Upgrade to Pro — share decks privately, control downloads, hide ads and more …

CiliumによるKubernetes Network Policyの実現 CNDT2021

62a14b322f22ab9588702ab2064df63f?s=47 Tomoki Sugiura
November 05, 2021
Programming
0
510

CiliumによるKubernetes Network Policyの実現 CNDT2021

62a14b322f22ab9588702ab2064df63f?s=128

Tomoki Sugiura

November 05, 2021
Tweet

More Decks by Tomoki Sugiura

See All by Tomoki Sugiura
naist colloquium-B 2
62a14b322f22ab9588702ab2064df63f?s=48 shanpu
0
130
ricc-20210826
62a14b322f22ab9588702ab2064df63f?s=48 shanpu
0
220
IOT53
62a14b322f22ab9588702ab2064df63f?s=48 shanpu
0
30
RICC-PIoT Workshop 2021
62a14b322f22ab9588702ab2064df63f?s=48 shanpu
0
300
ricc-nii-2020
62a14b322f22ab9588702ab2064df63f?s=48 shanpu
0
60
Cloud Native Kansai #05 LT4
62a14b322f22ab9588702ab2064df63f?s=48 shanpu
1
560
gcpug-kyoto#2-LT1
62a14b322f22ab9588702ab2064df63f?s=48 shanpu
0
410
kubernetes-seminar
62a14b322f22ab9588702ab2064df63f?s=48 shanpu
0
81
KansaiLT2
62a14b322f22ab9588702ab2064df63f?s=48 shanpu
0
170

Other Decks in Programming

See All in Programming
LINE Messaging APIの概要 - LINE API総復習シリーズ
01cca15e7d324831bd63b7e1e6213f7a?s=48 uezo
0
120
#JJUG_CCC 「サポート」は製品開発？　- JDBCライブラリ屋さんが実践する攻めのテクニカルサポートとJavaエンジニアのキャリアについて -
244963b5eab1dd775692490daea81a7f?s=48 cdataj
0
410
[DC SF 2022] Hitchhiking through Jetpack Compose
2fff9b69a69973e14026624f8c8a9672?s=48 jossiwolf
2
160
Airflowはすごいぞ！
65389cd2b6fdc531dcc4af999e864593?s=48 hankehly
0
370
"What's new in Swift"の要約 / swift_5_7_summary
42a6a049ac8f5265f31858a9509217fb?s=48 uhooi
1
260
git on intellij
1a51f443c6d75a0576428792b0da05f2?s=48 hiroto_kitamura
0
160
エンジニアによる事業指標計測のススメ
Ee398a67f5017cc2ad5c02d67d10e516?s=48 doyaaaaaken
1
180
I/O Extended 2022 in Android ~ Whats new in Android development tools
354271902cd8ba2762d05b251dfa0f84?s=48 pluu
0
520
heyにおけるCI/CDの現状と課題
4631864606a93224804a49331d1a7dfd?s=48 fufuhu
1
550
ドメインモデル方式のクラス設計　座談会
8f84b7d8869ef6005d89b378e8661f7c?s=48 masuda220
PRO
3
1k
Beyond Micro Frontends: Frontend Moduliths for the Enterprise @wad2022
15934fa2aa7b2ce21f091e9b7cffa856?s=48 manfredsteyer
PRO
0
120
Jakarta EE 10 and Beyond
B489790e1a844284d7cd1fa2cd6e021f?s=48 ivargrimstad
0
1.7k

