Upgrade to Pro — share decks privately, control downloads, hide ads and more …

インフラ基盤技術のセキュリティとこれから

mrtc0
September 25, 2020

 インフラ基盤技術のセキュリティとこれから

InfraStudy #6 https://forkwell.connpass.com/event/187694/ での発表資料
ターミナルの画像は GIF なのでスライド内のリンクか https://gist.github.com/mrtc0/16f169e679674e43dfbb33ae5b0c4d5e を参照してください。動画は https://www.youtube.com/watch?v=X8HvH3dF6ZM です。

mrtc0

September 25, 2020
Tweet

More Decks by mrtc0

Other Decks in Programming

Transcript

  1. ,VCFSOFUFT4FDVSJUZ w 4FSWJDF"DDPVOUؚΊͨ3#"$ͷઃఆ w ҆શͳίϯςφΠϝʔδͷར༻ w /FUXPSL1PMJDZ w 4FSWJDF.FTI w

    1PE΍ίϯςφͷ$BQBCJMJUZ΍Ϧιʔεઃఆ w 4FDSFUͷ؅ཧ w "VEJU-PH w LVCFBQJTFSWFS΍LVCFMFUͷอޢ w %BTICPBSEͳͲ΁ͷΞΫηε੍ޚ w ,VCFSOFSUFTࣗମ΍ίϯςφϥϯλΠϜ Χʔω ϧͷ੬ऑੑ w ίϯϙʔωϯτؒͷ҆શͳ௨৴ w .FUBEBUB4FSWJDFͷอޢ w "ENJTTJPO$POUSPMMFS1MVHJO w FUDEͷ҉߸Խ w ͳͲͳͲ
  2. "UUBDL7FDUPS 4FSWJDF"DDPVOU 5PLFO 1PEʹϚ΢ϯτ͞ΕΔ4FSWJDF"DDPVOU5PLFOΛѱ༻͢Δɻ ࣗಈͰϚ΢ϯτ͠ͳ͍ɺ3#"$Λద੾ʹઃఆ͢Δɻ 6OBVUIPSJ[FE"1* "1*Λೝূͳ͠Ͱ୭Ͱ΋ୟ͚Δঢ়ଶʹ͠ͳ͍ɻ LVCFBQJTFSWFSͰBOPOZNPVTBVUIUSVFʹ͠ͳ͍ɻ 1PE4FDVSJUZ1PMJDZ (BUFLFFQFS

    ϗετϑΝΠϧͷϚ΢ϯτ΍վ͟ΜͳͲ΁ͷରࡦɻ BMMPXFE)PTU1BUIT΍SFBE0OMZ3PPU'JMFTZTUFN $BQBCJMJUZͷઃఆ FUDEͷ҉߸Խ΍ΞΫ ηε੍ޚ FUDEʹ͸ػີ৘ใؚ͕·Ε͍ͯΔͷͰɺΞΫηε੍ޚ΍҉߸ԽΛࢪ͢ /FUXPSL ଞͷ1PE΍NFUBEBUBTFSWJDF΁ͷΞΫηε /FUXPSL1PMJDZ΍4FSWJDF.FTIͰ੍ޚ 4FDSFUͷ؅ཧ 7$4্ʹ4FDSFUΛͦͷ··؅ཧͯ͠͠·͏ɻ ҉߸ԽΛࢪͨ͠Γ7BVMU΍,.4؅ཧʹ͢ΔͳͲɻ
  3. JNQFSTPOBUFLVCFMFU root@test:/# echo $CA_CERT | base64 -d > bootstrap/ca.crt root@test:/#

    echo $KUBELET_CERT | base64 -d > bootstrap/kubelet-bootstrap.crt` root@test:/# echo $KUBELET_KEY | base64 -d > bootstrap/kubelet-bootstrap.key root@test:/# CURRENT_HOSTNAME="$(curl -s -H 'Metadata-flavor: Google' ${KUBE_HOSTNAME_URL} | awk -F. '{print $1}')" root@test:/# openssl ecparam -genkey -name prime256v1 -out kubelet.key root@test:/tmp# openssl req -new -config /tmp/openssl.cnf -key kubelet.key -out kubelet.csr root@test:/# cat /tmp/kubelet.yaml apiVersion: certificates.k8s.io/v1beta1 kind: CertificateSigningRequest metadata: name: node-csr-gke-sandbox-cluster-default-pool-f9270e72-mg63-2 spec: groups: - system:authenticated request: LS0tLS... ... username: kubelet root@test:/# kubectl create -f /tmp/kubelet.yaml --certificate-authority=bootstrap/ca.crt --server=https://$KUBERNETES_MASTER_NAME --client- certificate=bootstrap/kubelet-bootstrap.crt --client-key=bootstrap/kubelet-bootstrap.key root@test:/# kubectl --certificate-authority=bootstrap/ca.crt --server=https://$KUBERNETES_MASTER_NAME --client-certificate=bootstrap/kubelet-bootst client-key=bootstrap/kubelet-bootstrap.key get csr node-csr-gke-sandbox-cluster-default-pool-f9270e72-mg63-2 -o jsonpath='{.status.certificate}' | b /tmp/kubelet.crt
  4. ࣄྫ w 4IPQJGZ443'JO&YDIBOHFMFBETUP3005BDDFTTJOBMMJOTUBODFT w IUUQTIBDLFSPOFDPNSFQPSUT w (JUMBC443'JOUP4IBSFE3VOOFS CZSFQMBDJOHEPDLFSEXJUINBMJDJPVTTFSWFSJO&YFDVUPS w IUUQTIBDLFSPOFDPNSFQPSUT

    w μογϡϘʔυҎ֎ʹ΋8FBWF4DPQF΍LVCFqPXΛૂͬͨ߈ܸ w IUUQTXXXXFBWFXPSLTCMPHQSFWFOUJOHNBMJDJPVTVTFPGXFBWFTDPQF w IUUQTXXXNJDSPTPGUDPNTFDVSJUZCMPHNJTDPOpHVSFELVCFqPX XPSLMPBETBSFBTFDVSJUZSJTL