$30 off During Our Annual Pro Sale. View Details »

Kubernetes Admission Webhook Deep Dive

Kubernetes Admission Webhook Deep Dive

CloudNative Days Tokyo 2022のセッション「Kubernetes Admission Webhook Deep Dive」のサンプルプログラムです。

セッション情報
https://event.cloudnativedays.jp/cndt2022/talks/1579
補足記事
https://zenn.dev/zoetro/articles/admission-webhook-deep-dive
サンプルプログラム
https://github.com/zoetrope/sample-webhook

Akihiro Ikezoe

November 22, 2022
Tweet

More Decks by Akihiro Ikezoe

Other Decks in Programming

Transcript

  1. ,VCFSOFUFT"ENJTTJPO8FCIPPL %FFQ%JWF   αΠϘ΢ζגࣜձࣾ ஑ఴ ໌޺

  2. ࣗݾ঺հ u ஑ఴ ໌޺ ʢUXJUUFS ![PFUSPʣ u αΠϘ΢ζʹͯ,VCFSOFUFTΛϕʔεͱͨ͠৽͍͠ Πϯϑϥج൫ͷ։ൃͱӡ༻ʹैࣄɻ u

    ,VCFSOFUFTؔ࿈ͷهࣄ u IUUQT[FOOEFW[PFUSP u IUUQT[PFUSPQFHJUIVCJPLVCFCVJMEFSUSBJOJOH u ֶͭͬͯ͘Ϳ,VCFCVJMEFSΧελϜίϯτϩʔϥʔͷͭ͘ΓํΛղઆ u IUUQT[FOOEFWQDZCP[V@OFDP u /FDP8FFLMZ,VCFSOFUFT΍$MPVE/BUJWFؔ࿈ͷؾʹͳΔωλΛຖि঺հ 
  3. ຊ೔ͷൃද಺༰ u "ENJTTJPO8FCIPPLͱ͸ u "ENJTTJPO8FCIPPLͷ࣮૷ u %FFQ%JWF n ฒྻ࣮ߦ࣌ͷڝ߹ରࡦ n

    ηΩϡϦςΟରࡦ n Ϛϧνςφϯτ؀ڥ΁ͷରԠ n ୤"ENJTTJPO8FCIPPL 
  4. ຊ೔ͷൃද಺༰ u "ENJTTJPO 8FCIPPLͷগ͚ͩ͠σΟʔϓͳ࿩Λ͠·͢ɻ u ϕετϓϥΫςΟεʹ͍ͭͯ͸ҎԼͷࢿྉ͕͓͢͢Ί n ެࣜυΩϡϝϯτ%ZOBNJD"ENJTTJPO$POUSPM l IUUQTLVCFSOFUFTJPEPDTSFGFSFODFBDDFTTBVUIOBVUI[FYUFOTJCMF

    BENJTTJPODPOUSPMMFST n ,VCF$PO $MPVE/BUJWF$PO /""ENJTTJPO8FCIPPLT$POGJHVSBUJPO BOE%FCVHHJOH#FTU1SBDUJDFT )BPXFJ $BJ (PPHMF l IUUQTLDDODOBTDIFEDPNFWFOU6B7UBENJTTJPOXFCIPPLTDPOGJHVSBUJPO BOEEFCVHHJOHCFTUQSBDUJDFTIBPXFJDBJHPPHMF 
  5. "ENJTTJPO8FCIPPLͱ͸ 

  6. "ENJTTJPO8FCIPPLͱ͸ u ,VCFSOFUFTͷ"1*4FSWFSΛ֦ு͢Δ࢓૊Έ n Ϧιʔεͷ࡞੒΍มߋɺ࡟আૢ࡞Λ͓͜ͳ͏ࡍʹɺ8FCIPPLΛݺͼग़ͯ͠೚ҙͷϩδοΫ Λ࣮ߦ͢Δ͜ͱ͕Ͱ͖Δ n 1PE΍%FQMPZNFOUͳͲͷඪ४Ϧιʔε͚ͩͰͳ͘ɺ೚ҙͷΧελϜϦιʔεʹର͢Δ 8FCIPPLΛ࡞੒͢Δ͜ͱ͕Ͱ͖Δ u

    छྨͷ8FCIPPL n .VUBUJOH8FCIPPLɿϦιʔεͷ಺༰Λॻ͖׵͑Δ͜ͱ͕Ͱ͖Δ n 7BMJEBUJOH8FCIPPLɿϦιʔεͷ಺༰Λݕূ͢Δ͜ͱ͕Ͱ͖Δ 
  7. "ENJTTJPO8FCIPPLͷ࣮༻ࣄྫ u ηΩϡϦςΟϙϦγʔͷڧ੍ʢ1PE4FDVSJUZ"ENJTTJPOͳͲʣ u αΠυΧʔίϯςφʔͷΠϯδΣΫτʢτϥϑΟοΫ؅ཧɺϩάͷऩूͳͲʣ u ൚༻ϙϦγʔΤϯδϯʢ(BUFLFFQFS ,ZWFSOP LVCFXBSEFOͳͲʣ u