Featured

See All Featured
Visualization
170b760e0147792d0140e59ec78e9893?s=48 eitanlees
124
11k
CSS Pre-Processors: Stylus, Less & Sass
7559f6cff1f5efc2d210965febd4d71c?s=48 bermonpainter
349
27k
Fight the Zombie Pattern Library - RWD Summit 2016
9fa239b3154a0169d99ab7bf1422dd12?s=48 marcelosomers
226
15k
Writing Fast Ruby
1f74b13f1e5c6c69cb5d7fbaabb1e2cb?s=48 sferik
612
57k
Building Your Own Lightsaber
Fe6b81005d1553accd6b2a28f6a2bef1?s=48 phodgson
94
4.6k
Support Driven Design
1519587b1a0febb658c36c94f6272b0d?s=48 roundedbygravity
86
8.5k
The Invisible Side of Design
B3d6434763caa0ef5dc4b792662c49f7?s=48 smashingmag
290
48k
Designing Dashboards & Data Visualisations in Web Apps
Fde6c3a50ca518a909ef35c22c0ee0e4?s=48 destraynor
224
49k
ParisWeb 2013: Learning to Love: Crash Course in Emotional UX Design
651dcfe41723207fbb0aa044a4f7c07f?s=48 dotmariusz
100
5.9k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
3d4519fd34b76fb265fc0237f3792bd4?s=48 danielanewman
212
20k
Gamification - CAS2011
4394ceb8b277f35ee3da7030384efb5d?s=48 davidbonilla
75
3.9k
The World Runs on Bad Software
20bfe76b3d6105641f879fe45cfc9272?s=48 bkeepers
PRO
57
5.3k

Transcript

  1. CiliumʹΑΔ Kubernetes Network Policyͷ࣮ݱ 5PNPLJ4VHJVSB

  2. ຊηογϣϯͷ֓ཁ 2 1PE 1PE 1PE

  3. ຊηογϣϯͷ֓ཁ 3 $/*ϓϥάΠϯ 1PE 1PE 1PE 1PEؒͷ௨৴Λ؅ཧ

  4. ຊηογϣϯͷ֓ཁ 4 ❌ $/*ϓϥάΠϯ 1PEؒͷ௨৴Λ؅ཧ 1PE 1PE 1PE

  5. ຊηογϣϯͷ֓ཁ 5 ❌ Ͳ͏΍੍ͬͯޚʁ ઃఆ߲໨ʁ $/*ϓϥάΠϯ 1PEؒͷ௨৴Λ؅ཧ 1PE 1PE 1PE

    1PEؒͷ௨৴Λ؅ཧ

  6. ຊฤ΁ 6

  7. Kubernetes 7 ˓ ίϯςφΦʔέετϨʔγϣϯπʔϧ ˔ ෳ਺୆ͷίϯςφΛҰݩ؅ཧ ˓ ίϯςφӡ༻ͷͨΊͷ͜ͱΛͳΜͰ΋΍Δ ˔ ΦʔτώʔϦϯάɾϩʔϦϯάΞοϓσʔτ

    ˔ ίϯςφʹద༻͢Δઃఆ஋ͷ؅ཧ ˔ ݖݶ؅ཧ ˔ FUD ˓ 1PEؒͷ௨৴ػೳˠ$/*ϓϥάΠϯʹҕৡ ˔ 1PEʹωοτϫʔΫ໊લۭؒΛڞ༗͢Δίϯςφ܈

  8. CNI 8 ˓ $POUBJOFS/FUXPSL*OUFSGBDF ˓ $/$'*ODVCBUJOH1SPKFDU ˓ ίϯςφωοτϫʔΫ*'ͷ؅ཧʹ͓͚Δ࢓༷Λఆٛ ˔ ,VCFSOFUFTઐ༻πʔϧͰ͸ͳ͍

    ˓ ػೳ ˔ "%%ɿωοτϫʔΫ*'ͷ࡞੒ɾߋ৽ ˔ %&-ɿωοτϫʔΫ*'ͷ࡟আɾߋ৽ͷऔফ ˔ $)&$,ɿظ଴௨Γͷઃఆ͔֬ೝ ˔ 7&34*0/ɿαϙʔτ͍ͯ͠Δ$/*࢓༷ͷόʔδϣϯΛฦ͢

  9. ˓ $/*ʹ४ڌͨ͠,VCFSOFUFTͷ ωοτϫʔΫϓϥάΠϯ ˓ $/*όΠφϦ ˔ ίϯςφωοτϫʔΫ*'ͷ؅ཧ ˓ $/*σʔϞϯ ˔

    Ϋϥελ಺ͰͷωοτϫʔΫૄ௨Λ؅ཧ ˓ $/*ϓϥάΠϯྫ ˔ $BMJDP ˔ $JMJVN ˔ FUD CNIϓϥάΠϯ 9 $/* ϓϥάΠϯ FUI "%% ωοτϫʔΫ*'ͷ࡞੒ *1ΞυϨεͷׂΓ౰ͯ ܦ࿏ઃఆ

