Securing CI/CD Systems Through eBPF (recap)

Talked by https://k8sjp.connpass.com/event/264501/

Transcript

1. 4FDVSJOH
   $*$%
   4ZTUFNT
   5ISPVHI
   F#1' ,VCFSOFUFT
   .FFUVQ
   5PLZP
   
    ,VCF$PO
   /"
   
   3FDBQ $ZCFS"HFOU
   *OD
   த੢ ݐొ 
   XIZXBJUB
2. த੢ ݐొ 
   XIZXBJUB  $MPVE.BLFS
   BU
   $ZCFS"HFOU
   *OD  ϓϥΠϕʔτΫϥ΢υ *BB4  ϚωʔδυαʔϏε։ൃ TFMGIPTUFE
   SVOOFS
   JO
   (JU)VC
   "DUJPOT  XIZXBJUBNZTIPFT
   044
   EFWFMPQFS  झຯ
   ࣗ୐αʔό ,T!IPNF
   ϙʔΧʔ  ,VCF$POॳࢀઓ 
   ॳւ֎  ೖࠃΠϯλϏϡʔͰҰഊ 5IBOL
   ZPV
   BNTZ
   😭
3. 4FDVSJOH
   $*$%
   4ZTUFNT
   5ISPVHI
   F#1'
4. 4FDVSJOH
   $*$%
   4ZTUFNT
   5ISPVHI
   F#1' • CZ
   "MFY
   *MHBZFW
   $ZDPEF ◦ IUUQTDZDPEFDPN • IUUQTTDIFEDP"V[ • IUUQTXXXZPVUVCFDPNXBUDI WQD#(3'W4SW : • $*$%ΛηΩϡΞʹߦ͏ͨΊʹF#1'Λར༻͢ΔࢼΈ
5. • &YUFOEFE
   #FSLFMFZ
   1BDLFU
   'JMUFS • -JOVY
   ,FSOFMͷ4BOECPYͰίʔυΛ࣮ߦ͢Δ࢓૊ ◦ ϦίϯύΠϧෆཁ Ͱ ҆શ ͔ͭ ߴ଎ • /FUXPSL
   0CTFSWBCJMJUZͷར༻ࣄྫ͕ଟΊ ◦ ,VCFSOFUFT
   $/*
   .POJUPSJOH
   "HFOU લఏ஌ࣝ
   F#1'
6. • &YUFOEFE
   #FSLFMFZ
   1BDLFU
   'JMUFS • -JOVY
   ,FSOFMͷ4BOECPYͰίʔυΛ࣮ߦ͢Δ࢓૊ ◦ ϦίϯύΠϧෆཁ Ͱ ҆શ ͔ͭ ߴ଎ • /FUXPSL
   0CTFSWBCJMJUZͷར༻ࣄྫ͕ଟΊ ◦ ,VCFSOFUFT
   $/*
   $JMJVN ◦ .POJUPSJOH
   "HFOU
   EBUBEPHBHFOU
   FCQG@FYQPSUFS લఏ஌ࣝ
   F#1'
7. IUUQTUXJUUFSDPNHSBGBOBTUBUVT લఏ஌ࣝ
   F#1'
8. IUUQTHSBGBOBDPNCMPHHSBGBOBBOEDJMJVNEFFQFCQGQPXFSFEPCTFSWBCJMJUZGPSLVCFSOFUFTBOEDMPVE OBUJWFJOGSBTUSVDUVSF લఏ஌ࣝ
   F#1'
9. ຊ୊
10. 4FDVSJOH
    $*$%
    4ZTUFNT
    5ISPVHI
    F#1' • $*$%ʹ͓͚ΔηΩϡϦςΟࣄҊ ◦ 4PMBS8JOET
    ॺ໊෇͖ϑΝΠϧͷॻ׵ ◦ $PEF$PW
