$30 off During Our Annual Pro Sale. View Details »

CiliumによるKubernetes Network Policyの実現 CNDT2021

Tomoki Sugiura
November 05, 2021
Programming
0
620

CiliumによるKubernetes Network Policyの実現 CNDT2021

Tomoki Sugiura

November 05, 2021
Tweet

More Decks by Tomoki Sugiura

See All by Tomoki Sugiura
naist colloquium-B 2
shanpu
0
140
ricc-20210826
shanpu
0
260
IOT53
shanpu
0
33
RICC-PIoT Workshop 2021
shanpu
0
340
ricc-nii-2020
shanpu
0
62
Cloud Native Kansai #05 LT4
shanpu
1
630
gcpug-kyoto#2-LT1
shanpu
0
450
kubernetes-seminar
shanpu
0
91
KansaiLT2
shanpu
0
180

Other Decks in Programming

See All in Programming
KubeCon + CNCon NA 2022 Overview & Towards Something Better Than CRDs In a Post-Operator World / k8sjp54-kubecon-recap
masayaaoyama
0
410
AWS AppSync を利用したアプリ開発チーム視点の API 開発
sugiyu1234
0
120
Amazon EKS上の開発体験を最大化するプレビュー環境の作り方
katainaka0503
0
210
Django REST Framework はじめの一歩 〜 押さえておきたい３つのポイント 〜 / First step of Django REST Framework (stapy#87 2022)
akiyoko
0
560
ネットスーパーにおける商品在庫データのアプリケーション構築事例
10xinc
7
2.6k
競技プログラミングことはじめ
e869120
15
9k
Writing Greener Java Applications
hollycummins
1
870
ぱっと見犬猫っぽいAWSアーキテクチャ図を Amazon Rekognitionで判定しよう
kzkmaeda
0
260
JavaScript Testing Framework: Under the Hood(JSConfJP2022)
yoshiaki_togami
0
2k
Cloud-Native: Einführung, Überblick & Myth Busting
christianweyer
PRO
0
180
Node.jsの2022年と未来 / Node.js in 2022 and Future
masashi
1
640
FrankenPHP: a modern app server for PHP and Symfony apps
dunglas
0
110

Featured

See All Featured
Automating Front-end Workflow
addyosmani
1352
200k
Facilitating Awesome Meetings
lara
33
4.4k
Pencils Down: Stop Designing & Start Developing
hursman
113
10k
Easily Structure & Communicate Ideas using Wireframe
afnizarnur
182
15k
Statistics for Hackers
jakevdp
782
210k
WebSockets: Embracing the real-time Web
robhawkes
58
5.9k
Code Reviewing Like a Champion
maltzj
508
38k
Typedesign – Prime Four
hannesfritz
34
1.5k
How GitHub (no longer) Works
holman
298
140k
Building Adaptive Systems
keathley
25
1.3k
Writing Fast Ruby
sferik
613
57k
Web development in the modern age
philhawksworth
197
9.5k

Transcript

  1. CiliumʹΑΔ Kubernetes Network Policyͷ࣮ݱ 5PNPLJ4VHJVSB

  2. ຊηογϣϯͷ֓ཁ 2 1PE 1PE 1PE

  3. ຊηογϣϯͷ֓ཁ 3 $/*ϓϥάΠϯ 1PE 1PE 1PE 1PEؒͷ௨৴Λ؅ཧ

  4. ຊηογϣϯͷ֓ཁ 4 ❌ $/*ϓϥάΠϯ 1PEؒͷ௨৴Λ؅ཧ 1PE 1PE 1PE

  5. ຊηογϣϯͷ֓ཁ 5 ❌ Ͳ͏΍੍ͬͯޚʁ ઃఆ߲໨ʁ $/*ϓϥάΠϯ 1PEؒͷ௨৴Λ؅ཧ 1PE 1PE 1PE

    1PEؒͷ௨৴Λ؅ཧ

  6. ຊฤ΁ 6

  7. Kubernetes 7 ˓ ίϯςφΦʔέετϨʔγϣϯπʔϧ ˔ ෳ਺୆ͷίϯςφΛҰݩ؅ཧ ˓ ίϯςφӡ༻ͷͨΊͷ͜ͱΛͳΜͰ΋΍Δ ˔ ΦʔτώʔϦϯάɾϩʔϦϯάΞοϓσʔτ

    ˔ ίϯςφʹద༻͢Δઃఆ஋ͷ؅ཧ ˔ ݖݶ؅ཧ ˔ FUD ˓ 1PEؒͷ௨৴ػೳˠ$/*ϓϥάΠϯʹҕৡ ˔ 1PEʹωοτϫʔΫ໊લۭؒΛڞ༗͢Δίϯςφ܈

