Vault Secrets Operatorの使用感について登壇した資料。
Vault Secrets Operator TutorialKubernetes Novice Tokyo #24Ryotaro Uwatsu
View Slide
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 2ࣗݾհName: Ryotaro Uwatsu (Twitter: @URyo_0213)Title: Solutions ArchitectCommunity:- Kubernetes Meetup Novice ӡӦ- Kubenews
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 3Table of Contents• What’s HashiCorp Vault• How to use Vault Secrets Operator
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 4What’s HashiCorp Vault
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 5HashiCorp VaultHashiCorp VaultɺγʔΫϨοτΛηΩϡΞʹཧ͢Δ͜ͱ͕ՄೳͳπʔϧͰ͢ɻ༷ʑͳΞΫηεํࣜΛ༻͍ͯɺϙϦγʔʹԊͬͨγʔΫϨοτͷΞΫηε͕ՄೳͰ͢ɻҎԼͷΑ͏ʹ༷ʑͳܗࣜͷγʔΫϨοτΛཧ͢Δ͜ͱ͕Մೳͱͳ͍ͬͯ·͢ɻ• γʔΫϨοτཧ• User identityཧ• PKI• etc...
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 6ͳΜͰVault͕͋Δͱ͏Ε͍͠ͷ͔Secretͷσʔλɺbase64ͰΤϯίʔυ͞Ε͍ͯΔ͚ͩͰɺ͙͢ʹղಡͰ͖ͯ͠·͍·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 7ͳΜͰVault͕͋Δͱ͏Ε͍͠ͷ͔ηΩϡΞʹSecretΛཧ͢Δํ๏ʹɺSealed Secretͱ͍ͬͨιϦϡʔγϣϯ͕͋ͬͨΓ͢Δ͕ɺ͕૿͑ͯ͠·ͬͨΓ͢Δͱཧ͕ࡶʹͳͬͯ͠·ͬͨΓɺΫϥελʔຖʹཧ͠ͳ͚ΕͳΒͳ͔ͬͨΓ͢ΔͷͰɺҰݩతʹγʔΫϨοτΛཧ͍ͯͨ͠͠ͱײͯ͡͠·͏Ͱ͠ΐ͏ɻAWSͷSecret ManagerͷΑ͏ͳΈ͋Δ͕ɺύϒϦοΫΫϥυͳͲʹΞΫηεͰ͖ͳ͔ͬͨΓɺͦ͜ʹஔ͘͜ͱͷͰ͖ͳ͍ใ͋Δ͔ͱࢥ͍·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 8KubernetesͷγʔΫϨοτͷద༻(ެࣜ)• Agent Injector– Init ContainerͰγʔΫϨοτΛಛఆͷσΟϨΫτϦʹૠೖ͠ɺҎޙมߋ͕͋ͬͨ߹SidecarAgent͕มߋΛө͠·͢ɻ• CSI Provider– CSIΛ༻͍ͯɺVolumeͱͯ͠SecretΛPodʹ༩͑·͢ɻ(ίϛϡχςΟ)• External Secret– ExternalSecret(CRD)Λ༻͍ͨSecretϦιʔεͷ࡞Λ͠·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 9KubernetesͷγʔΫϨοτͷద༻(ެࣜ)• Agent Injector– Init ContainerͰγʔΫϨοτΛಛఆͷσΟϨΫτϦʹૠೖ͠ɺҎޙมߋ͕͋ͬͨ߹SidecarAgent͕มߋΛө͠·͢ɻ• CSI Provider– CSIΛ༻͍ͯɺVolumeͱͯ͠SecretΛPodʹ༩͑·͢ɻ(ίϛϡχςΟ)• External Secret– ExternalSecret(CRD)Λ༻͍ͨSecretϦιʔεͷ࡞Λ͠·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 10KubernetesͷγʔΫϨοτͷద༻(ެࣜ)• Agent Injector– Init ContainerͰγʔΫϨοτΛಛఆͷσΟϨΫτϦʹૠೖ͠ɺҎޙมߋ͕͋ͬͨ߹SidecarAgent͕มߋΛө͠·͢ɻ• CSI Provider– CSIΛ༻͍ͯɺVolumeͱͯ͠SecretΛPodʹ༩͑·͢ɻ(ίϛϡχςΟ)• External Secret– ExternalSecret(CRD)Λ༻͍ͨSecretϦιʔεͷ࡞Λ͠·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 11ৄ͘͠...Kubernetes Novice Tokyo #15 ͰɺHashiCorpͷؒ͞Μ͕ൃද͍͍ͯͨͩͨ͠ࢿྉΛࢀর͍ͩ͘͞ɻhttps://speakerdeck.com/jacopen/k8stovaultwozu-mihe-wasetesikuretutowomotutosekiyuani
