CiliumʹΑΔKubernetes Network Policyͷ࣮ݱ5PNPLJ4VHJVSB
View Slide
ຊηογϣϯͷ֓ཁ21PE 1PE1PE
ຊηογϣϯͷ֓ཁ3$/*ϓϥάΠϯ1PE 1PE1PE1PEؒͷ௨৴Λཧ
ຊηογϣϯͷ֓ཁ4❌$/*ϓϥάΠϯ 1PEؒͷ௨৴Λཧ1PE 1PE1PE
ຊηογϣϯͷ֓ཁ5❌Ͳ͏੍ͬͯޚʁઃఆ߲ʁ$/*ϓϥάΠϯ 1PEؒͷ௨৴Λཧ1PE 1PE1PE1PEؒͷ௨৴Λཧ
ຊฤ6
Kubernetes7˓ ίϯςφΦʔέετϨʔγϣϯπʔϧ˔ ෳͷίϯςφΛҰݩཧ˓ ίϯςφӡ༻ͷͨΊͷ͜ͱΛͳΜͰΔ˔ ΦʔτώʔϦϯάɾϩʔϦϯάΞοϓσʔτ˔ ίϯςφʹద༻͢Δઃఆͷཧ˔ ݖݶཧ˔ FUD˓ 1PEؒͷ௨৴ػೳˠ$/*ϓϥάΠϯʹҕৡ˔ 1PEʹωοτϫʔΫ໊લۭؒΛڞ༗͢Δίϯςφ܈
CNI8˓ $POUBJOFS/FUXPSL*OUFSGBDF˓ $/$'*ODVCBUJOH1SPKFDU˓ ίϯςφωοτϫʔΫ*'ͷཧʹ͓͚Δ༷Λఆٛ˔ ,VCFSOFUFTઐ༻πʔϧͰͳ͍˓ ػೳ˔ "%%ɿωοτϫʔΫ*'ͷ࡞ɾߋ৽˔ %&-ɿωοτϫʔΫ*'ͷআɾߋ৽ͷऔফ˔ $)&$,ɿظ௨Γͷઃఆ͔֬ೝ˔ 7&34*0/ɿαϙʔτ͍ͯ͠Δ$/*༷ͷόʔδϣϯΛฦ͢
˓ $/*ʹ४ڌͨ͠,VCFSOFUFTͷωοτϫʔΫϓϥάΠϯ˓ $/*όΠφϦ˔ ίϯςφωοτϫʔΫ*'ͷཧ˓ $/*σʔϞϯ˔ ΫϥελͰͷωοτϫʔΫૄ௨Λཧ˓ $/*ϓϥάΠϯྫ˔ $BMJDP˔ $JMJVN˔ FUDCNIϓϥάΠϯ9$/*ϓϥάΠϯFUI"%%ωοτϫʔΫ*'ͷ࡞*1ΞυϨεͷׂΓͯܦ࿏ઃఆ
˓ $/*ϓϥάΠϯͷҰͭ˓ $/$'*ODVCBUJOHQSPKFDU˓ σʔλϓϨʔϯʹF#1'Λ׆༻˓ ར༻ࣄྫ˔ (,&%BUBQMBOF7˔ &,4"OZXIFSFCilium10
˓ FYUFOEFE#FSLFMFZ1BDLFU'JMUFS˓ ࣗͷ࡞ͨ͠ϓϩάϥϜΛ-JOVYΧʔωϧͷ7.Ͱ࣮ߦ˔ ಠࣗϨδελ໋ྩηοτ˔ ϓϩάϥϜͷݕࠪػߏ͕͋Γ҆શੑΛอো˓ Πϕϯτۦಈ˔ FHύέοτ͕/*$ʹ౸ୡ˓ $ݴޠͰهड़Մೳ˔ $MBOH--7.eBPF11DMBOHUBSHFUCQG$ݴޠϓϩάϥϜόΠτίʔυ7FSJfiFS+*5$PNQJMFSΠϕϯτʹԠ࣮ͯ͡ߦCQG ϢʔβۭؒΧʔωϧۭؒ
͜͜·Ͱͷ·ͱΊ12˓ ,VCFSOFUFT1PEؒͷ௨৴ػೳΛ$/*ϓϥάΠϯʹҕৡ˓ $/*ϓϥάΠϯ$/*४ڌͷ,VCFSOFUFTϓϥάΠϯ˔ 1PEؒͷ௨৴ػೳͷఏڙɾཧΛߦ͏˓ $JMJVN$/*ϓϥάΠϯͷҰछ˔ σʔλϓϨʔϯʹF#1'Λ׆༻
Network Policyͱ13
Kubernetes Network PolicyϦιʔε141PE1PE1PE
Kubernetes Network PolicyϦιʔε151PE1PE1PE❌
Kubernetes Network PolicyϦιʔε161PE1PE1PE❌
Kubernetes Network Policyͱ17˓ ,VCFSFOUFTͷϦιʔεͷҰछ˓ --ͷ௨৴Λ੍ޚ˔ *1ΞυϨεϙʔτ൪߸˓ $/*ϓϥάΠϯ͕ରԠ͍ͯ͠Ε༻Մೳ˔ $JMJVNରԠ˔ 'MBOOFMະରԠ˓ ུশOFUQPM˔ LVCFDUMHFUOFUQPM"
Kubernetes Network Policy ྫ18˓ ໊લۭؒ͝ͱʹ࡞˓ ڐՄϦετ˓ --ϨϕϧͷϙϦγʔ˓ *OHSFTTʢ֎͔Βʣɼ&HSFTTʢ͔Β֎ʣωοτϫʔΫϙϦγʔྫ
