CiliumによるKubernetes Network Policyの実現 CNDT2021

Transcript

1. CiliumʹΑΔ Kubernetes Network Policyͷ࣮ݱ 5PNPLJ
   4VHJVSB
2. ຊηογϣϯͷ֓ཁ 2 1PE 1PE 1PE
3. ຊηογϣϯͷ֓ཁ 3 $/*ϓϥάΠϯ 1PE 1PE 1PE 1PEؒͷ௨৴Λ؅ཧ
4. ຊηογϣϯͷ֓ཁ 4 ❌ $/*ϓϥάΠϯ 1PEؒͷ௨৴Λ؅ཧ 1PE 1PE 1PE
5. ຊηογϣϯͷ֓ཁ 5 ❌ Ͳ͏΍੍ͬͯޚʁ ઃఆ߲໨ʁ $/*ϓϥάΠϯ 1PEؒͷ௨৴Λ؅ཧ 1PE 1PE 1PE 1PEؒͷ௨৴Λ؅ཧ
6. ຊฤ΁ 6
7. Kubernetes 7 ˓ ίϯςφΦʔέετϨʔγϣϯπʔϧ
   ˔ ෳ਺୆ͷίϯςφΛҰݩ؅ཧ
   ˓ ίϯςφӡ༻ͷͨΊͷ͜ͱΛͳΜͰ΋΍Δ
   ˔ ΦʔτώʔϦϯάɾϩʔϦϯάΞοϓσʔτ
   ˔ ίϯςφʹద༻͢Δઃఆ஋ͷ؅ཧ
   ˔ ݖݶ؅ཧ
   ˔ FUD
   ˓ 1PEؒͷ௨৴ػೳˠ$/*ϓϥάΠϯʹҕৡ
   ˔ 1PEʹωοτϫʔΫ໊લۭؒΛڞ༗͢Δίϯςφ܈
8. CNI 8 ˓ $POUBJOFS
   /FUXPSL
   *OUFSGBDF
   ˓ $/$'
   *ODVCBUJOH
   1SPKFDU
   ˓ ίϯςφωοτϫʔΫ*'ͷ؅ཧʹ͓͚Δ࢓༷Λఆٛ
   ˔ ,VCFSOFUFTઐ༻πʔϧͰ͸ͳ͍
   ˓ ػೳ
   ˔ "%%ɿωοτϫʔΫ*'ͷ࡞੒ɾߋ৽
   ˔ %&-ɿωοτϫʔΫ*'ͷ࡟আɾߋ৽ͷऔফ
   ˔ $)&$,ɿظ଴௨Γͷઃఆ͔֬ೝ
   ˔ 7&34*0/ɿαϙʔτ͍ͯ͠Δ$/*࢓༷ͷόʔδϣϯΛฦ͢
9. ˓ $/*ʹ४ڌͨ͠,VCFSOFUFTͷ
   ωοτϫʔΫϓϥάΠϯ
   ˓ $/*όΠφϦ
   ˔ ίϯςφωοτϫʔΫ*'ͷ؅ཧ
   ˓ $/*σʔϞϯ
   ˔ Ϋϥελ಺ͰͷωοτϫʔΫૄ௨Λ؅ཧ
   ˓ $/*ϓϥάΠϯྫ
   ˔ $BMJDP
   ˔ $JMJVN
   ˔ FUD CNIϓϥάΠϯ 9 $/*
   ϓϥάΠϯ FUI "%% ωοτϫʔΫ*'ͷ࡞੒
   *1ΞυϨεͷׂΓ౰ͯ
   ܦ࿏ઃఆ
10. ˓ $/*ϓϥάΠϯͷҰͭ
    ˓ $/$'
    *ODVCBUJOH
    QSPKFDU
    ˓ σʔλϓϨʔϯʹF#1'Λ׆༻
    ˓ ར༻ࣄྫ
    ˔ (,&
    %BUBQMBOF
    7
    ˔ &,4
    "OZXIFSF Cilium 10
11. ˓ FYUFOEFE
    #FSLFMFZ
    1BDLFU
    'JMUFS
    ˓ ࣗ෼ͷ࡞੒ͨ͠ϓϩάϥϜΛ
    -JOVYΧʔωϧ಺ͷ7.Ͱ࣮ߦ
    ˔ ಠࣗϨδελ໋ྩηοτ
    ˔ ϓϩάϥϜͷݕࠪػߏ͕͋Γ҆શੑΛอো
    ˓ Πϕϯτۦಈ
    ˔ FH
    ύέοτ͕/*$ʹ౸ୡ
    ˓ $ݴޠͰهड़Մೳ
    ˔ $MBOH
    
    --7. eBPF 11 DMBOH
    UBSHFU
    CQG $ݴޠ
    ϓϩάϥϜ όΠτίʔυ 7FSJ fi FS +*5
    $PNQJMFS ΠϕϯτʹԠ࣮ͯ͡ߦ CQG  Ϣʔβۭؒ Χʔωϧۭؒ
12. ͜͜·Ͱͷ·ͱΊ 12 ˓ ,VCFSOFUFT͸1PEؒͷ௨৴ػೳΛ
    $/*ϓϥάΠϯʹҕৡ
    ˓ $/*ϓϥάΠϯ͸$/*४ڌͷ,VCFSOFUFTϓϥάΠϯ
    ˔ 1PEؒͷ௨৴ػೳͷఏڙɾ؅ཧΛߦ͏
