CiliumによるKubernetes Network Policyの実現 CNDT2021

by Tomoki Sugiura

Slide 1

Slide 1 text

CiliumʹΑΔ Kubernetes Network Policyͷ࣮ݱ 5PNPLJ4VHJVSB

Slide 2

Slide 2 text

ຊηογϣϯͷ֓ཁ 2 1PE 1PE 1PE

Slide 3

Slide 3 text

ຊηογϣϯͷ֓ཁ 3 $/*ϓϥάΠϯ 1PE 1PE 1PE 1PEؒͷ௨৴Λ؅ཧ

Slide 4

Slide 4 text

ຊηογϣϯͷ֓ཁ 4 ❌ $/*ϓϥάΠϯ 1PEؒͷ௨৴Λ؅ཧ 1PE 1PE 1PE

Slide 5

Slide 5 text

ຊηογϣϯͷ֓ཁ 5 ❌ Ͳ͏΍੍ͬͯޚʁ ઃఆ߲໨ʁ $/*ϓϥάΠϯ 1PEؒͷ௨৴Λ؅ཧ 1PE 1PE 1PE 1PEؒͷ௨৴Λ؅ཧ

Slide 6

Slide 6 text

ຊฤ΁ 6

Slide 7

Slide 7 text

Kubernetes 7 ˓ ίϯςφΦʔέετϨʔγϣϯπʔϧ ˔ ෳ਺୆ͷίϯςφΛҰݩ؅ཧ ˓ ίϯςφӡ༻ͷͨΊͷ͜ͱΛͳΜͰ΋΍Δ ˔ ΦʔτώʔϦϯάɾϩʔϦϯάΞοϓσʔτ ˔ ίϯςφʹద༻͢Δઃఆ஋ͷ؅ཧ ˔ ݖݶ؅ཧ ˔ FUD ˓ 1PEؒͷ௨৴ػೳˠ$/*ϓϥάΠϯʹҕৡ ˔ 1PEʹωοτϫʔΫ໊લۭؒΛڞ༗͢Δίϯςφ܈

Slide 8

Slide 8 text

CNI 8 ˓ $POUBJOFS/FUXPSL*OUFSGBDF ˓ $/$'*ODVCBUJOH1SPKFDU ˓ ίϯςφωοτϫʔΫ*'ͷ؅ཧʹ͓͚Δ࢓༷Λఆٛ ˔ ,VCFSOFUFTઐ༻πʔϧͰ͸ͳ͍ ˓ ػೳ ˔ "%%ɿωοτϫʔΫ*'ͷ࡞੒ɾߋ৽ ˔ %&-ɿωοτϫʔΫ*'ͷ࡟আɾߋ৽ͷऔফ ˔ $)&$,ɿظ଴௨Γͷઃఆ͔֬ೝ ˔ 7&34*0/ɿαϙʔτ͍ͯ͠Δ$/*࢓༷ͷόʔδϣϯΛฦ͢

Slide 9

Slide 9 text

˓ $/*ʹ४ڌͨ͠,VCFSOFUFTͷ ωοτϫʔΫϓϥάΠϯ ˓ $/*όΠφϦ ˔ ίϯςφωοτϫʔΫ*'ͷ؅ཧ ˓ $/*σʔϞϯ ˔ Ϋϥελ಺ͰͷωοτϫʔΫૄ௨Λ؅ཧ ˓ $/*ϓϥάΠϯྫ ˔ $BMJDP ˔ $JMJVN ˔ FUD CNIϓϥάΠϯ 9 $/* ϓϥάΠϯ FUI "%% ωοτϫʔΫ*'ͷ࡞੒ *1ΞυϨεͷׂΓ౰ͯ ܦ࿏ઃఆ

Slide 10

Slide 10 text

˓ $/*ϓϥάΠϯͷҰͭ ˓ $/$'*ODVCBUJOHQSPKFDU ˓ σʔλϓϨʔϯʹF#1'Λ׆༻ ˓ ར༻ࣄྫ ˔ (,&%BUBQMBOF7 ˔ &,4"OZXIFSF Cilium 10

