Learn more about Admission Webhooks

kubernetes meetup #13
https://k8sjp.connpass.com/event/100842/

Transcript

1. ©2018 Wantedly, Inc. Learn more about 
 Admission Webhooks Kubernetes meetup #13 Yuichi Saito @munisystem
2. ©2018 Wantedly, Inc.  "ENJTTJPO
   $POUSPMMFS
   ͷ͓͞Β͍
    "ENJTTJPO
   8FCIPPLT
   ͱ͸
    ·ͱΊ Agenda
3. ©2018 Wantedly, Inc. "ENJTTJPO
   $POUSPMMFS
   ͷ͓͞Β͍
4. ©2018 Wantedly, Inc. ਎ۙʹ͋Δ
   "ENJTTJPO
   $POUSPMMFS
   ͷྫ ଘࡏ͠ͳ͍
   OBNFTQBDF
   ʹ
   QPE
   Λ࡞ͬͯΈΔ
5. ©2018 Wantedly, Inc. ਎ۙʹ͋Δ
   "ENJTTJPO
   $POUSPMMFS
   ͷྫ ଘࡏ͠ͳ͍
   OBNFTQBDF
   ʹରͯ͠
   QPE
   ͸࡞Δ͜ͱ͕Ͱ͖ͳ͍
6. ©2018 Wantedly, Inc. ਎ۙʹ͋Δ
   "ENJTTJPO
   $POUSPMMFS
   ͷྫ ଘࡏ͠ͳ͍
   OBNFTQBDF
   ʹରͯ͠
   QPE
   ͸࡞Δ͜ͱ͕Ͱ͖ͳ͍ /BNFTQBDF-JGFDZDMF https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#namespacelifecycle
7. ©2018 Wantedly, Inc. w ೝূ
   
   ೝՄͷ͋ͱɺ0CKFDU
   ͕ӬଓԽ͢Δલʹ
 ΫϥΠΞϯτ͔ΒͷཁٻΛड͚ೖΕΔ͔൑ఆ͢ΔͨΊͷ࢓૊Έ
   w "ENJTTJPO
   $POUSPMMFS
   NVUBUJOH
   ͱ
   WBMJEBUJOH
   ͷछྨ͕ଘࡏ͢Δ
   w NVUBUJOH
   
   ΫϥΠΞϯτͷཁٻΛॻ͖׵͑Δ
   w WBMJEBUJOH
   ΫϥΠΞϯτͷཁٻΛड͚ೖΕΔ͔Ͳ͏͔Λ൑அ͢Δ "ENJTTJPO
   $POUSPMMFS
   ͱ͸
8. ©2018 Wantedly, Inc. "ENJTTJPO
   $POUSPMMFS
   ͱ͸ https://kubernetes.io/docs/reference/access-authn-authz/controlling-access/
9. ©2018 Wantedly, Inc. w ೝূ
   
   ೝՄͷ͋ͱɺ0CKFDU
   ͕ӬଓԽ͢Δલʹ
 ΫϥΠΞϯτ͔ΒͷཁٻΛΤΫηϓτ͢ΔͨΊͷ࢓૊Έ
   w "ENJTTJPO
   $POUSPMMFS
   NVUBUJOH
   ͱ
   WBMJEBUJOH
   ͷछྨ͕ଘࡏ͢Δ
   w NVUBUJOH
   
   ΫϥΠΞϯτͷཁٻΛॻ͖׵͑Δ
   w WBMJEBUJOH
   ΫϥΠΞϯτͷཁٻΛड͚ೖΕΔ͔Ͳ͏͔Λ൑அ͢Δ "ENJTTJPO
   $POUSPMMFS
   ͱ͸
10. ©2018 Wantedly, Inc. ΫϥΠΞϯτͷཁٻΛॻ͖׵͑Δ͜ͱͰɺϚχϑΣετʹॻ͔ͣͱ΋ҎԼͷ͜ͱ͕ߦ͑Δ
    w ೚ҙͷ
    BOOPUBUJPO
    ΍
    MBCFM
    Λ෇༩͢Δ
    w ΞϓϦέʔγϣϯͷ؀ڥม਺ʹ೚ҙͷσʔλΛຒΊࠐΊΔ
    w QPE
    ͷલ໘ʹ
    QSPYZ
    Λஔ͘
    w ΠϝʔδΛॻ͖׵͑Δ
    w FUD "ENJTTJPO
    $POUSPMMFS
    ͱ͸
11. ©2018 Wantedly, Inc. w ೝূ
    
