Learn more about Admission Webhooks

Transcript

1. 1.

   ©2018 Wantedly, Inc. Learn more about 
 Admission Webhooks Kubernetes

   meetup #13 Yuichi Saito @munisystem
2. 2.

   ©2018 Wantedly, Inc.  "ENJTTJPO
   $POUSPMMFS
   ͷ͓͞Β͍
    "ENJTTJPO
   8FCIPPLT
   ͱ͸
    ·ͱΊ Agenda

3. 3.

   ©2018 Wantedly, Inc. "ENJTTJPO
   $POUSPMMFS
   ͷ͓͞Β͍

4. 4.

   ©2018 Wantedly, Inc. ਎ۙʹ͋Δ
   "ENJTTJPO
   $POUSPMMFS
   ͷྫ ଘࡏ͠ͳ͍
   OBNFTQBDF
   ʹ
   QPE
   Λ࡞ͬͯΈΔ

5. 5.

   ©2018 Wantedly, Inc. ਎ۙʹ͋Δ
   "ENJTTJPO
   $POUSPMMFS
   ͷྫ ଘࡏ͠ͳ͍
   OBNFTQBDF
   ʹରͯ͠
   QPE
   ͸࡞Δ͜ͱ͕Ͱ͖ͳ͍

6. 6.

   ©2018 Wantedly, Inc. ਎ۙʹ͋Δ
   "ENJTTJPO
   $POUSPMMFS
   ͷྫ ଘࡏ͠ͳ͍
   OBNFTQBDF
   ʹରͯ͠
   QPE
   ͸࡞Δ͜ͱ͕Ͱ͖ͳ͍ /BNFTQBDF-JGFDZDMF https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#namespacelifecycle

7. 7.

   ©2018 Wantedly, Inc. w ೝূ
   
   ೝՄͷ͋ͱɺ0CKFDU
   ͕ӬଓԽ͢Δલʹ
 ΫϥΠΞϯτ͔ΒͷཁٻΛड͚ೖΕΔ͔൑ఆ͢ΔͨΊͷ࢓૊Έ
   w "ENJTTJPO
   $POUSPMMFS
   NVUBUJOH
   ͱ
   WBMJEBUJOH
   ͷछྨ͕ଘࡏ͢Δ
   w NVUBUJOH
   
   ΫϥΠΞϯτͷཁٻΛॻ͖׵͑Δ
   

   w WBMJEBUJOH
   ΫϥΠΞϯτͷཁٻΛड͚ೖΕΔ͔Ͳ͏͔Λ൑அ͢Δ "ENJTTJPO
   $POUSPMMFS
   ͱ͸
8. 8.

   ©2018 Wantedly, Inc. "ENJTTJPO
   $POUSPMMFS
   ͱ͸ https://kubernetes.io/docs/reference/access-authn-authz/controlling-access/

9. 9.

   ©2018 Wantedly, Inc. w ೝূ
   
   ೝՄͷ͋ͱɺ0CKFDU
   ͕ӬଓԽ͢Δલʹ
 ΫϥΠΞϯτ͔ΒͷཁٻΛΤΫηϓτ͢ΔͨΊͷ࢓૊Έ
   w "ENJTTJPO
   $POUSPMMFS
   NVUBUJOH
   ͱ
   WBMJEBUJOH
   ͷछྨ͕ଘࡏ͢Δ
   w NVUBUJOH
   
   ΫϥΠΞϯτͷཁٻΛॻ͖׵͑Δ
   

   w WBMJEBUJOH
   ΫϥΠΞϯτͷཁٻΛड͚ೖΕΔ͔Ͳ͏͔Λ൑அ͢Δ "ENJTTJPO
   $POUSPMMFS
   ͱ͸
10. 10.

    ©2018 Wantedly, Inc. ΫϥΠΞϯτͷཁٻΛॻ͖׵͑Δ͜ͱͰɺϚχϑΣετʹॻ͔ͣͱ΋ҎԼͷ͜ͱ͕ߦ͑Δ
    w ೚ҙͷ
    BOOPUBUJPO
    ΍
    MBCFM
    Λ෇༩͢Δ
    w ΞϓϦέʔγϣϯͷ؀ڥม਺ʹ೚ҙͷσʔλΛຒΊࠐΊΔ
    w QPE
    ͷલ໘ʹ
    QSPYZ
    Λஔ͘
    

    w ΠϝʔδΛॻ͖׵͑Δ
    w FUD "ENJTTJPO
    $POUSPMMFS
    ͱ͸
11. 11.

