Share
Embed
container-immutable
2021/12/07 Kubernetes Novice Tokyo #15
コンテナとimmutableとわたし。あとセキュリティ。
セッション動画
https://k8s-novice-jp.connpass.com/event/229951/
mochizuki875
December 07, 2021
Transcript
73 slides
-
ຖि༵ۚdʹ,VCFSOFUFT$MPVE/BUJWFؔ࿈ͷΛ:PV5VCFੜ৴ʹͯ ࡶஊܗࣜͰ৴͍ͯ͠·͢ɻ એᶃ IUUQTLVCFOFXTDPOOQBTTDPN !NPDIJ[VLJ !BOUJCFSJBM !CFMMT@ !JU@@DIBHP !63ZP@ ҰॹʹϫΠϫΠ͠·͠ΐ͏😆
ήετग़ԋઈࢍืूதͰ͢ʂʂ ˞ήετग़ԋ͚ΔํҎԼϝϯόʔͷ5XJUUFS%.·Ͱ͝࿈བྷ͚Εͱࢥ͍·͢ -
JNNVUBCMFͱ JNNVUBCMF ɹʢܗʣ<JNK ú UⓒCⓒM> ɹෆมͷɺมߋෆՄೳͳ NVUBCMF ɹʢܗʣ<NK ú UⓒCⓒM>
ɹมΘΓ͍͢ɺมߋՄೳͳ IUUQTFPXBMDDPKQ -
ίϯςφJNNVUBCMF͔ʁ W $POUBJOFS W JNBHF %FWFMPQFS W JNBHF W $POUBJOFS
%FQMPZ ίϯςφͷҰൠతͳϥΠϑαΠΫϧΛ౿·͑ɺઌͷྫͱಉ༷ͷέʔεΛߟ͑ͯΈ·͢ɻ -
ίϯςφJNNVUBCMF͔ʁ W $POUBJOFS W JNBHF %FWFMPQFS W JNBHF W $POUBJOFS
৽͍͠ίϯςφʹΓସ͑ ίϯςφͷҰൠతͳϥΠϑαΠΫϧΛ౿·͑ɺઌͷྫͱಉ༷ͷέʔεΛߟ͑ͯΈ·͢ɻ -
ίϯςφJNNVUBCMF͔ʁ W JNBHF %FWFMPQFS W JNBHF W $POUBJOFS )FMMP8FC1BHF 5IJT1BHFJTW
ίϯςφͷҰൠతͳϥΠϑαΠΫϧΛ౿·͑ɺઌͷྫͱಉ༷ͷέʔεΛߟ͑ͯΈ·͢ɻ -
ίϯςφJNNVUBCMF͔ʁ ͦͦͳΜͰJNNVUBCMFΛ࣮ݱ͍͔ͨ͠ʁʁ ɹˠมߋͷੵΈॏͶʹΑΔτϥϒϧΛආ͚ΔͨΊ ɹɹFYʣߋ৽ͷࣦഊɺυΩϡϝϯτͱ࣮ڥͷࠩҟɺڥࠩҟͷൃੜ CBTF CBTF EJ ff @ W
W มߋ ʢEJ ff @ʣ ˞͜͜ͰNVUBCMFɺJNNVUBCMFͷҰൠతͳϝϦοτσϝϦοτʹਂ͘৮Ε·ͤΜ͕ɺ্هͷ؍͔ΒJNNVUBCMFͷߟ͑ํ͕ਪ͞Ε͍ͯΔҹͰ͢ɻ -
ίϯςφJNNVUBCMF͔ʁ ͦͦͳΜͰJNNVUBCMFΛ࣮ݱ͍͔ͨ͠ʁʁ ɹˠมߋͷੵΈॏͶʹΑΔτϥϒϧΛආ͚ΔͨΊ ɹɹFYʣߋ৽ͷࣦഊɺυΩϡϝϯτͱ࣮ڥͷࠩҟɺڥࠩҟͷൃੜ CBTF CBTF EJ ff @ CBTF
EJ ff @ EJ ff @ W W W มߋ ʢEJ ff @ʣ มߋ ʢEJ ff @ʣ ˞͜͜ͰNVUBCMFɺJNNVUBCMFͷҰൠతͳϝϦοτσϝϦοτʹਂ͘৮Ε·ͤΜ͕ɺ্هͷ؍͔ΒJNNVUBCMFͷߟ͑ํ͕ਪ͞Ε͍ͯΔҹͰ͢ɻ -
ίϯςφJNNVUBCMF͔ʁ ͦͦͳΜͰJNNVUBCMFΛ࣮ݱ͍͔ͨ͠ʁʁ ɹˠมߋͷੵΈॏͶʹΑΔτϥϒϧΛආ͚ΔͨΊ ɹɹFYʣߋ৽ͷࣦഊɺυΩϡϝϯτͱ࣮ڥͷࠩҟɺڥࠩҟͷൃੜ CBTF CBTF EJ ff @ CBTF