    ೝՄͷ͋ͱɺ0CKFDU
    ͕ӬଓԽ͢Δલʹ
 ΫϥΠΞϯτ͔ΒͷཁٻΛΤΫηϓτ͢ΔͨΊͷ࢓૊Έ
    w "ENJTTJPO
    $POUSPMMFS
    NVUBUJOH
    ͱ
    WBMJEBUJOH
    ͷछྨ͕ଘࡏ͢Δ
    w NVUBUJOH
    
    ΫϥΠΞϯτͷཁٻΛॻ͖׵͑Δ
    w WBMJEBUJOH
    ΫϥΠΞϯτͷཁٻΛड͚ೖΕΔ͔Ͳ͏͔Λ൑அ͢Δ "ENJTTJPO
    $POUSPMMFS
    ͱ͸
12. ©2018 Wantedly, Inc. ΫϥΠΞϯτͷཁٻΛड͚ೖΕΔ͔Ͳ͏͔ͷ൑அΛҎԼͷ৘ใ͔Βߦ͑Δ
    w ϚχϑΣετͷ಺༰
    w ΫϥΠΞϯτͷΞΧ΢ϯτ΍ϩʔϧͷछྨ
    w ֎෦αʔϏεͱͷ࿈ܞ
    w FUD "ENJTTJPO
    $POUSPMMFS
    ͱ͸
13. ©2018 Wantedly, Inc. w ೝূ
    
    ೝՄͷ͋ͱɺ0CKFDU
    ͕ӬଓԽ͢Δલʹ
 ΫϥΠΞϯτ͔ΒͷཁٻΛΤΫηϓτ͢ΔͨΊͷ࢓૊Έ
    w "ENJTTJPO
    $POUSPMMFS
    NVUBUJOH
    ͱ
    WBMJEBUJOH
    ͷछྨ͕ଘࡏ͢Δ
    w NVUBUJOH
    
    ΫϥΠΞϯτͷཁٻΛॻ͖׵͑Δ
    w WBMJEBUJOH
    ΫϥΠΞϯτͷཁٻΛड͚ೖΕΔ͔Ͳ͏͔Λ൑அ͢Δ "ENJTTJPO
    $POUSPMMFS
    ͱ͸ 
    ෳࡶͳΦϖϨʔγϣϯ΍ػೳΛ
    ,VCFSOFUFT
    ಺෦Ͱ࣮ݱͰ͖Δ
14. ©2018 Wantedly, Inc. "ENJTTJPO
    8FCIPPLT
    ͱ͸
15. ©2018 Wantedly, Inc. w Wd
    ͔Βαϙʔτ͞Εͨ
    "ENJTTJPO
    $POUSPMMFS
    Λ֦ு͢ΔͨΊͷػೳ
    CFUB
    w BENJTTJPO
    QMVHJOT
    ͰҎԼΛ༗ޮʹ͢Δ͜ͱͰར༻͕ՄೳʹͳΔ
    w .VUBUJOH"ENJTTJPO8FCIPPL
    w 7BMJEBUJOH"ENJTTJPO8FCIPPL
    w Ͳ͜Ͱ࢖ΘΕ͍ͯΔʁ
    w *TUJP
    ͕
    TJEFDBS
    ͱͯ͠
    FOWPZ
    Λ
    EFQMPZ
    ͢Δ࣌ʹར༻͍ͯ͠Δ
    w SFG
    IUUQTHJUIVCDPNJTUJPJTUJPCMPCNBTUFSQJMPUQLHLVCFJOKFDUXFCIPPLHP "ENJTTJPO
    8FCIPPLT
    ͱ͸
16. ©2018 Wantedly, Inc. "ENJTTJPO
    8FCIPPLT
    0WFSWJFX https://kubernetes.io/blog/2018/01/extensible-admission-is-beta/
17. ©2018 Wantedly, Inc. w LVCFBQJTFSWFS
    ʹ
    $BMMCBDL
    ઌͱͯ͠
    )551
    TFSWFS
    Λొ࿥͢Δ͜ͱͰɺ
 ͦ͜ʹ
    "ENJTTJPO
    3FRVFTU
    ͕ඈΜͰ͘ΔΑ͏ʹͳΔ
    w 7BMJEBUJOH8FCIPPL$POpHVSBUJPO
    0CKFDU
    w .VUBUJOH8FCIPPL$POpHVSBUJPO
    