    ޡૢ࡞๷ࢭʢ/BNFTQBDF΍$3%ͷ࡟আېࢭͳͲʣ u Ϛϧνςφϯτ؀ڥͷ࣮ݱ u ΧελϜϦιʔεͷόϦσʔγϣϯ 
  8. "ENJTTJPO8FCIPPLͷ࢓૊Έ u Ϧιʔεͷ࡞੒ɾߋ৽ɾ࡟আͷλΠϛϯάͰ೚ҙͷ8FCIPPLΛݺͼग़͠ɺ Ϧιʔεͷॻ͖׵͑΍ݕূΛ͓͜ͳ͏ɻ  Kubernetes API Server Admission Webhook

    Webhook Configuration Request JSON Response JSON HTTPS User Create, Update, Delete Mutating or Validating
  9. "ENJTTJPO3FWJFX u "1*4FSWFSͱ8FCIPPLؒ Ͱ΍ΓͱΓ͢Δ+40/ܗࣜ u 3FRVFTUʹ͸ɺ8FCIPPLͷ ର৅ͱͳΔΦϒδΣΫτ΍ɺૢ ࡞Λ͓͜ͳͬͨϢʔβʔͷ৘ใ ͳͲؚ͕·ΕΔɻ u

    .VUBUJOHͷ3FTQPOTF͸ɺ +40/1BUDIܗࣜͰมߋ಺༰ Λදݱ͢Δɻ  { "request": { "uid": "XXXX-YYYY", "name": "sample", "namespace": "default", "operation": "UPDATE", "userInfo": { // 省略 }, "object": { "kind": "Deployment", "apiVersion": "apps/v1", "metadata": { "name": "sample", "namespace": "default" }, "spec": { // 省略 } }, "oldObject": { // 省略 }, "dryRun": false, "options": { "kind": "UpdateOptions", "apiVersion": "meta.k8s.io/v1" } } } Request { "response": { "uid": "XXXX-YYYY", "allowed": true } } Response (Validating) Response (Mutating) { "response": { "uid": "XXXX-YYYY", "allowed": true, "patchType": "JSONPatch", "patch": "W3sib3AiOiAiYWRkIiwgInBhdGgiOiAiL3NwZWM vcmVwbGljYXMiLCAidmFsdWUiOiAzfV0=" } } [{ "op": "add", "path": "/spec/replicas", "value": 3 }] base64
  10. 8FCIPPL$POGJHVSBUJPO u "1*4FSWFSʹ఻͑Δ8FCIPPLͷઃఆ ʢ,VCFSOFUFTͷΫϥελʔϦιʔεʣ n 8FCIPPLͷݺͼग़͠ํ๏ n 8FCIPPL͕ݺͼग़ͤͳ͔ͬͨ৔߹ͷڍಈ n 8FCIPPLͷର৅ͱ͢ΔϦιʔεͷछྨ΍

    /BNFTQBDFͷߜΓࠐΈ u छྨͷϦιʔε͕͋Δ n 7BMJEBUJOH8FCIPPL$POGJHVSBUJPO n .VUBUJOH8FCIPPL$POGJHVSBUJPO  apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: validating-webhook-configuration webhooks: - admissionReviewVersions: - v1 clientConfig: service: name: webhook-service namespace: system path: /validate-apps-v1-deployment caBundle: LS0tLS1CRUdJ failurePolicy: Fail name: vdeployment.kb.io namespaceSelector: matchExpressions: - key: kubernetes.io/metadata.name operator: NotIn values: - kube-system rules: - apiGroups: - apps apiVersions: - v1 operations: - CREATE - UPDATE resources: - deployments sideEffects: None
  11.  Kubernetes API Server Mutating Webhooks etcd Mutating Webhooks Mutating

    Webhooks Validating Webhooks Authentication Authorization OpenAPI Schema Validation Persist to etcd par loop ෳ਺ͷ8FCIPPLΛॱʹݺͼग़͢ɻ 3FJOWPDBUJPO1PMJDZʹै͍ ܁Γฦ͠ݺͼग़͢৔߹͕͋Δɻ ෳ਺ͷ8FCIPPLΛ ฒྻʹݺͼग़͢ Create, Update, Delete
  12. "ENJTTJPO8FCIPPLͷ࣮૷ 

