Upgrade to Pro — share decks privately, control downloads, hide ads and more …

CiliumによるKubernetes Network Policyの実現 CNDT2021

CiliumによるKubernetes Network Policyの実現 CNDT2021

Tomoki Sugiura

November 05, 2021
Tweet

More Decks by Tomoki Sugiura

Other Decks in Programming

Transcript

  1. CiliumʹΑΔ


    Kubernetes Network Policyͷ࣮ݱ
    5PNPLJ4VHJVSB

    View full-size slide

  2. ຊηογϣϯͷ֓ཁ
    2
    1PE 1PE
    1PE

    View full-size slide

  3. ຊηογϣϯͷ֓ཁ
    3
    $/*ϓϥάΠϯ
    1PE 1PE
    1PE
    1PEؒͷ௨৴Λ؅ཧ

    View full-size slide

  4. ຊηογϣϯͷ֓ཁ
    4

    $/*ϓϥάΠϯ 1PEؒͷ௨৴Λ؅ཧ
    1PE 1PE
    1PE

    View full-size slide

  5. ຊηογϣϯͷ֓ཁ
    5

    Ͳ͏΍੍ͬͯޚʁ
    ઃఆ߲໨ʁ
    $/*ϓϥάΠϯ 1PEؒͷ௨৴Λ؅ཧ
    1PE 1PE
    1PE
    1PEؒͷ௨৴Λ؅ཧ

    View full-size slide

  6. Kubernetes
    7
    ˓ ίϯςφΦʔέετϨʔγϣϯπʔϧ
    ˔ ෳ਺୆ͷίϯςφΛҰݩ؅ཧ
    ˓ ίϯςφӡ༻ͷͨΊͷ͜ͱΛͳΜͰ΋΍Δ
    ˔ ΦʔτώʔϦϯάɾϩʔϦϯάΞοϓσʔτ
    ˔ ίϯςφʹద༻͢Δઃఆ஋ͷ؅ཧ
    ˔ ݖݶ؅ཧ
    ˔ FUD
    ˓ 1PEؒͷ௨৴ػೳˠ$/*ϓϥάΠϯʹҕৡ
    ˔ 1PEʹωοτϫʔΫ໊લۭؒΛڞ༗͢Δίϯςφ܈

    View full-size slide

  7. CNI
    8
    ˓ $POUBJOFS/FUXPSL*OUFSGBDF
    ˓ $/$'*ODVCBUJOH1SPKFDU
    ˓ ίϯςφωοτϫʔΫ*'ͷ؅ཧʹ͓͚Δ࢓༷Λఆٛ
    ˔ ,VCFSOFUFTઐ༻πʔϧͰ͸ͳ͍
    ˓ ػೳ
    ˔ "%%ɿωοτϫʔΫ*'ͷ࡞੒ɾߋ৽
    ˔ %&-ɿωοτϫʔΫ*'ͷ࡟আɾߋ৽ͷऔফ
    ˔ $)&$,ɿظ଴௨Γͷઃఆ͔֬ೝ
    ˔ 7&34*0/ɿαϙʔτ͍ͯ͠Δ$/*࢓༷ͷόʔδϣϯΛฦ͢

    View full-size slide

  8. ˓ $/*ʹ४ڌͨ͠,VCFSOFUFTͷ
    ωοτϫʔΫϓϥάΠϯ
    ˓ $/*όΠφϦ
    ˔ ίϯςφωοτϫʔΫ*'ͷ؅ཧ
    ˓ $/*σʔϞϯ
    ˔ Ϋϥελ಺ͰͷωοτϫʔΫૄ௨Λ؅ཧ
    ˓ $/*ϓϥάΠϯྫ
    ˔ $BMJDP
    ˔ $JMJVN
    ˔ FUD
    CNIϓϥάΠϯ
    9
    $/*
    ϓϥάΠϯ
    FUI
    "%%
    ωοτϫʔΫ*'ͷ࡞੒
    *1ΞυϨεͷׂΓ౰ͯ
    ܦ࿏ઃఆ

    View full-size slide

  9. ˓ $/*ϓϥάΠϯͷҰͭ
    ˓ $/$'*ODVCBUJOHQSPKFDU
    ˓ σʔλϓϨʔϯʹF#1'Λ׆༻
    ˓ ར༻ࣄྫ
    ˔ (,&%BUBQMBOF7
    ˔ &,4"OZXIFSF
    Cilium
    10