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 12͜Ε·ͰͷγʔΫϨοτใΛڥมͳͲʹద༻͍ͨ͠߹...ྫ) Agent Injectortemplateʹ͓͍ͯexport͢ΔΑ͏ʹॻ͖ɺίϯςφͰsourceίϚϯυΛ༻͍ͯద༻͠ͳ͚ΕͳΒͳΓ·ͤΜɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 13͜Ε·ͰͷγʔΫϨοτใΛڥมͳͲʹద༻͍ͨ͠߹...ྫ) CSI ProviderઃఆՄೳ͕ͩɺߋ৽ͨ͠߹ʹөͯ͘͠Ε·ͤΜɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 14Vault Secrets Operatorͷొ2023/03/29ͷϒϩάʹͯΞφϯε͞Ε·ͨ͠ɻ※ ·ͩϕʔλͱ͍͏ݐ͚ͳͷͰɺ༻͢Δࡍ͔ͬ͠Γͱݕ౼͍ͯͩ͘͠͞ɻhttps://www.hashicorp.com/blog/vault-secrets-operator-a-new-method-for-kubernetes-integration
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 15Vault Secrets OperatorVault Secrets Operator ɺ֤छCRDΛ༻͍ͯVaultͱKubernetesΛ࿈ܞͤ͞·͢ɻOperatorɺVault্ʹ͋ΔγʔΫϨοτσʔλΛλʔήοτͷKubernetes্ʹSecretϦιʔεͱͯ͠࡞͠ɺιʔεʹՃ͑ΒΕͨͯ͢ͷมߋ͕ө͞ΕΔΑ͏ʹͯ͘͠Ε·͢ɻରԠύλʔϯ• Static Secret– Key-Valueܕ(ver1, ver2)• Dynamic Secret– ύϒϦοΫΫϥυDBͷΞΫηεΛ͢ΔͨΊͷظݶ͖ೝূใΛಈతʹੜ͢Δͷ• PKI– ಈతͳ X.509 ূ໌ॻΛੜ͢Δ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 16How to use Vault Secrets Operator
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 17έʔεɾඪγʔΫϨοτΛVault͔Βऔಘ͠ɺ default ωʔϜεϖʔεʹSecretϦιʔεͱͯ͠࡞Ͱ͖ΔΑ͏ʹ͢ΔɻɾλεΫ0. ࣄલ४උ1. Vault Secrets OperatorͷΠϯετʔϧ2. VaultͷηοςΟϯά3. VaultConnectionͷ࡞4. VaultAuthͷ࡞5. VaultStaticSecretͷ࡞
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 180. ࣄલ४උ1. ࣄલʹHelmΛ༻͍ͯVaultΛ࡞͓ͯ͘͠ඞཁ͕͋Γ·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 190. ࣄલ४උ2. γʔΫϨοτΛVault͔Βऔಘ͢ΔࡍͷService AccountΛ࡞͠·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 201. Vault Secrets OperatorͷΠϯετʔϧࠓճɺVaultΛHelmΛ༻͍ͯೖΕͨ߹Λجʹ͍ͯ͠·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 21Vault Secrets Operator CRDVault Secret OperatorʹΑͬͯཧ͞ΕΔCRDNamespacedͳϦιʔεͱͯ͠ద༻͞Ε·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 222. VaultͷηοτΞοϓ1. Key-Value ver2Λ༗ޮԽ͠ɺSecretΛ࡞͠·͢ɻ2. Policyͷ࡞͠·͢ɻ ※pathɺSecret࡞࣌ͷύεͰͳ͘ɹ࡞࣌ͷग़ྗͷSecret Path
