Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Securing Clusters with Kubernetes Extensibility

71d7f6cdf5b1934a1b69f0624f5a7523?s=47 Aya (Igarashi) Ozawa
October 25, 2018
Technology
5
680

Securing Clusters with Kubernetes Extensibility

@ Kubernetes & Cloud Native Meetup
https://wantedly.connpass.com/event/105371/

71d7f6cdf5b1934a1b69f0624f5a7523?s=128

Aya (Igarashi) Ozawa

October 25, 2018
Tweet

More Decks by Aya (Igarashi) Ozawa

See All by Aya (Igarashi) Ozawa
71d7f6cdf5b1934a1b69f0624f5a7523?s=48 ladicle
0
120
71d7f6cdf5b1934a1b69f0624f5a7523?s=48 ladicle
0
64
71d7f6cdf5b1934a1b69f0624f5a7523?s=48 ladicle
17
6.4k
71d7f6cdf5b1934a1b69f0624f5a7523?s=48 ladicle
3
4.1k
71d7f6cdf5b1934a1b69f0624f5a7523?s=48 ladicle
5
2.4k
71d7f6cdf5b1934a1b69f0624f5a7523?s=48 ladicle
1
330
71d7f6cdf5b1934a1b69f0624f5a7523?s=48 ladicle
4
1.7k
71d7f6cdf5b1934a1b69f0624f5a7523?s=48 ladicle
31
9.3k
71d7f6cdf5b1934a1b69f0624f5a7523?s=48 ladicle
2
2.4k

Other Decks in Technology

See All in Technology
11cbdce6fef8ae507d51b96dca4a0ec5?s=48 sksat
0
110
03e869e0b971213c12889635e29e0aae?s=48 443n0511
0
120
Fecdd3417cd7375cc0bd0352d72db27e?s=48 1ftseabass
PRO
0
200
82ed567f8497acfed7f7b464225dd536?s=48 wakamsha
0
310
03858bb7b6debdd69ea0531b0f57c612?s=48 con_mame
5
3.7k
828bebe205894e1aa5f75a1fc6935a9c?s=48 ganchan11
0
160
6b8e2101579190ad96e747e01c279898?s=48 pauloxnet
2
110
Cd891a89dfec6ca7bd278b5f5bd87c90?s=48 tzkoba
11
3k
657ac87f75c375156e5f79cdadebed4d?s=48 yasuoyasuo
0
120
F507086e15832a4344df6b10cdc5b179?s=48 localyouser
0
260
028088964f255d677d471558da865b72?s=48 satoshin
1
150
4b2f3a64637b51e81813accbe8a98083?s=48 miura55
0
150

Featured

See All Featured
F68cb25ae3e5c2106997454b13b7737d?s=48 brad_frost
158
6.6k
A16eb159db895e3b01d3dc95767ad595?s=48 jonyablonski
30
1.5k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
780
240k
433acaea1012b25d97ae66da9b998dad?s=48 malarkey
193
8.8k
5f83ef806155b403c3393160ce51f955?s=48 jlugia
217
16k
A415db3ac9e9668acbc1fb36eead84ac?s=48 mthomps
40
2.4k
9128d500301ae51524e887bb680f471d?s=48 caitiem20
312
18k
027d1ebf66cc039a0bd3b55eeadbe75d?s=48 sachag
446
36k
1f74b13f1e5c6c69cb5d7fbaabb1e2cb?s=48 sferik
612
55k
C4de88ea47538e4594750e3861a341c8?s=48 brettharned
93
3.2k
11c84dff30266b907714802088852677?s=48 jasonvnalue
83
8.3k
9fa239b3154a0169d99ab7bf1422dd12?s=48 marcelosomers
221
15k

Transcript

  1. 4FDVSJOH$MVTUFSTXJUI ,VCFSOFUFT&YUFOTJCJMJUZ "ZB0[BXB !MBEJDMF 5BLBTIJ,VTVNJ ,VCFSOFUFT$MPVE/BUJWF.FFUVQ

  2.   "CPVUVT "ZB0[BXB!MBEJDMF 4PGUXBSF&OHJOFFS BU;-BC$PSQ 5BLBTIJ,VTVNJ 4PGUXBSF&OHJOFFS BU;-BC$PSQ

  3.   "ZB 5BLBTIJ 5PEBZˏTBHFOEB ,VCFSOFUFTBTB4FSWJDFGPS:BIPP+BQBO )PXTIPVMEXFDPOUSPMBDDFTTUPUIF,VCFSOFUFT"1*TFSWFS  8IBUJT+85BOE3#"$ BOE)PXUPVTFJU