EJ ff @ EJ ff @ W W W มߋ ʢEJ ff @ʣ มߋ ʢEJ ff @ʣ มߋ ʢEJ ff @ʣ ͜Ε·ͰͷมߋࠩͷੵΈॏͶ ʹΑΓมߋΛөͰ͖ͳ͍ ˞͜͜ͰNVUBCMFɺJNNVUBCMFͷҰൠతͳϝϦοτσϝϦοτʹਂ͘৮Ε·ͤΜ͕ɺ্هͷ؍͔ΒJNNVUBCMFͷߟ͑ํ͕ਪ͞Ε͍ͯΔҹͰ͢ɻ -
JNNVUBCMFͱηΩϡϦςΟ ϦεΫᶄɿίϯςφϗετ্ʹѱҙͷ͋ΔϑΝΠϧΛஔՄೳ $POUBJOFS)PTUʢ8PSLFS/PEFʣ 8FC "UUBDLFS ߈ܸऀʹΑΓίϯςφʹ৵ೖ͞Εɺѱҙͷ͋ΔϑΝΠϧΛ࡞͞Εͨͱ͠·͢ɻ ίϯςφʢ߈ܸऀ͔Β৵ೖʣ DNE DBU&0'DNE CJOTI
ODMcCBTIcOD߈ܸ*1 &0' DINPE YDNE DBU ϓϩάϥϜΛ࡞ DNE ίϯςφϗετʹόοΫυΞΛֻ͚ΔίϚϯυ -
JNNVUBCMFͱηΩϡϦςΟ ϦεΫᶄɿίϯςφϗετ্ʹѱҙͷ͋ΔϑΝΠϧΛஔՄೳ $POUBJOFS)PTUʢ8PSLFS/PEFʣ 8FC "UUBDLFS DNE ίϯςφͰ࡞͞ΕͨϑΝΠϧͷ࣮ମɺϗετ্ͷಛఆσΟϨΫτϦʹଘࡏ͢Δ͜ͱʹͳΓ·͢ɻ ͜ΕίϯςφͷSPPUGT͕ϗετ্ͷ0WFSMBZ'4͔ΒϚϯτ͞Ε͍ͯΔͨΊͰ͢ɻ DNE 0WFSMBZGT
6QQFSEJS -PXFSEJS -BZFS -PXFSEJS -BZFS XPSL DNE ࣮ମϗετ্ͷ 0WFSMBZGTʹଘࡏ NPVOUUPWFSMBZ PWFSMBZPOUZQFPWFSMBZ SX SFMBUJNF MPXFSEJSWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTWBSMJCDPOUBJOFSE JPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTWBSMJCDPOUBJOFSE JPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTWBSMJCDPOUBJOFSE JPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTWBSMJCDPOUBJOFSE JPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGT VQQFSEJSWBSMJCDPOUBJOFSE JPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGT XPSLEJSWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTXPSL YJOPP ff ѱҙͷ͋ΔϑΝΠϧ͕ ϗετʹஔ͞Εͨ ίϯςφʢ߈ܸऀ͔Β৵ೖʣ MTWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGT DNEFUDSPPUSVOWBS ίϯςφϗετ -
