Istio RBAC入門

Transcript

1. Istio RBAC ೖ໳ ෋࢜௨גࣜձࣾ ࡾ޷ ढ़հ

2. ࣗݾ঺հ • ࣾձਓ3೥໨ • Kubernetesͷٕज़ݕূɾීٴ׆ಈɾΞϓϦ։ൃͳͲ • IstioͷϑΝϯ • KubeCon 2017ͰॳΊͯݟͨ࣌ʹײಈ

   • झຯϓϩάϥϚʔ • GitHub: https://github.com/sh-miyoshi • Twitter: https://twitter.com/shmiyoshi

3. ࠓ೔օ͞Μʹ͓఻͍͑ͨ͜͠ͱ • ͜ͷઌϚΠΫϩαʔϏεԽͷ೾͸͖ͬͱ͘Δ • ͍͔ͭඞͣηΩϡϦςΟ͕໰୊ʹͳΔ • Microservices + Security
 →

   1ͭͷղͱͯ͠Istio

4. ϚΠΫϩαʔϏε࣌୅ͷηΩϡϦςΟ ֤αʔϏεͦΕͧΕ͕ߴ͍ϨϕϧͰͷηΩϡϦ ςΟΛ࣮ݱ͠ͳ͚Ε͹ͳΒͳ͍

5. Istio RBAC

6. Istio RBACͱ͸ʁ • IstioͷΞΫηείϯτϩʔϧػೳͷҰͭ • KubernetesͷRBACͱಉ༷͡ͳ࢖͍ํͰ Serviceؒͷ௨৴ͷΞΫηε੍ޚͰ͖Δ
 (k8s͸ϦιʔεͷΞΫηε੍ޚ) ྫʣserviceAͷGET /pathʹ͸userA͚ͩΞΫη

   εΛڐՄ͢Δͱ͍͏Α͏ͳઃఆ͕Մೳ

7. Istio RBACͰͰ͖Δ͜ͱ • ServiceͷೝՄ(Authorization)
 ※ೝূ(Authentication)͸Istio mTLSͰ΍Δ → ࣗ਎ͷService͕ͲͷService(΍User)ʹΞ ΫηεΛڐ͔͢ΛઃఆͰ͖Δ

8. Istio RBACͷ࢖͍ํ 1. IstioΛΠϯετʔϧ • ࠓͩͱGKE͕ศར(νΣοΫೖΕΔ͚ͩ) • mTLSΛ༗ޮʹͯ͠ىಈ͢Δ 2. Istio

   RBACΛ༗ޮԽ • σϑΥϧτ͸DisableͳͷͰEnableʹ͢ΔͨΊͷ CRDΛk8sʹapply͢Δ • ※༗ޮʹͳΔ·Ͱগ͕͔͔࣌ؒ͠Δ৔߹͕͋Γ·͢

9. Istio RBACͷ࢖͍ํ 3. ΞϓϦͷσϓϩΠ • istioctlίϚϯυͰΞϓϦΛσϓϩΠ 4. αʔϏεؒ௨৴ΛڐՄ • CRDͰServiceRoleΛ࡞Δ

   • ServiceRoleΛServiceRoleBinding(Istio CRD)Ͱ KubernetesͷServiceAccountʹݖݶΛ͚ͭΔ ͓·͚: ֎෦͔ΒͷΞΫηεΛڐՄ͢Δ • ུ

10. Let’s Go Demo ! *) https://github.com/sh-miyoshi/sectest खॱ͸sectest/rbac_demo/Apps_RBAC.md

11. Unhappy Things… • Istio͕େม • ࣦഊͨ࣌͠ϩά͕Ͳ͜ʹग़͍ͯΔ͔ෆ໌ • ίϯϙʔωϯτ͕ଟ͗͢ • ͳʹΛઃఆͨ͠Β͍͍͔෼͔Βͳ͍৔ॴ͕͋Δ

    • Serviceͷ໊લ͸ݻఆɺGatewayʹࢦఆग़དྷΔsecret໊΋ݻఆ • Istio RBAC͸·ͩalpha • ࢓༷͕େ͖͘มΘΔ͜ͱ΋ɾɾɾ
 (Istio v0.7 → v0.8Λ஌ͬͯΔਓ͸ۤ͠Έ͕Θ͔Δ͸ͣ)

12. ·ͱΊ Microservices + Security → Istio RBACͷ঺հ ݱ࣌఺ͰIstioΛ࢖͏ͷ͸େม͔΋͚ͩͲଘࡏ Λ஌͓ͬͯ͘ͱخ͍͜͠ͱ͋Δ͔΋