IAM Roles for Service Accounts 〜やさしいIRSA入門〜

Kubernetes Novice Tokyo #26
https://k8s-novice-jp.connpass.com/event/286692/

Transcript

1. ͋ͳͨͷ&,4Ϋϥελʔɺ
   ৮ͬͪΌμϝͳ"84Ϧιʔε΁ͷ
   ΞΫηε੍ޚͪΌΜͱͰ͖ͯ·͔͢ʁ
   ʙ ΍͍͞͠*34"ೖ໳ ʙ
   ΈͷΔΜ !NJOPSVO
   

   View Slide

2. XIPBNJ
   御⽥ 稔 !NJOPSVO
   ,%%*גࣜձࣾ ˍ ,%%*ΞδϟΠϧ։ൃηϯλʔגࣜձࣾʢ,"(ʣ
   ࡢ೥౓·Ͱ৘γεͰࢮ͵΄Ͳ&,4Ϋϥελʔ؅ཧͯ͠·ͨ͠ɻ
   ࠷ۙ͸"*धཁͰ"[VSFͰͷ։ൃ΋૿͖͑ͯͯ·͢ɻ
   +"846(43&ࢧ෦ӡӦ +"84%":4࣮ߦҕһ
   • "84$PNNVOJUZ#VJMEFS
   • ,%%*$MPVE4".63"*
   • ,%%*$MPVE"NCBTTBEPST
   

   View Slide

3. "84ϢʔβʔͷΈͳ͞Μɺ&,4͸޷͖Ͱ͔͢ʁ
   

   View Slide

4. &,4࢖ͬͯΔͱɺ1PE͔Βଞͷ"84Ϧιʔεʹ
   ΞΫηεͨ͘͠ͳΔ͜ͱ͋Γ·͢ΑͶʁ
   &,4Ϋϥελʔ
   1PE ଞͷ"84Ϧιʔε
   σʔλऔಘͳͲ
   

   View Slide

5. &,4Ϋϥελʔ
   1PE ଞͷ"84Ϧιʔε
   σʔλऔಘͳͲ
   ͋Εɺ͜͜ͷݖݶऔಘͲ͏͠Α͏ʜʁ 🤔
   

   View Slide

6. &,4Ϋϥελʔ
   1PE ଞͷ"84Ϧιʔε
   σʔλऔಘͳͲ
   ͋Εɺ͜͜ͷݖݶऔಘͲ͏͠Α͏ʜʁ 🤔
   "84Ϧιʔεͷݖݶऔಘͱ
   ͍͑͹ *".ϩʔϧʂ
   

   View Slide

7. *".ϩʔϧΛී௨ʹ෇͚ΒΕΔͷ͸
   "84Ϧιʔε ʹ &,4ϊʔυʢ&$΍'BSHBUFʣ
   &,4Ϋϥελʔ
   1PE ଞͷ"84Ϧιʔε
   σʔλऔಘͳͲ
   &,4ϊʔυ
   

   View Slide

8. ϊʔυʹͦͷ··*".ϩʔϧͰ
   ݖݶ෇༩ͪ͠ΌͬͯΔਓɺ͍·ͤΜ͔ʜʁ
   &,4Ϋϥελʔ
   1PE ଞͷ"84Ϧιʔε
   σʔλऔಘͳͲ
   ݖݶ෇༩ʂ
   

   View Slide

9. Կ͕໰୊ͳͷ͔ʁ
   

   View Slide

10. ௨ৗɺ&,4Ϋϥελʔ಺ʹ͸
    ෳ਺༻్ͷ1PE͕Քಇ͍ͯ͠Δ͜ͱ΋ଟ͍Ͱ͢
    &,4Ϋϥελʔ
    ஍ຯΞϓϦ
    ଞͷ"84Ϧιʔε
    େਓؾΞϓϦ
    

    View Slide

11. ଞͷ"84ϦιʔεʹϚϧൿ৘ใΛऔΓʹ͍͘ͷ͕
    ஍ຯΞϓϦ͚ͩͩͬͨͱͯ͠΋ʜ
    &,4Ϋϥελʔ
    ஍ຯΞϓϦ
    ଞͷ"84Ϧιʔε
    େਓؾΞϓϦ
    THFU0CKFDU
    
    

    View Slide

12. ౔୆ͷϊʔυࣗମʹ*".ϩʔϧ͕෇͍͍ͯΔͱ
    ྆ํͷ1PEͱ΋ʹΞΫηεݖݶ͕෇͍ͯ͠·͏
    &,4Ϋϥελʔ
    ஍ຯΞϓϦ
    ଞͷ"84Ϧιʔε
    େਓؾΞϓϦ
    