  13. ࣮૷ํ๏ u ͨͩͷ8FCαʔόʔͳͷͰɺೖग़ྗͷϑΥʔϚοτ͍͑͋ͬͯ͞Ε͹ ͲΜͳϓϩάϥϛϯάݴޠͰ΋࣮૷͢Δ͜ͱ͕Ͱ͖Δɻ u ࣮૷Λखॿ͚͢ΔͨΊͷϑϨʔϜϫʔΫ΋ଟ਺ଘࡏ͢Δ n ,VCFCVJMEFSDPOUSPMMFSSVOUJNF n ,VCFXBSEFO

    n ,VCFXFCIPPL n ,OBUJWF 
  14. ,VCFCVJMEFSDPOUSPMMFSSVOUJNF u ΧελϜίϯτϩʔϥʔΛ։ൃ͢ΔͨΊͷϑϨʔϜϫʔΫ u "ENJTTJPO8FCIPPLΛ࡞ΔͨΊʹศརͳػೳ͕ͨ͘͞Μ༻ҙ͞Ε͍ͯΔ n 7BMJEBUJOH.VUBUJOH8FCIPPL༻ͷϑϨʔϜϫʔΫ n 8FCIPPL$POGJHVSBUJPOͷࣗಈੜ੒ػೳ n

    σϓϩΠ͢ΔͨΊͷϚχϑΣετ n DFSUNBOBHFSΛར༻ͨ͠ূ໌ॻ؅ཧػೳ n ςετͷͻͳܗ u "ENJTTJPO8FCIPPLͷ։ൃʹ΋͓͢͢Ί 
  15. DPOUSPMMFSSVOUJNFʹΑΔ࣮૷ u "ENJTTJPO8FCIPPLͷ࣮૷ํ͕ࣜछྨ༻ҙ͞Ε͍ͯΔ n %FGBVMUFS7BMJEBUPS n $VTUPN%FGBVMUFS$VTUPN7BMJEBUPS n )BOEMFS u

    ৄࡉͳ࣮૷ํ๏͸ҎԼͷهࣄΛࢀর n IUUQT[PFUSPQFHJUIVCJPLVCFCVJMEFSUSBJOJOH n IUUQT[FOOEFW[PFUSPBSUJDMFTBENJTTJPOXFCIPPLEFFQEJWF 
  16. ͲͷํࣜΛ࢖͑͹͍͍ͷʁ %FGBVMUFS7BMJEBUPS $VTUPN%FGBVMUFS $VTUPN7BMJEBUPS )BOEMFS ѻ͑ΔϦιʔεͷछྨ ࣗ࡞ͷΧελϜϦιʔε ͷΈ ඪ४ϦιʔεͱΧελϜ Ϧιʔε

    ඪ४ϦιʔεͱΧελϜ Ϧιʔε "ENJTTJPO3FWJFX 3FRVFTU΁ͷΞΫηε ʷ ˓ ˓ 3FRVFTUͷ%FDPEFॲཧ +40/1BUDIͷ࡞੒ ࣗಈ ࣗಈ ࣗ෼Ͱ࣮૷͢Δඞཁ͋Γ ͭͷ8FCIPPLͰෳ਺छ ྨͷϦιʔεΛॲཧ ʷ ʷ ˓ 8BSOJOHΛฦ͢ ʷ ʷ ˓  u جຊ͸$VTUPN%FGBVMUFS$VTUPN7BMJEBUPS͕͓͢͢Ίɻ u ΑΓΧελϚΠζΛ͍ͨ͠৔߹͸)BOEMFSΛར༻͢Δɻ
  17. %FFQ%JWF 

  18. ᶃ ฒྻ࣮ߦ࣌ͷڝ߹ରࡦ u ಉ͡छྨͷϦιʔε͕ಉ࣌ʹෳ਺࡞੒͞Εͨͱ͖ɺ"ENJTTJPO8FCIPPL͸ ฒྻʹݺͼग़͞ΕΔɻ u ฒྻ࣮ߦʹΑΔ໰୊ n ଞͷϦιʔεΛࢀরͯ͠ݕূͨ͠Γɺݕূͷ݁Ռʹج͍ͮͯ֎෦ϦιʔεΛߋ৽͢Δ৔߹ɺ ਖ਼͘͠ݕূ͕͓͜ͳΘΕͳ͍έʔε΍ɺڝ߹໰୊͕ൃੜ͢Δέʔε͕͋Δɻ

    n ڝ߹͠ͳ͍Α͏ʹϩοΫΛऔΔͱɺॲཧ͕஗͘ͳΓେྔͷϦΫΤετΛࡹ͚ͳ͘ͳΔɻ u ࣄྫ঺հ n ࣄྫ)JFSBSDIJDBM/BNFTQBDF$POUSPMMFS )/$ n ࣄྫ3FTPVSDF2VPUB 
  19. ࣄྫ)/$ u )/$͸ɺ4VC/BNFTQBDFͱ͍͏ΧελϜϦ ιʔεΛར༻͢Δ͜ͱͰɺ؅ཧऀݖݶ͕ͳ͍ ϢʔβʔͰ΋/BNFTQBDF͕ͭ͘ΕΔ࢓૊Έɻ u "ENJTTJPO8FCIPPLͰطଘͷ/BNFTQBDF ͱ4VC/BNFTQBDFͷ໊લ͕িಥ͠ͳ͍Α͏ʹ νΣοΫ͍ͯ͠Δɻ 

