Securing CI/CD Systems Through eBPF (recap)

Talked by https://k8sjp.connpass.com/event/264501/

Transcript

1. 4FDVSJOH$*$%4ZTUFNT
   5ISPVHIF#1'
   ,VCFSOFUFT.FFUVQ5PLZP ,VCF$PO/"3FDBQ
   $ZCFS"HFOU *ODத੢ ݐొ XIZXBJUB
   

   View Slide

2. த੢ ݐొ XIZXBJUB
   $MPVE.BLFSBU$ZCFS"HFOU *OD
   ϓϥΠϕʔτΫϥ΢υ *BB4
   
   ϚωʔδυαʔϏε։ൃ
   TFMGIPTUFESVOOFSJO(JU)VC"DUJPOT
   
   XIZXBJUBNZTIPFT044EFWFMPQFS
   झຯࣗ୐αʔό ,T!IPNF
   ϙʔΧʔ
   ,VCF$POॳࢀઓ ॳւ֎
   ೖࠃΠϯλϏϡʔͰҰഊ 5IBOLZPVBNTZ😭
   
   

   View Slide

3. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
   

   View Slide

4. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
   ● CZ"MFY*MHBZFW $ZDPEF
   ○ IUUQTDZDPEFDPN
   ● IUUQTTDIFEDP"V[
   ● IUUQTXXXZPVUVCFDPNXBUDI WQD#(3'W4SW
   :
   ● $*$%ΛηΩϡΞʹߦ͏ͨΊʹF#1'Λར༻͢ΔࢼΈ
   

   View Slide

5. ● &YUFOEFE#FSLFMFZ1BDLFU'JMUFS
   ● -JOVY,FSOFMͷ4BOECPYͰίʔυΛ࣮ߦ͢Δ࢓૊
   ○ ϦίϯύΠϧෆཁ Ͱ ҆શ ͔ͭ ߴ଎
   ● /FUXPSL 0CTFSWBCJMJUZͷར༻ࣄྫ͕ଟΊ
   ○ ,VCFSOFUFT$/* .POJUPSJOH"HFOU
   લఏ஌ࣝF#1'
   

   View Slide

6. ● &YUFOEFE#FSLFMFZ1BDLFU'JMUFS
   ● -JOVY,FSOFMͷ4BOECPYͰίʔυΛ࣮ߦ͢Δ࢓૊
   ○ ϦίϯύΠϧෆཁ Ͱ ҆શ ͔ͭ ߴ଎
   ● /FUXPSL 0CTFSWBCJMJUZͷར༻ࣄྫ͕ଟΊ
   ○ ,VCFSOFUFT$/*$JMJVN
   ○ .POJUPSJOH"HFOUEBUBEPHBHFOU FCQG@FYQPSUFS
   લఏ஌ࣝF#1'
   

   View Slide

7. IUUQTUXJUUFSDPNHSBGBOBTUBUVT
   લఏ஌ࣝF#1'
   

   View Slide

8. IUUQTHSBGBOBDPNCMPHHSBGBOBBOEDJMJVNEFFQFCQGQPXFSFEPCTFSWBCJMJUZGPSLVCFSOFUFTBOEDMPVE
   OBUJWFJOGSBTUSVDUVSF
   લఏ஌ࣝF#1'
   

   View Slide

9. ຊ୊
   

   View Slide

10. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● $*$%ʹ͓͚ΔηΩϡϦςΟࣄҊ
    ○ 4PMBS8JOETॺ໊෇͖ϑΝΠϧͷॻ׵
    ○ $PEF$PWCBTIJOTUBMMFSͷॻ׵
    ○ /1. 1Z1*αϓϥΠνΣʔϯΞλοΫ
    ● $*$%πʔϧ ͷηΩϡϦςΟରࡦ͸೉͍͠
    ○ ڧݖݶ شൃ͢Δ؀ڥ ௿Մ؍ଌੑ
    

    View Slide

11. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● ఏҊ$*$%΁F#1'ϕʔεͳ"HFOUͷಋೖ
    ● XIZF#1'
    ○ ؆୯ʹՄ؍ଌੑͱηΩϡϦςΟχʔζΛߴΊΒΕΔ
    ○ ࠷৽ΧʔωϧͰಈ࡞͢Δ
    ○ ڧྗͳίϛϡχςΟͱπʔϧ
    ● $JMJVN5FUSBHPOͷ࠾༻
    

    View Slide

12. ● F#1'CBTFE
    4FDVSJUZ0CTFSWBCJMJUZ ηΩϡϦςΟͷՄ؍ଌੑ
    
    BOE
    3VOUJNF&OGPSDFNFOU ϦΞϧλΠϜ࣮ߦ੍ޚ
    
    ● ੨ࢁ͞ΜʹΑΔ೔ຊޠهࣄ
    $JMJVN1SPKFDU͔Βެ։ʂ
    F#1'Λ༻͍ͯηΩϡϦςΟͷՄ؍ଌੑΛ΋ͨΒ͢5FUSBHPOcHJIZPKQ
    $JMJVN5FUSBHPO
    IUUQTHJUIVCDPNDJMJVNUFUSBHPO ͔Θ͍͍ˠ
    

