Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
ricc-20210826
Search
Tomoki Sugiura
August 26, 2021
Programming
0
400
ricc-20210826
Tomoki Sugiura
August 26, 2021
Tweet
Share
More Decks by Tomoki Sugiura
See All by Tomoki Sugiura
CiliumによるKubernetes Network Policyの実現 CNDT2021
shanpu
0
890
naist colloquium-B 2
shanpu
0
150
IOT53
shanpu
0
36
RICC-PIoT Workshop 2021
shanpu
0
480
ricc-nii-2020
shanpu
0
81
Cloud Native Kansai #05 LT4
shanpu
1
840
gcpug-kyoto#2-LT1
shanpu
0
570
kubernetes-seminar
shanpu
0
130
KansaiLT2
shanpu
0
200
Other Decks in Programming
See All in Programming
Try creating your own orderedmap
kazamori
1
250
Let's learn code review
riofujimon
2
610
ServerAction で Progressive Enhancement はどこまで頑張れるか? / progressive-enhancement-with-server-action
takefumiyoshii
6
460
AmperとFleetを使ったAndroidアプリ
yoppie
0
270
Komplexe Oberflächen mit SVG und der Web Animation API
joergneumann
0
680
Goのmultiple errorsについて (2024年4月版)
syumai
4
1.2k
AppRouter Panel Talk
yosuke_furukawa
PRO
1
490
冗長なエラーログを削減し、スタックトレースを手に入れる / Reducing Verbose Error Logs and Obtaining Stack Traces
upamune
0
1.1k
Ruby GitHub Packages
bkuhlmann
0
650
はてなにおける CSS Modules、及び CSS Modules に足りないもの / CSS Modules in Hatena, and CSS Modules missing parts
mizdra
7
990
SIMD Parallel Programming with the Vector API
josepaumard
0
240
TCAとKMPを用いた新規動画配信アプリ 「ABEMA Live」の設計
tomu28
2
130
Featured
See All Featured
Reflections from 52 weeks, 52 projects
jeffersonlam
345
19k
Web development in the modern age
philhawksworth
203
10k
Build your cross-platform service in a week with App Engine
