Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Istio RBAC入門

Istio RBAC入門

Istio RBACがどういうものかといった説明の簡単バージョン
勉強会にて使用

78b42c5b261d03959ffec4a60d07c40f?s=128

Shunsuke Miyoshi

March 27, 2019
Tweet

Transcript

  1. Istio RBAC ೖ໳ ෋࢜௨גࣜձࣾ ࡾ޷ ढ़հ

  2. ࣗݾ঺հ • ࣾձਓ3೥໨ • Kubernetesͷٕज़ݕূɾීٴ׆ಈɾΞϓϦ։ൃͳͲ • IstioͷϑΝϯ • KubeCon 2017ͰॳΊͯݟͨ࣌ʹײಈ

    • झຯϓϩάϥϚʔ • GitHub: https://github.com/sh-miyoshi • Twitter: https://twitter.com/shmiyoshi
  3. ࠓ೔օ͞Μʹ͓఻͍͑ͨ͜͠ͱ • ͜ͷઌϚΠΫϩαʔϏεԽͷ೾͸͖ͬͱ͘Δ • ͍͔ͭඞͣηΩϡϦςΟ͕໰୊ʹͳΔ • Microservices + Security
 →

    1ͭͷղͱͯ͠Istio
  4. ϚΠΫϩαʔϏε࣌୅ͷηΩϡϦςΟ ֤αʔϏεͦΕͧΕ͕ߴ͍ϨϕϧͰͷηΩϡϦ ςΟΛ࣮ݱ͠ͳ͚Ε͹ͳΒͳ͍

  5. Istio RBAC

  6. Istio RBACͱ͸ʁ • IstioͷΞΫηείϯτϩʔϧػೳͷҰͭ • KubernetesͷRBACͱಉ༷͡ͳ࢖͍ํͰ Serviceؒͷ௨৴ͷΞΫηε੍ޚͰ͖Δ
 (k8s͸ϦιʔεͷΞΫηε੍ޚ) ྫʣserviceAͷGET /pathʹ͸userA͚ͩΞΫη

    εΛڐՄ͢Δͱ͍͏Α͏ͳઃఆ͕Մೳ
  7. Istio RBACͰͰ͖Δ͜ͱ • ServiceͷೝՄ(Authorization)
 ※ೝূ(Authentication)͸Istio mTLSͰ΍Δ → ࣗ਎ͷService͕ͲͷService(΍User)ʹΞ ΫηεΛڐ͔͢ΛઃఆͰ͖Δ

  8. Istio RBACͷ࢖͍ํ 1. IstioΛΠϯετʔϧ • ࠓͩͱGKE͕ศར(νΣοΫೖΕΔ͚ͩ) • mTLSΛ༗ޮʹͯ͠ىಈ͢Δ 2. Istio

    RBACΛ༗ޮԽ • σϑΥϧτ͸DisableͳͷͰEnableʹ͢ΔͨΊͷ CRDΛk8sʹapply͢Δ • ※༗ޮʹͳΔ·Ͱগ͕͔͔࣌ؒ͠Δ৔߹͕͋Γ·͢
  9. Istio RBACͷ࢖͍ํ 3. ΞϓϦͷσϓϩΠ • istioctlίϚϯυͰΞϓϦΛσϓϩΠ 4. αʔϏεؒ௨৴ΛڐՄ • CRDͰServiceRoleΛ࡞Δ

    • ServiceRoleΛServiceRoleBinding(Istio CRD)Ͱ KubernetesͷServiceAccountʹݖݶΛ͚ͭΔ ͓·͚: ֎෦͔ΒͷΞΫηεΛڐՄ͢Δ • ུ
  10. Let’s Go Demo ! *) https://github.com/sh-miyoshi/sectest खॱ͸sectest/rbac_demo/Apps_RBAC.md

  11. Unhappy Things… • Istio͕େม • ࣦഊͨ࣌͠ϩά͕Ͳ͜ʹग़͍ͯΔ͔ෆ໌ • ίϯϙʔωϯτ͕ଟ͗͢ • ͳʹΛઃఆͨ͠Β͍͍͔෼͔Βͳ͍৔ॴ͕͋Δ

    • Serviceͷ໊લ͸ݻఆɺGatewayʹࢦఆग़དྷΔsecret໊΋ݻఆ • Istio RBAC͸·ͩalpha • ࢓༷͕େ͖͘มΘΔ͜ͱ΋ɾɾɾ
 (Istio v0.7 → v0.8Λ஌ͬͯΔਓ͸ۤ͠Έ͕Θ͔Δ͸ͣ)
  12. ·ͱΊ Microservices + Security → Istio RBACͷ঺հ ݱ࣌఺ͰIstioΛ࢖͏ͷ͸େม͔΋͚ͩͲଘࡏ Λ஌͓ͬͯ͘ͱخ͍͜͠ͱ͋Δ͔΋