    ©2018 Wantedly, Inc. w ೝূ
    
    ೝՄͷ͋ͱɺ0CKFDU
    ͕ӬଓԽ͢Δલʹ
 ΫϥΠΞϯτ͔ΒͷཁٻΛΤΫηϓτ͢ΔͨΊͷ࢓૊Έ
    w "ENJTTJPO
    $POUSPMMFS
    NVUBUJOH
    ͱ
    WBMJEBUJOH
    ͷछྨ͕ଘࡏ͢Δ
    w NVUBUJOH
    
    ΫϥΠΞϯτͷཁٻΛॻ͖׵͑Δ
    

    w WBMJEBUJOH
    ΫϥΠΞϯτͷཁٻΛड͚ೖΕΔ͔Ͳ͏͔Λ൑அ͢Δ "ENJTTJPO
    $POUSPMMFS
    ͱ͸
12. 12.

    ©2018 Wantedly, Inc. ΫϥΠΞϯτͷཁٻΛड͚ೖΕΔ͔Ͳ͏͔ͷ൑அΛҎԼͷ৘ใ͔Βߦ͑Δ
    w ϚχϑΣετͷ಺༰
    w ΫϥΠΞϯτͷΞΧ΢ϯτ΍ϩʔϧͷछྨ
    w ֎෦αʔϏεͱͷ࿈ܞ
    

    w FUD "ENJTTJPO
    $POUSPMMFS
    ͱ͸
13. 13.

    ©2018 Wantedly, Inc. w ೝূ
    
    ೝՄͷ͋ͱɺ0CKFDU
    ͕ӬଓԽ͢Δલʹ
 ΫϥΠΞϯτ͔ΒͷཁٻΛΤΫηϓτ͢ΔͨΊͷ࢓૊Έ
    w "ENJTTJPO
    $POUSPMMFS
    NVUBUJOH
    ͱ
    WBMJEBUJOH
    ͷछྨ͕ଘࡏ͢Δ
    w NVUBUJOH
    
    ΫϥΠΞϯτͷཁٻΛॻ͖׵͑Δ
    

    w WBMJEBUJOH
    ΫϥΠΞϯτͷཁٻΛड͚ೖΕΔ͔Ͳ͏͔Λ൑அ͢Δ "ENJTTJPO
    $POUSPMMFS
    ͱ͸ 
    ෳࡶͳΦϖϨʔγϣϯ΍ػೳΛ
    ,VCFSOFUFT
    ಺෦Ͱ࣮ݱͰ͖Δ
14. 14.

    ©2018 Wantedly, Inc. "ENJTTJPO
    8FCIPPLT
    ͱ͸

15. 15.

    ©2018 Wantedly, Inc. w Wd
    ͔Βαϙʔτ͞Εͨ
    "ENJTTJPO
    $POUSPMMFS
    Λ֦ு͢ΔͨΊͷػೳ
    CFUB
    w BENJTTJPO
    QMVHJOT
    ͰҎԼΛ༗ޮʹ͢Δ͜ͱͰར༻͕ՄೳʹͳΔ
    w

    .VUBUJOH"ENJTTJPO8FCIPPL
    w 7BMJEBUJOH"ENJTTJPO8FCIPPL
    w Ͳ͜Ͱ࢖ΘΕ͍ͯΔʁ
    w *TUJP
    ͕
    TJEFDBS
    ͱͯ͠
    FOWPZ
    Λ
    EFQMPZ
    ͢Δ࣌ʹར༻͍ͯ͠Δ
    w SFG
    IUUQTHJUIVCDPNJTUJPJTUJPCMPCNBTUFSQJMPUQLHLVCFJOKFDUXFCIPPLHP "ENJTTJPO
    8FCIPPLT
    ͱ͸
16. 16.

    ©2018 Wantedly, Inc. "ENJTTJPO
    8FCIPPLT
    0WFSWJFX https://kubernetes.io/blog/2018/01/extensible-admission-is-beta/

17. 17.

    ©2018 Wantedly, Inc. w LVCFBQJTFSWFS
    ʹ
    $BMMCBDL
    ઌͱͯ͠
    )551
    TFSWFS
    Λొ࿥͢Δ͜ͱͰɺ
 ͦ͜ʹ
    "ENJTTJPO
    3FRVFTU
    ͕ඈΜͰ͘ΔΑ͏ʹͳΔ
    w 7BMJEBUJOH8FCIPPL$POpHVSBUJPO
    0CKFDU
    w .VUBUJOH8FCIPPL$POpHVSBUJPO
    
    0CKFDU
    

    w "ENJTTJPO
    3FRVFTU
    ʹର͠ฦ౴͢Δ
    3FTQPOTF
    ͷܗࣜʹΑͬͯ
 "ENJTTJPO
    $POUSPM
    Λ࣮ݱ͢Δ "ENJTTJPO
    8FCIPPLT
    ͱ͸
18. 18.