    ˓ $JMJVN͸$/*ϓϥάΠϯͷҰछ
    ˔ σʔλϓϨʔϯʹF#1'Λ׆༻
13. Network Policyͱ͸ 13
14. Kubernetes Network PolicyϦιʔε 14 1PE 1PE 1PE
15. Kubernetes Network PolicyϦιʔε 15 1PE 1PE 1PE ❌
16. Kubernetes Network PolicyϦιʔε 16 1PE 1PE 1PE ❌
17. Kubernetes Network Policyͱ͸ 17 ˓ ,VCFSFOUFTͷϦιʔεͷҰछ
    ˓ --ͷ௨৴Λ੍ޚ
    ˔ *1ΞυϨε
    
    ϙʔτ൪߸
    ˓ $/*ϓϥάΠϯ͕ରԠ͍ͯ͠Ε͹࢖༻Մೳ
    ˔ $JMJVN͸ରԠ
    ˔ 'MBOOFM͸ະରԠ
    ˓ ུশ͸OFUQPM
    ˔ LVCFDUM
    HFU
    OFUQPM
    "
18. Kubernetes Network Policy ྫ 18 ˓ ໊લۭؒ͝ͱʹ࡞੒
    ˓ ڐՄϦετ
    ˓ --ϨϕϧͷϙϦγʔ
    ˓ *OHSFTTʢ֎͔Β಺ʣɼ&HSFTTʢ಺͔Β֎ʣ ωοτϫʔΫϙϦγʔྫ
19. Kubernetes Network Policy σϞ 19 6CVOUV /(*/9 ❌ DVSM
    IUUQ/(*/9@*1
20. ˓ /FUXPSL
    1PMJDZͷ֦ு
    ˔ ΧελϜϦιʔε
    ˓ ໊લۭؒ
    PS
    Ϋϥελશମ
    ˔ $JMJVN
    /FUXPSL
    1PMJDZ
    ˔ $JMJVN
    $MVTUFSXJEF
    /FUXPSL
    1PMJDZ
    ˓ "MMPX%FOZ
    ྆ํઃఆՄೳ
    ˓ -ϨϕϧͰͷϙϦγʔΛઃఆՄೳ Cilium Network Policy 20
21. Cilium Network Policy L3 21 ˓ -BCFMϕʔε
    ˔ 1PEͷϥϕϧͰࢦఆ
    ˓ *1$*%3ϕʔε
    ˓ %/4ϕʔε
    ˓ 4FSWJDFϕʔε
    ˓ &OUJUZϕʔε -BCFMϕʔε
    $JMJVN
    /FUXPSL
    1PMJDZ
    ྫ
22. Cilium Network Policy L3 22 ˓ -BCFMϕʔε
    ˓ *1$*%3ϕʔε
    ˔ *1ΞυϨε
    ˔ *1ΞυϨεൣғ
    ˓ %/4ϕʔε
    ˓ 4FSWJDFϕʔε
    ˓ &OUJUZϕʔε *1$*%3ϕʔε
    $JMJVN
    /FUXPSL
    1PMJDZ
    ྫ
23. Cilium Network Policy L3 23 ˓ -BCFMϕʔε
    ˓ *1$*%3ϕʔε
    ˓ %/4ϕʔε
    ˔ '2%/Ͱࢦఆ
    ˓ 4FSWJDFϕʔε
    ˓ &OUJUZϕʔε %/4ϕʔε
    $JMJVN
    /FUXPSL
    1PMJDZ
    ྫ
24. Cilium Network Policy L3 24 ˓ -BCFMϕʔε
    ˓ *1$*%3ϕʔε
    ˓ %/4ϕʔε
    ˓ 4FSWJDFϕʔε
    ˔ ಛఆͷ4FSWJDFϦιʔε΁ͷ௨৴Λ੍ޚ
    ˓ &OUJUZϕʔε 4FSWJDFϕʔε
    $JMJVN
    /FUXPSL
    1PMJDZ
    ྫ
