Upgrade to Pro — share decks privately, control downloads, hide ads and more …

自作 Controller による Secret の配布と収集 / Distributing and collecting secrets with self-made controller

Takayuki Kasai
September 27, 2019

自作 Controller による Secret の配布と収集 / Distributing and collecting secrets with self-made controller

Kubernetes Meetup Tokyo #23

Takayuki Kasai

September 27, 2019
Tweet

More Decks by Takayuki Kasai

Other Decks in Programming

Transcript

  1. ©2019 Wantedly, Inc.
    ࣗ࡞ Controller ʹΑΔ
    Secret ͷ഑෍ͱऩू
    Kubernetes Meetup Tokyo #23
    Takayuki Kasai (@unblee) Wantedly, Inc.
    2019.9.27 -

    View full-size slide

  2. ©2019 Wantedly, Inc.
    w ӡ༻্ͷ՝୊Λখ͞ͳࣗ࡞$POUSPMMFSͰղܾ͢Δྫ
    w ӡ༻ϧʔϧʹಛԽͨ͠$POUSPMMFSͷ࣮૷ྫ
    ࿩͢͜ͱ
    ࿩͞ͳ͍͜ͱ
    w $POUSPMMFS࣮૷ͷৄࡉɾ5JQT

    View full-size slide

  3. ©2019 Wantedly, Inc.
    w 4FDSFUͷ഑෍
    w શͯͷ/BNFTQBDFʹڞ௨͢Δ4FDSFUΛઃఆ͍ͨ͠
    w XBOUFEMZLOTLFM
    ӡ༻্ͷ՝୊
    w 4FDSFUͷऩू
    w ෳ਺/BNFTQBDFͷ4FDSFUΛͭͷ/BNFTQBDFʹू໿͍ͨ͠
    w XBOUFEMZSJHHFS

    View full-size slide

  4. ©2019 Wantedly, Inc.
    w 4FDSFUͷ഑෍
    w શͯͷ/BNFTQBDFʹڞ௨͢Δ4FDSFUΛઃఆ͍ͨ͠
    w XBOUFEMZLOTLFM
    ӡ༻্ͷ՝୊
    w 4FDSFUͷऩू
    w ෳ਺/BNFTQBDFͷ4FDSFUΛͭͷ/BNFTQBDFʹू໿͍ͨ͠
    w XBOUFEMZSJHHFS

    View full-size slide

  5. ©2019 Wantedly, Inc.
    4FDSFUͷ഑෍
    w શͯͷ/BNFTQBDFʹڞ௨ͯ͠ઃఆͯ͠ཉ͍͠4FDSFU͕͋Δ
    w JNBHF1VMM4FDSFU EEBHFOUUPLFO FUD
    w /BNFTQBDFΛ࡞Δͨͼʹઃఆ͢Δͷ͸໘౗
    w 4FDSFUΛ௥Ճมߋ࡟আͨ͠Βطଘͷ/BNFTQBDFʹ΋൓өͯ͠΄͍͠
    ˠXBOUFEMZLOTLFMͱ͍͏$POUSPMMFSΛ࡞੒ͨ͠
    w DMJFOUHP࣮૷
    w ࡞੒ͨ͠ͷ͸Կ΋ແ͔ͬͨ೥લɹࠓͳΒ1PE1SFTFUΛ࢖͏

    View full-size slide

  6. ©2019 Wantedly, Inc.
    w 4FDSFUͷ഑෍
    w શͯͷ/BNFTQBDFʹڞ௨͢Δ4FDSFUΛઃఆ͍ͨ͠
    w XBOUFEMZLOTLFM
    ӡ༻্ͷ՝୊
    w 4FDSFUͷऩू
    w ෳ਺/BNFTQBDFͷ4FDSFUΛͭͷ/BNFTQBDFʹू໿͍ͨ͠
    w XBOUFEMZSJHHFS

    View full-size slide

  7. ©2019 Wantedly, Inc.
    എܠ"SHPͷಋೖ
    w ࠷ۙ"SHPͱ͍͏8PSLqPX&OHJOFΛಋೖͨ͠
    w $3%$POUSPMMFSͱ࣮ͯ͠૷͞Ε͍ͯΔ
    w 8PSLqPXෳ਺ͷεςοϓʢ%PDLFSJNBHFʣͰߏ੒͞ΕΔϑΝΠϧ

    View full-size slide

  8. ©2019 Wantedly, Inc.
    എܠ"SHPͷಋೖ
    templates:
    - name: alpine
    container:
    image: alpine
    command:
    - job-A
    - name: ubuntu
    container:
    image: ubuntu
    command:
    - job-Z
    - name: argo-workflow
    dag:
    tasks:
    - name: alpine-job-A
    template: alpine
    - name: ubuntu-job-Z
    dependencies: [alpine-job-A]
    template: ubuntu
    "SHP8PSLqPXϑΝΠϧͷྫ
    ʢؔ܎ͳ͍෦෼͸লུʣ