JNNVUBCMFͱηΩϡϦςΟ ϦεΫᶅɿίϯςφͷෆਖ਼ͳϓϩάϥϜͷ%-͕Մೳ $POUBJOFS)PTUʢ8PSLFS/PEFʣ 8FC "UUBDLFS ίϯςφͰͷมߋ͕Մೳͱ͍͏͜ͱɺύοέʔδཧπʔϧʢBQUZVNʣΛͬͯҙͷ ίϚϯυΛίϯςφʹΠϯετʔϧͨ͠Γɺѱҙͷ͋ΔϓϩάϥϜΛίϯςφʹஔ࣮͠ߦ ͢Δ͜ͱ͕ՄೳʹͳΓ·͢ɻ BQUHFUJOTUBMMZHJU HJUDMPOFIUUQTHJUIVCDPNTDVNKSEJSUZDPXWETPHJUEJSUZDPXWETP
DEEJSUZDPXWETP NBLF ɾɾɾ ίϯςφʢ߈ܸऀ͔Β৵ೖʣ EJSUZDPXWETP ѱҙͷ͋ΔϓϩάϥϜΛ %-࣮ͯ͠ߦ -
JNNVUBCMFͱηΩϡϦςΟ ϦεΫᶅɿίϯςφͷෆਖ਼ͳϓϩάϥϜͷ%-͕Մೳ $POUBJOFS)PTUʢ8PSLFS/PEFʣ 8FC "UUBDLFS ͦͷ݁Ռɺίϯςφ͔Βϗετͷ৵ೖʢ$POUBJOFS#SFBLPVUʣΛڐͯ͠͠·͏ͳͲɺ ߋͳΔ߈ܸʹܨ͛ΒΕͯ͠·͏ϦεΫ͕͋Γ·͢ɻ IPTUOBNF LTDMVTUFSXPSLFS JE
VJE SPPU HJE SPPU HSPVQT SPPU ίϯςφʢ߈ܸऀ͔Β৵ೖʣ ίϯςφϗετͷ ݖݶΛୣऔ EJSUZDPXWETP $POUBJOFS#SFBLPVU -
JNNVUBCMFͱηΩϡϦςΟ ʢࢀߟʣ%JSUZ$08 ϦεΫᶅͷྫͰ%JSUZ$08ʢ$7&ʣͱݺΕΔίϯςφϗετͷ੬ऑੑΛར༻ͨ͠ ߈ܸͷྫΛ͍ࣔͯ͠·͢ɻ ͜ΕίϯςφϗετͷΧʔωϧʹWҎલͷͷΛ༻͍ͯ͠Δ߹ɺ ίϯςφͰॴఆͷίʔυΛ࣮ߦ͢ΔͱίϯςφϗετͷಛݖΛऔಘͰ͖Δͱ͍͏ͷͰ͢ɻ %JSUZ$08 $7& %PDLFS$POUBJOFS&TDBQF IUUQTCMPHQBSBOPJETPGUXBSFDPNEJSUZDPXDWFEPDLFSDPOUBJOFSFTDBQF
1P$ʢTDVNKSEJSUZDPXWETPʣ IUUQTHJUIVCDPNTDVNKSEJSUZDPXWETP ಈըʢ%JSUZ$08%PDLFS&TDBQFʣ IUUQTXXXZPVUVCFDPNXBUDI W#X6G)+9H:H -
ίϯςφͷSPPUGTΛ3FBE0OMZʹ͢Δ ίϯςφʢͷSPPUGTʣ͕มߋՄೳͱ͍͏ঢ়ଶηΩϡϦςΟϦεΫʹͳΓಘΔͱݴ͑·͢ɻ ݴ͍͑ΕJNNVUBCMFͳߏ੍ޚͷ࣮ݱηΩϡϦςΟͷ؍͔Βҙ͕ٛ͋Δͱݴ͑·͢ɻ ʢ/PU0OMZߏཧʣ Ҏ߱Ͱઌʹࣔͨ͠ϦεΫͷରࡦͱͯ͠ ίϯςφͷSPPUGTΛ3FBE0OMZͱ͢ΔखஈΛ͝հ͠·͢ɻ ίϯςφͷSPPUGTΛ3FBE0OMZͱ͖͢ࢫҰൠతͳίϯςφηΩϡϦςΟͷϓϥΫςΟεͰड़ΒΕ͍ͯ·͢ɻ ɹ/*4541ΞϓϦέʔγϣϯίϯςφηΩϡϦςΟΨΠυʢ*1"ຊޠ༁൛ʣ ɹIUUQTXXXJQBHPKQ fi
MFTQEG ɹ/4"$*4",VCFSOFUFT)BSEFOJOH(VJEBODFʢ,VCFSOFUFT1PETFDVSJUZʣ ɹIUUQTNFEJBEFGFOTFHPW"VH$53@,6#&3/&5&4)"3%&/*/((6*%"/$&1%' -