    View full-size slide

  10. ˓ FYUFOEFE#FSLFMFZ1BDLFU'JMUFS
    ˓ ࣗ෼ͷ࡞੒ͨ͠ϓϩάϥϜΛ
    -JOVYΧʔωϧ಺ͷ7.Ͱ࣮ߦ
    ˔ ಠࣗϨδελ໋ྩηοτ
    ˔ ϓϩάϥϜͷݕࠪػߏ͕͋Γ҆શੑΛอো
    ˓ Πϕϯτۦಈ
    ˔ FHύέοτ͕/*$ʹ౸ୡ
    ˓ $ݴޠͰهड़Մೳ
    ˔ $MBOH--7.
    eBPF
    11
    DMBOHUBSHFUCQG
    $ݴޠϓϩάϥϜ
    όΠτίʔυ
    7FSJ
    fi
    FS
    +*5$PNQJMFS
    ΠϕϯτʹԠ࣮ͯ͡ߦ
    CQG

    Ϣʔβۭؒ
    Χʔωϧۭؒ

    View full-size slide

  11. ͜͜·Ͱͷ·ͱΊ
    12
    ˓ ,VCFSOFUFT͸1PEؒͷ௨৴ػೳΛ
    $/*ϓϥάΠϯʹҕৡ
    ˓ $/*ϓϥάΠϯ͸$/*४ڌͷ,VCFSOFUFTϓϥάΠϯ
    ˔ 1PEؒͷ௨৴ػೳͷఏڙɾ؅ཧΛߦ͏
    ˓ $JMJVN͸$/*ϓϥάΠϯͷҰछ
    ˔ σʔλϓϨʔϯʹF#1'Λ׆༻

    View full-size slide

  12. Network Policyͱ͸
    13

    View full-size slide

  13. Kubernetes Network PolicyϦιʔε
    14
    1PE
    1PE
    1PE

    View full-size slide

  14. Kubernetes Network PolicyϦιʔε
    15
    1PE
    1PE
    1PE

    View full-size slide

  15. Kubernetes Network PolicyϦιʔε
    16
    1PE
    1PE
    1PE

    View full-size slide

  16. Kubernetes Network Policyͱ͸
    17
    ˓ ,VCFSFOUFTͷϦιʔεͷҰछ
    ˓ --ͷ௨৴Λ੍ޚ
    ˔ *1ΞυϨεϙʔτ൪߸
    ˓ $/*ϓϥάΠϯ͕ରԠ͍ͯ͠Ε͹࢖༻Մೳ
    ˔ $JMJVN͸ରԠ
    ˔ 'MBOOFM͸ະରԠ
    ˓ ུশ͸OFUQPM
    ˔ LVCFDUMHFUOFUQPM"

    View full-size slide

  17. Kubernetes Network Policy ྫ
    18
    ˓ ໊લۭؒ͝ͱʹ࡞੒
    ˓ ڐՄϦετ
    ˓ --ϨϕϧͷϙϦγʔ
    ˓ *OHSFTTʢ֎͔Β಺ʣɼ&HSFTTʢ಺͔Β֎ʣ
    ωοτϫʔΫϙϦγʔྫ

    View full-size slide

  18. Kubernetes Network Policy σϞ
    19
    6CVOUV /(*/9

    DVSMIUUQ/(*/9@*1

    View full-size slide

  19. ˓ /FUXPSL1PMJDZͷ֦ு
    ˔ ΧελϜϦιʔε
    ˓ ໊લۭؒPSΫϥελશମ
    ˔ $JMJVN/FUXPSL1PMJDZ
    ˔ $JMJVN$MVTUFSXJEF/FUXPSL1PMJDZ
    ˓ "MMPX%FOZ྆ํઃఆՄೳ
    ˓ -ϨϕϧͰͷϙϦγʔΛઃఆՄೳ
    Cilium Network Policy
    20

    View full-size slide

  20. Cilium Network Policy L3
    21
    ˓ -BCFMϕʔε
    ˔ 1PEͷϥϕϧͰࢦఆ
    ˓ *1$*%3ϕʔε
    ˓ %/4ϕʔε
    ˓ 4FSWJDFϕʔε
    ˓ &OUJUZϕʔε
    -BCFMϕʔε$JMJVN/FUXPSL1PMJDZྫ

    View full-size slide

  21. Cilium Network Policy L3
    22
    ˓ -BCFMϕʔε
    ˓ *1$*%3ϕʔε
    ˔ *1ΞυϨε
    ˔ *1ΞυϨεൣғ
    ˓ %/4ϕʔε
    ˓ 4FSWJDFϕʔε
    ˓ &OUJUZϕʔε
    *1$*%3ϕʔε$JMJVN/FUXPSL1PMJDZྫ