    View full-size slide

  9. ©2019 Wantedly, Inc.
    4FDSFUͷऩूϞνϕʔγϣϯ
    "SHP8PSLqPXͷઃܭͱ8BOUFEMZͷӡ༻ϧʔϧͷ૬ੑ͕ѱ͍
    w /BNFTQBDF.JDSPTFSWJDFͱ͍͏ӡ༻ϧʔϧ
    w ֤.JDSPTFSWJDFͷ؀ڥม਺͸֤/BNFTQBDFͷઐ༻4FDSFUͰ؅ཧ͞Ε͍ͯΔ
    w ͭͷ8PSLqPX͕ෳ਺ͷ.JDSPTFSWJDFͰߏ੒͞ΕΔ͜ͱ͕͋Δ
    w 8PSLqPXʹؚ·ΕΔ֤εςοϓ͸શͯͭͷ/BNFTQBDF಺Ͱ࣮ߦ͞ΕΔ
    w ֤εςοϓͰඞཁͳ؀ڥม਺͕ผͷ/BNFTQBDFʹ͋ͬͯಡΈࠐΊͳ͍
    ෳ਺.JDSPTFSWJDFͷ4FDSFUΛͭͷ/BNFTQBDFʹू໿͢Δඞཁੑ

    View full-size slide

  10. ©2019 Wantedly, Inc.
    4FDSFUͷऩूͲ͏΍͔ͬͨ
    w ,VCFCVJMEFSW BMQIB
    Ͱ࣮૷ͨ͠$3%$POUSPMMFS
    w ಛఆͷ໊લʹҰக͢Δ4FDSFUΛશͯͷ/BNFTQBDF͔Βऩू͠

    ࢦఆͨ͠/BNFTQBDF΁ෳ੡ɾಉظ͢Δ
    w ର৅ͷ4FDSFUͷ஋͕௥Ճߋ৽࡟আ͞Εͨͱ͖͸

    ෳ੡ͨ͠4FDSFUʹ΋ࣗಈతʹ൓ө͢Δ
    XBOUFEMZSJHHFS

    View full-size slide

  11. ©2019 Wantedly, Inc.
    4FDSFUͷऩूͲ͏΍͔ͬͨ
    apiVersion: rigger.k8s.wantedly.com/v1beta1
    kind: Plan
    metadata:
    name: plan-sample
    spec:
    syncTargetSecretName: env
    syncDestNamespace: sync-dest
    XBOUFEMZSJHHFS
    w 1MBO3FTPVSDFͰઃఆ͢Δ
    w TZOD5BSHFU4FDSFU/BNF
    w ෳ੡ݩͷ4FDSFU໊
    w TZOD%FTU/BNFTQBDF
    w ෳ੡ઌͷ/BNFTQBDF໊

    View full-size slide

  12. ©2019 Wantedly, Inc.
    /BNFTQBDFTZODEFTU
    4FDFUTFSWJDFCB[FOW
    4FDFUTFSWJDFCBSFOW
    /BNFTQBDFTFSWJDFCB[
    /BNFTQBDFTFSWJDFCBS
    /BNFTQBDFTFSWJDFGPP
    4FDSFUͷऩूͲ͏΍͔ͬͨ
    4FDFUFOW 4FDFUFOW 4FDFUFOW
    50,&/BBB 50,&/ZZZ 50,&/[[[
    4FDFUTFSWJDFGPPFOW
    50,&/BBB 50,&/ZZZ 50,&/[[[
    SJHHFS

    View full-size slide

  13. ©2019 Wantedly, Inc.
    ·ͱΊ
    w ӡ༻্ͷ՝୊Λখ͞ͳࣗ࡞$POUSPMMFSͰղܾ͢ΔྫΛ঺հ
    w ,VCFSOFUFTͷϑϨʔϜϫʔΫʹ৐Δ͜ͱͰ

    ௿ίετͰཉ͍͠ػೳ͕࣮ݱͰ͖Δ
    w ӡ༻ϧʔϧʹಛԽͨ͠$POUSPMMFSΛࣗ࡞͢Δ͜ͱ͕༗ޮͳέʔε΋͋Δ

    View full-size slide

  14. ©2019 Wantedly, Inc.
    !VOCMFF5BLBZVLJ,BTBJ
    *OGSBTUSVDUVSF&OHJOFFS 8BOUFEMZ *OD
    /FX(SBET

    View full-size slide