    Namespace1 SubNamespace A ࢠͷ/BNFTQBDF ͕࡞੒͞ΕΔ NamespaceA User ࡞੒
  20. ࣄྫ)/$Ͱͷڝ߹  Namespace1 SubNamespace B $POGMJDU NamespaceB Namespace2 SubNamespace B

    u ҟͳΔ/BNFTQBDFʹಉ͡λΠϛ ϯάͰಉ໊ͷ4VC/BNFTQBDF ͕࡞੒͞ΕΔͱʜ u 8FCIPPL͸ฒྻͰݺͼग़͞ΕΔ ͨΊɺͦΕͧΕνΣοΫͨ࣌͠఺ Ͱ͸ର৅ͷ/BNFTQBDF͕ଘࡏͤ ͣɺνΣοΫΛ͢Γൈ͚ͯ͠·͏ɻ
  21. ࣄྫ)/$ʹ͓͚Δղܾࡦ u "ENJTTJPO 8FCIPPLʹΑΔνΣοΫΛ·Εʹ͢Γൈ͚Δ͜ͱ͸ڐ༰͢Δɻ u Ϧιʔεͷεςʔλεʹঢ়ଶҟৗΛه࿥͠Ϣʔβʔʹؾ͔ͮͤΔɻ  ʠ /PUF5IFSFBSFTPNFSBSFDPSOFSDBTFTUIBUDPVMESFTVMUJOBDZDMFCFJOH GPSNFE

    EFTQJUFUIFQSFTFODFTPGUIFWBMJEBUJOHBENJTTJPODPOUSPMMFST'PS FYBNQMF UXPEJGGFSFOUVTFSTNJHIUNBLFOBNFTQBDFT"BOE#QBSFOUTPGFBDI PUIFSBUFYBDUMZUIFTBNF UJNFUIFBENJTTJPODPOUSPMMFSXPVMEBMMPXUIJT TJODF OFJUIFSJTZFUUIFQBSFOUPGUIFPUIFS MFBEJOHUPBDZDMF"MUFSOBUJWFMZ BOBENJO NJHIUTJNQMZBDDJEFOUBMMZEJTBCMFUIFBENJTTJPODPOUSPMMFST*OTVDIDBTFT )/$ XJMMQVUBO"DUJWJUJFT)BMUFE DPOEJUJPOPOUIFOBNFTQBDFTVOUJMUIFDZDMFJT SFTPMWFE IUUQTHJUIVCDPNLVCFSOFUFTTJHTIJFSBSDIJDBMOBNFTQBDFTCMPCNBTUFSEPDTVTFSHVJEFDPODFQUTNE
  22. ࣄྫ3FTPVSDF2VPUB u 3FTPVSDF2VPUBͱ͸ɺ/BNFTQBDF͝ͱͷ૯Ϧιʔεফඅྔʢྫ͑͹ɺ 1PEʹׂΓ౰ͯΔ$16΍ϝϞϦʣΛ੍ݶ͢ΔͨΊͷػೳ u "ENJTTJPO8FCIPPLͰ͸ͳ͘,VCFSOFUFTඪ४ͷ"ENJTTJPO $POUSPMMFSͱ࣮ͯ͠૷͞Ε͍ͯΔ  Namespace1 ResouceQuota

    hard: limits.memory: 10Gi used: limits.memory: 8Gi Pod A limits.memory: 5Gi Pod B limits.memory: 3Gi Pod C limits.memory: 3Gi 2VPUBͷ੍ݶΛ௒͑ͯ 1PEΛ࡞੒͢Δ͜ͱ͸ Ͱ͖ͳ͍
  23. ࣄྫ3FTPVSDF2VPUBͰͷڝ߹ u ݕূʹ੒ޭ͢Δͱ3FTPVSDF2VPUBϦιʔεͷVTFEϑΟʔϧυΛߋ৽͢Δ͕ɺ ಉ࣌ʹෳ਺ͷϦΫΤετΛॲཧ͢Δ৔߹ɺॻ͖ࠐΈ࣌ʹিಥ͕ൃੜ͢Δɻ u 3FTPVSDF2VPUB͸େྔͷϦΫΤετΛѻ͏ͨΊিಥ͕ൃੜ͠΍͍͢ɻ  Namespace2 Pod X

    limits.memory: 5Gi Pod Z limits.memory: 3Gi Pod Y limits.memory: 3Gi 1PEΛಉ࣌ʹ࡞੒͢Δ ͱʜ ? ResouceQuota hard: limits.memory: 10Gi used: limits.memory: 5Gi
  24. API Server ࣄྫ3FTPVSDF2VPUBʹ͓͚Δղܾࡦ  Workers Workers Workers Workers Workers Queue