    View Slide

13. ͭ·Γɺຊ౰͸ؔ܎ͳ͍ผͷΞϓϦ͕΍΂ౕ͑ʹ
    ৐ͬऔΒΕ͚ͨͩͰϚϧൿ৘ใ΋࿙Ӯͯ͠͠·͏ʜʂ
    &,4Ϋϥελʔ
    ஍ຯΞϓϦ
    ଞͷ"84Ϧιʔε
    େਓؾΞϓϦ
    ΍΂ౕ͑
    

    View Slide

14. ͡Ό͋ɺ
    Ͳ͏͢Ε͹͍͍ͷ͔ʁ
    

    View Slide

15. 安⼼してください
    IRSAがありますよ
    

    View Slide

16. *34"ʜʁ
    

    View Slide

17. *3 ʹ *".3PMFT
    4" ʹ 4FSWJDF"DDPVOUT
    

    View Slide

18. *".3PMFT
    GPS
    4FSWJDF"DDPVOUT
    

    View Slide

19. *".3PMFTGPS4FSWJDF"DDPVOUT
    ͭ·Γɺ
    "84ͷੈքͱ,Tͷੈք
    ྆ऀͷೝূػߏΛ
    ϚϦΞʔδϡͤ͞Δػೳʂ
    

    View Slide

20. *34"ͷ͘͠Έ
    

    View Slide

21. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    1PE
    1PE͔Β4όέοτΛ৮Γ͍ͨ৔߹
    

    View Slide

22. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    1PE
    1PE͔Β4όέοτΛ৮Γ͍ͨ৔߹
    ʢ೔ຊ͔ΒΞϝϦΧʹ౉ߤ͢Δͱߟ͑ͯΈΑ͏ʣ
    

    View Slide

23. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    1PE
    ·ͣ"84*".্ʹ0*%$ϓϩόΠμʔΛ࡞੒͠·͢
    ʢΞϝϦΧʹ೔ຊେ࢖ؗΛݐͯΔʣ
    0*%$ϓϩόΠμʔ
    ൃߦ
    

    View Slide

24. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    1PE
    *".ϩʔϧˍαʔϏεΞΧ΢ϯτΛ࡞੒͠·͢
    0*%$ϓϩόΠμʔ
    αʔϏεΞΧ΢ϯτ
    Ξϊςʔγϣϯ
    ʢ஫ऍʣʹ෇Ճ
    *".ϩʔϧ
    ΞΫηεڐՄ
    ৴པϙϦγʔ
    Ͱࢦఆ
    

    View Slide

25. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    1PE
    ։ൃऀ͕1PEىಈίϚϯυΛ&,4΁ૹ৴͠·͢
    0*%$ϓϩόΠμʔ
    αʔϏεΞΧ΢ϯτ
    *".ϩʔϧ
    LVCFBQJTFSWFS
    1PEىಈʂ
    ։ൃऀ
    

    View Slide

26. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    1PE
    ͢Δͱ1PE*EFOUJUZ8FCIPPL͕1PEఆٛΛߋ৽͠·͢
    ʢύεϙʔτൃߦॴͷΑ͏ͳ΋ͷʣ
    0*%$ϓϩόΠμʔ
    αʔϏεΞΧ΢ϯτ
    *".ϩʔϧ
    LVCFBQJTFSWFS
    ։ൃऀ
    1PE*EFOUJUZ8FCIPPL
    

    View Slide

27. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    1PE
    ͦͯ͠LVCFMFU͕4"τʔΫϯΛ1PEʹϚ΢ϯτ͠·͢
    ʢύεϙʔτͷΑ͏ͳ΋ͷʣ
    0*%$ϓϩόΠμʔ
    αʔϏεΞΧ΢ϯτ
    *".ϩʔϧ
    LVCFBQJTFSWFS
    ։ൃऀ
    1PE*EFOUJUZ8FCIPPL
    LVCFMFU
    4"τʔΫϯ
    ىಈ࣌ʹϚ΢ϯτ
    

    View Slide

28. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    1PE
    1PE͸"84ͷ454ʹ"TTVNF3PMFΛཁٻ͠·͢
    0*%$ϓϩόΠμʔ
    αʔϏεΞΧ΢ϯτ
    *".ϩʔϧ
    LVCFBQJTFSWFS
    ։ൃऀ
    1PE*EFOUJUZ8FCIPPL
    LVCFMFU
    4"τʔΫϯ
    454
    Ұ࣌ೝূΛऔಘ
    

    View Slide

29. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    1PE
    454͸1PEͷ4"τʔΫϯΛ֬ೝ͠·͢ʢೖࠃ৹ࠪʣ
    0*%$ϓϩόΠμʔ͕৴པ͢ΔΫϥελʔ͔ΒͷൃߦͳΒ0,
    0*%$ϓϩόΠμʔ
    αʔϏεΞΧ΢ϯτ
    *".ϩʔϧ
    LVCFBQJTFSWFS
    ։ൃऀ
    1PE*EFOUJUZ8FCIPPL
    LVCFMFU
    4"τʔΫϯ
    454
    