  10. ˓ $/*ϓϥάΠϯͷҰͭ ˓ $/$'*ODVCBUJOHQSPKFDU ˓ σʔλϓϨʔϯʹF#1'Λ׆༻ ˓ ར༻ࣄྫ ˔ (,&%BUBQMBOF7

    ˔ &,4"OZXIFSF Cilium 10

  11. ˓ FYUFOEFE#FSLFMFZ1BDLFU'JMUFS ˓ ࣗ෼ͷ࡞੒ͨ͠ϓϩάϥϜΛ -JOVYΧʔωϧ಺ͷ7.Ͱ࣮ߦ ˔ ಠࣗϨδελ໋ྩηοτ ˔ ϓϩάϥϜͷݕࠪػߏ͕͋Γ҆શੑΛอো ˓

    Πϕϯτۦಈ ˔ FHύέοτ͕/*$ʹ౸ୡ ˓ $ݴޠͰهड़Մೳ ˔ $MBOH--7. eBPF 11 DMBOHUBSHFUCQG $ݴޠϓϩάϥϜ όΠτίʔυ 7FSJ fi FS +*5$PNQJMFS ΠϕϯτʹԠ࣮ͯ͡ߦ CQG  Ϣʔβۭؒ Χʔωϧۭؒ

  12. ͜͜·Ͱͷ·ͱΊ 12 ˓ ,VCFSOFUFT͸1PEؒͷ௨৴ػೳΛ $/*ϓϥάΠϯʹҕৡ ˓ $/*ϓϥάΠϯ͸$/*४ڌͷ,VCFSOFUFTϓϥάΠϯ ˔ 1PEؒͷ௨৴ػೳͷఏڙɾ؅ཧΛߦ͏ ˓

    $JMJVN͸$/*ϓϥάΠϯͷҰछ ˔ σʔλϓϨʔϯʹF#1'Λ׆༻

  13. Network Policyͱ͸ 13

  14. Kubernetes Network PolicyϦιʔε 14 1PE 1PE 1PE

  15. Kubernetes Network PolicyϦιʔε 15 1PE 1PE 1PE ❌

  16. Kubernetes Network PolicyϦιʔε 16 1PE 1PE 1PE ❌

  17. Kubernetes Network Policyͱ͸ 17 ˓ ,VCFSFOUFTͷϦιʔεͷҰछ ˓ --ͷ௨৴Λ੍ޚ ˔ *1ΞυϨεϙʔτ൪߸

    ˓ $/*ϓϥάΠϯ͕ରԠ͍ͯ͠Ε͹࢖༻Մೳ ˔ $JMJVN͸ରԠ ˔ 'MBOOFM͸ະରԠ ˓ ུশ͸OFUQPM ˔ LVCFDUMHFUOFUQPM"

  18. Kubernetes Network Policy ྫ 18 ˓ ໊લۭؒ͝ͱʹ࡞੒ ˓ ڐՄϦετ ˓

    --ϨϕϧͷϙϦγʔ ˓ *OHSFTTʢ֎͔Β಺ʣɼ&HSFTTʢ಺͔Β֎ʣ ωοτϫʔΫϙϦγʔྫ

  19. Kubernetes Network Policy σϞ 19 6CVOUV /(*/9 ❌ DVSMIUUQ/(*/9@*1

  20. ˓ /FUXPSL1PMJDZͷ֦ு ˔ ΧελϜϦιʔε ˓ ໊લۭؒPSΫϥελશମ ˔ $JMJVN/FUXPSL1PMJDZ ˔ $JMJVN$MVTUFSXJEF/FUXPSL1PMJDZ

    ˓ "MMPX%FOZ྆ํઃఆՄೳ ˓ -ϨϕϧͰͷϙϦγʔΛઃఆՄೳ Cilium Network Policy 20

  21. Cilium Network Policy L3 21 ˓ -BCFMϕʔε ˔ 1PEͷϥϕϧͰࢦఆ ˓

    *1$*%3ϕʔε ˓ %/4ϕʔε ˓ 4FSWJDFϕʔε ˓ &OUJUZϕʔε -BCFMϕʔε$JMJVN/FUXPSL1PMJDZྫ

  22. Cilium Network Policy L3 22 ˓ -BCFMϕʔε ˓ *1$*%3ϕʔε ˔

    *1ΞυϨε ˔ *1ΞυϨεൣғ ˓ %/4ϕʔε ˓ 4FSWJDFϕʔε ˓ &OUJUZϕʔε *1$*%3ϕʔε$JMJVN/FUXPSL1PMJDZྫ

