Upgrade to Pro — share decks privately, control downloads, hide ads and more …

ricc-20210826

 ricc-20210826

Tomoki Sugiura

August 26, 2021
Tweet

More Decks by Tomoki Sugiura

Other Decks in Programming

Transcript

  1. Cilium Explicit Allow-
    Listing for ICMP


    GSoC 2021
    3*$$೥౓ୈҰճݚڀ߹॓
    /"*454%-BC.
    ਿӜஐج

    View full-size slide

  2. ֓ཁ
    2
    ˓ (PPHMF4VNNFSPG$PEFʢ(4P$ʣʹࢀՃ͠·ͨ͠
    ˓ $JMJVNͱ͍͏ωοτϫʔΫ044ͷػೳ௥ՃΛ୲౰
    ˔ *$.1ύέοτͷϑΟϧλʔػೳ
    ˓ ͜ͷൃදͰ͸$JMJVN΍ػೳͷ࣮૷ʹ͍ͭͯ঺հ

    View full-size slide

  3. Google Summer of CodeʢGSoCʣ
    3
    ˓ (PPHMFओ࠵ͷֶੜͷ044ߩݙΛࢧԉ͢ΔϓϩάϥϜ
    ˓ ֶੜ͸ϦετΞοϓ͞Εͨ044ʹରͯ͠ػೳ௥Ճͷ
    ϓϩϙʔβϧΛఏग़
    ˓ ࠾୒͞ΕͨΒʙ݄ͷिؒͰ࣮૷
    ˔ ϝϯλʔ͋Γ
    ˓ தؒ৹ࠪɼ࠷ऴ৹ࠪͦΕͧΕ௨Δ͝ͱʹใ঑ۚ
    ˓ $JMJVNωοτϫʔΫϙϦγʔͷ*$.1ରԠ

    View full-size slide

  4. Cilium
    4
    ˓ ,VCFSOFUFTͷ$/*ϓϥάΠϯͷҰछ
    ˔ IUUQTHJUIVCDPNDJMJVNDJMJVN
    ˓ ॲཧج൫ʹF#1'Λ࢖༻
    ˓ $/*ϓϥάΠϯք۾ͷதͰΞπ͍ଘࡏ
    ˔ (,&EBUBQMBOFWʹ࠾༻
    ˔ $/$'JODVCBUJOHQSPKFDU΁ొ࿥ਃ੥த
    ˗ IUUQTHJUIVCDPNDODGUPDQVMM
    ˔ ೔ຊͰ͸͋·Γ࢖ΘΕͯͳ͍ ҹ৅
    🥺

    View full-size slide

  5. Kubernetes
    5
    ˓ ίϯςφΦʔέετϨʔγϣϯπʔϧͷσϑΝΫτ
    ˓ ෳ਺ͷίϯςφɺෳ਺ͷϊʔυΛ؅ཧ
    ˔ εέδϡʔϦϯά
    ˔ ࣗಈ෮چ
    ˔ ϘϦϡʔϜͷׂΓ౰ͯ
    ˔ FUD
    ˓ એݴతૢ࡞ͱϦίϯαΠϧϧʔϓʢௐ੔ϧʔϓʣ
    ˓ ΦϖϨʔλͷ࢓૊ΈΛ࢖ͬͯίϯςφҎ֎΋
    ؅ཧ
    ˔ ίϯςφΦʔέετϨʔγϣϯ΋Ͱ͖Δπʔϧ

    View full-size slide

  6. KubernetesͱCNIϓϥάΠϯ
    6
    ˓ ,VCFSOFUFT͸ίϯςφͷωοτϫʔΫ*'ͷ࡞੒Λ֎෦
    ϓϥάΠϯʹ೚͍ͤͯΔ
    ˔ ͦΕΛ୲͏ͷ͕$POUBJOFS/FUXPSL*OUFSGBDFʢ$/*ʣ
    ϓϥάΠϯ
    ˔ $/*ϓϥάΠϯ͸,VCFSOFUFTઐ༻πʔϧͰ͸ͳ͍
    ˓ 1PEʢ㲈$POUBJOFSʣੜ੒࣌ʹ,VCFMFU͕$/*ϓϥάΠϯ
    Λىಈ
    ˓ $/*ϓϥάΠϯͷ੹೚ൣғ͸͋͘·Ͱ*'ͷ࡞੒͕ͩ
    ωοτϫʔΫपΓͷॾʑΛ୲͍ͬͯΔ

