Upgrade to Pro — share decks privately, control downloads, hide ads and more …

ricc-20210826

 ricc-20210826

Tomoki Sugiura

August 26, 2021
Tweet

More Decks by Tomoki Sugiura

Other Decks in Programming

Transcript

  1. Cilium Explicit Allow- Listing for ICMP GSoC 2021 3*$$೥౓ୈҰճݚڀ߹॓ /"*454%-BC.

    ਿӜஐج
  2. ֓ཁ 2 ˓ (PPHMF4VNNFSPG$PEFʢ(4P$ʣʹࢀՃ͠·ͨ͠ ˓ $JMJVNͱ͍͏ωοτϫʔΫ044ͷػೳ௥ՃΛ୲౰ ˔ *$.1ύέοτͷϑΟϧλʔػೳ ˓ ͜ͷൃදͰ͸$JMJVN΍ػೳͷ࣮૷ʹ͍ͭͯ঺հ

  3. Google Summer of CodeʢGSoCʣ 3 ˓ (PPHMFओ࠵ͷֶੜͷ044ߩݙΛࢧԉ͢ΔϓϩάϥϜ ˓ ֶੜ͸ϦετΞοϓ͞Εͨ044ʹରͯ͠ػೳ௥Ճͷ ϓϩϙʔβϧΛఏग़

    ˓ ࠾୒͞ΕͨΒʙ݄ͷिؒͰ࣮૷ ˔ ϝϯλʔ͋Γ ˓ தؒ৹ࠪɼ࠷ऴ৹ࠪͦΕͧΕ௨Δ͝ͱʹใ঑ۚ ˓ $JMJVNωοτϫʔΫϙϦγʔͷ*$.1ରԠ
  4. Cilium 4 ˓ ,VCFSOFUFTͷ$/*ϓϥάΠϯͷҰछ ˔ IUUQTHJUIVCDPNDJMJVNDJMJVN ˓ ॲཧج൫ʹF#1'Λ࢖༻ ˓ $/*ϓϥάΠϯք۾ͷதͰΞπ͍ଘࡏ

    ˔ (,&EBUBQMBOFWʹ࠾༻ ˔ $/$'JODVCBUJOHQSPKFDU΁ొ࿥ਃ੥த ˗ IUUQTHJUIVCDPNDODGUPDQVMM ˔ ೔ຊͰ͸͋·Γ࢖ΘΕͯͳ͍ ҹ৅ 🥺
  5. Kubernetes 5 ˓ ίϯςφΦʔέετϨʔγϣϯπʔϧͷσϑΝΫτ ˓ ෳ਺ͷίϯςφɺෳ਺ͷϊʔυΛ؅ཧ ˔ εέδϡʔϦϯά ˔ ࣗಈ෮چ

    ˔ ϘϦϡʔϜͷׂΓ౰ͯ ˔ FUD ˓ એݴతૢ࡞ͱϦίϯαΠϧϧʔϓʢௐ੔ϧʔϓʣ ˓ ΦϖϨʔλͷ࢓૊ΈΛ࢖ͬͯίϯςφҎ֎΋ ؅ཧ ˔ ίϯςφΦʔέετϨʔγϣϯ΋Ͱ͖Δπʔϧ
  6. KubernetesͱCNIϓϥάΠϯ 6 ˓ ,VCFSOFUFT͸ίϯςφͷωοτϫʔΫ*'ͷ࡞੒Λ֎෦ ϓϥάΠϯʹ೚͍ͤͯΔ ˔ ͦΕΛ୲͏ͷ͕$POUBJOFS/FUXPSL*OUFSGBDFʢ$/*ʣ ϓϥάΠϯ ˔ $/*ϓϥάΠϯ͸,VCFSOFUFTઐ༻πʔϧͰ͸ͳ͍

    ˓ 1PEʢ㲈$POUBJOFSʣੜ੒࣌ʹ,VCFMFU͕$/*ϓϥάΠϯ Λىಈ ˓ $/*ϓϥάΠϯͷ੹೚ൣғ͸͋͘·Ͱ*'ͷ࡞੒͕ͩ ωοτϫʔΫपΓͷॾʑΛ୲͍ͬͯΔ
  7. KubernetesͱCNIϓϥάΠϯ 7 ˓ $/*ͷఆٛ͸͜͜ ˓ $/*ͷఏڙ͢΂͖ػೳ ˔ "%% ˗ ίϯςφʹωοτϫʔΫ*'Λ௥ՃPSߋ৽

    ˔ %&- ˗ ίϯςφͷωοτϫʔΫ*'Λ࡟আPS6OEP ˔ $)&$, ˗ ίϯςφͷωοτϫʔΫ*'ͷঢ়ଶ֬ೝ ˔ 7&34*0/ ˗ $/*ϓϥάΠϯͷόʔδϣϯ֬ೝ
  8. ୅දతͳCNIϓϥάΠϯ 8 ˓ 'MBOOFM ˓ $BMJDP ˓ 8FBWF ˓ $JMJVN