    3#"$JT/05FOPVHI %FNPOTUSBUJPOPGQSJWJMFHFFTDBMBUJPO 4FDVSJOH,VCFSOFUFTXJUI7BMJEBUJOH"ENJTTJPO8FCIPPL

  4. ;-BC,VCFSOFUFTBTB4FSWJDF 4 .BTUFS ,VCFSOFUFT$MVTUFS 6TFS ,VCFSOFUFT$MVTUFS 6TFS ,VCFSOFUFT$MVTUFS 6TFS ,VCFSOFUFT$MVTUFS

    Ӝ4FMGIFBMJOHUIFXIPMF DMVTUFS Ӝ4DBMJOHDMVTUFSFBTJMZ Ӝ;FSPEPXOUJNFVQHSBEF DMVTUFSWFSTJPO .BKPS'FBUVSFT .BTUFS$MVTUFSNBOBHFTNVMUJQMF6TFS ,VCFSOFUFT$MVTUFSBOEJUTFMGVTJOH$3%

  5. )PXTIPVMEXFDPOUSPMBDDFTT 5 .BTUFS ,VCFSOFUFT$MVTUFS 6TFS ,VCFSOFUFT$MVTUFS 6TFS ,VCFSOFUFT$MVTUFS 6TFS ,VCFSOFUFT$MVTUFS

    "QQ %FWFMPQFS "QQ %FWFMPQFS "QQ 0QFSBUPS LT 0QFSBUPS "UUBDLFS ✖%&/:

  6. "DDFTT$POUSPM

  7. TUFQT"DDFTT$POUSPM 7 "VUIFOUJDBUJPO "VUI/ "VUIPSJ[BUJPO "VUI; "ENJTTJPO $POUSPM "1*4FSWFS "DDFTT

  8. "MMPX 8IBUIBQQFOTJOFBDITUFQ 8 "DDFTT 8IPBSFZPV ✔$SFBUF9 ✖%FMFUF:  8IBUDBOZPVEP %FOZ

    %FOZ %FOZ 7BMJEBUJOH .PEJGZJOH ٥٥٥ "MMPX "MMPX "VUI/ "VUI; "ENJTTJPO$POUSPM

  9. "DDFTT$POUSPMNPEVMFT 9 9DMJFOUDFSU 1BTTXPSE +85 1MBOF5PLFO "VUI/ "VUI; "ENJTTJPO$POUSPM "#"$

    3#"$ 8FCIPPL /PEF3PMF 4FSWJDF"DDPVOU 3FTPVSDF2VPUB 1SJPSJUZ 7BMJEBUJOH "ENJTTJPO 8FCIPPL FUD FUD FUD

  10. 8IZEPXFVTF+85 10 9DMJFOUDFSU 1BTTXPSE +85 1MBOF5PLFO "VUI/ "VUI; "ENJTTJPO$POUSPM "#"$

    3#"$ 8FCIPPL /PEF3PMF 4FSWJDF"DDPVOU 3FTPVSDF2VPUB 1SJPSJUZ 7BMJEBUJOH "ENJTTJPO FUD FUD FUD Ӝ %ZOBNJDVTFSBVUIFOUJDBUJPO Ӝ 1BTTXPSEBOE1MBOF5PLFONPEVMFT SFRVJSFUPTFU"VUI/TFUUJOHXIFOCPPUJOH "1*TFSWFS Ӝ 4FWFSBM0*%$*E1TTVQQPSUUIJTNPEVMF