ίϯςφͷSPPUGTΛ3FBE0OMZʹ͢Δ ,VCFSOFUFTͰίϯςφͷىಈઃఆʹͯίϯςφͷSPPUGTΛ3FBE0OMZʹઃఆ͢Δ͜ͱ͕ՄೳͰ͢ɻ ͜͏͢Δ͜ͱͰɺίϯςφͰͷSPPUGTʹର͢Δॻ͖ࠐΈΛ͏ૢ࡞͕ېࢭ͞Εɺ ηΩϡϦςΟϨϕϧΛߴΊΔ͜ͱʹܨ͕Γ·͢ɻ BQJ7FSTJPOW LJOE1PE NFUBEBUB MBCFMT SVOVCVOUVSFBEPOMZ OBNFVCVOUVSFBEPOMZ
TQFD DPOUBJOFST JNBHFVCVOUV OBNFVCVOUVSFBEPOMZ DPNNBOE<CJOTI D XIJMFEPTMFFQEPOF> TFDVSJUZ$POUFYU SFBE0OMZ3PPU'JMFTZTUFNUSVF VCVOUVJNNVUBCMFZNM SPPU!VCVOUVSFBEPOMZBQUHFUJOTUBMMZHJU ɾɾɾ 8/PUVTJOHMPDLJOHGPSSFBEPOMZMPDL fi MFWBSMJCEQLHMPDLGSPOUFOE 8/PUVTJOHMPDLJOHGPSSFBEPOMZMPDL fi MFWBSMJCEQLHMPDL &6OBCMFUPMPDBUFQBDLBHFHJU SPPU!VCVOUVSFBEPOMZDBU&0'DNE ɾɾɾ CBTIDBOOPUDSFBUFUFNQ fi MFGPSIFSFEPDVNFOU3FBEPOMZ fi MFTZTUFN $POUBJOFS)PTUʢ8PSLFS/PEFʣ VCVOUVSFBEPOMZ DNE SPPUGT QSPDFTT CJO SPPU MPDBMBQBDIFMPHT VTS ɾ ɾ ɾ NPVOU SPPUGT PWFSMBZGT 3FBE0OMZ ίϯςφͷSPPUGTΛ30ʹઃఆ 8SJUF -
ίϯςφͷSPPUGTΛ3FBE0OMZʹ͢Δ ͔͠͠ͳ͕ΒίϯςφͷڍಈʹΑͬͯɺSPPUGTͷॻ͖ࠐΈ͕ېࢭ͞Ε͍ͯΔͱਖ਼ৗʹίϯςφ͕ىಈͰ͖ͳ͍ ߹͋Γ·͢ɻIUUQEͷΑ͏ʹίϯςφϓϩηε͕SPPUGTԼͷಛఆσΟϨΫτϦʹϑΝΠϧΛग़ྗ͢Δಈ࡞Λ͢Δ߹ɺ SPPUGT͕3FBE0OMZͩͱίϯςφΛىಈ͢Δ͜ͱ͕Ͱ͖·ͤΜɻ BQJ7FSTJPOW LJOE1PE NFUBEBUB MBCFMT SVOIUUQESFBEPOMZ OBNFIUUQESFBEPOMZ
TQFD DPOUBJOFST JNBHFIUUQE OBNFIUUQESFBEPOMZ TFDVSJUZ$POUFYU SFBE0OMZ3PPU'JMFTZTUFNUSVF IUUQESFBEPOMZZNM ›››LVCFDUMHFUQPIUUQESFBEPOMZ /".&3&"%:45"5643&45"354"(& IUUQESFBEPOMZ&SSPS TBHP T ›››LVCFDUMMPHTIUUQESFBEPOMZ ")IUUQE$PVMEOPUSFMJBCMZEFUFSNJOFUIFTFSWFSTGVMMZRVBMJ fi FEEPNBJOOBNF VTJOH4FUUIF4FSWFS/BNFEJSFDUJWFHMPCBMMZUPTVQQSFTTUIJTNFTTBHF ")IUUQE$PVMEOPUSFMJBCMZEFUFSNJOFUIFTFSWFSTGVMMZRVBMJ fi FEEPNBJOOBNF VTJOH4FUUIF4FSWFS/BNFEJSFDUJWFHMPCBMMZUPTVQQSFTTUIJTNFTTBHF <4BU/PW><DPSFFSSPS><QJEUJE> 