Slide 11

Slide 11 text

˓ FYUFOEFE#FSLFMFZ1BDLFU'JMUFS ˓ ࣗ෼ͷ࡞੒ͨ͠ϓϩάϥϜΛ -JOVYΧʔωϧ಺ͷ7.Ͱ࣮ߦ ˔ ಠࣗϨδελ໋ྩηοτ ˔ ϓϩάϥϜͷݕࠪػߏ͕͋Γ҆શੑΛอো ˓ Πϕϯτۦಈ ˔ FHύέοτ͕/*$ʹ౸ୡ ˓ $ݴޠͰهड़Մೳ ˔ $MBOH--7. eBPF 11 DMBOHUBSHFUCQG $ݴޠϓϩάϥϜ όΠτίʔυ 7FSJ fi FS +*5$PNQJMFS ΠϕϯτʹԠ࣮ͯ͡ߦ CQG Ϣʔβۭؒ Χʔωϧۭؒ

Slide 12

Slide 12 text

͜͜·Ͱͷ·ͱΊ 12 ˓ ,VCFSOFUFT͸1PEؒͷ௨৴ػೳΛ $/*ϓϥάΠϯʹҕৡ ˓ $/*ϓϥάΠϯ͸$/*४ڌͷ,VCFSOFUFTϓϥάΠϯ ˔ 1PEؒͷ௨৴ػೳͷఏڙɾ؅ཧΛߦ͏ ˓ $JMJVN͸$/*ϓϥάΠϯͷҰछ ˔ σʔλϓϨʔϯʹF#1'Λ׆༻

Slide 13

Slide 13 text

Network Policyͱ͸ 13

Slide 14

Slide 14 text

Kubernetes Network PolicyϦιʔε 14 1PE 1PE 1PE

Slide 15

Slide 15 text

Kubernetes Network PolicyϦιʔε 15 1PE 1PE 1PE ❌

Slide 16

Slide 16 text

Kubernetes Network PolicyϦιʔε 16 1PE 1PE 1PE ❌

Slide 17

Slide 17 text

Kubernetes Network Policyͱ͸ 17 ˓ ,VCFSFOUFTͷϦιʔεͷҰछ ˓ --ͷ௨৴Λ੍ޚ ˔ *1ΞυϨεϙʔτ൪߸ ˓ $/*ϓϥάΠϯ͕ରԠ͍ͯ͠Ε͹࢖༻Մೳ ˔ $JMJVN͸ରԠ ˔ 'MBOOFM͸ະରԠ ˓ ུশ͸OFUQPM ˔ LVCFDUMHFUOFUQPM"

Slide 18

Slide 18 text

Kubernetes Network Policy ྫ 18 ˓ ໊લۭؒ͝ͱʹ࡞੒ ˓ ڐՄϦετ ˓ --ϨϕϧͷϙϦγʔ ˓ *OHSFTTʢ֎͔Β಺ʣɼ&HSFTTʢ಺͔Β֎ʣ ωοτϫʔΫϙϦγʔྫ

Slide 19

Slide 19 text

Kubernetes Network Policy σϞ 19 6CVOUV /(*/9 ❌ DVSMIUUQ/(*/9@*1

Slide 20

Slide 20 text

˓ /FUXPSL1PMJDZͷ֦ு ˔ ΧελϜϦιʔε ˓ ໊લۭؒPSΫϥελશମ ˔ $JMJVN/FUXPSL1PMJDZ ˔ $JMJVN$MVTUFSXJEF/FUXPSL1PMJDZ ˓ "MMPX%FOZ྆ํઃఆՄೳ ˓ -ϨϕϧͰͷϙϦγʔΛઃఆՄೳ Cilium Network Policy 20

Slide 21

Slide 21 text

Cilium Network Policy L3 21 ˓ -BCFMϕʔε ˔ 1PEͷϥϕϧͰࢦఆ ˓ *1$*%3ϕʔε ˓ %/4ϕʔε ˓ 4FSWJDFϕʔε ˓ &OUJUZϕʔε -BCFMϕʔε$JMJVN/FUXPSL1PMJDZྫ

Slide 22

Slide 22 text

Cilium Network Policy L3 22 ˓ -BCFMϕʔε ˓ *1$*%3ϕʔε ˔ *1ΞυϨε ˔ *1ΞυϨεൣғ ˓ %/4ϕʔε ˓ 4FSWJDFϕʔε ˓ &OUJUZϕʔε *1$*%3ϕʔε$JMJVN/FUXPSL1PMJDZྫ