    View Slide

13. $JMJVN5FUSBHPO
    

    View Slide

14. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● $*$%γεςϜʹ$JMJVN5FUSBHPOΛಋೖ
    ○ $*$%γεςϜʹ͓͚Δzಈ࡞Λ؍ଌ͢Δ
    ○ ϓϩηε ίωΫγϣϯ ϑΝΠϧ *0৘ใ
    ● 5FUSBHPO࠾༻ཧ༝
    ○ LQSPCFΛ࢝Ίͱͯ͠ଟ͘ͷσʔλ͕औಘՄೳ
    ○ LTҎ֎ͷ؀ڥͰ΋ಈ࡞͢Δ
    

    View Slide

15. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    

    View Slide

16. 1P$ͷ࣮૷಺༰ʹ͍ͭͯ
    ● Ϗϧυ؀ڥͷ0CTFSWBMJCJUZ
    ○ ϓϩηε ઀ଓઌυϝΠϯ *1
    ● ιʔείʔυͷ׬શੑ֬อ
    ○ HPϑΝΠϧͷॻ׵Λ؂ࢹ
    ● ௨৴ઌͷ੍ޚ
    ○ ڐՄͯ͠ͳ͍*1υϝΠϯ΁ͷ઀ଓՄ൱
    ● (JU)VC"DUJPOT্Ͱಈ࡞͢ΔΑ͏ߏஙࡁ
    

    View Slide

17. 1P$ͷ࣮૷಺༰ʹ͍ͭͯ
    

    View Slide

18. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    HJUDMPOF࣌ͷ HJUIVCDPN΁ͷ઀ଓ
    UDQ@DPOOFDU
    ΛUSBDJOH͢Δ͜ͱͰ؍ଌ੒ޭ
    

    View Slide

19. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    TFUVQHP಺Ͱ࣮ߦ͞Ε͍ͯΔ
    ϓϩηε৘ใͷ؍ଌ੒ޭ
    

    View Slide

20. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● σϞ
    ○ Ϗϧυதͷ HPϑΝΠϧͷॻ׵ 4*(,*--
    ○ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 4*(,*--
    ○ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 4*(,*--
    

    View Slide

21. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● σϞ
    ○ Ϗϧυதͷ HPϑΝΠϧͷॻ׵ 4*(,*--
    ○ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 4*(,*--
    ○ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 4*(,*--
    

    View Slide

22. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    

    View Slide

23. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● σϞ
    ○ Ϗϧυதͷ HPϑΝΠϧͷॻ׵ 4*(,*--
    ○ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 4*(,*--
    ○ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 4*(,*--
    

    View Slide

24. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    (JU)VC"DUJPOT্ͷઃఆϑΝΠϧ͔Β
    $JMJVN5FUSBHPOͷઃఆΛੜ੒
    

    View Slide

25. ·ͱΊ
    ● F#1' $JMJVN5FUSBHPO͸ύϫϑϧͳςΫϊϩδʔ
    ● $*$%͸F#1'ʹΑͬͯ͞ΒʹηΩϡΞʹͳΔ
    ● ࠓޙ͸1P$Ͱ࢖ͬͨ"HFOUΛ044Խ༧ఆ
    ○ ͞Εͯ·ͨ͠
    IUUQTHJUIVCDPN$ZDPEF-BCTFCQGBHFOUBDUJPO
    ● $POUSJCVUF଴ͬͯΔΑʂ
    

    View Slide

26. ײ૝
    ● 5FUSBHPOͷڧྗ͞Λेೋ෼ʹ׆͔͢ൃද
    ○ 0CTFSWBCJMJUZ 3VOUJNF&OGPSDFNFOU
    ○ ϕετϑΟοτ
    ● ʮؾΛ͚ͭΔʯҎ্ͷ͜ͱ͕ग़དྷΔΑ͏ʹ
    ○ $*$%ͷΑ͏ʹʮॏཁ͚ͩͲ޻਺ׂ͕͔Εʹ͍͘ʯ෺͸
    ಛʹ͜ͷΑ͏ͳऔΓ૊Έ͕ඞཁʹͳΓͦ͏
    

    View Slide

27. αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ
    ϓϥΠϕʔτΫϥ΢υͰͷ(JU)VC"DUJPOTج൫Λ
    ։ൃɾӡ༻த
    IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT
    XJUIZPVSTIPFT
    

    View Slide

28. αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ
    IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT
    XJUIZPVSTIPFT
    ಈతͳTFMGIPTUFESVOOFS XIZXBJUBNZTIPFT
    
    

    View Slide

29. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    

    View Slide

30. αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ
    IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT
    XJUIZPVSTIPFT
    ಈతͳ TFMGIPTUFESVOOFS XIZXBJUBNZTIPFT
    
    .BOBHFE
    1P$"HFOU4FSWFS
    

    View Slide

31. Q?
    

    View Slide