    PodA PodB NS4 PodP PodQ 2VFVF͔Β/BNFTQBDFΛͭऔ Γग़͢ɻ ͦͷ/BNFTQBDFͷϦιʔε੍͕ ݶΛ௒͍͑ͯͳ͍͜ͱΛνΣοΫ͠ɺ 2VPUBͷ4UBUVTΛߋ৽͢Δɻ PodF NS3 1PEͷ࡞੒ 1PEͷ࡞੒ ͭͷHPSPVUJOF͕ ඵपظͰ࣮ߦ PodX PodA PodB NS2 NS1 ࡞੒͢ΔϦιʔεΛ /BNFTQBDF୯ҐͰ2VFVF ʹొ࿥͢Δɻ ॲཧ͕׬ྃ͢Δ·Ͱ଴ͭɻ /BNFTQBDF୯ҐͰܭࢉ͢Δ͜ͱͰɺ িಥΛݮΒ͢ ˞ ͜ͱ͕Ͱ͖Δɻ ͞Βʹɺෳ਺ͷϦιʔεͷܭࢉ݁ՌΛ Ұ౓Ͱॻ͖ࠐΊΔͨΊɺεϧʔϓοτ ͕޲্͢Δɻ ˞"1*4FSWFS͕৑௕Խ͞Ε͍ͯΔͱॻ͖ࠐΈ࣌ʹিಥ͕ൃੜ͢Δ৔߹͕͋Δɻͦͷ࣌͸ϦτϥΠ͢Δɻ
  25. ڝ߹ରࡦͷݸਓతݟղ u ՄೳͰ͋Ε͹ɺ"ENJTTJPO8FCIPPLͰଞͷϦιʔε΍֎෦ͷঢ়ଶʹґଘ͠ ͳ͍Α͏ʹ͢Δ u ڝ߹ঢ়ଶΛڐ༰Ͱ͖Δ৔߹ n λΠϛϯάʹΑͬͯݕূΛ͢Γൈ͚ΔέʔεΛ೺Ѳ͓ͯ͘͠ n )/$ͷΑ͏ʹɺڝ߹ঢ়ଶΛఆظతʹνΣοΫ͠Ϣʔβʔʹؾ͔ͮͤΔΑ͏ʹ͢Δ

    u ڝ߹Λݫີʹݕূ͍ͨ͠৔߹ n "ENJTTJPO8FCIPPLͰ͸ੑೳ໘΍ɺ࣮ߦॱং੍͕ޚͰ͖ͳ͍͜ͱ͕՝୊ͱͳΔ n 3FTPVSDF2VPUBͷΑ͏ͳ࣮૷Λ͍ͨ͠৔߹͸ɺ$VTUPN"1*4FSWFSͳͲΛݕ౼͢Δ 
  26. ᶄ ηΩϡϦςΟରࡦ u ,VCFSOFUFT"ENJTTJPO$POUSPM5ISFBU.PEFM n IUUQTHJUIVCDPNLVCFSOFUFTTJHTFDVSJUZCMPCNBJOTJHTFDVSJUZ EPDTQBQFSTBENJTTJPODPOUSPMLVCFSOFUFTBENJTTJPODPOUSPMUISFBU NPEFMNE u ओͳ.JUJHBUJPOT

    n ڧ͍ݖݶΛ࣋ͨͤͳ͍Α͏ʹ͠Α͏ʢ3#"$ QSJWJMFHFEͳͲʣ n 'BJM$MPTFEʹ͠Α͏ʢGBJMVSF1PMJDZΛ'BJMʹઃఆ͢Δʣ n ௨৴ͷ5-4҉߸Խ ΫϥΠΞϯτೝূ N5-4ͳͲΛ࠾༻͠Α͏ n ઃఆͷϨϏϡʔ΍ςετΛ࣮ࢪ͠Α͏ 
  27. ରࡦ'BJM$MPTFE u 8FCIPPL͕ར༻Ͱ͖ͳ͍ͱ͖ʹɺϦιʔεͷมߋૢ࡞Λࣦഊͤ͞Δ͜ͱ n ϙϦγʔΛແࢹͨ͠ϫʔΫϩʔυ͕࡞੒͞ΕΔ͜ͱΛ๷͙͜ͱ͕Ͱ͖Δ n Ұํɺ8FCIPPLͷো֐͕,VCFSOFUFTΫϥελʔʹӨڹΛ༩͑Δ͜ͱʹͳΔ u ো֐ͷര෩൒ܘʢ#MBTU3BEJVTʣΛ࠷খԽ͢Δ n