  9. Ciliumͷಛ௃ 9 ˓ F#1'Λॲཧج൫ʹ׆༻ ˔ 9%1ʹΑΔύέοτॲཧͷߴ଎Խ ˗ JQUBCMFTΑΓ΋ύϑΥʔϚϯεߴ ˔ ௨৴ଳҬ؅ཧ

    ˔ ॆ࣮ͨ͠؂ࢹػೳ ˓ ΤϯυϙΠϯτͷ*%ϕʔε؅ཧʢOPU*1ΞυϨεʣ ˔ LT্ͷΞϓϦέʔγϣϯ͸*1ΞυϨε͕සൟʹมΘΔ
  10. eBPF 10 ˓ FYUFOEFE#FSLFMFZ1BDLFU'JMUFS ˔ 1BDLFU'JMUFSͱݴ͍ͭͭγεςϜίʔϧͷϑΟϧλϦϯάΛ ͨ͠ΓϓϩάϥϜͷτϨʔγϯάΛͨ͠Γ ˓ ಠ໋ࣗྩηοτΛ΋ͬͨΧʔωϧ಺Ծ૝ϚγϯͰ࣮ߦ ˔

    γεςϜ7.͡Όͳͯ͘ϓϩηε7. ˔ ϓϩάϥϜͷݕࠪػߏ͕͋Δ ˓ $ݴޠͰهड़ ˓ ࠷ۙF#1''PVOEBUJPO͕-JOVY'PVOEBUJOࡿԼʹ Ͱ͖ͨ
  11. Kubernetesʹ͓͚ΔNetwork Policy 11 ˓ $/*ϓϥάΠϯ͕ػೳΛ͍࣋ͬͯΕ͹࢖༻Մೳ ˓ ҎԼͷཁૉͰϗϫΠτϦετΛ࡞੒ ˔ *1ΞυϨε ˔

    ໊લۭؒ ˔ ϥϕϧ ˔ ϙʔτ൪߸ /FUXPSL1PMJDZྫ
  12. Cilium Network PolicyʢCNPʣ 12 ˓ $/1͸,VCFSOFUFT/FUXPSL1PMJDZͷ֦ு ˔ 4FSWJDF ˔ &OUJUZ

    ˔ '2%/ ˔ -ʢ)551ɼ,BGLBʣ ˔ FUD ˓ BMMPXEFOZ྆ํՄೳ -$/1ͷྫ
  13. CNPͱICMP 13 ˓ ͔͠͠*$.1ͷBMMPXEFOZػೳ͸ͳ͔ͬͨ ˔ -ͷBMMPXϧʔϧΛ࡞Δͱ-΋ࣗಈతʹઃఆ͞ΕΔ ˠ*$.1શͯυϩοϓ ˓ ແ͍ͳΒ࡞Ζ͏

  14. Ciliumʹ͓͚ΔPolicyͷ࣮ݱ 14 /FUXPSL1PMJDZΛهड़ͨ͠ ϚχϑΣετϑΝΠϧ

  15. Ciliumʹ͓͚ΔPolicyͷ࣮ݱ 15 ਖ਼͍͔͠νΣοΫ F#1'.BQߏ଄ମ (P Ϣʔβۭ֤ؒϊʔυʹͯ /1༻F#1'.BQʹ ରԠ͢Δߏ଄ମʹม׵ F#1'.BQʹ௥Ճ

  16. Ciliumʹ͓͚ΔPolicyͷ࣮ݱ 16 ύέοτ F#1'.BQ Χʔωϧۭؒ ϔομΛಡΈऔͬͯ ߏ଄ମʹม׵ F#1'.BQLFZ র߹͢Δ 1BTT

    %SPQ
  17. ICMP Policyͷ࣮૷1 17 ਖ਼͍͔͠νΣοΫ Ϣʔβۭ֤ؒϊʔυʹͯ /1༻F#1'.BQʹ ରԠ͢Δߏ଄ମʹม׵ F#1'.BQʹ௥Ճ *$.1ϑΟʔϧυͷνΣοΫ *$.1UZQFΛ%FTU1PSUʹೖΕΔ

  18. ICMP Policyͷ࣮૷2 18 ύέοτ F#1'.BQ Χʔωϧۭؒ ϔομΛಡΈऔͬͯ ߏ଄ମʹม׵ F#1'.BQLFZ র߹͢Δ

    1BTT %SPQ *$.1ϔομΛಡΈऔΓ
  19. ICMP Policyͷ࣮૷3 19 ˓ ৄ͘͠͸ͪ͜Β ˔ IUUQTHJTUHJUIVCDPNDIF[TIBOQV DBDBDDGBGGDBE

  20. ۤ࿑ϙΠϯτ 20 ˓ F#1'͸ϓϩάϥϜαΠζʢ໋ྩ਺ʣͷ੍ݶ͋Γ ˔ ΧʔωϧόʔδϣϯʹΑͬͯҧ͏ͷͰͦΕͧΕͰ֬ೝ ˔ ͜ͷ੍ݶʹΑΓ*$.1ϑΟϧλʔ͸Ծ࣮૷ঢ়ଶ🥺 ˓ ʢ୭͔͕͕$*յ͢ͱࣗ෼ͷมߋΛϚʔδͯ͠΋Β͑ͳ͍ʣ

  21. ·ͱΊ 21 ˓ ,VCFSOFUFT͸ωοτϫʔΫػೳΛ$/*ϓϥάΠϯʹҕ೚ ˓ $JMJVN͸F#1'Λ࢖ͬͨ$/*ϓϥάΠϯͷҰͭ ˓ F#1'ͷ੍ݶ͔Β*$.1ϑΟϧλʔػೳ͸Ծ࣮૷ঢ়ଶ ˓ (4P$͸ऴΘΓ·͕ͨ͠ɼ΋͏ͪΐͬͱؤுΓ·͢