3FBEPOMZ fi MFTZTUFN")DPVMEOPUDSFBUFVTSMPDBMBQBDIFMPHTIUUQEQJEJV5ODG <4BU/PW><DPSFFSSPS><QJEUJE>")IUUQEDPVMEOPUMPHQJEUP fi MFVTSMPDBMBQBDIFMPHTIUUQEQJE $POUBJOFS)PTUʢ8PSLFS/PEFʣ IUUQESFBEPOMZ DNE SPPUGT QSPDFTT CJO SPPU MPDBMBQBDIFMPHT VTS ɾ ɾ ɾ NPVOU 3FBE0OMZ 3FBE0OMZ ίϯςφͷSPPUGTΛ30ʹઃఆ SPPUGT PWFSMBZGT 8SJUF 8SJUF -
ίϯςφͷSPPUGTΛ3FBE0OMZʹ͢Δ ରࡦͱͯ͠ɺSPPUGT3FBE0OMZͱͭͭ͠ίϯςφϓϩηε͕ॻ͖ࠐΈΛߦ͏ඞཁ͕͋ΔσΟϨΫτϦͷΈ 3FBE8JUFͰ7PMVNF.PVOUΛߦ͏ͱ͍͏ํ๏͕ߟ͑ΒΕ·͢ɻ ҎԼͰίϯςφىಈ࣌ʹରσΟϨΫτϦʹରͯ͠FNQUZ%JSʢҰ࣌తͳϘϦϡʔϜʣΛ࡞Ϛϯτ͍ͯ͠·͢ɻ BQJ7FSTJPOW LJOE1PE NFUBEBUB MBCFMT SVOIUUQESFBEPOMZ OBNFIUUQESFBEPOMZ
TQFD DPOUBJOFST JNBHFIUUQE OBNFIUUQESFBEPOMZ TFDVSJUZ$POUFYU SFBE0OMZ3PPU'JMFTZTUFNUSVF WPMVNF.PVOUT OBNFMPHWPMVNF NPVOU1BUIVTSMPDBMBQBDIFMPHT WPMVNFT OBNFMPHWPMVNF FNQUZ%JS\^ ›››LVCFDUMHFUQPIUUQESFBEPOMZ /".&3&"%:45"5643&45"354"(& IUUQESFBEPOMZ3VOOJOHNT $POUBJOFS)PTUʢ8PSLFS/PEFʣ IUUQESFBEPOMZ DNE SPPUGT QSPDFTT CJO SPPU MPDBMBQBDIFMPHT VTS ɾ ɾ ɾ NPVOU MPHWPMVNF NPVOU 3FBE0OMZ 3FBE8SJUFͰ 7PMVNF.PVOU IUUQESFBEPOMZZNM ίϯςφͷSPPUGTΛ30ʹઃఆ ॻ͖ࠐΈ͕ඞཁ͕ྖҬΛ FNQUZ%JSʹϚϯτ SPPUGT PWFSMBZGT 8SJUF -
,VCFSOFUFTશΨΠυୈ൛ IUUQTCPPLJNQSFTTDPKQCPPLT $FSUJ fi FE,VCFSOFUFT4FDVSJUZ4QFDJBMJTU $,4 IUUQTLPEFLMPVEDPNDPVSTFTDFSUJ fi FELVCFSOFUFTTFDVSJUZTQFDJBMJTUDLT
$POUBJOFS4FDVSJUZ#PPL IUUQTDPOUBJOFSTFDVSJUZEFWTFDVSJUZCSFBLPVUUPIPTUIUNM %PDLFS,VCFSOFUFT։ൃɾӡ༻ͷͨΊͷηΩϡϦςΟ࣮ફΨΠυ IUUQTCPPLNZOBWJKQFDQSPEVDUTEFUBJMJE ίϯςφٕज़ೖԾԽͱͷҧ͍ΛΓɺཁૉٕज़Λ৮ֶͬͯ΅͏ IUUQTFIDBSFFSDPNFOHJOFFSIVCFOUSZ ࢀߟ