Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Kubernetes の認証・認可と RBAC

Kubernetes の認証・認可と RBAC

Kubernetes Meetup Tokyo #4
https://k8sjp.connpass.com/event/53737/

Takashi Kusumi

April 20, 2017
Tweet

More Decks by Takashi Kusumi

Other Decks in Technology

Transcript

  1. 钠鏾ה钠〳הכ Ӝ 钠鏾 "VUIFOUJDBUJPO"VUI/  ِ٦ؠך劤➂䚍׾然钠ׅ׷ ⢽*%1BTTXPSEדBMJDFהְֲِ٦ؠ׾陎ⴽ٥然钠ׅ׷ Ӝ 钠〳 "VUIPSJ[BUJPO"VUI;

     ِ٦ؠח㼎ׅ׷ٔا٦أך،ؙإأ埄ꣲⵖ䖴׾遤ֲ ⢽BMJDFהְֲِ٦ؠכ1PEך铣׫《׶埄ꣲָ֮׷ַ 
  2. 钠鏾٥钠〳כ"1*4FSWFSד遤׻׸׷  controllers master components scheduler etcd API Server kubelet

    kube-proxy node 1 kubelet kube-proxy node 2 LVCFMFU kube-proxy node 3 Users
  3. 钠鏾٥钠〳ך崧׸  钠鏾 "VUI/ 钠〳 "VUI; "ENJTTJPO$POUSPM plugin 1 plugin

    2 plugin 3 plugin 1 plugin 2 plugin 3 plugin 1 plugin 2 plugin 3 6TFS*%(SPVQ׾《䖤 "MMPX%FOZ 圫ղזؙٔؒأزⵖ䖴
  4. 钠鏾٥钠〳ך崧׸  钠鏾 "VUI/ 钠〳 "VUI; "ENJTTJPO$POUSPM plugin 1 plugin

    2 plugin 3 plugin 1 plugin 2 plugin 3 plugin 1 plugin 2 plugin 3 6TFS*%(SPVQ׾《䖤 "MMPX%FOZ 圫ղזؙٔؒأزⵖ䖴
  5. 钠鏾倯䒭 Ӝ 9ؙٓ؎،ٝز鏾僇剅 Ӝ ꫼涸ز٦ؙٝؿ؋؎ٕ Ӝ ـ٦زأزٓحفز٦ؙٝ Ӝ ꫼涸ػأٙ٦سؿ؋؎ٕ Ӝ

    4FSWJDF"DDPVOU  Ӝ 0QFO*%$POOFDU Ӝ 8FCIPPL Ӝ 钠鏾فؙٗء٦ Ӝ ,FZ4UPOF 0QFO4UBDL  ぐ倯䒭ד钠鏾׾遤ְِ٦ؠせהؚٕ٦فせזוך䞔㜠׾《䖤ׅ׷
  6. 9ؙٓ؎،ٝز鏾僇剅  Certificate: Data: ... Validity Not Before: Apr 16

    02:14:52 2017 GMT Not After : Apr 16 02:14:52 2018 GMT Subject: O=system:masters, CN=minikube "1*4FSWFSךDMJFOUDBMFؔفءّٝד$"׾䭷㹀 0 0SHBOJ[BUJPO ָؚٕ٦فせծ$/ $PNNPO/BNF ָِ٦ؠせ
  7. 

  8. 钠鏾٥钠〳ך崧׸  钠鏾 "VUI/ 钠〳 "VUI; "ENJTTJPO$POUSPM plugin 1 plugin

    2 plugin 3 plugin 1 plugin 2 plugin 3 plugin 1 plugin 2 plugin 3 6TFS*%(SPVQ׾《䖤 "MMPX%FOZ 圫ղזؙٔؒأزⵖ䖴
  9. 钠〳فؚٓ؎ٝ Ӝ 3PMF#BTFE"DDFTT$POUSPM 3#"$  Ӝ "UUSJCVUF#BTFE"DDFTT$POUSPM "#"$  Ӝ

    8FCIPPL Ӝ "MXBZT"MMPX"MXBZT%FOZ  钠鏾فؚٓ؎ٝד《䖤׃׋ِ٦ؠせծؚٕ٦فせה،ؙإأׅ׷ؙٔ ؒأز䞔㜠׾⯋ח،ؙإأⵖ䖴׾遤ֲկ
  10. ؙٔؒأز䞔㜠 BVUIPSJ[PS"UUSJCVUFT  Ӝ ِ٦ؠ䞔㜠 OBNF HSPVQTזו Ӝ "1*ٔا٦أַやַ Ӝ

    ؙٔؒأزךػأ䞔㜠 Ӝ 乼⡲珏ⴽ WFSC)551.FUIPE  HFU DSFBUF VQEBUF瘝 Ӝ ٔا٦أ珏ⴽ Ӝ ؟ـٔا٦أ珏ⴽ Ӝ ؔـآؙؑزせ Ӝ "1*ؚٕ٦ف Ӝ "1*غ٦آّٝ
  11. "1*4FSWFSפךؙٔؒأز  $ kubectl get --namespace myns pods mypod GET

    https://.../api/v1/namespaces/myns/pods/mypod Accept: application/json Authorization: Bearer eyJ...Ptw # 認証情報 ...
  12. ٗ٦ٕך㹀纏 3PMF  1PEח㼎׃גEFGBVMUط٦يأل٦أךHFUXBUDIMJTU׾鏩〳ׅ׷ kind: Role apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: namespace:

    default name: pod-reader rules: # ルールは複数書ける - apiGroups: [""] # Core グループ resources: ["pods"] # リソース verbs: ["get", "watch", "list"] # 読み取り権限
  13. ٗ٦ٕך秡➰ֽ 3PMF#JOEJOH  kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: read-pods

    namespace: default subjects: - kind: User name: alice # alice を紐付ける apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: pod-reader # 紐付けるのは pod-reader ロール apiGroup: rbac.authorization.k8s.io
  14. 钠鏾٥钠〳ך崧׸  钠鏾 "VUI/ 钠〳 "VUI; "ENJTTJPO$POUSPM plugin 1 plugin

    2 plugin 3 plugin 1 plugin 2 plugin 3 plugin 1 plugin 2 plugin 3 6TFS*%(SPVQ׾《䖤 "MMPX%FOZ 圫ղזؙٔؒأزⵖ䖴
  15. "ENJTTJPO$POUSPMMFSך♧鋮  Ӝ "MXBZT"ENJU Ӝ "MXBZT1VMM*NBHFT Ӝ "MXBZT%FOZ Ӝ %FOZ&TDBMBUJOH&YFD

    Ӝ *NBHF1PMJDZ8FCIPPL Ӝ 4FSWJDF"DDPVOU Ӝ 4FDVSJUZ$POUFYU%FOZ Ӝ 3FTPVSDF2VPUB Ӝ -JNJU3BOHFS Ӝ *OJUJBM3FTPVSDFT Ӝ /BNFTQBDF-JGFDZDMF Ӝ %FGBVMU4UPSBHF$MBTT Ӝ %FGBVMU5PMFSBUJPO4FDPOET Ӝ 1PE4FDVSJUZ1PMJDZ