Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Securing Clusters with Kubernetes Extensibility

Securing Clusters with Kubernetes Extensibility

@ Kubernetes & Cloud Native Meetup
https://wantedly.connpass.com/event/105371/

Aya (Igarashi) Ozawa

October 25, 2018
Tweet

More Decks by Aya (Igarashi) Ozawa

Other Decks in Technology

Transcript

  1. 4FDVSJOH$MVTUFSTXJUI
    ,VCFSOFUFT&YUFOTJCJMJUZ
    "ZB0[BXB !MBEJDMF
    5BLBTIJ,VTVNJ
    ,VCFSOFUFT$MPVE/BUJWF.FFUVQ

    View Slide



  2. "CPVUVT
    "ZB0[BXB!MBEJDMF
    4PGUXBSF&OHJOFFS
    BU;-BC$PSQ
    5BLBTIJ,VTVNJ
    4PGUXBSF&OHJOFFS
    BU;-BC$PSQ

    View Slide



  3. "ZB
    5BLBTIJ
    5PEBZˏTBHFOEB
    ,VCFSOFUFTBTB4FSWJDFGPS:BIPP+BQBO
    )PXTIPVMEXFDPOUSPMBDDFTTUPUIF,VCFSOFUFT"1*TFSWFS
    8IBUJT+85BOE3#"$ BOE)PXUPVTFJU
    3#"$JT/05FOPVHI
    %FNPOTUSBUJPOPGQSJWJMFHFFTDBMBUJPO
    4FDVSJOH,VCFSOFUFTXJUI7BMJEBUJOH"ENJTTJPO8FCIPPL

    View Slide

  4. ;-BC,VCFSOFUFTBTB4FSWJDF
    4
    .BTUFS
    ,VCFSOFUFT$MVTUFS
    6TFS
    ,VCFSOFUFT$MVTUFS
    6TFS
    ,VCFSOFUFT$MVTUFS
    6TFS
    ,VCFSOFUFT$MVTUFS
    Ӝ4FMGIFBMJOHUIFXIPMF
    DMVTUFS
    Ӝ4DBMJOHDMVTUFSFBTJMZ
    Ӝ;FSPEPXOUJNFVQHSBEF
    DMVTUFSWFSTJPO
    .BKPS'FBUVSFT
    .BTUFS$MVTUFSNBOBHFTNVMUJQMF6TFS
    ,VCFSOFUFT$MVTUFSBOEJUTFMGVTJOH$3%

    View Slide

  5. )PXTIPVMEXFDPOUSPMBDDFTT
    5
    .BTUFS
    ,VCFSOFUFT$MVTUFS
    6TFS
    ,VCFSOFUFT$MVTUFS
    6TFS
    ,VCFSOFUFT$MVTUFS
    6TFS
    ,VCFSOFUFT$MVTUFS

    "QQ
    %FWFMPQFS
    "QQ
    %FWFMPQFS
    "QQ
    0QFSBUPS
    LT
    0QFSBUPS
    "UUBDLFS
    ✖%&/:

    View Slide

  6. "DDFTT$POUSPM

    View Slide

  7. TUFQT"DDFTT$POUSPM
    7
    "VUIFOUJDBUJPO
    "VUI/

    "VUIPSJ[BUJPO
    "VUI;

    "ENJTTJPO
    $POUSPM
    "1*4FSWFS
    "DDFTT

    View Slide

  8. "MMPX
    8IBUIBQQFOTJOFBDITUFQ
    8
    "DDFTT
    8IPBSFZPV
    ✔$SFBUF9
    ✖%FMFUF:

    8IBUDBOZPVEP
    %FOZ %FOZ %FOZ
    7BMJEBUJOH
    .PEJGZJOH
    ٥٥٥
    "MMPX "MMPX
    "VUI/ "VUI; "ENJTTJPO$POUSPM

    View Slide

  9. "DDFTT$POUSPMNPEVMFT
    9
    9DMJFOUDFSU
    1BTTXPSE
    +85
    1MBOF5PLFO
    "VUI/ "VUI; "ENJTTJPO$POUSPM
    "#"$
    3#"$
    8FCIPPL
    /PEF3PMF
    4FSWJDF"DDPVOU
    3FTPVSDF2VPUB
    1SJPSJUZ
    7BMJEBUJOH
    "ENJTTJPO
    8FCIPPL
    FUD
    FUD FUD

    View Slide

  10. 8IZEPXFVTF+85
    10
    9DMJFOUDFSU
    1BTTXPSE
    +85
    1MBOF5PLFO
    "VUI/ "VUI; "ENJTTJPO$POUSPM
    "#"$
    3#"$
    8FCIPPL
    /PEF3PMF
    4FSWJDF"DDPVOU
    3FTPVSDF2VPUB
    1SJPSJUZ
    7BMJEBUJOH
    "ENJTTJPO
    FUD
    FUD FUD
    Ӝ %ZOBNJDVTFSBVUIFOUJDBUJPO
    Ӝ 1BTTXPSEBOE1MBOF5PLFONPEVMFT
    SFRVJSFUPTFU"VUI/TFUUJOHXIFOCPPUJOH
    "1*TFSWFS
    Ӝ 4FWFSBM0*%$*E1TTVQQPSUUIJTNPEVMF