25. Cilium Network Policy L3 25 ˓ -BCFMϕʔε
    ˓ *1$*%3ϕʔε
    ˓ %/4ϕʔε
    ˓ 4FSWJDFϕʔε
    ˓ &OUJUZϕʔε
    ˔ &OUJUZʢଐੑʣͰ௨৴Λ੍ޚ
    ˗ Ϋϥελ֎
    ˗ Ϋϥελ಺
    ˗ $JMJVN؅ཧ
    ˗ $JMJVN؅ཧ֎
    ˗ ͳͲ &OUJUZϕʔε
    $JMJVN
    /FUXPSL
    1PMJDZ
    ྫ
26. Cilium Network Policy L4 26 ˓ 5$16%1ϙʔτ൪߸
    ˓ *$.1λΠϓ 5$1ϙʔτ൪߸
    $JMJVN
    /FUXPSL
    1PMJDZͷྫ
27. Cilium Network Policy L4 27 ˓ 5$16%1ϙʔτ൪߸
    ˓ *$.1λΠϓ
    ˔ *$.1ɺ*$.1WͷλΠϓ
    ˔ GFBUVSFϑϥάΛ༗ޮʹ͢Δ͜ͱͰར༻Մೳ
    ˔ ͨͩ͠ݱࡏ͸҆ఆಈ࡞͠ͳ͍ͨΊඇਪ঑ *$.1λΠϓ
    $JMJVN
    /FUXPSL
    1PMJDZͷྫ
28. Cilium Network Policy L7 28 ˓ ڐՄϦετͷΈ
    ˓ )551
    ˔ ύε
    ˔ ϗετ໊
    ˔ ϝιου
    ˔ ϔομʔ
    ˓ %/4
    ˓ ,BGLB CFUB )551
    $JMJVN
    /FUXPSL
    1PMJDZͷྫ
29. Cilium Network Policy L7 29 ˓ ڐՄϦετͷΈ
    ˓ )551
    ˓ %/4
    ˔ ໊લࢦఆ
    ˔ ύλʔϯϚον
    ˓ ,BGLB CFUB %/4
    $JMJVN
    /FUXPSL
    1PMJDZͷྫ
30. Cilium Network Policy L7 30 ˓ ڐՄϦετͷΈ
    ˓ )551
    ˓ %/4
    ˓ ,BGLB CFUB
    ˔ 3PMF
    ˔ "1*Ωʔ
    ˔ "1*όʔδϣϯ
    ˔ ΫϥΠΞϯτ*%
    ˔ τϐοΫ ,BGLB
    $JMJVN
    /FUXPSL
    1PMJDZͷྫ
31. Cilium Network Policy σϞ L7-HTTP 31 6CVOUV /(*/9 ❌ BMMPX EFOZ
32. Cilium Network Policyͷ࣮ݱ 32 /FUXPSL1PMJDZΛهड़ͨ͠
    ϚχϑΣετϑΝΠϧ DJMJVNQLHLTXBUDIFSTDJMJVN@OFUXPSL@QPMJDZHP
    ,T8BUDIFSBEE$JMJVN/FUXPSL1PMJDZ7
33. Cilium Network Policyͷ࣮૷ 33 ϙϦγʔͷݕࠪ Ϣʔβۭؒʢ(Pݴޠʣ DJMJVNQLH
    a
    QPMJDZBQJSVMF@WBMJEBUJPOHP
    3VMF4BOJUJ[F
34. Cilium Network Policyͷ࣮૷ 34 ϙϦγʔͷݕࠪ /FUXPSL
    1PMJDZ
    F#1'
    .BQʹ
    ରԠ͢Δߏ଄ମʹม׵ Ϣʔβۭؒʢ(Pݴޠʣ DJMJVNQLH
    a
    QPMJDZBQJSVMF@WBMJEBUJPOHP
    3VMF4BOJUJ[F DJMJVNQLH
    a
    FOEQPJOUCQGHP
    &OEQPJOUBEE1PMJDZ,FZ F#1'
    .BQʹରԠͨ͠ߏ଄ମ
