GitHub as an Authenticator

Transcript

1. ©2018 Wantedly, Inc. GitHub as an Authenticator શ෦ GitHub Ͱ؅ཧͯ͠ΈΔ GitHub Satellite Tokyo LT 12.Jun.2018 - Shimpei Otsubo - @potsbo
2. ©2018 Wantedly, Inc. ࣾһ໊฽Ͳ͏ͯ͠·͔͢ʁ ݖݶ؅ཧͲ͏ͯ͠·͔͢ʁ ৘ใڞ༗Ͳ͏ͯ͠·͔͢ʁ
3. ©2018 Wantedly, Inc. શ෦
   GitHub ࣾһ໊฽Ͳ͏ͯ͠·͔͢ʁ ݖݶ؅ཧͲ͏ͯ͠·͔͢ʁ ৘ใڞ༗Ͳ͏ͯ͠·͔͢ʁ
4. ©2018 Wantedly, Inc. GitHub ๏຿ ࣾ಺͸ͳΜͰ΋
   (JU)VC (JU)VCΛ࢖ͬͯ๏຿ίϛϡχέʔγϣϯͷεϐʔυΛഒʹͨ͠࿩ ৘ใڞ༗͜͏ͯ͠·͢ IUUQTXXXXBOUFEMZDPNDPNQBOJFTXBOUFEMZQPTU@BSUJDMFT ʮJTTVF
   ͭͬͨ͘ʁʯ ίʔυϨϏϡʔه࿥ٞ࿦ேձ໨ඪ݁Ռʜ ࣾ಺શһ
   (JU)VC ೖࣾϑϩʔ͸(JU)VCΞΧ΢ϯτͷ࡞੒͔Β
5. ©2018 Wantedly, Inc. ૊৫্ͷνʔϜͱ(JU)VCͷνʔϜ͕ରԠ infrastructure full-time-employee visit people short-term-intern long-term-intern engineers ଐੑ΋؅ཧ ૊৫ߏ੒ ruby … … ࣾһ໊฽͜͏ͯ͠·͢
6. ©2018 Wantedly, Inc. (JU)VC
   5FBN
   ΛϕʔεʹೝՄ )3ͷϑϩʔʹ৐Δ͚ͩͰྑ͍ ݖݶͷ֎͠๨Ε͕ͳ͍ e.g. full-time-employee => ok org ͔Β֎ͤ͹ࣗಈతʹશݖݶΛ revoke Ͱ͖Δ HR ͷೖୀࣾϑϩʔͰେମ
   ok ݖݶ؅ཧ͜͏ͯ͠·͢
7. ©2018 Wantedly, Inc. ssh Results K public key ಛఆͷνʔϜͷਓ͚ͩ
   TTI
   ΛڐՄ͍ͨ͠ kenmon ssh Production Results K enmon ݕ໰ ಛఆ
   team ʹೖ͍ͬͯΔͱ production access ΁ͷ ssh ΛڐՄ SSH Proxy with GitHub Private Keys by wantedly
8. ©2018 Wantedly, Inc.  એݴ͞Εͨ
   
   
   
   6TFSOBNF
   ͷެ։伴ͰϩάΠϯ
    ಛఆͷ
   
   
   
   5FBNॴଐ͔Λ͔֬ΊΔ
    ໨తͷ4FSWFS΁ͷ44)ΛڐՄ ಛఆͷνʔϜͷਓ͚ͩ
   TTI
   ΛڐՄ͍ͨ͠ ssh Results K public key kenmon ssh Production Results
9. ©2018 Wantedly, Inc. Team ͝ͱʹҟͳΔ
   
   
   
   
   
   k8s
   ͷૢ࡞ΛڐՄ͍ͨ͠ G Token Token Teams Groups RBAC!! genmon TokenReview G enmon ݳ໳ ֤ team ʹରͯ͠ ద੾ͳݖݶΛ෇༩ by wantedly Webhook token authenticator for Kubernetes Results Token
10. ©2018 Wantedly, Inc.  %BFNPO4FU
    Ͱ֤
    NBTUFS
    ʹ
    HFONPO
    ͕ଘࡏ
     8FCIPPL
    "VUIFOUJDBUJPO
    Ͱ
    HFONPO
    ΁
    
    
    
    5FBN
    
    
    
    
    
    (SPVQ
    ͱͯ͠ѻ͍
    3#"$ https://github.com/appscode/guard https://github.com/oursky/kubernetes-github-authn ࢀߟ࣮૷ https://kubernetes.io/docs/admin/authentication/#webhook-token-authentication Role Based Access Control Team ͝ͱʹҟͳΔ
    
    
    
    
    
    k8s
    ͷૢ࡞ΛڐՄ͍ͨ͠ G Token Token Teams Groups RBAC!! genmon TokenReview Results Token
11. ©2018 Wantedly, Inc. K enmon ݕ໰ ಛఆ
    team ʹೖ͍ͬͯΔͱ production access ΁ͷ ssh ΛڐՄ G enmon ݳ໳ ֤ team ʹରͯ͠ ద੾ͳݖݶΛ෇༩ by wantedly SSH Proxy with GitHub Private Keys Webhook token authenticator for Kubernetes by wantedly
12. ©2018 Wantedly, Inc. ࣾ಺શһ
    GitHub
    ʹೖΕͪΌ͓͏ GitHub
    ΛೝূαʔϏεͱͯ͠࢖͓͏ ૊৫ߏ଄ͱTeamߏ଄Λ߹ΘͤΑ͏ Summary