    View Slide

  11. 8IZEPXFVTF3#"$
    11
    9DMJFOUDFSU
    1BTTXPSE
    +85
    1MBOF5PLFO
    "VUI/ "VUI; "ENJTTJPO$POUSPM
    "#"$
    3#"$
    8FCIPPL
    /PEF3PMF
    4FSWJDF"DDPVOU
    3FTPVSDF2VPUB
    1SJPSJUZ
    7BMJEBUJOH
    "ENJTTJPO
    FUD
    FUD FUD
    Ӝ %ZOBNJDBDDFTTBVUIPSJ[BUJPO
    Ӝ /PBEEJUJPOBMEFWFMPQNFOU
    Ӝ 3#"$TFUUJOHTDBOCF
    DPOSNFECZLVCFDUMMJLFBOZ
    PUIFSSFTPVSDFT
    /05&*GZPVBMSFBEZIBWF"VUI;TZTUFN
    8FCIPPLJTBHPPEDIPJDF

    View Slide

  12. "VUI/+85 4FSWJDF"DDPVOU0*%$

    View Slide

  13. 5XPDBUFHPSJFTPG6TFST
    13
    "1*4FSWFS
    "DDFTT
    6TFSNBOBHFECZLT
    FH#PU
    /PSNBM6TFS
    FH"MJDF

    View Slide

  14. #PUI4"BOE0*%$VTJOH+85
    14
    "1*4FSWFS
    6TFSNBOBHFECZLT
    FH#PU
    /PSNBM6TFS
    FH"MJDF
    +85
    +85
    (FU+85GSPNB0*%$*E1
    (FU+85GSPN
    B4FSWJDF"DDPVOU

    View Slide

  15. 4"4FDSFUIBT+85
    15
    $SFBUFBCPU4"
    JOUIFTZTUFN/4
    %FUFDUUIF
    DSFBUJPOFWFOU
    $SFBUFBCPU4"4FDSFU
    XJUI+85JOUIFTZTUFN/4
    5PLFO
    $POUSPMMFS
    4FSWJDF
    "DDPVOU
    4FDSFU
    +85

    View Slide

  16. 4"$POUSPMMFSDSFBUFTEFGBVMU4"GPSBMM/4
    16
    $SFBUFTZTUFN
    /BNFTQBDF
    $SFBUFEFGBVMU
    4"JOTZTUFN/4
    4"
    $POUSPMMFS
    4FSWJDF
    "DDPVOU
    /BNF
    TQBDF
    %FUFDUUIF
    DSFBUJPOFWFOU

    View Slide

  17. 7PMVNF
    "MM1PETBTTPDJBUF4FSWJDF"DDPVOU
    17
    4""ENJTTJPO
    $POUSPMMFS
    .PVOU
    $SFBUF1PE
    4FUEFGBVMU/"*GUIF
    1PEEPFTOPUIBWF4"
    4FDSFU
    +85
    1PE
    4FU*NBHF1VMM4FDSFUTPG4"*G
    UIF1PEEPFTOPUIBWFJU
    4FU4FDSFUPG4"UPUIF1PEWPMVNF
    .PEJGZ1PE

    View Slide

  18. %FY0QFO*%$POOFDU*%1SPWJEFS
    18
    %FY
    0*%$*E1

    3FEJSFDU
    +85
    6QTUSFBN*E1
    FH'BDFCPPL
    $MJFOU
    IUUQTHJUIVCDPNEFYJEQEFY
    0*%$JTBTJNQMFJEFOUJUZMBZFSPO
    UPQPGUIF0"VUIQSPUPDPM

    View Slide

  19. +40/8FC5PLFODPOTJTUTPGQBSUT
    19
    )FBEFS
    1BZMPBE
    4JHOBUVSF
    IUUQTKXUJP

    View Slide

  20. 7FSJGZJOH+85PG0*%$
    20
    "1*4FSWFS
    LVCFDUM
    +85
    $BMM"1*XJUI+85
    *T+85TJHOBUVSFWBMJE
    )BTUIF+85FYQJSFE MBUFYQ

    6TFS"VUIPSJ[FE
    3FUVSOSFTVMU
    "VUIPSJ[BUJPO#FBSFS+85
    ⚠/05&
    4"ˏT+85EPFTOPUIBWFFYQJSBUJPOEBUF
    BOEJUJTOPUSPUBUFE

    View Slide

  21. "VUI;3#"$

    View Slide

  22. 3PMF#BTF"DDFTT$POUSPM
    22
    "DDFTT
    %FOZ
    "MMPX
    7JFXFS3PMF
    4VCKFDU 3PMF
    Y $POUSPM
    #PC
    7JFXFSDBOHFU
    SFTPVSDFT
    IBTSVMFTUIBU
    #JOEJOH
    NBOBHFS(SPVQ
    BOE
    7JFXFS3PMF
    *G#PCJTB
    NBOBHFS
    *G#PCJTOPU
    BNBOBHFS
    "DDFTT6TFSJT
    #PC