    View full-size slide

  7. KubernetesͱCNIϓϥάΠϯ
    7
    ˓ $/*ͷఆٛ͸͜͜
    ˓ $/*ͷఏڙ͢΂͖ػೳ
    ˔ "%%
    ˗ ίϯςφʹωοτϫʔΫ*'Λ௥ՃPSߋ৽
    ˔ %&-
    ˗ ίϯςφͷωοτϫʔΫ*'Λ࡟আPS6OEP
    ˔ $)&$,
    ˗ ίϯςφͷωοτϫʔΫ*'ͷঢ়ଶ֬ೝ
    ˔ 7&34*0/
    ˗ $/*ϓϥάΠϯͷόʔδϣϯ֬ೝ

    View full-size slide

  8. ୅දతͳCNIϓϥάΠϯ
    8
    ˓ 'MBOOFM
    ˓ $BMJDP
    ˓ 8FBWF
    ˓ $JMJVN

    View full-size slide

  9. Ciliumͷಛ௃
    9
    ˓ F#1'Λॲཧج൫ʹ׆༻
    ˔ 9%1ʹΑΔύέοτॲཧͷߴ଎Խ
    ˗ JQUBCMFTΑΓ΋ύϑΥʔϚϯεߴ
    ˔ ௨৴ଳҬ؅ཧ
    ˔ ॆ࣮ͨ͠؂ࢹػೳ
    ˓ ΤϯυϙΠϯτͷ*%ϕʔε؅ཧʢOPU*1ΞυϨεʣ
    ˔ LT্ͷΞϓϦέʔγϣϯ͸*1ΞυϨε͕සൟʹมΘΔ

    View full-size slide

  10. eBPF
    10
    ˓ FYUFOEFE#FSLFMFZ1BDLFU'JMUFS
    ˔ 1BDLFU'JMUFSͱݴ͍ͭͭγεςϜίʔϧͷϑΟϧλϦϯάΛ
    ͨ͠ΓϓϩάϥϜͷτϨʔγϯάΛͨ͠Γ
    ˓ ಠ໋ࣗྩηοτΛ΋ͬͨΧʔωϧ಺Ծ૝ϚγϯͰ࣮ߦ
    ˔ γεςϜ7.͡Όͳͯ͘ϓϩηε7.
    ˔ ϓϩάϥϜͷݕࠪػߏ͕͋Δ
    ˓ $ݴޠͰهड़
    ˓ ࠷ۙF#1''PVOEBUJPO͕-JOVY'PVOEBUJOࡿԼʹ
    Ͱ͖ͨ

    View full-size slide

  11. Kubernetesʹ͓͚ΔNetwork Policy
    11
    ˓ $/*ϓϥάΠϯ͕ػೳΛ͍࣋ͬͯΕ͹࢖༻Մೳ
    ˓ ҎԼͷཁૉͰϗϫΠτϦετΛ࡞੒
    ˔ *1ΞυϨε
    ˔ ໊લۭؒ
    ˔ ϥϕϧ
    ˔ ϙʔτ൪߸
    /FUXPSL1PMJDZྫ

    View full-size slide

  12. Cilium Network PolicyʢCNPʣ
    12
    ˓ $/1͸,VCFSOFUFT/FUXPSL1PMJDZͷ֦ு
    ˔ 4FSWJDF
    ˔ &OUJUZ
    ˔ '2%/
    ˔ -ʢ)551ɼ,BGLBʣ
    ˔ FUD
    ˓ BMMPXEFOZ྆ํՄೳ
    -$/1ͷྫ