Kubernetes Network Policy σϞ196CVOUV /(*/9❌DVSMIUUQ/(*/[email protected]*1
˓ /FUXPSL1PMJDZͷ֦ு˔ ΧελϜϦιʔε˓ ໊લۭؒPSΫϥελશମ˔ $JMJVN/FUXPSL1PMJDZ˔ $JMJVN$MVTUFSXJEF/FUXPSL1PMJDZ˓ "MMPX%FOZ྆ํઃఆՄೳ˓ -ϨϕϧͰͷϙϦγʔΛઃఆՄೳCilium Network Policy20
Cilium Network Policy L321˓ -BCFMϕʔε˔ 1PEͷϥϕϧͰࢦఆ˓ *1$*%3ϕʔε˓ %/4ϕʔε˓ 4FSWJDFϕʔε˓ &OUJUZϕʔε-BCFMϕʔε$JMJVN/FUXPSL1PMJDZྫ
Cilium Network Policy L322˓ -BCFMϕʔε˓ *1$*%3ϕʔε˔ *1ΞυϨε˔ *1ΞυϨεൣғ˓ %/4ϕʔε˓ 4FSWJDFϕʔε˓ &OUJUZϕʔε*1$*%3ϕʔε$JMJVN/FUXPSL1PMJDZྫ
Cilium Network Policy L323˓ -BCFMϕʔε˓ *1$*%3ϕʔε˓ %/4ϕʔε˔ '2%/Ͱࢦఆ˓ 4FSWJDFϕʔε˓ &OUJUZϕʔε%/4ϕʔε$JMJVN/FUXPSL1PMJDZྫ
Cilium Network Policy L324˓ -BCFMϕʔε˓ *1$*%3ϕʔε˓ %/4ϕʔε˓ 4FSWJDFϕʔε˔ ಛఆͷ4FSWJDFϦιʔεͷ௨৴Λ੍ޚ˓ &OUJUZϕʔε4FSWJDFϕʔε$JMJVN/FUXPSL1PMJDZྫ
Cilium Network Policy L325˓ -BCFMϕʔε˓ *1$*%3ϕʔε˓ %/4ϕʔε˓ 4FSWJDFϕʔε˓ &OUJUZϕʔε˔ &OUJUZʢଐੑʣͰ௨৴Λ੍ޚ˗ Ϋϥελ֎˗ Ϋϥελ˗ $JMJVNཧ˗ $JMJVNཧ֎˗ ͳͲ&OUJUZϕʔε$JMJVN/FUXPSL1PMJDZྫ
Cilium Network Policy L426˓ 5$16%1ϙʔτ൪߸˓ *$.1λΠϓ5$1ϙʔτ൪߸$JMJVN/FUXPSL1PMJDZͷྫ
Cilium Network Policy L427˓ 5$16%1ϙʔτ൪߸˓ *$.1λΠϓ˔ *$.1ɺ*$.1WͷλΠϓ˔ GFBUVSFϑϥάΛ༗ޮʹ͢Δ͜ͱͰར༻Մೳ˔ ͨͩ͠ݱࡏ҆ఆಈ࡞͠ͳ͍ͨΊඇਪ*$.1λΠϓ$JMJVN/FUXPSL1PMJDZͷྫ
Cilium Network Policy L728˓ ڐՄϦετͷΈ˓ )551˔ ύε˔ ϗετ໊˔ ϝιου˔ ϔομʔ˓ %/4˓ ,BGLB CFUB)551$JMJVN/FUXPSL1PMJDZͷྫ
Cilium Network Policy L729˓ ڐՄϦετͷΈ˓ )551˓ %/4˔ ໊લࢦఆ˔ ύλʔϯϚον˓ ,BGLB CFUB%/4$JMJVN/FUXPSL1PMJDZͷྫ
Cilium Network Policy L730˓ ڐՄϦετͷΈ˓ )551˓ %/4˓ ,BGLB CFUB˔ 3PMF˔ "1*Ωʔ˔ "1*όʔδϣϯ˔ ΫϥΠΞϯτ*%˔ τϐοΫ,BGLB$JMJVN/FUXPSL1PMJDZͷྫ
Cilium Network Policy σϞ L7-HTTP316CVOUV /(*/9❌BMMPXEFOZ
Cilium Network Policyͷ࣮ݱ32/FUXPSL1PMJDZΛهड़ͨ͠ϚχϑΣετϑΝΠϧ[email protected]@QPMJDZHP,T8BUDIFSBEE$JMJVN/FUXPSL1PMJDZ7