    View Slide

  23. 3PMF
    3PMF
    #JOEJOHT
    3PMF
    3#"$JO,VCFSOFUFT
    23
    Y $POUSPM
    Ӝ4"
    Ӝ6TFS
    Ӝ(SPVQ
    /PSNBM6TFS
    ,T6TFS
    "VUIFOUJDBUFE6TFS
    %FOZ
    "MMPX
    ,VCFSOFUFT"1*0CKFDU
    subjects:
    - kind: Group
    name: manager
    roleRef:
    kind: Role
    name: viewer
    4VCKFDU
    "DDFTT

    View Slide

  24. 3PMF
    3PMF
    #JOEJOHT
    3PMF
    3#"$JO,VCFSOFUFT
    24
    Y $POUSPM
    %FOZ
    "MMPX
    ,VCFSOFUFT"1*0CKFDU
    metadata:
    name: viewer
    rules:
    - apiGroups: [""]
    resources: ["pods","pods/exec"]
    verbs: ["get","list","watch"]
    - nonResourceURLs: ["/version","/healthz"]
    verbs: [""]
    4VCKFDU
    Ӝ4"
    Ӝ6TFS
    Ӝ(SPVQ
    /PSNBM6TFS
    ,T6TFS
    "VUIFOUJDBUFE6TFS
    "DDFTT

    View Slide

  25. 8IJDI3#"$SFTPVSDFTTIPVMEZPVVTF
    25
    #JOEJOHT $MVTUFS3PMF#JOEJOHT
    3PMF
    (SBOUQFSNJTTJPOTUPSFTPVSDFTJOUIF
    TQFDJDOBNFTQBDF
    $MVTUFS
    3PMF
    6TF$MVTUFS3PMFGSPNNVMUJQMF
    OBNFTQBDFT
    ˖ (SBOUBDDFTTUPOPO"1*SFTPVSDFT
    ˖ (SBOUBDDFTTQFSNJTTJPOUPSFTPVSDFTPG
    BMMOBNFTQBDFT
    $MVTUFS999EPFTOPUCFMPOH
    UPUIF/BNFTQBDFT

    View Slide

  26. #VU3#"$JT/05FOPVHI

    View Slide

  27. 1SFWFOUQSJWJMFHFFTDBMBUJPO
    Ӝ 
    Ӝ 
    DBOPCUBJOIPTUTSPPUCZNPVOUJOH%PDLFSTPDLFU
    Ӝ 
    DBOBDDFTTIPTUTMFTZTUFNWJBQSPD<1*%>SPPU
    Ӝ 


    ☠5IFTFBSFFTFOUJBMMZFRVJWBMFOUUPSPPUPOUIFIPTU

    View Slide

  28. SPOILER ALERT!
    :PVDBOVTF
    1PE4FDVSJUZ1PMJDZ
    PS
    7BMJEBUJOH"ENJTTJPO8FCIPPL
    UPQSFWFOUJU

    View Slide

  29. %FNP1SJWJMFHFFTDBMBUJPOCZIPTU1BUI
    29
    IUUQTBTDJJOFNBPSHBG'+X+E4F#S)S%V.

    View Slide

  30. )PXUPQSFWFOUQSJWJMFHFFTDBMBUJPO
    Ӝ 1PE4FDVSJUZ1PMJDZ
    %FOFBOENBOBHFTFDVSJUZQPMJDZXJUI3#"$
    "EEUPUPVTFJU
    OFFEUPSFTUBSULVCFBQJTFSWFS
    $BOOPUDSFBUFBOZQPETXJUIPVUQPMJDZ OPEFGBVMUQSPWJEFE

    Ӝ 7BMJEBUJOH"ENJTTJPO8FCIPPL
    *NQMFNFOUZPVSPXOQPMJDZ
    DBOCFEZOBNJDBMMZDPOHVSFECZ
    /POFFEUPSFTUBSULVCFBQJTFSWFS


    View Slide

  31. 7BMJEBUJOH"ENJTTJPO8FCIPPL


    "1*4FSWFS
    :PVS8FCIPPL
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    *TUIFPCKFDUBMMPXFE ZFTOP

    View Slide

  32. 4VNNBSZ
    Ӝ $VTUPN3FTPVSDF%FOJUJPO
    UPDSFBUF,VCFSOFUFTBTB4FSWJDFJUTFMG
    Ӝ 0QFO*%$POOFDU"VUIPSJ[BUJPO8FCIPPL
    UPJOUFHSBUFPVSBVUIOBVUI[TZTUFN
    Ӝ 7BMJEBUJOH"ENJTTJPO8FCIPPL
    UPQSFWFOUQSJWJMFHFFTDBMBUJPOBOEJNQMFNFOUDVTUPNQPMJDZ


    ,VCFSOFUFTFYUFOTJCJMJUZBSFBMTPVTFGVMUPTFDVSFDMVTUFST

    View Slide

  33. 8FBSFIJSJOH
    CJUMZ[MBCDBSFFST

    View Slide