    View full-size slide

  22. Cilium Network Policy L3
    23
    ˓ -BCFMϕʔε
    ˓ *1$*%3ϕʔε
    ˓ %/4ϕʔε
    ˔ '2%/Ͱࢦఆ
    ˓ 4FSWJDFϕʔε
    ˓ &OUJUZϕʔε
    %/4ϕʔε$JMJVN/FUXPSL1PMJDZྫ

    View full-size slide

  23. Cilium Network Policy L3
    24
    ˓ -BCFMϕʔε
    ˓ *1$*%3ϕʔε
    ˓ %/4ϕʔε
    ˓ 4FSWJDFϕʔε
    ˔ ಛఆͷ4FSWJDFϦιʔε΁ͷ௨৴Λ੍ޚ
    ˓ &OUJUZϕʔε
    4FSWJDFϕʔε$JMJVN/FUXPSL1PMJDZྫ

    View full-size slide

  24. Cilium Network Policy L3
    25
    ˓ -BCFMϕʔε
    ˓ *1$*%3ϕʔε
    ˓ %/4ϕʔε
    ˓ 4FSWJDFϕʔε
    ˓ &OUJUZϕʔε
    ˔ &OUJUZʢଐੑʣͰ௨৴Λ੍ޚ
    ˗ Ϋϥελ֎
    ˗ Ϋϥελ಺
    ˗ $JMJVN؅ཧ
    ˗ $JMJVN؅ཧ֎
    ˗ ͳͲ
    &OUJUZϕʔε$JMJVN/FUXPSL1PMJDZྫ

    View full-size slide

  25. Cilium Network Policy L4
    26
    ˓ 5$16%1ϙʔτ൪߸
    ˓ *$.1λΠϓ
    5$1ϙʔτ൪߸$JMJVN/FUXPSL1PMJDZͷྫ

    View full-size slide

  26. Cilium Network Policy L4
    27
    ˓ 5$16%1ϙʔτ൪߸
    ˓ *$.1λΠϓ
    ˔ *$.1ɺ*$.1WͷλΠϓ
    ˔ GFBUVSFϑϥάΛ༗ޮʹ͢Δ͜ͱͰར༻Մೳ
    ˔ ͨͩ͠ݱࡏ͸҆ఆಈ࡞͠ͳ͍ͨΊඇਪ঑
    *$.1λΠϓ$JMJVN/FUXPSL1PMJDZͷྫ

    View full-size slide

  27. Cilium Network Policy L7
    28
    ˓ ڐՄϦετͷΈ
    ˓ )551
    ˔ ύε
    ˔ ϗετ໊
    ˔ ϝιου
    ˔ ϔομʔ
    ˓ %/4
    ˓ ,BGLB CFUB

    )551$JMJVN/FUXPSL1PMJDZͷྫ

    View full-size slide

  28. Cilium Network Policy L7
    29
    ˓ ڐՄϦετͷΈ
    ˓ )551
    ˓ %/4
    ˔ ໊લࢦఆ
    ˔ ύλʔϯϚον
    ˓ ,BGLB CFUB

    %/4$JMJVN/FUXPSL1PMJDZͷྫ

    View full-size slide

  29. Cilium Network Policy L7
    30
    ˓ ڐՄϦετͷΈ
    ˓ )551
    ˓ %/4
    ˓ ,BGLB CFUB

    ˔ 3PMF
    ˔ "1*Ωʔ
    ˔ "1*όʔδϣϯ
    ˔ ΫϥΠΞϯτ*%
    ˔ τϐοΫ
    ,BGLB$JMJVN/FUXPSL1PMJDZͷྫ

    View full-size slide

  30. Cilium Network Policy σϞ L7-HTTP
    31
    6CVOUV /(*/9

    BMMPX
    EFOZ

    View full-size slide

  31. Cilium Network Policyͷ࣮ݱ
    32
    /FUXPSL1PMJDZΛهड़ͨ͠
    ϚχϑΣετϑΝΠϧ
    DJMJVNQLHLTXBUDIFSTDJMJVN@OFUXPSL@QPMJDZHP
    ,T8BUDIFSBEE$JMJVN/FUXPSL1PMJDZ7

    View full-size slide

  32. Cilium Network Policyͷ࣮૷
    33
    ϙϦγʔͷݕࠪ
    Ϣʔβۭؒʢ(Pݴޠʣ
    DJMJVNQLHa
    QPMJDZBQJSVMF@WBMJEBUJPOHP
    3VMF4BOJUJ[F

