10分で学ぶKubernetesコンテナセキュリティ/10min-k8s-container-sec

by mochizuki875

Slide 1

Slide 1 text

!NPDIJ[VLJ ෼ͰֶͿ ,VCFSOFUFTίϯςφηΩϡϦςΟ 'JOEZ-VODI-5Ϋϥ΢υηΩϡϦςΟΛ࠶ۛຯ͢ΔͨΊʹ ʙ࣮ྫ͔ΒֶͿɺߟྀ͢΂͖؍఺ͱͦͷରࡦࣄྫʙ

Slide 2

Slide 2 text

XIPBNJ !NPDIJ[VLJ 🌕,FJUB.PDIJ[VLJ ❤,VCFSOFUFT 🚨"GPY OPUBSBDDPPOEPH

Slide 3

Slide 3 text

<એ఻>$MPVE/BUJWF%BZT8JOUFS ৐ͬऔΕ,VCFSOFUFTʂʂdϦεΫ͔ΒֶͿ,VCFSOFUFTηΩϡϦςΟͷߟ͑ํd IUUQTTQFBLFSEFDLDPNNPDIJ[VLJLTSJTLBOETFDVSJUZDDFDEEBEGEFE

Slide 4

Slide 4 text

<એ఻>,VCFSOFUFT#MPH ,VCFSOFUFT#MPH4QPUMJHIUPO,VCFSOFUFT6QTUSFBN5SBJOJOHJO+BQBO IUUQTLVCFSOFUFTJPCMPHLTVQTUSFBNUSBJOJOHKBQBOTQPUMJHIU

Slide 5

Slide 5 text

஫ҙࣄ߲ ຊൃද͸αΠόʔ߈ܸΛߠఆ͢Δ΋ͷͰ͸͋Γ·ͤΜ ܝࡌ಺༰͸ݸਓͷݟղͰ͋Γɺॴଐ͢Δاۀ΍૊৫ͷཱ৔ɺઓུɺҙݟΛ୅ද͢Δ΋ͷͰ͸͋Γ·ͤΜ هࡌ͞Ε͍ͯΔձ໊ࣾɺ঎඼໊ɺ·ͨ͸αʔϏε໊͸ɺ֤ࣾͷ঎ඪొ࿥·ͨ͸঎ඪͰ͢

Slide 6

Slide 6 text

ίϯςφηΩϡϦςΟʁ ,VCFSOFUFT΍ίϯςφ͸Ϋϥ΢υωΠςΟϒٕज़ͷதͰ΋޿͘׆༻͞ΕΔٕज़ͱͳΓ·ͨ͠ɻ $/$'"//6"-4637&: IUUQTXXXDODGJPSFQPSUTDODGBOOVBMTVSWFZ

Slide 7

Slide 7 text

ίϯςφηΩϡϦςΟʁ コンテナセキュリティやって。ぶっちゃけよくわからんけどいい感じにね！はいっ !

Slide 8

Slide 8 text

ίϯςφηΩϡϦςΟʁ ͿͬͪΌ͚΍Γͨ͘ͳ͍ むずそう。。。え、やだえ、待って、何やれば良いの？コンテナセキュリティ is 何？

Slide 9

Slide 9 text

ίϯςφηΩϡϦςΟʁ ಛʹ1SPEVDUJPO؀ڥͰ,VCFSOFUFTίϯςφΛར༻͢Δ࣌ ηΩϡϦςΟͷݕ౼͸ආ͚ͯ௨Δ͜ͱͷͰ͖ͳ͍՝୊ͷͭ 🛡 🗡 Ͱ΋΍Βͳ͖Ό͍͚ͳ͍