  11. 8IZEPXFVTF3#"$ 11 9DMJFOUDFSU 1BTTXPSE +85 1MBOF5PLFO "VUI/ "VUI; "ENJTTJPO$POUSPM "#"$

    3#"$ 8FCIPPL /PEF3PMF 4FSWJDF"DDPVOU 3FTPVSDF2VPUB 1SJPSJUZ 7BMJEBUJOH "ENJTTJPO FUD FUD FUD Ӝ %ZOBNJDBDDFTTBVUIPSJ[BUJPO Ӝ /PBEEJUJPOBMEFWFMPQNFOU Ӝ 3#"$TFUUJOHTDBOCF DPOSNFECZLVCFDUMMJLFBOZ PUIFSSFTPVSDFT /05&*GZPVBMSFBEZIBWF"VUI;TZTUFN  8FCIPPLJTBHPPEDIPJDF

  12. "VUI/+85 4FSWJDF"DDPVOU0*%$

  13. 5XPDBUFHPSJFTPG6TFST 13 "1*4FSWFS "DDFTT 6TFSNBOBHFECZLT FH#PU /PSNBM6TFS FH"MJDF

  14. #PUI4"BOE0*%$VTJOH+85 14 "1*4FSWFS 6TFSNBOBHFECZLT FH#PU /PSNBM6TFS FH"MJDF +85 +85 (FU+85GSPNB0*%$*E1

    (FU+85GSPN B4FSWJDF"DDPVOU

  15. 4"4FDSFUIBT+85 15 $SFBUFBCPU4" JOUIFTZTUFN/4 %FUFDUUIF DSFBUJPOFWFOU $SFBUFBCPU4"4FDSFU XJUI+85JOUIFTZTUFN/4 5PLFO $POUSPMMFS

    4FSWJDF "DDPVOU 4FDSFU +85

  16. 4"$POUSPMMFSDSFBUFTEFGBVMU4"GPSBMM/4 16 $SFBUFTZTUFN /BNFTQBDF $SFBUFEFGBVMU 4"JOTZTUFN/4 4" $POUSPMMFS 4FSWJDF "DDPVOU

    /BNF TQBDF %FUFDUUIF DSFBUJPOFWFOU

  17. 7PMVNF "MM1PETBTTPDJBUF4FSWJDF"DDPVOU 17 4""ENJTTJPO $POUSPMMFS .PVOU $SFBUF1PE 4FUEFGBVMU/"*GUIF 1PEEPFTOPUIBWF4" 4FDSFU

    +85 1PE 4FU*NBHF1VMM4FDSFUTPG4"*G UIF1PEEPFTOPUIBWFJU 4FU4FDSFUPG4"UPUIF1PEWPMVNF .PEJGZ1PE

  18. %FY0QFO*%$POOFDU*%1SPWJEFS 18 %FY 0*%$*E1 3FEJSFDU +85 6QTUSFBN*E1 FH'BDFCPPL $MJFOU IUUQTHJUIVCDPNEFYJEQEFY

    0*%$JTBTJNQMFJEFOUJUZMBZFSPO UPQPGUIF0"VUIQSPUPDPM

  19. +40/8FC5PLFODPOTJTUTPGQBSUT 19 )FBEFS 1BZMPBE 4JHOBUVSF IUUQTKXUJP

  20. 7FSJGZJOH+85PG0*%$ 20 "1*4FSWFS LVCFDUM +85 $BMM"1*XJUI+85 *T+85TJHOBUVSFWBMJE  )BTUIF+85FYQJSFE 

    MBU FYQ  6TFS"VUIPSJ[FE 3FUVSOSFTVMU "VUIPSJ[BUJPO#FBSFS+85 ⚠/05& 4"ˏT+85EPFTOPUIBWFFYQJSBUJPOEBUF  BOEJUJTOPUSPUBUFE

  21. "VUI;3#"$

  22. 3PMF#BTF"DDFTT$POUSPM 22 "DDFTT %FOZ "MMPX 7JFXFS3PMF 4VCKFDU 3PMF Y $POUSPM

    #PC 7JFXFSDBOHFU SFTPVSDFT IBTSVMFTUIBU #JOEJOH NBOBHFS(SPVQ BOE 7JFXFS3PMF *G#PCJTB NBOBHFS *G#PCJTOPU BNBOBHFS "DDFTT6TFSJT #PC