    View full-size slide

  33. Cilium Network Policyͷ࣮૷
    34
    ϙϦγʔͷݕࠪ /FUXPSL1PMJDZ
    F#1'.BQʹ
    ରԠ͢Δߏ଄ମʹม׵
    Ϣʔβۭؒʢ(Pݴޠʣ
    DJMJVNQLHa
    QPMJDZBQJSVMF@WBMJEBUJPOHP
    3VMF4BOJUJ[F

    DJMJVNQLHa
    FOEQPJOUCQGHP
    &OEQPJOUBEE1PMJDZ,FZ

    F#1'.BQʹରԠͨ͠ߏ଄ମ

    View full-size slide

  34. Cilium Network Policyͷ࣮૷
    35
    ϙϦγʔͷݕࠪ
    F#1'.BQʹରԠͨ͠ߏ଄ମ
    /FUXPSL1PMJDZ
    F#1'.BQʹ
    ରԠ͢Δߏ଄ମʹม׵
    F#1'.BQʹ௥Ճ
    -͸&OWPZ

    Ϣʔβۭؒʢ(Pݴޠʣ
    DJMJVNQLHa
    QPMJDZBQJSVMF@WBMJEBUJPOHP
    3VMF4BOJUJ[F

    DJMJVNQLHa
    FOEQPJOUCQGHP
    &OEQPJOUBEE1PMJDZ,FZ

    DJMJVNQLHa
    CQGNBQ@MJOVYHP
    .BQ6QEBUF

    View full-size slide

  35. ˓ F#1'ϓϩάϥϜؒ΍ϢʔβۭؒϓϩάϥϜͱ
    σʔλΛڞ༗͢Δ࢓૊Έ
    ˔ Ϣʔβۭ͔ؒΒ͸γεςϜίʔϧΛൃߦ
    ˓ LFZWBMVFετΞ
    eBPF Map
    36
    F#1'
    .BQT

    View full-size slide

  36. Cilium Network Policyͷ࣮૷
    37
    ύέοτ
    Χʔωϧۭؒ

    View full-size slide

  37. Cilium Network Policyͷ࣮૷
    38
    ύέοτ
    Χʔωϧۭؒ
    ϔομ৘ใ͔Β
    ϚοϓΩʔʹରԠ͢Δ
    ߏ଄ମʹม׵
    DJMJVNCQGMJCa
    DPOOUSBDLI
    DU@MPPLVQ

    DU@MPPLVQ

    View full-size slide

  38. Cilium Network Policyͷ࣮૷
    39
    ύέοτ
    Χʔωϧۭؒ
    ϔομ৘ใ͔Β
    ϚοϓΩʔʹରԠ͢Δ
    ߏ଄ମʹม׵
    DJMJVNCQGMJCa
    DPOOUSBDLI
    DU@MPPLVQ

    DU@MPPLVQ

    DJMJVNCQGMJCa
    QPMJDZI
    @@QPMJDZ@DBO@BDDFTT

    View full-size slide

  39. Cilium Network Policyͷ࣮૷
    40
    ύέοτ
    Χʔωϧۭؒ
    ϔομ৘ใ͔Β
    ϚοϓΩʔʹରԠ͢Δ
    ߏ଄ମʹม׵
    DJMJVNCQGMJCa
    DPOOUSBDLI
    DU@MPPLVQ

    DU@MPPLVQ

    DJMJVNCQGMJCa
    QPMJDZI
    @@QPMJDZ@DBO@BDDFTT

    View full-size slide

  40. Cilium Network Policyͷ࣮૷
    41
    ύέοτ
    Χʔωϧۭؒ
    ϔομ৘ใ͔Β
    ϚοϓΩʔʹରԠ͢Δ
    ߏ଄ମʹม׵
    র߹͢Δ
    1PMJDZ.BQ
    F#1'.BQ

    %SPQ
    1BTT
    DJMJVNCQGMJCa
    DPOOUSBDLI
    DU@MPPLVQ

    DU@MPPLVQ

    DJMJVNCQGMJCa
    QPMJDZI
    @@QPMJDZ@DBO@BDDFTT

    View full-size slide

  41. ·ͱΊ
    42
    ˓ /FUXPSL1PMJDZϦιʔεͰ1PEͷ௨৴Λ੍ޚͰ͖Δ
    ˓ $JMJVN/FUXPSL1PMJDZ͸/FUXPSL1PMJDZͷ֦ு
    ˔ -ɺ-ɺ-ϙϦγʔ
    ˓ $JMJVN͸F#1'Λ׆༻ͯ͠/FUXPSL1PMJDZΛ࣮ݱ
    ˔ F#1'.BQΛ࢖ͬͯϙϦγʔ৘ใΛ఻೻

    View full-size slide