    γεςϜͷՔಇʹؔΘΔॏཁͳϫʔΫϩʔυΛ"ENJTTJPO 8FCIPPLͷର৅֎ʹ͢Δ n 8FCIPPLͷର৅ͱͳΔϦιʔε͸ɺ8FCIPPL಺ͷϩδοΫͰ൑ผ͢ΔͷͰ͸ͳ͘ɺ 8FCIPPL$POGJHVSBUJPOͷઃఆͰߜΓࠐΉɻ 
  28. ରࡦ5-4҉߸ԽɾΫϥΠΞϯτೝূ u 5-4҉߸Խ n ,VCFCVJMEFSͰϓϩδΣΫτΛੜ੒͢ΔͱσϑΥϧτͰ5-4҉߸Խ͕༗ޮԽ͞Ε͍ͯΔ n DFSUNBOBHFSʹΑΓূ໌ॻͷൃߦ΍ϩʔςʔγϣϯΛࣗಈԽ n DFSUXBUDIFSͱ͍͏࢓૊ΈʹΑΓɺূ໌ॻͷϩʔςʔγϣϯ࣌ʹ8FCIPPLΛ࠶ىಈ͢Δ ͜ͱͳ͠ʹূ໌ॻ͕࠶ಡΈࠐΈ͞ΕΔ

    u ΫϥΠΞϯτೝূ n ,VCFCVJMEFSͰੜ੒ͨ͠ϓϩδΣΫτͰ͸༗ޮʹͳ͍ͬͯͳ͍ n ,VCFSOFUFTͷ࢓૊Έ্ɺݺͼग़͢8FCIPPLΛ௥Ճͨ͠Γূ໌ॻΛ࠶ൃߦ͢Δͨͼʹ "1*4FSWFSͷ࠶ىಈ͕ඞཁͱͳΔ 
  29. DFSUNBOBHFSʹΑΔূ໌ॻͷ؅ཧ  Kubernetes API Server Admission Webhook Webhook Configuration HTTPS

    cert manager Certificate Secret $"ূ໌ॻ αʔόʔ ূ໌ॻ ൿີݤ Inject Generate DFSUXBUDIFS͕ϑΝΠ ϧͷมߋΛ؂ࢹ͓ͯ͠Γɺ ূ໌ॻ͕࠶ൃߦ͞ΕΔͱ ϑΝΠϧΛಡΈࠐΈ௚͢ ༗ޮظݶ͕ۙ͘ͳΔͱ ࣗಈతʹূ໌ॻΛ࠶ൃߦ 😊DFSUNBOBHFSʹ͓·͔ͤ
  30. kubeconfig ΫϥΠΞϯτূ໌ॻͷઃఆ  Kubernetes API Server Admission Webhook Admission Configuration

    HTTPS Secret $"ূ໌ॻ ΫϥΠΞϯτ ূ໌ॻ ൿີݤ Generate "1*4FSWFSͷىಈ࣌ʹ ίϚϯυϥΠϯΦϓγϣϯ Ͱࢦఆ͢Δඞཁ͕͋Δɻ Generate ,VCFSOFUFTΫϥελʔ Λ্ཱͪ͛Δલʹࣄલʹ ূ໌ॻΛ࡞੒͓ͯ͘͠ ઃఆΛมߋͨ͠৔߹ɺ "1*4FSWFSΛ࠶ىಈ ͠ͳ͚Ε͹ͳΒͳ͍ɻ 😥ؾܰʹઃఆมߋͰ͖ͳ͍ ˞ৄࡉͳઃఆํ๏͸ิ଍هࣄࢀর
  31. ରࡦαϒϦιʔεͷ8FCIPPL u ,VCFSOFUFTʹ͸ɺαϒϦιʔεͱ͍͏ϦιʔεͷҰ෦ͷϑΟʔϧυͷΈΛ ૢ࡞͢Δ"1* &OEQPJOU͕༻ҙ͞Ε͍ͯΔ u 7BMJEBUJOH8FCIPPLͰαϒϦιʔεͷνΣοΫ͕࿙ΕΔͱɺηΩϡϦςΟ ࣄނʹͭͳ͕ΔՄೳੑ͕͋Δɻ n 1PEϦιʔεͷ8FCIPPLͰಛݖίϯςφΛ࡞੒Ͱ͖ͳ͍Α͏ʹ੍ݶ͍͕ͯͨ͠ɺ