jlugia
226
17k
GitHub's CSS Performance
jonrohan
1025
450k
GraphQLの誤解/rethinking-graphql
sonatard
56
9.3k
4 Signs Your Business is Dying
shpigford
176
21k
Docker and Python
trallard
35
2.7k
Building a Scalable Design System with Sketch
lauravandoore
457
32k
The Pragmatic Product Professional
lauravandoore
26
5.8k
Building Flexible Design Systems
yeseniaperezcruz
320
37k
How GitHub Uses GitHub to Build GitHub
holman
468
290k
Fontdeck: Realign not Redesign
paulrobertlloyd
76
4.9k
Transcript
Cilium Explicit Allow- Listing for ICMP GSoC 2021 3*$$ୈҰճݚڀ߹॓ /"*454%-BC.
ਿӜஐج
֓ཁ 2 ˓ (PPHMF4VNNFSPG$PEFʢ(4P$ʣʹࢀՃ͠·ͨ͠ ˓ $JMJVNͱ͍͏ωοτϫʔΫ044ͷػೳՃΛ୲ ˔ *$.1ύέοτͷϑΟϧλʔػೳ ˓ ͜ͷൃදͰ$JMJVNػೳͷ࣮ʹ͍ͭͯհ
Google Summer of CodeʢGSoCʣ 3 ˓ (PPHMFओ࠵ͷֶੜͷ044ߩݙΛࢧԉ͢ΔϓϩάϥϜ ˓ ֶੜϦετΞοϓ͞Εͨ044ʹରͯ͠ػೳՃͷ ϓϩϙʔβϧΛఏग़
˓ ࠾͞ΕͨΒʙ݄ͷिؒͰ࣮ ˔ ϝϯλʔ͋Γ ˓ தؒ৹ࠪɼ࠷ऴ৹ࠪͦΕͧΕ௨Δ͝ͱʹใۚ ˓ $JMJVNωοτϫʔΫϙϦγʔͷ*$.1ରԠ
Cilium 4 ˓ ,VCFSOFUFTͷ$/*ϓϥάΠϯͷҰछ ˔ IUUQTHJUIVCDPNDJMJVNDJMJVN ˓ ॲཧج൫ʹF#1'Λ༻ ˓ $/*ϓϥάΠϯք۾ͷதͰΞπ͍ଘࡏ
˔ (,&EBUBQMBOFWʹ࠾༻ ˔ $/$'JODVCBUJOHQSPKFDUొਃத ˗ IUUQTHJUIVCDPNDODGUPDQVMM ˔ ຊͰ͋·ΓΘΕͯͳ͍ ҹ 🥺
Kubernetes 5 ˓ ίϯςφΦʔέετϨʔγϣϯπʔϧͷσϑΝΫτ ˓ ෳͷίϯςφɺෳͷϊʔυΛཧ ˔ εέδϡʔϦϯά ˔ ࣗಈ෮چ
˔ ϘϦϡʔϜͷׂΓͯ ˔ FUD ˓ એݴతૢ࡞ͱϦίϯαΠϧϧʔϓʢௐϧʔϓʣ ˓ ΦϖϨʔλͷΈΛͬͯίϯςφҎ֎ ཧ ˔ ίϯςφΦʔέετϨʔγϣϯͰ͖Δπʔϧ
KubernetesͱCNIϓϥάΠϯ 6 ˓ ,VCFSOFUFTίϯςφͷωοτϫʔΫ*'ͷ࡞Λ֎෦ ϓϥάΠϯʹ͍ͤͯΔ ˔ ͦΕΛ୲͏ͷ͕$POUBJOFS/FUXPSL*OUFSGBDFʢ$/*ʣ ϓϥάΠϯ ˔ $/*ϓϥάΠϯ,VCFSOFUFTઐ༻πʔϧͰͳ͍
˓ 1PEʢ㲈$POUBJOFSʣੜ࣌ʹ,VCFMFU͕$/*ϓϥάΠϯ Λىಈ ˓ $/*ϓϥάΠϯͷൣғ͋͘·Ͱ*'ͷ࡞͕ͩ ωοτϫʔΫपΓͷॾʑΛ୲͍ͬͯΔ
KubernetesͱCNIϓϥάΠϯ 7 ˓ $/*ͷఆٛ͜͜ ˓ $/*ͷఏڙ͖͢ػೳ ˔ "%% ˗ ίϯςφʹωοτϫʔΫ*'ΛՃPSߋ৽