  23. 3PMF 3PMF #JOEJOHT 3PMF 3#"$JO,VCFSOFUFT 23 Y $POUSPM Ӝ4" Ӝ6TFS

    Ӝ(SPVQ /PSNBM6TFS ,T6TFS "VUIFOUJDBUFE6TFS %FOZ "MMPX ,VCFSOFUFT"1*0CKFDU subjects: - kind: Group name: manager roleRef: kind: Role name: viewer 4VCKFDU "DDFTT

  24. 3PMF 3PMF #JOEJOHT 3PMF 3#"$JO,VCFSOFUFT 24 Y $POUSPM %FOZ "MMPX

    ,VCFSOFUFT"1*0CKFDU metadata: name: viewer rules: - apiGroups: [""] resources: ["pods","pods/exec"] verbs: ["get","list","watch"] - nonResourceURLs: ["/version","/healthz"] verbs: [""] 4VCKFDU Ӝ4" Ӝ6TFS Ӝ(SPVQ /PSNBM6TFS ,T6TFS "VUIFOUJDBUFE6TFS "DDFTT

  25. 8IJDI3#"$SFTPVSDFTTIPVMEZPVVTF 25 #JOEJOHT $MVTUFS3PMF#JOEJOHT 3PMF (SBOUQFSNJTTJPOTUPSFTPVSDFTJOUIF TQFDJDOBNFTQBDF $MVTUFS 3PMF 6TF$MVTUFS3PMFGSPNNVMUJQMF

    OBNFTQBDFT ˖ (SBOUBDDFTTUPOPO"1*SFTPVSDFT ˖ (SBOUBDDFTTQFSNJTTJPOUPSFTPVSDFTPG BMMOBNFTQBDFT $MVTUFS999EPFTOPUCFMPOH UPUIF/BNFTQBDFT

  26. #VU3#"$JT/05FOPVHI

  27. 1SFWFOUQSJWJMFHFFTDBMBUJPO Ӝ  Ӝ  DBOPCUBJOIPTUTSPPUCZNPVOUJOH%PDLFSTPDLFU Ӝ  DBOBDDFTTIPTUTMFTZTUFNWJBQSPD<1*%>SPPU Ӝ

       ☠5IFTFBSFFTFOUJBMMZFRVJWBMFOUUPSPPUPOUIFIPTU

  28. SPOILER ALERT! :PVDBOVTF 1PE4FDVSJUZ1PMJDZ PS 7BMJEBUJOH"ENJTTJPO8FCIPPL UPQSFWFOUJU

  29. %FNP1SJWJMFHFFTDBMBUJPOCZIPTU1BUI 29 IUUQTBTDJJOFNBPSHBG'+X+E4F#S)S%V.

  30. )PXUPQSFWFOUQSJWJMFHFFTDBMBUJPO Ӝ 1PE4FDVSJUZ1PMJDZ %FOFBOENBOBHFTFDVSJUZQPMJDZXJUI3#"$ "EEUPUPVTFJU OFFEUPSFTUBSULVCFBQJTFSWFS $BOOPUDSFBUFBOZQPETXJUIPVUQPMJDZ OPEFGBVMUQSPWJEFE  Ӝ

    7BMJEBUJOH"ENJTTJPO8FCIPPL *NQMFNFOUZPVSPXOQPMJDZ DBOCFEZOBNJDBMMZDPOHVSFECZ /POFFEUPSFTUBSULVCFBQJTFSWFS  

  31. 7BMJEBUJOH"ENJTTJPO8FCIPPL   "1*4FSWFS :PVS8FCIPPL     

              *TUIFPCKFDUBMMPXFE ZFTOP

  32. 4VNNBSZ Ӝ $VTUPN3FTPVSDF%FOJUJPO UPDSFBUF,VCFSOFUFTBTB4FSWJDFJUTFMG Ӝ 0QFO*%$POOFDU"VUIPSJ[BUJPO8FCIPPL UPJOUFHSBUFPVSBVUIOBVUI[TZTUFN Ӝ 7BMJEBUJOH"ENJTTJPO8FCIPPL UPQSFWFOUQSJWJMFHFFTDBMBUJPOBOEJNQMFNFOUDVTUPNQPMJDZ

      ,VCFSOFUFTFYUFOTJCJMJUZBSFBMTPVTFGVMUPTFDVSFDMVTUFST

  33. 8FBSFIJSJOH CJUMZ[MBCDBSFFST