi daidai. Layin da ya ɓace yana biyan awoyi na lokacin hutu.
Case 3 - babban RBAC kama. A yayin bincike, an gano bayanan ServiceAccount wanda AI ya haifar yana da alaƙa da aikin cluster-admin - ma'ana cewa sabis na iya sarrafa duka tarin. Ƙungiyar ta taƙaita izinin karanta Pods kawai a cikin sunan su. Ka'idar mafi ƙarancin gata ta rufe raunin tsaro.
Samfura huɗu masu kwafi
1) Ƙaddamarwa + Samar da Sabis:
Rubuta Bayyanar Ayyuka da Sabis don Kubernetes. Aikace-aikace: [AD], hoto: [hoto: kafaffen-version], tashar jiragen ruwa: [X], kwafi: [N]. Dokoki: - Ƙara buƙatun CPU / ƙwaƙwalwar ajiya da iyakoki.- Ƙayyade rayuwaProbe da shirye-shiryenProbe.- Karanta daidaitawa daga ConfigMap, sirri daga Abun Asiri; Kada ku sanya dabi'u a cikin bayyani, yi amfani da masu riƙewa. - KADA KA yi amfani da alamar hoto ": latest". Ba da bayanin.
2) Bayyana kuskure:
Pod na yanzu yana cikin [CrashLoopBackOff / Pending / ImagePullBackOff]. Dangane da fitowar mai zuwa da 'kubectl siffanta', jera abubuwan da za a iya haifar da su cikin tsari mai yiwuwa kuma a ba da tabbacin tabbatar da kowane. Bayyanawa: [YAML] Bayyana: [OUTPUT]
3) Tsaro/Tabbatar Mutunci:
Bincika wannan bayanin Kubernetes: shin iyakar albarkatun ta ɓace, shin yana ɓacewa bincike, akwai alamar : latest tag, akwai RBAC/izni mai faɗi fiye da kima, sirrin yana cikin bayanan? Rubuta abubuwan da aka gano cikin tsari mai mahimmanci kuma tare da gyara. Bayani: [YAML]
4) Juya zuwa Taswirar Helm:
Mayar da ɗanyen abubuwan da ke biyo baya zuwa ginshiƙi mai sake amfani da su na Helm: wadanne dabi'u ne yakamata su fita zuwa ƙimar.yaml (hoto, kwafi, tushe, muhalli)? Nuna tsarin ginshiƙi da ƙimar samfurin.yaml.Bayanai: [YAML]
Rauni mai ƙarfi / Ƙarfi mai ƙarfi
Rauni: "Rubuta Kubernetes YAML don aikace-aikacena."
Sakamako: babu-bincike, babu iyaka Ƙaddamarwa tare da : latest tag, shigar da bayanan sirri; Rashin tsaro kuma mai rauni a cikin samfur.
Ƙarfafa: "Rubuta Ƙaddamarwar Kubernetes + Sabis. Hoton myapp: 1.4.2, 3 replicas, 8080 tashar jiragen ruwa. CPU 100m-500m, ƙwaƙwalwar ajiya 128Mi-512Mi ƙara buƙatun / iyakoki. Sanya bincike na rayuwa don / healthz, bincike na shirye-shirye don / shirye. Karanta, asiri dontbed daga bayanin sirrin.
Bambanci: sigar gaggawa ta biyu tana ba da ma'auni, iyakokin albarkatu, binciken lafiya da ƙa'idar sirri; Fitowar yana kusa da samarwa da aminci.
Kuskuren gama gari
- Ba saita iyakokin albarkatu ba. Pod guda ɗaya na iya cinye duka kumburin.
- Ba ƙara gwajin lafiya ba (bincike). Kubernetes ba zai iya gano faɗuwar da ba a shirya Pod ba.
- `: latest` tag. Ba a san ko wane sigar ke gudana ba, ba za a iya jujjuya shi ba.
- Aiwatar da sirrin kai tsaye ga Git. Base64 ba boye-boye ba ne; kowa ya warware shi.
- Gudun umarni a cikin mahallin kuskure / sarari suna. Hanyar da ta fi dacewa don yin karo a cikin samfur.
- tsallake `-- bushe-gudu`/`diff`. Rashin ganin abin da zai faru kafin aiwatarwa.
A takaice
Kubernetes mai ƙarfi ne amma mai haɗaɗɗiyar ƙungiyar makaɗa wanda ke turawa ta atomatik, ma'auni, da haɓaka kwantena a cikin tari; Komai an bayyana shi ta bayyanar YAMLs, wanda Helm ya gwada. AI da sauri yana samar da Bayyanawa / Sabis na bayyanawa da sigogin Helm, yana magance kurakurai masu ban mamaki - amma dole ne ku nemi ƙayyadaddun albarkatu, duba lafiya, alamar hoto mara canzawa, kunkuntar RBAC da dokokin tsaro na sirri. --bushe-gudu, bambance-bambance da kuma duba mahallin daidai halaye ne da ke hana haɗarin haɗari.
Aikin aikace-aikace
Shin AI ta samar da bayyananniyar aikace-aikacen samfurin tare da samfurin "Tsarin Ƙarshen Sabis". Sannan: (1) A duba iyakar albarkatun, bincike, :sabbi, da sirri tare da samfurin "Security/sanity check"; (2) gudu kubectl apply --dry-run=uwar garke a kan gungu na gwaji/minikube idan zai yiwu kuma karanta fitarwa; (3) lura da abubuwa biyu mafi mahimmancin aminci/karfi da kuka samu sun ɓace.
jerin abubuwan dubawa
- [ ] Na ƙara sigar hoton, adadin kwafi, tashar jiragen ruwa da iyakokin albarkatu zuwa buƙatara.
- [ ] Na ƙara raye-raye da bincike na shirye-shirye zuwa bayyanannen.
- [ ] An gyara alamar hoton; Ban yi amfani da : latest.
- [ ] Ba a shigar da asirin a bayyane; Na yi amfani da Abun Sirri/Vult na waje.
- [ ] Na rage RBAC/izini zuwa mafi ƙarancin izini.
- [ ] Kafin nema, na tabbatar da cewa ina cikin madaidaicin mahallin da kuma --bushe-run/diff fitarwa.