˔ %&- ˗ ίϯςφͷωοτϫʔΫ*'ΛআPS6OEP ˔ $)&$, ˗ ίϯςφͷωοτϫʔΫ*'ͷঢ়ଶ֬ೝ ˔ 7&34*0/ ˗ $/*ϓϥάΠϯͷόʔδϣϯ֬ೝ
දతͳCNIϓϥάΠϯ 8 ˓ 'MBOOFM ˓ $BMJDP ˓ 8FBWF ˓ $JMJVN
Ciliumͷಛ 9 ˓ F#1'Λॲཧج൫ʹ׆༻ ˔ 9%1ʹΑΔύέοτॲཧͷߴԽ ˗ JQUBCMFTΑΓύϑΥʔϚϯεߴ ˔ ௨৴ଳҬཧ
˔ ॆ࣮ͨ͠ࢹػೳ ˓ ΤϯυϙΠϯτͷ*%ϕʔεཧʢOPU*1ΞυϨεʣ ˔ LT্ͷΞϓϦέʔγϣϯ*1ΞυϨε͕සൟʹมΘΔ
eBPF 10 ˓ FYUFOEFE#FSLFMFZ1BDLFU'JMUFS ˔ 1BDLFU'JMUFSͱݴ͍ͭͭγεςϜίʔϧͷϑΟϧλϦϯάΛ ͨ͠ΓϓϩάϥϜͷτϨʔγϯάΛͨ͠Γ ˓ ಠ໋ࣗྩηοτΛͬͨΧʔωϧԾϚγϯͰ࣮ߦ ˔
γεςϜ7.͡Όͳͯ͘ϓϩηε7. ˔ ϓϩάϥϜͷݕࠪػߏ͕͋Δ ˓ $ݴޠͰهड़ ˓ ࠷ۙF#1''PVOEBUJPO͕-JOVY'PVOEBUJOࡿԼʹ Ͱ͖ͨ
Kubernetesʹ͓͚ΔNetwork Policy 11 ˓ $/*ϓϥάΠϯ͕ػೳΛ͍࣋ͬͯΕ༻Մೳ ˓ ҎԼͷཁૉͰϗϫΠτϦετΛ࡞ ˔ *1ΞυϨε ˔
໊લۭؒ ˔ ϥϕϧ ˔ ϙʔτ൪߸ /FUXPSL1PMJDZྫ
Cilium Network PolicyʢCNPʣ 12 ˓ $/1,VCFSOFUFT/FUXPSL1PMJDZͷ֦ு ˔ 4FSWJDF ˔ &OUJUZ
˔ '2%/ ˔ -ʢ)551ɼ,BGLBʣ ˔ FUD ˓ BMMPXEFOZ྆ํՄೳ -$/1ͷྫ
CNPͱICMP 13 ˓ ͔͠͠*$.1ͷBMMPXEFOZػೳͳ͔ͬͨ ˔ -ͷBMMPXϧʔϧΛ࡞Δͱ-ࣗಈతʹઃఆ͞ΕΔ ˠ*$.1શͯυϩοϓ ˓ ແ͍ͳΒ࡞Ζ͏
Ciliumʹ͓͚ΔPolicyͷ࣮ݱ 14 /FUXPSL1PMJDZΛهड़ͨ͠ ϚχϑΣετϑΝΠϧ
Ciliumʹ͓͚ΔPolicyͷ࣮ݱ 15 ਖ਼͍͔͠νΣοΫ F#1'.BQߏମ (P Ϣʔβۭ֤ؒϊʔυʹͯ /1༻F#1'.BQʹ ରԠ͢Δߏମʹม F#1'.BQʹՃ
Ciliumʹ͓͚ΔPolicyͷ࣮ݱ 16 ύέοτ F#1'.BQ Χʔωϧۭؒ ϔομΛಡΈऔͬͯ ߏମʹม F#1'.BQLFZ র߹͢Δ 1BTT
%SPQ
ICMP Policyͷ࣮1 17 ਖ਼͍͔͠νΣοΫ Ϣʔβۭ֤ؒϊʔυʹͯ /1༻F#1'.BQʹ ରԠ͢Δߏମʹม F#1'.BQʹՃ *$.1ϑΟʔϧυͷνΣοΫ *$.1UZQFΛ%FTU1PSUʹೖΕΔ
ICMP Policyͷ࣮2 18 ύέοτ F#1'.BQ Χʔωϧۭؒ ϔομΛಡΈऔͬͯ ߏମʹม F#1'.BQLFZ র߹͢Δ
1BTT %SPQ *$.1ϔομΛಡΈऔΓ
ICMP Policyͷ࣮3 19 ˓ ৄͪ͘͜͠Β ˔ IUUQTHJTUHJUIVCDPNDIF[TIBOQV DBDBDDGBGGDBE
ۤ࿑ϙΠϯτ 20 ˓ F#1'ϓϩάϥϜαΠζʢ໋ྩʣͷ੍ݶ͋Γ ˔ ΧʔωϧόʔδϣϯʹΑͬͯҧ͏ͷͰͦΕͧΕͰ֬ೝ ˔ ͜ͷ੍ݶʹΑΓ*$.1ϑΟϧλʔԾ࣮ঢ়ଶ🥺 ˓ ʢ୭͔͕͕$*յ͢ͱࣗͷมߋΛϚʔδͯ͠Β͑ͳ͍ʣ
·ͱΊ 21 ˓ ,VCFSOFUFTωοτϫʔΫػೳΛ$/*ϓϥάΠϯʹҕ ˓ $JMJVNF#1'Λͬͨ$/*ϓϥάΠϯͷҰͭ ˓ F#1'ͷ੍ݶ͔Β*$.1ϑΟϧλʔػೳԾ࣮ঢ়ଶ ˓ (4P$ऴΘΓ·͕ͨ͠ɼ͏ͪΐͬͱؤுΓ·͢
❤