  8. CNI 8 ˓ $POUBJOFS/FUXPSL*OUFSGBDF ˓ $/$'*ODVCBUJOH1SPKFDU ˓ ίϯςφωοτϫʔΫ*'ͷ؅ཧʹ͓͚Δ࢓༷Λఆٛ ˔ ,VCFSOFUFTઐ༻πʔϧͰ͸ͳ͍

    ˓ ػೳ ˔ "%%ɿωοτϫʔΫ*'ͷ࡞੒ɾߋ৽ ˔ %&-ɿωοτϫʔΫ*'ͷ࡟আɾߋ৽ͷऔফ ˔ $)&$,ɿظ଴௨Γͷઃఆ͔֬ೝ ˔ 7&34*0/ɿαϙʔτ͍ͯ͠Δ$/*࢓༷ͷόʔδϣϯΛฦ͢

  9. ˓ $/*ʹ४ڌͨ͠,VCFSOFUFTͷ ωοτϫʔΫϓϥάΠϯ ˓ $/*όΠφϦ ˔ ίϯςφωοτϫʔΫ*'ͷ؅ཧ ˓ $/*σʔϞϯ ˔

    Ϋϥελ಺ͰͷωοτϫʔΫૄ௨Λ؅ཧ ˓ $/*ϓϥάΠϯྫ ˔ $BMJDP ˔ $JMJVN ˔ FUD CNIϓϥάΠϯ 9 $/* ϓϥάΠϯ FUI "%% ωοτϫʔΫ*'ͷ࡞੒ *1ΞυϨεͷׂΓ౰ͯ ܦ࿏ઃఆ

  10. ˓ $/*ϓϥάΠϯͷҰͭ ˓ $/$'*ODVCBUJOHQSPKFDU ˓ σʔλϓϨʔϯʹF#1'Λ׆༻ ˓ ར༻ࣄྫ ˔ (,&%BUBQMBOF7

    ˔ &,4"OZXIFSF Cilium 10

  11. ˓ FYUFOEFE#FSLFMFZ1BDLFU'JMUFS ˓ ࣗ෼ͷ࡞੒ͨ͠ϓϩάϥϜΛ -JOVYΧʔωϧ಺ͷ7.Ͱ࣮ߦ ˔ ಠࣗϨδελ໋ྩηοτ ˔ ϓϩάϥϜͷݕࠪػߏ͕͋Γ҆શੑΛอো ˓

    Πϕϯτۦಈ ˔ FHύέοτ͕/*$ʹ౸ୡ ˓ $ݴޠͰهड़Մೳ ˔ $MBOH--7. eBPF 11 DMBOHUBSHFUCQG $ݴޠϓϩάϥϜ όΠτίʔυ 7FSJ fi FS +*5$PNQJMFS ΠϕϯτʹԠ࣮ͯ͡ߦ CQG  Ϣʔβۭؒ Χʔωϧۭؒ

  12. ͜͜·Ͱͷ·ͱΊ 12 ˓ ,VCFSOFUFT͸1PEؒͷ௨৴ػೳΛ $/*ϓϥάΠϯʹҕৡ ˓ $/*ϓϥάΠϯ͸$/*४ڌͷ,VCFSOFUFTϓϥάΠϯ ˔ 1PEؒͷ௨৴ػೳͷఏڙɾ؅ཧΛߦ͏ ˓

    $JMJVN͸$/*ϓϥάΠϯͷҰछ ˔ σʔλϓϨʔϯʹF#1'Λ׆༻

  13. Network Policyͱ͸ 13

  14. Kubernetes Network PolicyϦιʔε 14 1PE 1PE 1PE

  15. Kubernetes Network PolicyϦιʔε 15 1PE 1PE 1PE ❌

  16. Kubernetes Network PolicyϦιʔε 16 1PE 1PE 1PE ❌

  17. Kubernetes Network Policyͱ͸ 17 ˓ ,VCFSFOUFTͷϦιʔεͷҰछ ˓ --ͷ௨৴Λ੍ޚ ˔ *1ΞυϨεϙʔτ൪߸

    ˓ $/*ϓϥάΠϯ͕ରԠ͍ͯ͠Ε͹࢖༻Մೳ ˔ $JMJVN͸ରԠ ˔ 'MBOOFM͸ະରԠ ˓ ུশ͸OFUQPM ˔ LVCFDUMHFUOFUQPM"