    ©2018 Wantedly, Inc. w LVCFBQJTFSWFS
    ʹ
    $BMMCBDL
    ઌͱͯ͠
    )551
    TFSWFS
    Λొ࿥͢Δ͜ͱͰɺ
 ͦ͜ʹ
    "ENJTTJPO
    3FRVFTU
    ͕ඈΜͰ͘ΔΑ͏ʹͳΔ
    w 7BMJEBUJOH8FCIPPL$POpHVSBUJPO
    0CKFDU
    w .VUBUJOH8FCIPPL$POpHVSBUJPO
    
    0CKFDU
    

    w "ENJTTJPO
    3FRVFTU
    ʹର͠ฦ౴͢Δ
    3FTQPOTF
    ͷܗࣜʹΑͬͯ
 "ENJTTJPO
    $POUSPM
    Λ࣮ݱ͢Δ "ENJTTJPO
    8FCIPPLT
    ͱ͸
19. 19.

    ©2018 Wantedly, Inc. "ENJTTJPO
    8FCIPPLT
    ͷઃఆ 7BMJEBUJOH
    8FCIPPLT
    ͷྫ ͜ͷઃఆͩͱ
    w ৚݅
    w $MJFOU
    ͔Βͷཁٻ͕


    BQJ7FSTJPO
    W
    ͷ
    QPE
    ͷ
    $3&"5&
    ͷ৔߹
    w Ͳ͜ʹ
    w EFGBVMU
    OBNFTQBDF
    ͷ
 FYBNQMFIPPLTFSWFS
    TFSWJDF
    ͷ
 BENJUQPET
    ʹରͯ͠
    w ͳʹ͕
    w 7BMJEBUJOH
    ͷͨΊͷ
    "ENJTTJPO
    3FRVFTU
    ͕ૹΒΕͯ͘ΔΑ͏ʹͳΔ
    
20. 20.

    ©2018 Wantedly, Inc. w LVCFBQJTFSWFS
    ʹ
    $BMMCBDL
    ઌͱͯ͠
    )551
    TFSWFS
    Λొ࿥͢Δ͜ͱͰɺ
 ͦ͜ʹ
    "ENJTTJPO
    3FRVFTU
    ͕ඈΜͰ͘ΔΑ͏ʹͳΔ
    w 7BMJEBUJOH8FCIPPL$POpHVSBUJPO
    0CKFDU
    w .VUBUJOH8FCIPPL$POpHVSBUJPO
    
    0CKFDU
    

    w "ENJTTJPO
    3FRVFTU
    ʹର͠ฦ౴͢Δ
    3FTQPOTF
    ͷܗࣜʹΑͬͯ
 "ENJTTJPO
    $POUSPM
    Λ࣮ݱ͢Δ "ENJTTJPO
    8FCIPPLT
    ͱ͸
21. 21.

    ©2018 Wantedly, Inc. γϯϓϧͳ
    "ENJTTJPO
    8FCIPPLT
    ͷྫ

22. 22.

    ©2018 Wantedly, Inc. γϯϓϧͳ
    "ENJTTJPO
    8FCIPPLT
    ͷྫ

23. 23.

    ©2018 Wantedly, Inc. γϯϓϧͳ
    "ENJTTJPO
    8FCIPPLT
    ͷྫ QPE
    ͷ࡞੒͕ඞࣦͣഊ͢Δ

24. 24.

    ©2018 Wantedly, Inc. w "ENJTTJPO
    8FCIPPLT
    ͸
    ,VCFSOFUFT
    ΛΧελϚΠζ͢Δ࢓૊Έ
    w ͜ΕΛ͔ͭ͏͜ͱͰ
    ,VCFSOFUFT
    ʹෳࡶͳΦϖϨʔγϣϯΛ࣮ݱͰ͖Δ
    w ΫϥΠΞϯτͷཁٻΛड͚ೖΕΔ
    w

    ΫϥΠΞϯτͷཁٻΛॻ͖׵͑Δ
    w /05
    ۜͷ஄ؙ
    w ͝ར༻͸ܭըతʹ ·ͱΊ