  23. Cilium Network Policy L3 23 ˓ -BCFMϕʔε ˓ *1$*%3ϕʔε ˓

    %/4ϕʔε ˔ '2%/Ͱࢦఆ ˓ 4FSWJDFϕʔε ˓ &OUJUZϕʔε %/4ϕʔε$JMJVN/FUXPSL1PMJDZྫ

  24. Cilium Network Policy L3 24 ˓ -BCFMϕʔε ˓ *1$*%3ϕʔε ˓

    %/4ϕʔε ˓ 4FSWJDFϕʔε ˔ ಛఆͷ4FSWJDFϦιʔε΁ͷ௨৴Λ੍ޚ ˓ &OUJUZϕʔε 4FSWJDFϕʔε$JMJVN/FUXPSL1PMJDZྫ

  25. Cilium Network Policy L3 25 ˓ -BCFMϕʔε ˓ *1$*%3ϕʔε ˓

    %/4ϕʔε ˓ 4FSWJDFϕʔε ˓ &OUJUZϕʔε ˔ &OUJUZʢଐੑʣͰ௨৴Λ੍ޚ ˗ Ϋϥελ֎ ˗ Ϋϥελ಺ ˗ $JMJVN؅ཧ ˗ $JMJVN؅ཧ֎ ˗ ͳͲ &OUJUZϕʔε$JMJVN/FUXPSL1PMJDZྫ

  26. Cilium Network Policy L4 26 ˓ 5$16%1ϙʔτ൪߸ ˓ *$.1λΠϓ 5$1ϙʔτ൪߸$JMJVN/FUXPSL1PMJDZͷྫ

  27. Cilium Network Policy L4 27 ˓ 5$16%1ϙʔτ൪߸ ˓ *$.1λΠϓ ˔

    *$.1ɺ*$.1WͷλΠϓ ˔ GFBUVSFϑϥάΛ༗ޮʹ͢Δ͜ͱͰར༻Մೳ ˔ ͨͩ͠ݱࡏ͸҆ఆಈ࡞͠ͳ͍ͨΊඇਪ঑ *$.1λΠϓ$JMJVN/FUXPSL1PMJDZͷྫ

  28. Cilium Network Policy L7 28 ˓ ڐՄϦετͷΈ ˓ )551 ˔

    ύε ˔ ϗετ໊ ˔ ϝιου ˔ ϔομʔ ˓ %/4 ˓ ,BGLB CFUB )551$JMJVN/FUXPSL1PMJDZͷྫ

  29. Cilium Network Policy L7 29 ˓ ڐՄϦετͷΈ ˓ )551 ˓

    %/4 ˔ ໊લࢦఆ ˔ ύλʔϯϚον ˓ ,BGLB CFUB %/4$JMJVN/FUXPSL1PMJDZͷྫ

  30. Cilium Network Policy L7 30 ˓ ڐՄϦετͷΈ ˓ )551 ˓

    %/4 ˓ ,BGLB CFUB  ˔ 3PMF ˔ "1*Ωʔ ˔ "1*όʔδϣϯ ˔ ΫϥΠΞϯτ*% ˔ τϐοΫ ,BGLB$JMJVN/FUXPSL1PMJDZͷྫ

  31. Cilium Network Policy σϞ L7-HTTP 31 6CVOUV /(*/9 ❌ BMMPX

    EFOZ

  32. Cilium Network Policyͷ࣮ݱ 32 /FUXPSL1PMJDZΛهड़ͨ͠ ϚχϑΣετϑΝΠϧ DJMJVNQLHLTXBUDIFSTDJMJVN@OFUXPSL@QPMJDZHP ,T8BUDIFSBEE$JMJVN/FUXPSL1PMJDZ7