Slide 10

Slide 10 text

ίϯςφηΩϡϦςΟʁ $/$'"//6"-4637&: IUUQTXXXDODGJPSFQPSUTDODGBOOVBMTVSWFZ

Slide 11

Slide 11 text

ίϯςφηΩϡϦςΟʁ $/$'"//6"-4637&: IUUQTXXXDODGJPSFQPSUTDODGBOOVBMTVSWFZ

Slide 12

Slide 12 text

͡Ό͋Ͳ͏޲͖߹͏͔ʁ XIZΛ஌Δ͜ͱ͸ॏཁ ɹ✅໨తͷຊ࣭తͳཧղʹΑΔඞཁे෼ͳରࡦ ɹɹɹରࡦʹ͸ඞͣʮԿ͔ΒकΔ͔ʯͱ͍͏໨త͕͋Δ ɹɹɹɹ❌कΔ΂͖΋ͷΛͪΌΜͱकΕ͍ͯΔ͔෼͔Βͳ͍ ɹɹɹ༷ʑͳରࡦ͕ଘࡏ͢Δ ɹɹɹɹ❌ա৒ͳରࡦʹΑΔίετͷ૿Ճ ɹ✅ͲͷΑ͏ʹϦεΫʹ޲͖߹͏΂͖͔ମܥతͳཧղ ɹɹɹϦεΫ͸ࠜຊతͳ࢓૊Έ͕มΘΒͳ͍ݶΓมԽ͠ͳ͍ ɹɹɹɹ❌৽͍͠ରࡦʹग़ձͬͨ࣌ʹରԠͰ͖ͳ͍

Slide 13

Slide 13 text

We have fallen many times before. That’s why we take great care not to fall again. ࢲͨͪ͸͜Ε·ͰʹԿ౓΋సΜͩ͜ͱ͕͋Δɻ͔ͩΒస͹ͳ͍Α͏ʹࡉ৺ͷ஫ҙΛ෷͏ͷͩɻ

Slide 14

Slide 14 text

,VCFSOFUFTίϯςφηΩϡϦςΟ ,VCFSOFUFTͰίϯςφΛѻ͏৔߹ͷηΩϡϦςΟ͸ɺ࣍ͷΑ͏ͳϨΠϠʹ෼͚ͯߟ͑Δ͜ͱ͕ Ͱ͖·͢ɻҰൠతʹ͸֤ϨΠϠʹରͯ͠ରࡦΛߦ͏ଟ૚๷ޚͷߟ͑ํ͕ਪ঑͞Ε·͢ɻ ಛʹίϯςφΛѻ͏ίϯςφ։ൃऀͷཱ৔Ͱ͸ɺίϯςφΠϝʔδ΍ίϯςφͦͷ΋ͷͷ ηΩϡϦςΟʹ஫ҙΛ޲͚Δඞཁ͕͋Γ·͢ɻ "QQMJDBUJPO 安全なワークロードをコンテナとして実行する安全なコンテナ実行環境を提供する $POUBJOFS*NBHF $POUBJOFS ,VCFSOFUFT $MPVE%BUBDFOUFS コンテナ開発者

Slide 15

Slide 15 text

,VCFSOFUFTίϯςφηΩϡϦςΟ ϦεΫҼࢠͷࠞೖ Πϝʔδͷྲྀग़ ίϯςφΠϝʔδͷվ᜵ ίϯςφͷઃఆෆඋ Ϧιʔεͷա৒ར༻ ա৒ͳݖݶ ൿີ৘ใͷྲྀग़ ෆਖ਼ͳ௨৴ ίϯςφ։ൃऀͷཱ৔Ͱ΋ηΩϡϦςΟʹ͍ͭͯߟ͑Δ΂͖ࣄ߲͸ͨ͘͞Μ͋Γ·͢ɻ ✅08"41,VCFSOFUFT5PQ5FO ɹɹIUUQTPXBTQPSHXXXQSPKFDULVCFSOFUFTUPQUFO ✅/*4541"QQMJDBUJPO$POUBJOFS4FDVSJUZ(VJEF ɹɹIUUQTOWMQVCTOJTUHPWOJTUQVCTTQFDJBMQVCMJDBUJPOTOJTUTQQEG

Slide 16

Slide 16 text

Slide 17

Slide 17 text

ίϯςφͷઃఆෆඋʹΑΔϦεΫ 08"41,VCFSOFUFT5PQ5FO 5PQ,VCFSOFUFT3JTLTΑΓ IUUQTPXBTQPSHXXXQSPKFDULVCFSOFUFTUPQUFOFOTSD,JOTFDVSFXPSLMPBEDPO fi HVSBUJPOT

Slide 18

Slide 18 text

ίϯςφͷઃఆෆඋʹΑΔϦεΫ ίϯςφ͸ίϯςφϗετ͔ΒݟΕ͹ͭͷϓϩηεʹա͗·ͤΜɻ ௨ৗͷϓϩηεͱͷҧ͍͸ɺ-JOVYΧʔωϧͷ༷࣋ͭʑͳ࢓૊ΈʹΑΓ ίϯςφϓϩηε͕ଞ͔Βִ཭͞Ε͍ͯΔ఺Ͱ͢ɻ $POUBJOFS 1SPDFTT 1SPDFTT" 1SPDFTT# 全て1プロセスに過ぎない ࣮ߦ؀ڥݖݶϦιʔε ͷ؍఺Ͱִ཭ ίϯςφϗετ /PEF

