Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Recap: Zero Trust Service Mesh with Calico, SPI...

moricho
June 20, 2020

Recap: Zero Trust Service Mesh with Calico, SPIRE, and Envoy

moricho

June 20, 2020
Tweet

More Decks by moricho

Other Decks in Technology

Transcript

  1. About Me Morito Ikeda (@_moricho_) ɾGo, Kubernetes, Rust, … ɾgVisor΍FirecrackerͳͲOSS΁ͷ

    ɹίϯτϦϏϡʔτ ɾ GoʹΑΔίϯςφϥϯλΠϜࣗ࡞ͷɹɹ ɹిࢠॻ੶ΛΠϯϓϨε͞Μ͔Βग़൛ɹɹ ɹ༧ఆͰ͢
  2. Calicoͱ͸ Calico Network Policy ɾ endpointʹରͯ͠ϙϦγʔ੍ޚΛߦ͏FW ɾτϥϑΟοΫͷํ޲ (Ingress,Egress)΍ڋ൱/ڐՄ (Deny/Allow), ϓϩτίϧ

    (TCP/UDP/ICMPͳͲ), ϙʔτ൪߸ Dikastes ɾEnvoy Plugin ɾDataPlaneʹ഑ஔ͞ΕΔʢPod͝ͱʣ ɾFelix͔Β഑෍͞ΕͨωοτϫʔΫϙϦγʔͷద༻
  3. ZeroTrustͳ ServiceMeshΛ໨ࢦͯ͠ αʔϏε͝ͱͷAuthZ ɾCalicoΛ࢖ͬͨϙϦγʔઃఆͱ ద੾ͳΞΫηε੍ޚ ɾOPAͳͲ΋͋Γ ɾCalico͸NetworkPolicy୯ମͰͷ ࢖༻΋Մೳ ZeroTrustͳNetworkͱ͸ ɾϚΠΫϩαʔϏεԽʹ൐͍ɺ

    ωοτϫʔΫΛލ͍ͩ௨৴͕ ଟ͘ͳͬͨ ɾશͯͷτϥϑΟοΫΛ৴༻͠ͳ͍ લఏͰηΩϡϦςΟରࡦΛ͢Δ αʔϏεؒͷAuthN ɾSPIFFE/SPIREΛ࢖ͬͨೝূɺ ূ໌ॻ؅ཧ ɾαʔϏεؒͷ௨৴Λ mTLSʹ͢Δ ɾIstio΋͋Γ͚ͩͲେ͖͗͢Δ
  4. ࢀߟࢿྉ ɾCalicoʹΑΔKubernetesϐϡΞL3ωοτϫʔΩϯά - Yahoo! JAPAN Tech Blog https://techblog.yahoo.co.jp/infrastructure/kubernetes_calico_networking/ ɾProject CalicoͷΞʔΩςΫνϟΛݟͯΈΑ͏

    https://thinkit.co.jp/article/14112 ɾSecuring the Service Mesh with SPIRE - Speaker Deck https://speakerdeck.com/ryysud/securing-the-service-mesh-with-spire ɾZero Trust Service Mesh with Calico, SPIRE, and Envoy https://kccnceu19.sched.com/event/MPe3