  18. Kubernetes Network Policy ྫ 18 ˓ ໊લۭؒ͝ͱʹ࡞੒ ˓ ڐՄϦετ ˓

    --ϨϕϧͷϙϦγʔ ˓ *OHSFTTʢ֎͔Β಺ʣɼ&HSFTTʢ಺͔Β֎ʣ ωοτϫʔΫϙϦγʔྫ

  19. Kubernetes Network Policy σϞ 19 6CVOUV /(*/9 ❌ DVSMIUUQ/(*/9@*1

  20. ˓ /FUXPSL1PMJDZͷ֦ு ˔ ΧελϜϦιʔε ˓ ໊લۭؒPSΫϥελશମ ˔ $JMJVN/FUXPSL1PMJDZ ˔ $JMJVN$MVTUFSXJEF/FUXPSL1PMJDZ

    ˓ "MMPX%FOZ྆ํઃఆՄೳ ˓ -ϨϕϧͰͷϙϦγʔΛઃఆՄೳ Cilium Network Policy 20

  21. Cilium Network Policy L3 21 ˓ -BCFMϕʔε ˔ 1PEͷϥϕϧͰࢦఆ ˓

    *1$*%3ϕʔε ˓ %/4ϕʔε ˓ 4FSWJDFϕʔε ˓ &OUJUZϕʔε -BCFMϕʔε$JMJVN/FUXPSL1PMJDZྫ

  22. Cilium Network Policy L3 22 ˓ -BCFMϕʔε ˓ *1$*%3ϕʔε ˔

    *1ΞυϨε ˔ *1ΞυϨεൣғ ˓ %/4ϕʔε ˓ 4FSWJDFϕʔε ˓ &OUJUZϕʔε *1$*%3ϕʔε$JMJVN/FUXPSL1PMJDZྫ

  23. Cilium Network Policy L3 23 ˓ -BCFMϕʔε ˓ *1$*%3ϕʔε ˓

    %/4ϕʔε ˔ '2%/Ͱࢦఆ ˓ 4FSWJDFϕʔε ˓ &OUJUZϕʔε %/4ϕʔε$JMJVN/FUXPSL1PMJDZྫ

  24. Cilium Network Policy L3 24 ˓ -BCFMϕʔε ˓ *1$*%3ϕʔε ˓

    %/4ϕʔε ˓ 4FSWJDFϕʔε ˔ ಛఆͷ4FSWJDFϦιʔε΁ͷ௨৴Λ੍ޚ ˓ &OUJUZϕʔε 4FSWJDFϕʔε$JMJVN/FUXPSL1PMJDZྫ

  25. Cilium Network Policy L3 25 ˓ -BCFMϕʔε ˓ *1$*%3ϕʔε ˓

    %/4ϕʔε ˓ 4FSWJDFϕʔε ˓ &OUJUZϕʔε ˔ &OUJUZʢଐੑʣͰ௨৴Λ੍ޚ ˗ Ϋϥελ֎ ˗ Ϋϥελ಺ ˗ $JMJVN؅ཧ ˗ $JMJVN؅ཧ֎ ˗ ͳͲ &OUJUZϕʔε$JMJVN/FUXPSL1PMJDZྫ

  26. Cilium Network Policy L4 26 ˓ 5$16%1ϙʔτ൪߸ ˓ *$.1λΠϓ 5$1ϙʔτ൪߸$JMJVN/FUXPSL1PMJDZͷྫ

  27. Cilium Network Policy L4 27 ˓ 5$16%1ϙʔτ൪߸ ˓ *$.1λΠϓ ˔

    *$.1ɺ*$.1WͷλΠϓ ˔ GFBUVSFϑϥάΛ༗ޮʹ͢Δ͜ͱͰར༻Մೳ ˔ ͨͩ͠ݱࡏ͸҆ఆಈ࡞͠ͳ͍ͨΊඇਪ঑ *$.1λΠϓ$JMJVN/FUXPSL1PMJDZͷྫ

  28. Cilium Network Policy L7 28 ˓ ڐՄϦετͷΈ ˓ )551 ˔

    ύε ˔ ϗετ໊ ˔ ϝιου ˔ ϔομʔ ˓ %/4 ˓ ,BGLB CFUB )551$JMJVN/FUXPSL1PMJDZͷྫ

  29. Cilium Network Policy L7 29 ˓ ڐՄϦετͷΈ ˓ )551 ˓

    %/4 ˔ ໊લࢦఆ ˔ ύλʔϯϚον ˓ ,BGLB CFUB %/4$JMJVN/FUXPSL1PMJDZͷྫ

  30. Cilium Network Policy L7 30 ˓ ڐՄϦετͷΈ ˓ )551 ˓

    %/4 ˓ ,BGLB CFUB  ˔ 3PMF ˔ "1*Ωʔ ˔ "1*όʔδϣϯ ˔ ΫϥΠΞϯτ*% ˔ τϐοΫ ,BGLB$JMJVN/FUXPSL1PMJDZͷྫ