    0CKFDU
    w "ENJTTJPO
    3FRVFTU
    ʹର͠ฦ౴͢Δ
    3FTQPOTF
    ͷܗࣜʹΑͬͯ
 "ENJTTJPO
    $POUSPM
    Λ࣮ݱ͢Δ "ENJTTJPO
    8FCIPPLT
    ͱ͸
18. ©2018 Wantedly, Inc. w LVCFBQJTFSWFS
    ʹ
    $BMMCBDL
    ઌͱͯ͠
    )551
    TFSWFS
    Λొ࿥͢Δ͜ͱͰɺ
 ͦ͜ʹ
    "ENJTTJPO
    3FRVFTU
    ͕ඈΜͰ͘ΔΑ͏ʹͳΔ
    w 7BMJEBUJOH8FCIPPL$POpHVSBUJPO
    0CKFDU
    w .VUBUJOH8FCIPPL$POpHVSBUJPO
    
    0CKFDU
    w "ENJTTJPO
    3FRVFTU
    ʹର͠ฦ౴͢Δ
    3FTQPOTF
    ͷܗࣜʹΑͬͯ
 "ENJTTJPO
    $POUSPM
    Λ࣮ݱ͢Δ "ENJTTJPO
    8FCIPPLT
    ͱ͸
19. ©2018 Wantedly, Inc. "ENJTTJPO
    8FCIPPLT
    ͷઃఆ 7BMJEBUJOH
    8FCIPPLT
    ͷྫ ͜ͷઃఆͩͱ
    w ৚݅
    w $MJFOU
    ͔Βͷཁٻ͕
 BQJ7FSTJPO
    W
    ͷ
    QPE
    ͷ
    $3&"5&
    ͷ৔߹
    w Ͳ͜ʹ
    w EFGBVMU
    OBNFTQBDF
    ͷ
 FYBNQMFIPPLTFSWFS
    TFSWJDF
    ͷ
 BENJUQPET
    ʹରͯ͠
    w ͳʹ͕
    w 7BMJEBUJOH
    ͷͨΊͷ
    "ENJTTJPO
    3FRVFTU
    ͕ૹΒΕͯ͘ΔΑ͏ʹͳΔ
    
20. ©2018 Wantedly, Inc. w LVCFBQJTFSWFS
    ʹ
    $BMMCBDL
    ઌͱͯ͠
    )551
    TFSWFS
    Λొ࿥͢Δ͜ͱͰɺ
 ͦ͜ʹ
    "ENJTTJPO
    3FRVFTU
    ͕ඈΜͰ͘ΔΑ͏ʹͳΔ
    w 7BMJEBUJOH8FCIPPL$POpHVSBUJPO
    0CKFDU
    w .VUBUJOH8FCIPPL$POpHVSBUJPO
    
    0CKFDU
    w "ENJTTJPO
    3FRVFTU
    ʹର͠ฦ౴͢Δ
    3FTQPOTF
    ͷܗࣜʹΑͬͯ
 "ENJTTJPO
    $POUSPM
    Λ࣮ݱ͢Δ "ENJTTJPO
    8FCIPPLT
    ͱ͸
21. ©2018 Wantedly, Inc. γϯϓϧͳ
    "ENJTTJPO
    8FCIPPLT
    ͷྫ
22. ©2018 Wantedly, Inc. γϯϓϧͳ
    "ENJTTJPO
    8FCIPPLT
    ͷྫ
23. ©2018 Wantedly, Inc. γϯϓϧͳ
    "ENJTTJPO
    8FCIPPLT
    ͷྫ QPE
    ͷ࡞੒͕ඞࣦͣഊ͢Δ
24. ©2018 Wantedly, Inc. w "ENJTTJPO
    8FCIPPLT
    ͸
    ,VCFSOFUFT
    ΛΧελϚΠζ͢Δ࢓૊Έ
    w ͜ΕΛ͔ͭ͏͜ͱͰ
    ,VCFSOFUFT
    ʹෳࡶͳΦϖϨʔγϣϯΛ࣮ݱͰ͖Δ
    w ΫϥΠΞϯτͷཁٻΛड͚ೖΕΔ
    w ΫϥΠΞϯτͷཁٻΛॻ͖׵͑Δ
    w /05
    ۜͷ஄ؙ
    w ͝ར༻͸ܭըతʹ ·ͱΊ