Slide 19

Slide 19 text

ίϯςφͷઃఆෆඋʹΑΔϦεΫ ίϯςφΛѻ͏্Ͱͷ୅දతͳηΩϡϦςΟϦεΫͱͯ͠$POUBJOFS#SFBLPVU͕͋Γ·͢ɻ ίϯςφ͸ִ཭͞Εͨ؀ڥΛ࡞Γग़ٕ͢ज़Ͱ͕͢ɺίϯςφͷઃఆෆඋ΍੬ऑੑ౳͕ཁҼͱͳΓɺ ίϯςφͷִ཭؀ڥ͔Β֎෦ʹӨڹΛٴ΅͢͜ͱ͕ՄೳʹͳΔ৔߹͕͋Γ·͢ɻ ಛʹίϯςφ͸ෳ਺ͷίϯςφ͕ಉҰͷίϯςφϗετͰ࣮ߦ͞ΕΔέʔε͕ҰൠతͰ͋ΔͨΊɺ $POUBJOFS#SFBLPVU͕੒ཱ͢ΔͱͦͷӨڹ͕ଞͷίϯςφʹ೾ٴ͢ΔϦεΫ΋͋Γ·͢ɻ $POUBJOFS 1SPDFTT ίϯςφϗετ /PEF $POUBJOFS 1SPDFTT

Slide 20

Slide 20 text

ίϯςφͷઃఆෆඋʹΑΔϦεΫ ίϯςφ։ൃऀ͕ઃఆෆඋͷ͋ΔίϯςφΛɺ,VCFSOFUFTʹ1PEͱͯ͠σϓϩΠͨ͠ έʔεΛߟ͑·͢ɻ OPEF TBNQMFXFC CBDLFOEBQQ LVCFDUMBQQMZGTBNQMFXFCZBNM

Slide 21

Slide 21 text

ίϯςφͷઃఆෆඋʹΑΔϦεΫ ԿΒ͔ͷཁҼʹΑΓɺ߈ܸऀ͕1PEʹؚ·ΕΔίϯςφʹ৵ೖͨ͠ͱ͠·͢ɻ ຊདྷͰ͋Ε͹৵ೖʹΑΔӨڹ͸ɺίϯςφ಺ʹཹ·Δ΂͖Ͱ͢ɻ OPEF IPTUOBNF TBNQMFXFC XIPBNJ SPPU Podに侵入 TBNQMFXFC CBDLFOEBQQ

Slide 22

Slide 22 text

ίϯςφͷઃఆෆඋʹΑΔϦεΫ ͔͠͠ίϯςφʹઃఆෆඋ͕͋Δͱɺίϯςφ͔Βίϯςφϗετ /PEF ΁ͷ৵ೖΛڐͯ͠͠·͏ ৔߹͕͋Γ·͢ɻ OPEF TBNQMFXFC CBDLFOEBQQ (勝った...!) ✌ OTFOUFSUBCJOCBTI QZUIPODJNQPSUQUZQUZTQBXO CJOCBTI SPPU!OPEFIPTUOBNF OPEF SPPU!OPEFXIPBNJ SPPU コンテナからNodeに侵入できた

Slide 23

Slide 23 text

ίϯςφͷઃఆෆඋʹΑΔϦεΫ ͞Βʹίϯςφϗετʹ৵ೖ͞Εͨ͜ͱͰɺଞͷίϯςφʹӨڹ͕ٴͿՄೳੑ΋͋Γ·͢ɻ OPEF TBNQMFXFC CBDLFOEBQQ 👍 SPPU!OPEFDSJDUMQT $0/5"*/&3/".&10% ECCGCBVCVOUVTBNQMFXFC EBBFDGDBQQCBDLFOEBQQ SPPU!CBDLFOEBQQDSJDUMFYFDJUEBBFDGDCJOCBTI SPPU!CBDLFOEBQQMTEBUB DSFEFOUJBMT SPPU!CBDLFOEBQQDBUEBUBDSFEFOUJBMT %"5"#"4&@)045ECFYBNQMFDPN %"5"#"4&@1035 %"5"#"4&@/".&DVTUPNFS %"5"#"4&@64&3/".&VTFS %"5"#"4&@1"44803%1!TTXSE 他のコンテナに含まれる秘密情報を奪取できた