  31. Cilium Network Policy σϞ L7-HTTP 31 6CVOUV /(*/9 ❌ BMMPX

    EFOZ

  32. Cilium Network Policyͷ࣮ݱ 32 /FUXPSL1PMJDZΛهड़ͨ͠ ϚχϑΣετϑΝΠϧ DJMJVNQLHLTXBUDIFSTDJMJVN@OFUXPSL@QPMJDZHP ,T8BUDIFSBEE$JMJVN/FUXPSL1PMJDZ7

  33. Cilium Network Policyͷ࣮૷ 33 ϙϦγʔͷݕࠪ Ϣʔβۭؒʢ(Pݴޠʣ DJMJVNQLHa QPMJDZBQJSVMF@WBMJEBUJPOHP 3VMF4BOJUJ[F

  34. Cilium Network Policyͷ࣮૷ 34 ϙϦγʔͷݕࠪ /FUXPSL1PMJDZ F#1'.BQʹ ରԠ͢Δߏ଄ମʹม׵ Ϣʔβۭؒʢ(Pݴޠʣ DJMJVNQLHa

    QPMJDZBQJSVMF@WBMJEBUJPOHP 3VMF4BOJUJ[F DJMJVNQLHa FOEQPJOUCQGHP &OEQPJOUBEE1PMJDZ,FZ F#1'.BQʹରԠͨ͠ߏ଄ମ

  35. Cilium Network Policyͷ࣮૷ 35 ϙϦγʔͷݕࠪ F#1'.BQʹରԠͨ͠ߏ଄ମ /FUXPSL1PMJDZ F#1'.BQʹ ରԠ͢Δߏ଄ମʹม׵ F#1'.BQʹ௥Ճ

    -͸&OWPZ Ϣʔβۭؒʢ(Pݴޠʣ DJMJVNQLHa QPMJDZBQJSVMF@WBMJEBUJPOHP 3VMF4BOJUJ[F DJMJVNQLHa FOEQPJOUCQGHP &OEQPJOUBEE1PMJDZ,FZ DJMJVNQLHa CQGNBQ@MJOVYHP .BQ6QEBUF

  36. ˓ F#1'ϓϩάϥϜؒ΍ϢʔβۭؒϓϩάϥϜͱ σʔλΛڞ༗͢Δ࢓૊Έ ˔ Ϣʔβۭ͔ؒΒ͸γεςϜίʔϧΛൃߦ ˓ LFZWBMVFετΞ eBPF Map 36

    F#1' .BQT

  37. Cilium Network Policyͷ࣮૷ 37 ύέοτ Χʔωϧۭؒ

  38. Cilium Network Policyͷ࣮૷ 38 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β ϚοϓΩʔʹରԠ͢Δ ߏ଄ମʹม׵ DJMJVNCQGMJCa

    DPOOUSBDLI DU@MPPLVQ  DU@MPPLVQ

  39. Cilium Network Policyͷ࣮૷ 39 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β ϚοϓΩʔʹରԠ͢Δ ߏ଄ମʹม׵ DJMJVNCQGMJCa

    DPOOUSBDLI DU@MPPLVQ  DU@MPPLVQ DJMJVNCQGMJCa QPMJDZI @@QPMJDZ@DBO@BDDFTT

  40. Cilium Network Policyͷ࣮૷ 40 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β ϚοϓΩʔʹରԠ͢Δ ߏ଄ମʹม׵ DJMJVNCQGMJCa

    DPOOUSBDLI DU@MPPLVQ  DU@MPPLVQ DJMJVNCQGMJCa QPMJDZI @@QPMJDZ@DBO@BDDFTT

  41. Cilium Network Policyͷ࣮૷ 41 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β ϚοϓΩʔʹରԠ͢Δ ߏ଄ମʹม׵ র߹͢Δ

    1PMJDZ.BQ F#1'.BQ %SPQ 1BTT DJMJVNCQGMJCa DPOOUSBDLI DU@MPPLVQ  DU@MPPLVQ DJMJVNCQGMJCa QPMJDZI @@QPMJDZ@DBO@BDDFTT

  42. ·ͱΊ 42 ˓ /FUXPSL1PMJDZϦιʔεͰ1PEͷ௨৴Λ੍ޚͰ͖Δ ˓ $JMJVN/FUXPSL1PMJDZ͸/FUXPSL1PMJDZͷ֦ு ˔ -ɺ-ɺ-ϙϦγʔ ˓ $JMJVN͸F#1'Λ׆༻ͯ͠/FUXPSL1PMJDZΛ࣮ݱ

    ˔ F#1'.BQΛ࢖ͬͯϙϦγʔ৘ใΛ఻೻