35. Cilium Network Policyͷ࣮૷ 35 ϙϦγʔͷݕࠪ F#1'
    .BQʹରԠͨ͠ߏ଄ମ /FUXPSL
    1PMJDZ
    F#1'
    .BQʹ
    ରԠ͢Δߏ଄ମʹม׵ F#1'
    .BQʹ௥Ճ
    -͸&OWPZ Ϣʔβۭؒʢ(Pݴޠʣ DJMJVNQLH
    a
    QPMJDZBQJSVMF@WBMJEBUJPOHP
    3VMF4BOJUJ[F DJMJVNQLH
    a
    FOEQPJOUCQGHP
    &OEQPJOUBEE1PMJDZ,FZ DJMJVNQLH
    a
    CQGNBQ@MJOVYHP
    .BQ6QEBUF
36. ˓ F#1'ϓϩάϥϜؒ΍ϢʔβۭؒϓϩάϥϜͱ
    σʔλΛڞ༗͢Δ࢓૊Έ
    ˔ Ϣʔβۭ͔ؒΒ͸γεςϜίʔϧΛൃߦ
    ˓ LFZWBMVF
    ετΞ eBPF Map 36 F#1'
    .BQT
    
37. Cilium Network Policyͷ࣮૷ 37 ύέοτ Χʔωϧۭؒ
38. Cilium Network Policyͷ࣮૷ 38 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β
    ϚοϓΩʔʹରԠ͢Δ
    ߏ଄ମʹม׵ DJMJVNCQGMJC
    a
    DPOOUSBDLI
    DU@MPPLVQ
    DU@MPPLVQ
39. Cilium Network Policyͷ࣮૷ 39 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β
    ϚοϓΩʔʹରԠ͢Δ
    ߏ଄ମʹม׵ DJMJVNCQGMJC
    a
    DPOOUSBDLI
    DU@MPPLVQ
    DU@MPPLVQ DJMJVNCQGMJC
    a
    QPMJDZI
    @@QPMJDZ@DBO@BDDFTT
40. Cilium Network Policyͷ࣮૷ 40 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β
    ϚοϓΩʔʹରԠ͢Δ
    ߏ଄ମʹม׵ DJMJVNCQGMJC
    a
    DPOOUSBDLI
    DU@MPPLVQ
    DU@MPPLVQ DJMJVNCQGMJC
    a
    QPMJDZI
    @@QPMJDZ@DBO@BDDFTT
41. Cilium Network Policyͷ࣮૷ 41 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β
    ϚοϓΩʔʹରԠ͢Δ
    ߏ଄ମʹม׵ র߹͢Δ 1PMJDZ
    .BQ
    F#1'
    .BQ %SPQ 1BTT DJMJVNCQGMJC
    a
    DPOOUSBDLI
    DU@MPPLVQ
    DU@MPPLVQ DJMJVNCQGMJC
    a
    QPMJDZI
    @@QPMJDZ@DBO@BDDFTT
42. ·ͱΊ 42 ˓ /FUXPSL
    1PMJDZϦιʔεͰ1PEͷ௨৴Λ੍ޚͰ͖Δ
    ˓ $JMJVN
    /FUXPSL
    1PMJDZ͸/FUXPSL
    1PMJDZͷ֦ு
    ˔ -ɺ-ɺ-ϙϦγʔ
    ˓ $JMJVN͸F#1'Λ׆༻ͯ͠/FUXPSL
    1PMJDZΛ࣮ݱ
    ˔ F#1'
    .BQΛ࢖ͬͯϙϦγʔ৘ใΛ఻೻