Tweet
Tweet

Slide 1

Slide 1 text

Istio RBAC ೖ໳ ෋࢜௨גࣜձࣾ ࡾ޷ ढ़հ

Slide 2

Slide 2 text

ࣗݾ঺հ • ࣾձਓ3೥໨ • Kubernetesͷٕज़ݕূɾීٴ׆ಈɾΞϓϦ։ൃͳͲ • IstioͷϑΝϯ • KubeCon 2017ͰॳΊͯݟͨ࣌ʹײಈ • झຯϓϩάϥϚʔ • GitHub: https://github.com/sh-miyoshi • Twitter: https://twitter.com/shmiyoshi

Slide 3

Slide 3 text

ࠓ೔օ͞Μʹ͓఻͍͑ͨ͜͠ͱ • ͜ͷઌϚΠΫϩαʔϏεԽͷ೾͸͖ͬͱ͘Δ • ͍͔ͭඞͣηΩϡϦςΟ͕໰୊ʹͳΔ • Microservices + Security
 → 1ͭͷղͱͯ͠Istio

Slide 4

Slide 4 text

ϚΠΫϩαʔϏε࣌୅ͷηΩϡϦςΟ ֤αʔϏεͦΕͧΕ͕ߴ͍ϨϕϧͰͷηΩϡϦ ςΟΛ࣮ݱ͠ͳ͚Ε͹ͳΒͳ͍

Slide 5

Slide 5 text

Istio RBAC

Slide 6

Slide 6 text

Istio RBACͱ͸ʁ • IstioͷΞΫηείϯτϩʔϧػೳͷҰͭ • KubernetesͷRBACͱಉ༷͡ͳ࢖͍ํͰ Serviceؒͷ௨৴ͷΞΫηε੍ޚͰ͖Δ
 (k8s͸ϦιʔεͷΞΫηε੍ޚ) ྫʣserviceAͷGET /pathʹ͸userA͚ͩΞΫη εΛڐՄ͢Δͱ͍͏Α͏ͳઃఆ͕Մೳ

Slide 7

Slide 7 text

Istio RBACͰͰ͖Δ͜ͱ • ServiceͷೝՄ(Authorization)
 ※ೝূ(Authentication)͸Istio mTLSͰ΍Δ → ࣗ਎ͷService͕ͲͷService(΍User)ʹΞ ΫηεΛڐ͔͢ΛઃఆͰ͖Δ

Slide 8

Slide 8 text

Istio RBACͷ࢖͍ํ 1. IstioΛΠϯετʔϧ • ࠓͩͱGKE͕ศར(νΣοΫೖΕΔ͚ͩ) • mTLSΛ༗ޮʹͯ͠ىಈ͢Δ 2. Istio RBACΛ༗ޮԽ • σϑΥϧτ͸DisableͳͷͰEnableʹ͢ΔͨΊͷ CRDΛk8sʹapply͢Δ • ※༗ޮʹͳΔ·Ͱগ͕͔͔࣌ؒ͠Δ৔߹͕͋Γ·͢

Slide 9

Slide 9 text

Istio RBACͷ࢖͍ํ 3. ΞϓϦͷσϓϩΠ • istioctlίϚϯυͰΞϓϦΛσϓϩΠ 4. αʔϏεؒ௨৴ΛڐՄ • CRDͰServiceRoleΛ࡞Δ • ServiceRoleΛServiceRoleBinding(Istio CRD)Ͱ KubernetesͷServiceAccountʹݖݶΛ͚ͭΔ ͓·͚: ֎෦͔ΒͷΞΫηεΛڐՄ͢Δ • ུ

Slide 10

Slide 10 text

Let’s Go Demo ! *) https://github.com/sh-miyoshi/sectest खॱ͸sectest/rbac_demo/Apps_RBAC.md

Slide 11

Slide 11 text

Unhappy Things… • Istio͕େม • ࣦഊͨ࣌͠ϩά͕Ͳ͜ʹग़͍ͯΔ͔ෆ໌ • ίϯϙʔωϯτ͕ଟ͗͢ • ͳʹΛઃఆͨ͠Β͍͍͔෼͔Βͳ͍৔ॴ͕͋Δ • Serviceͷ໊લ͸ݻఆɺGatewayʹࢦఆग़དྷΔsecret໊΋ݻఆ • Istio RBAC͸·ͩalpha • ࢓༷͕େ͖͘มΘΔ͜ͱ΋ɾɾɾ
 (Istio v0.7 → v0.8Λ஌ͬͯΔਓ͸ۤ͠Έ͕Θ͔Δ͸ͣ)

Slide 12

Slide 12 text

·ͱΊ Microservices + Security → Istio RBACͷ঺հ ݱ࣌఺ͰIstioΛ࢖͏ͷ͸େม͔΋͚ͩͲଘࡏ Λ஌͓ͬͯ͘ͱخ͍͜͠ͱ͋Δ͔΋