  33. Cilium Network Policyͷ࣮૷ 33 ϙϦγʔͷݕࠪ Ϣʔβۭؒʢ(Pݴޠʣ DJMJVNQLHa QPMJDZBQJSVMF@WBMJEBUJPOHP 3VMF4BOJUJ[F

  34. Cilium Network Policyͷ࣮૷ 34 ϙϦγʔͷݕࠪ /FUXPSL1PMJDZ F#1'.BQʹ ରԠ͢Δߏ଄ମʹม׵ Ϣʔβۭؒʢ(Pݴޠʣ DJMJVNQLHa

    QPMJDZBQJSVMF@WBMJEBUJPOHP 3VMF4BOJUJ[F DJMJVNQLHa FOEQPJOUCQGHP &OEQPJOUBEE1PMJDZ,FZ F#1'.BQʹରԠͨ͠ߏ଄ମ

  35. Cilium Network Policyͷ࣮૷ 35 ϙϦγʔͷݕࠪ F#1'.BQʹରԠͨ͠ߏ଄ମ /FUXPSL1PMJDZ F#1'.BQʹ ରԠ͢Δߏ଄ମʹม׵ F#1'.BQʹ௥Ճ

    -͸&OWPZ Ϣʔβۭؒʢ(Pݴޠʣ DJMJVNQLHa QPMJDZBQJSVMF@WBMJEBUJPOHP 3VMF4BOJUJ[F DJMJVNQLHa FOEQPJOUCQGHP &OEQPJOUBEE1PMJDZ,FZ DJMJVNQLHa CQGNBQ@MJOVYHP .BQ6QEBUF

  36. ˓ F#1'ϓϩάϥϜؒ΍ϢʔβۭؒϓϩάϥϜͱ σʔλΛڞ༗͢Δ࢓૊Έ ˔ Ϣʔβۭ͔ؒΒ͸γεςϜίʔϧΛൃߦ ˓ LFZWBMVFετΞ eBPF Map 36

    F#1' .BQT

  37. Cilium Network Policyͷ࣮૷ 37 ύέοτ Χʔωϧۭؒ

  38. Cilium Network Policyͷ࣮૷ 38 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β ϚοϓΩʔʹରԠ͢Δ ߏ଄ମʹม׵ DJMJVNCQGMJCa

    DPOOUSBDLI DU@MPPLVQ  DU@MPPLVQ

  39. Cilium Network Policyͷ࣮૷ 39 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β ϚοϓΩʔʹରԠ͢Δ ߏ଄ମʹม׵ DJMJVNCQGMJCa

    DPOOUSBDLI DU@MPPLVQ  DU@MPPLVQ DJMJVNCQGMJCa QPMJDZI @@QPMJDZ@DBO@BDDFTT

  40. Cilium Network Policyͷ࣮૷ 40 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β ϚοϓΩʔʹରԠ͢Δ ߏ଄ମʹม׵ DJMJVNCQGMJCa

    DPOOUSBDLI DU@MPPLVQ  DU@MPPLVQ DJMJVNCQGMJCa QPMJDZI @@QPMJDZ@DBO@BDDFTT

  41. Cilium Network Policyͷ࣮૷ 41 ύέοτ Χʔωϧۭؒ ϔομ৘ใ͔Β ϚοϓΩʔʹରԠ͢Δ ߏ଄ମʹม׵ র߹͢Δ

    1PMJDZ.BQ F#1'.BQ %SPQ 1BTT DJMJVNCQGMJCa DPOOUSBDLI DU@MPPLVQ  DU@MPPLVQ DJMJVNCQGMJCa QPMJDZI @@QPMJDZ@DBO@BDDFTT

  42. ·ͱΊ 42 ˓ /FUXPSL1PMJDZϦιʔεͰ1PEͷ௨৴Λ੍ޚͰ͖Δ ˓ $JMJVN/FUXPSL1PMJDZ͸/FUXPSL1PMJDZͷ֦ு ˔ -ɺ-ɺ-ϙϦγʔ ˓ $JMJVN͸F#1'Λ׆༻ͯ͠/FUXPSL1PMJDZΛ࣮ݱ

    ˔ F#1'.BQΛ࢖ͬͯϙϦγʔ৘ใΛ఻೻