Slide 24

Slide 24 text

ίϯςφͷઃఆෆඋʹΑΔϦεΫ ࠓճͷέʔεͰ1PEͷσϓϩΠʹ࢖༻͞Ε͍ͯͨϚχϑΣετ͸ҎԼͷ௨ΓͰ͢ɻ ͜ͷϚχϑΣετͰ͸ίϯςφʹର͢Δͭͷ੬ऑͳઃఆؚ͕·Ε͍ͯ·͢ɻ BQJ7FSTJPOW LJOE1PE NFUBEBUB OBNFTBNQMFXFC MBCFMT BQQTBNQMFXFC TQFD IPTU1*%USVF DPOUBJOFST OBNFVCVOUV JNBHFVCVOUV DPNNBOE<CJOCBTI D TMFFQJO fi OJUZ> TFDVSJUZ$POUFYU QSJWJMFHFEUSVF TBNQMFXFCZBNM

Slide 25

Slide 25 text

ίϯςφͷઃఆෆඋʹΑΔϦεΫ ௨ৗίϯςφϓϩηε͸ɺίϯςφϗετʹର͢Δݖݶ੍͕ݶ͞Εͨঢ়ଶͰ࣮ߦ͞Ε·͢ɻ ͔͠͠QSJWJMFHFEUSVFͱ͍͏ઃఆʹΑΓɺ͜ͷ੍ݶ͕ແޮԽ͞Ε·͢ɻ ·ͨɺίϯςφϓϩηε͸௨ৗͷϓϩηεͱ࣮ߦۭؒΛִ཭࣮ͯ͠ߦ͞ΕΔͨΊɺ ຊདྷίϯςφϗετ্ͷϓϩηεΛࢀরग़དྷ·ͤΜɻ -JOVYͷ1*%/BNFTQBDFͱ͍͏࢓૊ΈʹΑΔ ͔͠͠IPTU1*%USVFͱ͍͏ઃఆʹΑΓɺ͜ͷִ཭͕ແޮԽ͞Ε·͢ɻ $POUBJOFS 1SPDFTT 1SPDFTT" 1SPDFTT# QSJWJMFHFEUSVF -JOVYΧʔωϧʹର͢Δ ੍ݶ͕ແޮԽ͞Εͨঢ়ଶ IPTU1*%USVF ଞϓϩηεΛ ࢀরՄೳͳঢ়ଶ ίϯςφϗετ /PEF

Slide 26

Slide 26 text

͜ͷྫ͔Βֶ΂Δ͜ͱ ✅ίϯςφͷઃఆෆඋʹΑͬͯ$POUBJOFS#SFBLPVU͕ൃੜ͠ಘΔ ɹࠓճͷΑ͏ͳQSJWJMFHFEUSVF΍IPTU1*%USVF͸ۃྗආ͚Δ΂͖ ✅ίϯςφ͸ͦͷ࢓૊Έ্$POUBJOFS#SFBLPVUͷϦεΫΛሃΜͰ͍Δ ɹԿΒ͔ͷཧ༝Ͱ$POUBJOFS#SFBLPVU͕Ҿ͖ى͜͞ΕΔͱͦͷӨڹ͸ਙେ

Slide 27

Slide 27 text

ରࡦίϯςφͷִ཭ੑΛҡ࣋ɾ޲্ͤ͞Δ ίϯςφ։ൃऀ͕ίϯςφΛ࣮ߦ͢Δࡍ͸͜ͷΑ͏ͳϦεΫΛ౿·͑ɺ ʮίϯςφͷִ཭ੑΛҡ࣋ɾ޲্ʯͤ͞ΔͨΊͷରࡦΛߦ͏ඞཁ͕͋Γ·͢ɻ ίϯςφϗετ /PEF ίϯςφ֎ʹӨڹ $POUBJOFS 1SPDFTT $POUBJOFS 1SPDFTT ίϯςφͷִ཭ੑ͕֬อ͞Ε͓ͯΓ ηΩϡϦςΟϨϕϧ͕ߴ͍ঢ়ଶ ίϯςφͷִ཭ੑ͕֬อ͞Ε͓ͯΒͣ ηΩϡϦςΟϨϕϧ͕௿͍ঢ়ଶ #SFBLPVU

