自作 Controller による Secret の配布と収集 / Distributing and collecting secrets with self-made controller

©2019 Wantedly, Inc. ࣗ࡞ Controller ʹΑΔ Secret ͷ഑෍ͱऩू Kubernetes Meetup
Tokyo #23 Takayuki Kasai (@unblee) Wantedly, Inc. 2019.9.27 -

©2019 Wantedly, Inc. w ӡ༻্ͷ՝୊Λখ͞ͳࣗ࡞$POUSPMMFSͰղܾ͢Δྫ w ӡ༻ϧʔϧʹಛԽͨ͠$POUSPMMFSͷ࣮૷ྫ ࿩͢͜ͱ ࿩͞ͳ͍͜ͱ w
$POUSPMMFS࣮૷ͷৄࡉɾ5JQT

©2019 Wantedly, Inc. w 4FDSFUͷ഑෍ w શͯͷ/BNFTQBDFʹڞ௨͢Δ4FDSFUΛઃఆ͍ͨ͠ w XBOUFEMZLOTLFM ӡ༻্ͷ՝୊
w 4FDSFUͷऩू w ෳ਺/BNFTQBDFͷ4FDSFUΛͭͷ/BNFTQBDFʹू໿͍ͨ͠ w XBOUFEMZSJHHFS

©2019 Wantedly, Inc. 4FDSFUͷ഑෍ w શͯͷ/BNFTQBDFʹڞ௨ͯ͠ઃఆͯ͠ཉ͍͠4FDSFU͕͋Δ w JNBHF1VMM4FDSFU EEBHFOUUPLFO FUD
w /BNFTQBDFΛ࡞Δͨͼʹઃఆ͢Δͷ͸໘౗ w 4FDSFUΛ௥Ճมߋ࡟আͨ͠Βطଘͷ/BNFTQBDFʹ΋൓өͯ͠΄͍͠ ˠXBOUFEMZLOTLFMͱ͍͏$POUSPMMFSΛ࡞੒ͨ͠ w DMJFOUHP࣮૷ w ࡞੒ͨ͠ͷ͸Կ΋ແ͔ͬͨ೥લɹࠓͳΒ1PE1SFTFUΛ࢖͏

©2019 Wantedly, Inc. w 4FDSFUͷ഑෍ w શͯͷ/BNFTQBDFʹڞ௨͢Δ4FDSFUΛઃఆ͍ͨ͠ w XBOUFEMZLOTLFM ӡ༻্ͷ՝୊
w 4FDSFUͷऩू w ෳ਺/BNFTQBDFͷ4FDSFUΛͭͷ/BNFTQBDFʹू໿͍ͨ͠ w XBOUFEMZSJHHFS

©2019 Wantedly, Inc. എܠ"SHPͷಋೖ templates: - name: alpine container: image:
alpine command: - job-A - name: ubuntu container: image: ubuntu command: - job-Z - name: argo-workflow dag: tasks: - name: alpine-job-A template: alpine - name: ubuntu-job-Z dependencies: [alpine-job-A] template: ubuntu "SHP8PSLqPXϑΝΠϧͷྫ ʢؔ܎ͳ͍෦෼͸লུʣ

©2019 Wantedly, Inc. 4FDSFUͷऩूϞνϕʔγϣϯ "SHP8PSLqPXͷઃܭͱ8BOUFEMZͷӡ༻ϧʔϧͷ૬ੑ͕ѱ͍ w /BNFTQBDF.JDSPTFSWJDFͱ͍͏ӡ༻ϧʔϧ w ֤.JDSPTFSWJDFͷ؀ڥม਺͸֤/BNFTQBDFͷઐ༻4FDSFUͰ؅ཧ͞Ε͍ͯΔ w
ͭͷ8PSLqPX͕ෳ਺ͷ.JDSPTFSWJDFͰߏ੒͞ΕΔ͜ͱ͕͋Δ w 8PSLqPXʹؚ·ΕΔ֤εςοϓ͸શͯͭͷ/BNFTQBDF಺Ͱ࣮ߦ͞ΕΔ w ֤εςοϓͰඞཁͳ؀ڥม਺͕ผͷ/BNFTQBDFʹ͋ͬͯಡΈࠐΊͳ͍ ෳ਺.JDSPTFSWJDFͷ4FDSFUΛͭͷ/BNFTQBDFʹू໿͢Δඞཁੑ

©2019 Wantedly, Inc. 4FDSFUͷऩूͲ͏΍͔ͬͨ w ,VCFCVJMEFSW BMQIB Ͱ࣮૷ͨ͠$3%$POUSPMMFS w ಛఆͷ໊લʹҰக͢Δ4FDSFUΛશͯͷ/BNFTQBDF͔Βऩू͠ 
ࢦఆͨ͠/BNFTQBDF΁ෳ੡ɾಉظ͢Δ w ର৅ͷ4FDSFUͷ஋͕௥Ճߋ৽࡟আ͞Εͨͱ͖͸  ෳ੡ͨ͠4FDSFUʹ΋ࣗಈతʹ൓ө͢Δ XBOUFEMZSJHHFS

©2019 Wantedly, Inc. 4FDSFUͷऩूͲ͏΍͔ͬͨ apiVersion: rigger.k8s.wantedly.com/v1beta1 kind: Plan metadata: name:
plan-sample spec: syncTargetSecretName: env syncDestNamespace: sync-dest XBOUFEMZSJHHFS w 1MBO3FTPVSDFͰઃఆ͢Δ w TZOD5BSHFU4FDSFU/BNF w ෳ੡ݩͷ4FDSFU໊ w TZOD%FTU/BNFTQBDF w ෳ੡ઌͷ/BNFTQBDF໊