Cilium Network Policyͷ࣮33ϙϦγʔͷݕࠪϢʔβۭؒʢ(PݴޠʣDJMJVNQLHa[email protected]3VMF4BOJUJ[F
Cilium Network Policyͷ࣮34ϙϦγʔͷݕࠪ /FUXPSL1PMJDZF#1'.BQʹରԠ͢ΔߏମʹมϢʔβۭؒʢ(PݴޠʣDJMJVNQLHa[email protected]3VMF4BOJUJ[F DJMJVNQLHaFOEQPJOUCQGHP&OEQPJOUBEE1PMJDZ,FZ F#1'.BQʹରԠͨ͠ߏମ
Cilium Network Policyͷ࣮35ϙϦγʔͷݕࠪF#1'.BQʹରԠͨ͠ߏମ/FUXPSL1PMJDZF#1'.BQʹରԠ͢ΔߏମʹมF#1'.BQʹՃ-&OWPZϢʔβۭؒʢ(PݴޠʣDJMJVNQLHa[email protected]3VMF4BOJUJ[F DJMJVNQLHaFOEQPJOUCQGHP&OEQPJOUBEE1PMJDZ,FZ DJMJVNQLHa[email protected].BQ6QEBUF
˓ F#1'ϓϩάϥϜؒϢʔβۭؒϓϩάϥϜͱσʔλΛڞ༗͢ΔΈ˔ Ϣʔβۭ͔ؒΒγεςϜίʔϧΛൃߦ˓ LFZWBMVFετΞeBPF Map36F#1'.BQT
Cilium Network Policyͷ࣮37ύέοτΧʔωϧۭؒ
Cilium Network Policyͷ࣮38ύέοτΧʔωϧۭؒϔομใ͔ΒϚοϓΩʔʹରԠ͢ΔߏମʹมDJMJVNCQGMJCaDPOOUSBDLI[email protected] [email protected]
Cilium Network Policyͷ࣮39ύέοτΧʔωϧۭؒϔομใ͔ΒϚοϓΩʔʹରԠ͢ΔߏମʹมDJMJVNCQGMJCaDPOOUSBDLI[email protected] [email protected] DJMJVNCQGMJCaQPMJDZI@@[email protected]@BDDFTT
Cilium Network Policyͷ࣮40ύέοτΧʔωϧۭؒϔομใ͔ΒϚοϓΩʔʹରԠ͢ΔߏମʹมDJMJVNCQGMJCaDPOOUSBDLI[email protected] [email protected] DJMJVNCQGMJCaQPMJDZI@@[email protected]@BDDFTT
Cilium Network Policyͷ࣮41ύέοτΧʔωϧۭؒϔομใ͔ΒϚοϓΩʔʹରԠ͢Δߏମʹมর߹͢Δ1PMJDZ.BQF#1'.BQ%SPQ1BTTDJMJVNCQGMJCaDPOOUSBDLI[email protected] [email protected] DJMJVNCQGMJCaQPMJDZI@@[email protected]@BDDFTT
·ͱΊ42˓ /FUXPSL1PMJDZϦιʔεͰ1PEͷ௨৴Λ੍ޚͰ͖Δ˓ $JMJVN/FUXPSL1PMJDZ/FUXPSL1PMJDZͷ֦ு˔ -ɺ-ɺ-ϙϦγʔ˓ $JMJVNF#1'Λ׆༻ͯ͠/FUXPSL1PMJDZΛ࣮ݱ˔ F#1'.BQΛͬͯϙϦγʔใΛ
shanpu
danilop
tmokmss
nsuz
xblood
ymotongpoo
fornewid
doggy
beberlei
dunglas
m_seki
alli83
77web
philhawksworth
chrisshort
addyosmani
edds
hatefulcrawdad
phodgson
destraynor
smashingmag
brettharned
scottboms
davidbonilla
zenorocha