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 232. VaultͷηοτΞοϓ3. RoleΛ࡞͠·͢ɻ• auth/kubernetes/role/vso-demo-role– ͜ͷޙɺVaultAuthͰࢦఆ͠·͢[.spec.kubernetes.role]• bound_service_account_names: Service Account໊– (P.1*) 0-2Ͱ࡞ͨ͠Service Account– ͜ͷޙɺVaultAuthͰࢦఆ͠·͢[.spec.kubernetes.serviceAccount]• bound_service_account_namespaces: γʔΫϨοτΛ࡞͢ΔNamespace• policies: (P.1*) 1-2Ͱ࡞ͨ͠ϙϦγʔ໊
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 243. VaultConnectionͷ࡞ଓઌͱ͢ΔVaultΛࢦఆ͢ΔϦιʔεͰ͢ɻ[Մมύϥϝʔλ].spec.address=> VaultʹΞΫηε͢ΔΞυϨε͜ͷଞʹɺHTTPϔομʔTLSͷઃఆΛ͢Δύϥϝʔλ͕͋Γ·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 254. VaultAuthͷ࡞Vaultʹରͯ͠ɺೝূ͢ΔͨΊʹඞཁͳใΛهड़͢ΔϦιʔεͰ͢ɻ[Մมύϥϝʔλ].spec.vaultConnectionRef=> (P.1*) 3 Ͱ࡞ͨ͠VaultConnectionϦιʔε໊.spec.kubernetes.role=> (P.1*) 2-3 Ͱ࡞ͨ͠Vault্ͷrole.spec.kubernetes.serviceAccount=> (P.1*) 0-2 Ͱ࡞ͨ͠Service Account໊
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 265. VaultStaticSecretͷ࡞Vault͔Βऔಘͨ͠γʔΫϨοτΛɺKubernetes্ʹSecretͱͯ͠࡞͢ΔϦιʔεͰ͢ɻ[Մมύϥϝʔλ].spec.vaultAuthRef=> (P.1*) 4 Ͱ࡞ͨ͠VaultAuthϦιʔε໊.spec.destination.name=> Kubernetes্ʹ࡞͢ΔSecretϦιʔε໊.spec.mount / .spec.name=> (P.1*) 2-1 Ͱ࡞ͨ͠Vault্ͷγʔΫϨοτͷύεmount name
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 275. VaultStaticSecretͷ࡞ҎԼͷΑ͏ʹɺSecretϦιʔε͕࡞͞Ε·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 28͠֊͕ਂ͘ͳͬͨ߹Ͳ͏ͨ͠Β͍͍ʁઌ΄ͲͷྫͰɺ2֊ͰͷγʔΫϨοτ࡞Λ͔ͨ͠Β͔Γ͔ͬͨ͢ͱࢥ͍·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 29͠֊͕ਂ͘ͳͬͨ߹Ͳ͏ͨ͠Β͍͍ʁ֊͕૿͑ͯҎԼͷ௨Γʹద༻͢Δ͜ͱ͕Ͱ͖·͢ɻ
Copyright © Dell Inc. All Rights Reserved.Internal Use - Confidential 30·ͱΊSidecar Agent Injector CSI Provider Vault Secrets OperatorγʔΫϨοτͷఏڙํ๏ Volume (emptyDir) VolumeڥมSecretγʔΫϨοτλΠϓ StaticDynamicPKIStaticDynamicPKIStaticDynamicPKIςϯϓϨʔτ ʓ × × (2023/04/17࣌)γʔΫϨοτϩʔςʔγϣϯʓ × ʓVault Secrets OperatorΛ༻͍ͯɺ͜Ε·ͰҎ্ʹγʔΫϨοτΛѻ͍͘͢ͳΓ·ͨ͠ɻࠓճհͨ͠ͷҎ֎ʹ༷ʑͳར༻ํ๏͕͋ΔͷͰɺͥͻࢼͯ͠Έ͍ͯͩ͘͞ɻଞͷKubernetesͱͷ࿈ܞํ๏ͱͷ؆୯ͳൺֱҎԼͷ௨ΓͰ͢ɻ