©2019 Wantedly, Inc. /BNFTQBDFTZODEFTU 4FDFUTFSWJDFCB[FOW 4FDFUTFSWJDFCBSFOW /BNFTQBDFTFSWJDFCB[ /BNFTQBDFTFSWJDFCBS /BNFTQBDFTFSWJDFGPP 4FDSFUͷऩूͲ͏΍͔ͬͨ
4FDFUFOW 4FDFUFOW 4FDFUFOW 50,&/BBB 50,&/ZZZ 50,&/[[[ 4FDFUTFSWJDFGPPFOW 50,&/BBB 50,&/ZZZ 50,&/[[[ SJHHFS

©2019 Wantedly, Inc. ·ͱΊ w ӡ༻্ͷ՝୊Λখ͞ͳࣗ࡞$POUSPMMFSͰղܾ͢ΔྫΛ঺հ w ,VCFSOFUFTͷϑϨʔϜϫʔΫʹ৐Δ͜ͱͰ  ௿ίετͰཉ͍͠ػೳ͕࣮ݱͰ͖Δ w
ӡ༻ϧʔϧʹಛԽͨ͠$POUSPMMFSΛࣗ࡞͢Δ͜ͱ͕༗ޮͳέʔε΋͋Δ

自作 Controller による Secret の配布と収集 / Distributing ...

自作 Controller による Secret の配布と収集 / Distributing and collecting secrets with self-made controller

Takayuki Kasai

More Decks by Takayuki Kasai

Other Decks in Programming

Featured

Transcript

©2019 Wantedly, Inc. ࣗ࡞ Controller ʹΑΔ Secret ͷ഑෍ͱऩू Kubernetes Meetup

©2019 Wantedly, Inc. w ӡ༻্ͷ՝୊Λখ͞ͳࣗ࡞$POUSPMMFSͰղܾ͢Δྫ w ӡ༻ϧʔϧʹಛԽͨ͠$POUSPMMFSͷ࣮૷ྫ ࿩͢͜ͱ ࿩͞ͳ͍͜ͱ w

©2019 Wantedly, Inc. w 4FDSFUͷ഑෍ w શͯͷ/BNFTQBDFʹڞ௨͢Δ4FDSFUΛઃఆ͍ͨ͠ w XBOUFEMZLOTLFM ӡ༻্ͷ՝୊

©2019 Wantedly, Inc. w 4FDSFUͷ഑෍ w શͯͷ/BNFTQBDFʹڞ௨͢Δ4FDSFUΛઃఆ͍ͨ͠ w XBOUFEMZLOTLFM ӡ༻্ͷ՝୊

©2019 Wantedly, Inc. 4FDSFUͷ഑෍ w શͯͷ/BNFTQBDFʹڞ௨ͯ͠ઃఆͯ͠ཉ͍͠4FDSFU͕͋Δ w JNBHF1VMM4FDSFU EEBHFOUUPLFO FUD

©2019 Wantedly, Inc. w 4FDSFUͷ഑෍ w શͯͷ/BNFTQBDFʹڞ௨͢Δ4FDSFUΛઃఆ͍ͨ͠ w XBOUFEMZLOTLFM ӡ༻্ͷ՝୊

©2019 Wantedly, Inc. എܠ"SHPͷಋೖ w ࠷ۙ"SHPͱ͍͏8PSLqPX&OHJOFΛಋೖͨ͠ w $3%$POUSPMMFSͱ࣮ͯ͠૷͞Ε͍ͯΔ w 8PSLqPXෳ਺ͷεςοϓʢ%PDLFSJNBHFʣͰߏ੒͞ΕΔϑΝΠϧ

©2019 Wantedly, Inc. എܠ"SHPͷಋೖ templates: - name: alpine container: image:

©2019 Wantedly, Inc. 4FDSFUͷऩूϞνϕʔγϣϯ "SHP8PSLqPXͷઃܭͱ8BOUFEMZͷӡ༻ϧʔϧͷ૬ੑ͕ѱ͍ w /BNFTQBDF.JDSPTFSWJDFͱ͍͏ӡ༻ϧʔϧ w ֤.JDSPTFSWJDFͷ؀ڥม਺͸֤/BNFTQBDFͷઐ༻4FDSFUͰ؅ཧ͞Ε͍ͯΔ w

©2019 Wantedly, Inc. 4FDSFUͷऩूͲ͏΍͔ͬͨ w ,VCFCVJMEFSW BMQIB Ͱ࣮૷ͨ͠$3%$POUSPMMFS w ಛఆͷ໊લʹҰக͢Δ4FDSFUΛશͯͷ/BNFTQBDF͔Βऩू͠

©2019 Wantedly, Inc. 4FDSFUͷऩूͲ͏΍͔ͬͨ apiVersion: rigger.k8s.wantedly.com/v1beta1 kind: Plan metadata: name:

©2019 Wantedly, Inc. /BNFTQBDFTZODEFTU 4FDFUTFSWJDFCB[FOW 4FDFUTFSWJDFCBSFOW /BNFTQBDFTFSWJDFCB[ /BNFTQBDFTFSWJDFCBS /BNFTQBDFTFSWJDFGPP 4FDSFUͷऩूͲ͏΍͔ͬͨ

©2019 Wantedly, Inc. ·ͱΊ w ӡ༻্ͷ՝୊Λখ͞ͳࣗ࡞$POUSPMMFSͰղܾ͢ΔྫΛ঺հ w ,VCFSOFUFTͷϑϨʔϜϫʔΫʹ৐Δ͜ͱͰ  ௿ίετͰཉ͍͠ػೳ͕࣮ݱͰ͖Δ w

©2019 Wantedly, Inc. !VOCMFF5BLBZVLJ,BTBJ OGSBTUSVDUVSF&OHJOFFS 8BOUFEMZ OD /FX(SBET