Slide 28

Slide 28 text

ରࡦίϯςφͷִ཭ੑΛҡ࣋ɾ޲্ͤ͞Δ 1PE4FDVSJUZ4UBOEBSET IUUQTLVCFSOFUFTJPEPDTDPODFQUTTFDVSJUZQPETFDVSJUZTUBOEBSET Pod Security Standards* ✅ෆཁͳઃఆΛߦΘͳ͍ ɹɹίϯςφͱͯ͠࠷௿ݶͷִ཭ੑΛ֬อ͢Δ ✅ִ཭ੑΛߴΊΔઃఆΛߦ͏ ɹɹ௥ՃͷઃఆʹΑΓִ཭ੑΛ͞ΒʹߴΊΔ ɹɹ ྫ͑͹੬ऑੑ౳ʹΑִͬͯ཭ੑͷ௿Լ͕ىͬͯ͜΋ॿ͔ΔՄೳੑ͕͋Δ ✅ίϯςφઃఆͷεΩϟϯ ɹɹίϯςφʹରִͯ͠཭ੑͷ௿Լʹܨ͕Δઃఆ͕ߦΘΕ͍ͯͳ͍͔Λݕ஌ ɹɹFH,VCFSOFUFTͰ͋Ε͹1PEͷઃఆΛεΩϟϯ 5SJWZ LVCFMJOUFSFUD ✅ͦͷଞ ɹɹϙϦγʔ੍ޚɺηΩϡΞͳίϯςφϥϯλΠϜɺৼΔ෣͍؂ࢹFUD

Slide 29

Slide 29 text

ࢀߟ ίϯςφʹؔ͢ΔͦͷͦͷଞͷϦεΫͷྫ ✅ίϯςφΠϝʔδ΁ͷϦεΫҼࢠͷࠞೖ ɹ😱ίϯςφ΁ͷ৵ೖ ✅ίϯςφΠϝʔδͷެ։ઃఆͷෆඋ ɹ😱ίϯςφΠϝʔδͷྲྀग़ ✅ίϯςφΠϝʔδͷ৴པੑෆ଍ ɹ😱վ᜵͞ΕͨίϯςφΠϝʔδͷ࢖༻ ✅ίϯςφΠϝʔδ΁ͷൿີ৘ใͷࠞೖ ɹ😱ίϯςφΠϝʔδ͔Βൿີ৘ใͷୣऔɹ ✅ίϯςφͷϧʔτϑΝΠϧγεςϜ΁ͷॻ͖ࠐΈڐՄ ɹ😱ίϯςφͷվ᜵ ✅ίϯςφͷແ੍ݶͳϦιʔε࢖༻ ɹ😱ίϯςφϗετͷϦιʔεͷա৒ͳ࢖༻ ✅1PE΁ͷա৒ͳݖݶͷ෇༩ ɹ😱,VCFSOFUFTͷෆਖ਼ͳૢ࡞ ✅ίϯςφ͕࢖༻͢Δൿີ৘ใͷෆద੾ͳ؅ཧ ɹ😱ίϯςφͷൿີ৘ใͷྲྀग़ ✅1PEʹର͢Δ௨৴੍ݶͷະ࣮ࢪ ɹ😱1PEʹର͢Δෆਖ਼ͳ௨৴

Slide 30

Slide 30 text

13 "NB[PO ✅୅දతͳϦεΫΛ࣮ײ͠ରࡦͷߟ͑ํʢجૅʣΛཧղͰ͖Δ ɹɹ✔ϦεΫΛϕʔεͱͨ͠ষߏ੒ʢશέʔεʴЋʣ ɹɹ✔ϦεΫΛ౿·͑ͯରࡦͷجຊݪଇ΍۩ମతख๏ରࡦΛཧղͰ͖Δ ✅ϋϯζΦϯΛ௨ͯ͡۩ମతʹཧղͰ͖Δ ɹɹ✔खΛಈ͔͠ͳ͕Βֶ΂ΔʢϋϯζΦϯ཰͘Β͍ʣ ɹɹ✔,VCFSOFUFT޷͖Ͱ͋Ε͹ͦ͜·ͰηΩϡϦςΟʹڵຯ͕ͳ͍ਓͰ΋ָ͠ΊΔ ϦεΫ͔ΒֶͿ,VCFSOFUFTίϯςφηΩϡϦςΟ ίϯςφ։ൃऀ͕͓͓͑ͯ͘͞΂͖جૅ஌ࣝ ίϯςφηΩϡϦςΟΛֶͿೖΓޱ 絶賛発売中!!

Slide 31

Slide 31 text

໊༷ʹϓϨθϯτ🎁 Findy様、ありがとうございます🙏 アンケートへの回答で

Slide 32

Slide 32 text

5IBOL:PV