Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Istio RBAC入門

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest.

Istio RBAC入門

Istio RBACがどういうものかといった説明の簡単バージョン
勉強会にて使用

Avatar for Shunsuke Miyoshi

Shunsuke Miyoshi

March 27, 2019
Tweet

More Decks by Shunsuke Miyoshi

Other Decks in Programming

Transcript

  1. ࣗݾ঺հ • ࣾձਓ3೥໨ • Kubernetesͷٕज़ݕূɾීٴ׆ಈɾΞϓϦ։ൃͳͲ • IstioͷϑΝϯ • KubeCon 2017ͰॳΊͯݟͨ࣌ʹײಈ

    • झຯϓϩάϥϚʔ • GitHub: https://github.com/sh-miyoshi • Twitter: https://twitter.com/shmiyoshi
  2. Istio RBACͷ࢖͍ํ 1. IstioΛΠϯετʔϧ • ࠓͩͱGKE͕ศར(νΣοΫೖΕΔ͚ͩ) • mTLSΛ༗ޮʹͯ͠ىಈ͢Δ 2. Istio

    RBACΛ༗ޮԽ • σϑΥϧτ͸DisableͳͷͰEnableʹ͢ΔͨΊͷ CRDΛk8sʹapply͢Δ • ※༗ޮʹͳΔ·Ͱগ͕͔͔࣌ؒ͠Δ৔߹͕͋Γ·͢
  3. Istio RBACͷ࢖͍ํ 3. ΞϓϦͷσϓϩΠ • istioctlίϚϯυͰΞϓϦΛσϓϩΠ 4. αʔϏεؒ௨৴ΛڐՄ • CRDͰServiceRoleΛ࡞Δ

    • ServiceRoleΛServiceRoleBinding(Istio CRD)Ͱ KubernetesͷServiceAccountʹݖݶΛ͚ͭΔ ͓·͚: ֎෦͔ΒͷΞΫηεΛڐՄ͢Δ • ུ
  4. Unhappy Things… • Istio͕େม • ࣦഊͨ࣌͠ϩά͕Ͳ͜ʹग़͍ͯΔ͔ෆ໌ • ίϯϙʔωϯτ͕ଟ͗͢ • ͳʹΛઃఆͨ͠Β͍͍͔෼͔Βͳ͍৔ॴ͕͋Δ

    • Serviceͷ໊લ͸ݻఆɺGatewayʹࢦఆग़དྷΔsecret໊΋ݻఆ • Istio RBAC͸·ͩalpha • ࢓༷͕େ͖͘มΘΔ͜ͱ΋ɾɾɾ
 (Istio v0.7 → v0.8Λ஌ͬͯΔਓ͸ۤ͠Έ͕Θ͔Δ͸ͣ)