    View Slide

30. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    LVCFBQJTFSWFS
    LVCFMFU
    1PE*EFOUJUZ8FCIPPL
    αʔϏεΞΧ΢ϯτ
    4"τʔΫϯ
    454
    0*%$ϓϩόΠμʔ
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    *".ϩʔϧ
    1PE
    ։ൃऀ
    1PE͸&,4Ϋϥελʔ͕ೝΊͨਖ਼نͷϦιʔεͩͱ֬ೝ׬ྃʂ
    ඥ͚ͮΒΕͨ*".ϩʔϧΛແࣄʹҰ࣌ར༻Ͱ͖Δ 🎉
    ੖ΕͯΞΫηεʂ
    

    View Slide

31. ޚୗ͸෼͔ͬͨʂ
    ͱΓ࣮͋͑ͣػΛݟͤΖ
    ʢσϞ࣮ԋλΠϜʣ
    

    View Slide

32. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    LVCFBQJTFSWFS
    LVCFMFU
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    QPECFGPSF
    ։ൃऀ
    ᶃ ී௨ʹ1PEΛ࡞ͬͯ4΁ΞΫηεͯ͠ΈΔ
    

    View Slide

33. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    ᶄ "84*".্ʹ0*%$ϓϩόΠμʔΛ࡞੒͢Δ
    0*%$ϓϩόΠμʔ
    ൃߦ
    

    View Slide

34. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    ᶅ *".ϩʔϧˍαʔϏεΞΧ΢ϯτΛ࡞੒͢Δ
    0*%$ϓϩόΠμʔ
    αʔϏεΞΧ΢ϯτ
    Ξϊςʔγϣϯ
    ʢ஫ऍʣʹ෇Ճ
    *".ϩʔϧ
    ΞΫηεڐՄ
    ৴པϙϦγʔ
    Ͱࢦఆ
    

    View Slide

35. ίϯτϩʔϧϓϨʔϯʢ&,4ʣ
    ϊʔυʢ&$ʣ
    "84*".
    LVCFBQJTFSWFS
    LVCFMFU
    1PE*EFOUJUZ8FCIPPL
    αʔϏεΞΧ΢ϯτ
    4"τʔΫϯ
    454
    0*%$ϓϩόΠμʔ
    1PE͕৮Γ͍ͨ
    "84Ϧιʔε
    *".ϩʔϧ
    QPEBGUFS
    ։ൃऀ
    ᶆ *34"ͱඥ෇͚ͯɺ࠶౓1PEΛىಈʂ
    ੖ΕͯΞΫηεʂ
    

    View Slide

36. ࢀߟจݙ
    Πϯλʔωοτͷӥஐʹײँ͠·͢ɻࢲ΋ෛ͚ͣʹίϯτϦϏϡʔτ͍͖ͯ͠·͢ʂ
    • ,VCFSOFUFTr ೝূʢ,VCFSOFUFTJPʣ
    LVCFSOFUFTJPKBEPDTSFGFSFODFBDDFTTBVUIOBVUI[BVUIFOUJDBUJPO
    • &,4ͷBXTBVUIͱ͔*34"ͱ͔ʢձ઒͞Μʣ
    [FOOEFWOBNFMFTT@HZP[BBSUJDMFTFLTBVUIFOUJDBUJPOBVUIPSJ[BUJPO
    • ,VCFSOFUFTαʔϏεΞΧ΢ϯτʹର͢Δ͖Ίࡉ΍͔ͳ*".ϩʔϧׂΓ౰ͯͷ঺հʢ"84ࣾʣ
    BXTBNB[PODPNKQCMPHTOFXTJOUSPEVDJOHGJOFHSBJOFEJBNSPMFTTFSWJDFBDDPVOUT
    • ,VCFSOFUFTʹ͓͍ͯͷ"84ϦιʔεͷΞΫηε؅ཧʢ.FUSJD'JSFࣾʣ
    RJJUBDPN.FUSJD'JSFJUFNTCGFCCFEBF
    • "84&,4ͷ*".3PMFTGPS4FSWJDF"DDPVOUTΛ׬શʹཧղͨ͠ʢ,BJUPZ͞Μʣ
    XXXLBJUPZYZ[BXTJSTB
    

    View Slide

37. 2JJUB&OHJOFFS'FTUBͰձࣾର߅ઓҐΛૂͬͯ·͢💪
    RJJUBDPNPSHBOJ[BUJPOTLEEJBHJMF
    

    View Slide

38. ,%%*ΞδϟΠϧ։ൃηϯλʔʢ,"(ʣઈࢍ࠾༻தʂ
    ϑϧϦϞʔτͳιϑτ΢ΣΞΤϯδχΞઈࢍืूͯ͠·͢👍
    

    View Slide