    QIFNFSBMDPOUBJOFSTαϒϦιʔεΛ8FCIPPLͷର৅ʹ͍ͯ͠ͳ͔ͬͨͨΊɺ ಛݖΛ࣋ͬͨ&QIFNFSBM$POUBJOFSΛ࡞੒Ͱ͖ͯ͠·͏ɻ n %FQMPZNFOUϦιʔεͷ8FCIPPLͰSFQMJDBTͷ੍ݶΛ͍͕ͯͨ͠ɺTDBMFαϒϦιʔε Λ8FCIPPLͷର৅ʹ͍ͯ͠ͳ͔ͬͨͨΊɺSFQMJDBTͷ੍ݶΛճආͰ͖ͯ͠·͏ɻ 
  32. αϒϦιʔεΛ8FCIPPLͷର৅ʹ͢Δ u ϦΫΤετͰ౉ͬͯ͘ΔPCKFDUͷܕ͕ɺα ϒϦιʔεʹΑͬͯҟͳΔͷͰ஫ҙɻ n TUBUVT͸ɺ਌Ϧιʔε͕ͦͷ··౉ͬͯ͘Δɻ n TDBMF͸ɺBVUPTDBMJOH4DBMFܕ͕౉ͬͯ͘Δɻ  apiVersion:

    admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: validating-webhook-configuration webhooks: - rules: - apiGroups: - "" apiVersions: - v1 operations: - CREATE - UPDATE resources: - pods - pods/ephemeralcontainers SFTPVSDFTʹαϒϦιʔεͷύεΛؚΊͯࢦఆ ͢Δ͜ͱ͕Ͱ͖Δɻ ͨͩ͠ Λࢦఆͯ͠΋αϒϦιʔε͸ର৅ͱͳ Βͳ͍ͷͰ஫ҙɻ શαϒϦιʔεΛࢦఆ͍ͨ͠৔߹͸ QPET ͷ Α͏ʹࢦఆ͢Δ ! "#$%&$'(")*! "+,-$.(")*! "/012")*"3.45$"6 "4708$#'0+1")*"4&(+'.45019:;<"6 "=$(424(4")*! "14=$")*"'4=75$"6 "14=$'74.$")*"2$>4&5("6 ?6 "'7$.")*! "#$750.4'")*@ ? ? ? ?
  33. ᶅ Ϛϧνςφϯτ؀ڥ΁ͷରԠ u "ENJTTJPO8FCIPPL͸جຊతʹ͸Ϋϥελ؅ཧऀ͕؅ཧ͢Δɻ u ෳ਺ͷνʔϜ͕ͭͷ,VCFSOFUFTΫϥελΛڞ༗͍ͯ͠ΔϚϧνςφϯτ؀ ڥͰ͸ɺ֤νʔϜ͕ࣗ༝ʹ"ENJTTJPO8FCIPPLΛཱͯΔ͜ͱ͕Ͱ͖ͳ͍ɻ n "ENJTTJPO8FCIPPLʹ͸3#"$͕ద༻͞Εͳ͍ͨΊɺଞͷνʔϜͷϦιʔεΛݟ์୊ɺ มߋ͠์୊ʹͳͬͯ͠·͏ɻ

    n ֤νʔϜͷ"ENJTTJPO8FCIPPLͷੑೳ໰୊΍ෆ҆ఆੑ͕ɺ,VCFSOFUFTΫϥελʔ શମͷ໰୊ʹͭͳ͕ͬͯ͠·͏ɻ 
  34. Ϛϧνςφϯτ؀ڥ΁ͷରԠ u ϙϦγʔΤϯδϯʢ,ZWFSOP ,VCFXBSEFOʣ n ҰൠϢʔβʔ͕/BNFTQBDF୯ҐͷϙϦγʔΛͭ͘Δ͜ͱ͕Ͱ͖Δɻ u Ծ૝Ϋϥελʔ n 7$MVTUFS΍,$1ͳͲΛར༻ͯ͠ɺԾ૝Ϋϥελʔ্Ͱ"ENJTTJPO8FCIPPLΛར༻͢Δɻ

    u /BNFTQBDFE "ENJTTJPOʢ&YQFSJNFOUBMʣ n IUUQTHJUIVCDPN[PFUSPQFOBNFTQBDFEBENJTTJPO n νʔϜ͝ͱʹ"ENJTTJPO8FCIPPLΛ্ཱͪ͛ΔͨΊͷΧελϜίϯτϩʔϥʔ 
  35. Team X /BNFTQBDFE "ENJTTJPO  Namespace B Namespaced Admission Controller