Slide 23

Slide 23 text

Cilium Network Policy L3 23 ˓ -BCFMϕʔε ˓ *1$*%3ϕʔε ˓ %/4ϕʔε ˔ '2%/Ͱࢦఆ ˓ 4FSWJDFϕʔε ˓ &OUJUZϕʔε %/4ϕʔε$JMJVN/FUXPSL1PMJDZྫ

Slide 24

Slide 24 text

Cilium Network Policy L3 24 ˓ -BCFMϕʔε ˓ *1$*%3ϕʔε ˓ %/4ϕʔε ˓ 4FSWJDFϕʔε ˔ ಛఆͷ4FSWJDFϦιʔε΁ͷ௨৴Λ੍ޚ ˓ &OUJUZϕʔε 4FSWJDFϕʔε$JMJVN/FUXPSL1PMJDZྫ

Slide 25

Slide 25 text

Cilium Network Policy L3 25 ˓ -BCFMϕʔε ˓ *1$*%3ϕʔε ˓ %/4ϕʔε ˓ 4FSWJDFϕʔε ˓ &OUJUZϕʔε ˔ &OUJUZʢଐੑʣͰ௨৴Λ੍ޚ ˗ Ϋϥελ֎ ˗ Ϋϥελ಺ ˗ $JMJVN؅ཧ ˗ $JMJVN؅ཧ֎ ˗ ͳͲ &OUJUZϕʔε$JMJVN/FUXPSL1PMJDZྫ

Slide 26

Slide 26 text

Cilium Network Policy L4 26 ˓ 5$16%1ϙʔτ൪߸ ˓ *$.1λΠϓ 5$1ϙʔτ൪߸$JMJVN/FUXPSL1PMJDZͷྫ

Slide 27

Slide 27 text

Cilium Network Policy L4 27 ˓ 5$16%1ϙʔτ൪߸ ˓ *$.1λΠϓ ˔ *$.1ɺ*$.1WͷλΠϓ ˔ GFBUVSFϑϥάΛ༗ޮʹ͢Δ͜ͱͰར༻Մೳ ˔ ͨͩ͠ݱࡏ͸҆ఆಈ࡞͠ͳ͍ͨΊඇਪ঑ *$.1λΠϓ$JMJVN/FUXPSL1PMJDZͷྫ

Slide 28

Slide 28 text

Cilium Network Policy L7 28 ˓ ڐՄϦετͷΈ ˓ )551 ˔ ύε ˔ ϗετ໊ ˔ ϝιου ˔ ϔομʔ ˓ %/4 ˓ ,BGLB CFUB )551$JMJVN/FUXPSL1PMJDZͷྫ

Slide 29

Slide 29 text

Cilium Network Policy L7 29 ˓ ڐՄϦετͷΈ ˓ )551 ˓ %/4 ˔ ໊લࢦఆ ˔ ύλʔϯϚον ˓ ,BGLB CFUB %/4$JMJVN/FUXPSL1PMJDZͷྫ

Slide 30

Slide 30 text

Cilium Network Policy L7 30 ˓ ڐՄϦετͷΈ ˓ )551 ˓ %/4 ˓ ,BGLB CFUB ˔ 3PMF ˔ "1*Ωʔ ˔ "1*όʔδϣϯ ˔ ΫϥΠΞϯτ*% ˔ τϐοΫ ,BGLB$JMJVN/FUXPSL1PMJDZͷྫ

Slide 31

Slide 31 text

Cilium Network Policy σϞ L7-HTTP 31 6CVOUV /(*/9 ❌ BMMPX EFOZ

Slide 32

Slide 32 text

Cilium Network Policyͷ࣮ݱ 32 /FUXPSL1PMJDZΛهड़ͨ͠ ϚχϑΣετϑΝΠϧ DJMJVNQLHLTXBUDIFSTDJMJVN@OFUXPSL@QPMJDZHP ,T8BUDIFSBEE$JMJVN/FUXPSL1PMJDZ7