    View full-size slide

  13. CNPͱICMP
    13
    ˓ ͔͠͠*$.1ͷBMMPXEFOZػೳ͸ͳ͔ͬͨ
    ˔ -ͷBMMPXϧʔϧΛ࡞Δͱ-΋ࣗಈతʹઃఆ͞ΕΔ
    ˠ*$.1શͯυϩοϓ
    ˓ ແ͍ͳΒ࡞Ζ͏

    View full-size slide

  14. Ciliumʹ͓͚ΔPolicyͷ࣮ݱ
    14
    /FUXPSL1PMJDZΛهड़ͨ͠
    ϚχϑΣετϑΝΠϧ

    View full-size slide

  15. Ciliumʹ͓͚ΔPolicyͷ࣮ݱ
    15
    ਖ਼͍͔͠νΣοΫ
    F#1'.BQߏ଄ମ (P

    Ϣʔβۭ֤ؒϊʔυʹͯ
    /1༻F#1'.BQʹ
    ରԠ͢Δߏ଄ମʹม׵
    F#1'.BQʹ௥Ճ

    View full-size slide

  16. Ciliumʹ͓͚ΔPolicyͷ࣮ݱ
    16
    ύέοτ
    F#1'.BQ
    Χʔωϧۭؒ
    ϔομΛಡΈऔͬͯ
    ߏ଄ମʹม׵
    F#1'.BQLFZ
    র߹͢Δ
    1BTT
    %SPQ

    View full-size slide

  17. ICMP Policyͷ࣮૷1
    17
    ਖ਼͍͔͠νΣοΫ
    Ϣʔβۭ֤ؒϊʔυʹͯ
    /1༻F#1'.BQʹ
    ରԠ͢Δߏ଄ମʹม׵
    F#1'.BQʹ௥Ճ
    *$.1ϑΟʔϧυͷνΣοΫ
    *$.1UZQFΛ%FTU1PSUʹೖΕΔ

    View full-size slide

  18. ICMP Policyͷ࣮૷2
    18
    ύέοτ
    F#1'.BQ
    Χʔωϧۭؒ
    ϔομΛಡΈऔͬͯ
    ߏ଄ମʹม׵
    F#1'.BQLFZ
    র߹͢Δ
    1BTT
    %SPQ
    *$.1ϔομΛಡΈऔΓ

    View full-size slide

  19. ICMP Policyͷ࣮૷3
    19
    ˓ ৄ͘͠͸ͪ͜Β
    ˔ IUUQTHJTUHJUIVCDPNDIF[TIBOQV
    DBDBDDGBGGDBE

    View full-size slide

  20. ۤ࿑ϙΠϯτ
    20
    ˓ F#1'͸ϓϩάϥϜαΠζʢ໋ྩ਺ʣͷ੍ݶ͋Γ
    ˔ ΧʔωϧόʔδϣϯʹΑͬͯҧ͏ͷͰͦΕͧΕͰ֬ೝ
    ˔ ͜ͷ੍ݶʹΑΓ*$.1ϑΟϧλʔ͸Ծ࣮૷ঢ়ଶ🥺
    ˓ ʢ୭͔͕͕$*յ͢ͱࣗ෼ͷมߋΛϚʔδͯ͠΋Β͑ͳ͍ʣ

    View full-size slide

  21. ·ͱΊ
    21
    ˓ ,VCFSOFUFT͸ωοτϫʔΫػೳΛ$/*ϓϥάΠϯʹҕ೚
    ˓ $JMJVN͸F#1'Λ࢖ͬͨ$/*ϓϥάΠϯͷҰͭ
    ˓ F#1'ͷ੍ݶ͔Β*$.1ϑΟϧλʔػೳ͸Ծ࣮૷ঢ়ଶ
    ˓ (4P$͸ऴΘΓ·͕ͨ͠ɼ΋͏ͪΐͬͱؤுΓ·͢

    View full-size slide