    Namespaced Webhook Configuration Admission Webhook Webhook Configuration ҰൠϢʔβʔ Service Account σϓϩΠ ੜ੒ ର৅ͱͳΔνʔϜʹଐ͢Δ /BNFTQBDF͚͕ͩ 8FCIPPLͷର৅ͱͳΔΑ͏ʹ OBNFTQBDF4FMFDUPSΛઃఆ Namespace A 4FSWJDF"DDPVOU͕ΞΫηε ՄೳͳϦιʔεͷΈ͕8FCIPPL ͷର৅ͱͳ͍ͬͯΔ͜ͱΛ֬ೝ
  36. ᶆ ୤"ENJTTJPO8FCIPPL u "ENJTTJPO8FCIPPLͷ໰୊఺ n 8FCαʔόʔΛ্ཱͪ͛Δඞཁ͕͋Γɺӡ༻ͷෛ୲͕େ͖͍ɻ n "ENJTTJPO8FCIPPLͷՄ༻ੑ͕ɺ,VCFSOFUFTΫϥελʔશମͷՄ༻ੑʹӨڹ͢Δɻ n ֎෦ͷ8FCαʔόʔΛݺͼग़ͨ͢Ίɺ"1*

    4FSWFSͷϨΠςϯγʔ͕ѱԽ͢Δɻ u "ENJTTJPO8FCIPPLҎ֎ͷํ๏ n -JOUπʔϧΛར༻ͯ͠ɺ,VCFSOFUFTΫϥελʔ΁ͷద༻લʹνΣοΫ n ΧελϜϦιʔε͸0QFO"1* W4DIFNBͰνΣοΫͰ͖Δ͜ͱ΋ଟ͍ n কདྷతʹ͸$&-GPS"ENJTTJPO$POUSPMΛ׆༻ 
  37. $&-GPS "ENJTTJPO $POUSPM u $&-ʢ$PNNPO&YQSFTTJPO-BOHVBHFʣܗࣜͰ7BMJEBUJPOϧʔϧ͕ه ड़Ͱ͖Δ,VCFSOFUFTͷඪ४ػೳ n ,VCFSOFUFTWͰΧελϜϦιʔεͷ7BMJEBUJPOػೳ͕Ќ൛Ͱ࢖͑ΔΑ͏ʹͳͬͨɻ n ,VCFSOFUFTWͰ೚ҙͷϦιʔεʹରͯ͠7BMJEBUJPO͕͓͜ͳ͑Δػೳͷ։ൃ͕ਐ

    ΊΒΕ͍ͯΔɻʢ,&1ʣ u ಛ௃ n "ENJTTJPO8FCIPPLͷΑ͏ʹผαʔόʔΛཱͯΔඞཁ͕ͳ͍ͷͰӡ༻ͷख͕ؒෆཁɻ n "1*4FSWFSͷΠϯϓϩηεͰ࣮ߦ͞ΕΔͷͰɺϨΠςϯγʔΛ௿͘཈͑ΒΕΔɻ 
  38. $&-ʹΑΔϧʔϧͷهड़ u ϑΟʔϧυΛมߋͰ͖ͳ͍Α͏ʹ͢Δ u NBQ΁ͷΩʔͷ௥ՃΛڐՄ͢Δ͕ɺ࡟আ΍มߋΛېࢭ͢Δ u ίϯςφ໊͕YZ[͔Β࢝·Δ͜ͱΛνΣοΫ͢Δ  x-kubernetes-validations: -

    message: Keys may not be removed and their values must stay the same rule: oldSelf.all(key, key in self && self[key] == oldSelf[key]) validations: - scopes: [ "spec.containers[*]", "initContainers[*]", "spec.ephemeralContainers[*]" ] expression: "scope.name.startsWith('xyz-')" messageExpression: "scope.name + ' does not start with ¥'xyz¥''" x-kubernetes-validations: - message: Value is immutable rule: self == oldSelf
  39. ·ͱΊ 

  40. ·ͱΊ u "ENJTTJPO8FCIPPL͸ڧྗͳ,VCFSOFUFT֦ுػೳͷͻͱͭɻ u ຊൃදͰ঺հͨ͠಺༰ʹ஫ҙͭͭ͠ɺͥͻ͞·͟·ͳ༻్Ͱར༻ͯ͠Έͯͩ͘ ͍͞ɻ u ิ଍هࣄͱαϯϓϧϓϩάϥϜ΋͋Θͤͯ͝ཡ͍ͩ͘͞ɻ n IUUQT[FOOEFW[PFUSPBSUJDMFTBENJTTJPOXFCIPPLEFFQEJWF

    n IUUQTHJUIVCDPN[PFUSPQFTBNQMFXFCIPPL