Slide 33

Slide 33 text

Cilium Network Policyͷ࣮૷ 33 ϙϦγʔͷݕࠪ Ϣʔβۭؒʢ(Pݴޠʣ DJMJVNQLHa QPMJDZBQJSVMF@WBMJEBUJPOHP 3VMF4BOJUJ[F

Slide 34

Slide 34 text

Cilium Network Policyͷ࣮૷ 34 ϙϦγʔͷݕࠪ /FUXPSL1PMJDZ F#1'.BQʹ ରԠ͢Δߏ଄ମʹม׵ Ϣʔβۭؒʢ(Pݴޠʣ DJMJVNQLHa QPMJDZBQJSVMF@WBMJEBUJPOHP 3VMF4BOJUJ[F DJMJVNQLHa FOEQPJOUCQGHP &OEQPJOUBEE1PMJDZ,FZ F#1'.BQʹରԠͨ͠ߏ଄ମ

Slide 35

Slide 35 text

Cilium Network Policyͷ࣮૷ 35 ϙϦγʔͷݕࠪ F#1'.BQʹରԠͨ͠ߏ଄ମ /FUXPSL1PMJDZ F#1'.BQʹ ରԠ͢Δߏ଄ମʹม׵ F#1'.BQʹ௥Ճ -͸&OWPZ Ϣʔβۭؒʢ(Pݴޠʣ DJMJVNQLHa QPMJDZBQJSVMF@WBMJEBUJPOHP 3VMF4BOJUJ[F DJMJVNQLHa FOEQPJOUCQGHP &OEQPJOUBEE1PMJDZ,FZ DJMJVNQLHa CQGNBQ@MJOVYHP .BQ6QEBUF

Slide 36

Slide 36 text

˓ F#1'ϓϩάϥϜؒ΍ϢʔβۭؒϓϩάϥϜͱ σʔλΛڞ༗͢Δ࢓૊Έ ˔ Ϣʔβۭ͔ؒΒ͸γεςϜίʔϧΛൃߦ ˓ LFZWBMVFετΞ eBPF Map 36 F#1' .BQT

Slide 37

Slide 37 text

Cilium Network Policyͷ࣮૷ 37 ύέοτ Χʔωϧۭؒ

Slide 38

Slide 38 text

Cilium Network Policyͷ࣮૷ 38 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β ϚοϓΩʔʹରԠ͢Δ ߏ଄ମʹม׵ DJMJVNCQGMJCa DPOOUSBDLI DU@MPPLVQ DU@MPPLVQ

Slide 39

Slide 39 text

Cilium Network Policyͷ࣮૷ 39 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β ϚοϓΩʔʹରԠ͢Δ ߏ଄ମʹม׵ DJMJVNCQGMJCa DPOOUSBDLI DU@MPPLVQ DU@MPPLVQ DJMJVNCQGMJCa QPMJDZI @@QPMJDZ@DBO@BDDFTT

Slide 40

Slide 40 text

Cilium Network Policyͷ࣮૷ 40 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β ϚοϓΩʔʹରԠ͢Δ ߏ଄ମʹม׵ DJMJVNCQGMJCa DPOOUSBDLI DU@MPPLVQ DU@MPPLVQ DJMJVNCQGMJCa QPMJDZI @@QPMJDZ@DBO@BDDFTT

Slide 41

Slide 41 text

Cilium Network Policyͷ࣮૷ 41 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β ϚοϓΩʔʹରԠ͢Δ ߏ଄ମʹม׵ র߹͢Δ 1PMJDZ.BQ F#1'.BQ %SPQ 1BTT DJMJVNCQGMJCa DPOOUSBDLI DU@MPPLVQ DU@MPPLVQ DJMJVNCQGMJCa QPMJDZI @@QPMJDZ@DBO@BDDFTT

Slide 42

Slide 42 text

·ͱΊ 42 ˓ /FUXPSL1PMJDZϦιʔεͰ1PEͷ௨৴Λ੍ޚͰ͖Δ ˓ $JMJVN/FUXPSL1PMJDZ͸/FUXPSL1PMJDZͷ֦ு ˔ -ɺ-ɺ-ϙϦγʔ ˓ $JMJVN͸F#1'Λ׆༻ͯ͠/FUXPSL1PMJDZΛ࣮ݱ ˔ F#1'.BQΛ࢖ͬͯϙϦγʔ৘ใΛ఻೻