    CBTI
    JOTUBMMFSͷॻ׵ ◦ /1.
    1Z1*
    αϓϥΠνΣʔϯΞλοΫ • $*$%πʔϧ ͷηΩϡϦςΟରࡦ͸೉͍͠ ◦ ڧݖݶ
    شൃ͢Δ؀ڥ
    ௿Մ؍ଌੑ
11. 4FDVSJOH
    $*$%
    4ZTUFNT
    5ISPVHI
    F#1' • ఏҊ
    $*$%΁F#1'ϕʔεͳ"HFOUͷಋೖ • XIZ
    F#1' ◦ ؆୯ʹՄ؍ଌੑͱηΩϡϦςΟχʔζΛߴΊΒΕΔ ◦ ࠷৽ΧʔωϧͰಈ࡞͢Δ ◦ ڧྗͳίϛϡχςΟͱπʔϧ • $JMJVN
    5FUSBHPOͷ࠾༻
12. • F#1'CBTFE
    4FDVSJUZ
    0CTFSWBCJMJUZ
    ηΩϡϦςΟͷՄ؍ଌੑ BOE 3VOUJNF
    &OGPSDFNFOU
    ϦΞϧλΠϜ࣮ߦ੍ޚ • ੨ࢁ͞ΜʹΑΔ೔ຊޠهࣄ $JMJVN
    1SPKFDU͔Βެ։ʂ F#1'Λ༻͍ͯηΩϡϦςΟͷՄ؍ଌੑΛ΋ͨΒ͢5FUSBHPO
    c
    HJIZPKQ $JMJVN
    5FUSBHPO IUUQTHJUIVCDPNDJMJVNUFUSBHPO ͔Θ͍͍ˠ
13. $JMJVN
    5FUSBHPO
14. 4FDVSJOH
    $*$%
    4ZTUFNT
    5ISPVHI
    F#1' • $*$%γεςϜʹ$JMJVN
    5FUSBHPOΛಋೖ ◦ $*$%γεςϜʹ͓͚Δzಈ࡞Λ؍ଌ͢Δ ◦ ϓϩηε
    ίωΫγϣϯ
    ϑΝΠϧ *0৘ใ • 5FUSBHPO࠾༻ཧ༝ ◦ LQSPCFΛ࢝Ίͱͯ͠ଟ͘ͷσʔλ͕औಘՄೳ ◦ LTҎ֎ͷ؀ڥͰ΋ಈ࡞͢Δ
15. 4FDVSJOH
    $*$%
    4ZTUFNT
    5ISPVHI
    F#1'
16. 1P$ͷ࣮૷಺༰ʹ͍ͭͯ • Ϗϧυ؀ڥͷ0CTFSWBMJCJUZ ◦ ϓϩηε 
    ઀ଓઌυϝΠϯ
    *1 • ιʔείʔυͷ׬શੑ֬อ ◦ HP
    ϑΝΠϧͷॻ׵Λ؂ࢹ • ௨৴ઌͷ੍ޚ ◦ ڐՄͯ͠ͳ͍*1υϝΠϯ΁ͷ઀ଓՄ൱ • (JU)VC
    "DUJPOT্Ͱಈ࡞͢ΔΑ͏ߏஙࡁ
17. 1P$ͷ࣮૷಺༰ʹ͍ͭͯ
18. 4FDVSJOH
    $*$%
    4ZTUFNT
    5ISPVHI
    F#1' HJU
    DMPOF࣌ͷ HJUIVCDPN
    ΁ͷ઀ଓ UDQ@DPOOFDU
    ΛUSBDJOH͢Δ͜ͱͰ؍ଌ੒ޭ
19. 4FDVSJOH
    $*$%
    4ZTUFNT
    5ISPVHI
    F#1' TFUVQHP
    ಺Ͱ࣮ߦ͞Ε͍ͯΔ ϓϩηε৘ใͷ؍ଌ੒ޭ
20. 4FDVSJOH
    $*$%
    4ZTUFNT
    5ISPVHI
    F#1' • σϞ ◦ Ϗϧυதͷ HP
    ϑΝΠϧͷॻ׵ 
    4*(,*-- ◦ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 
    4*(,*-- ◦ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 
    4*(,*--
21. 4FDVSJOH
    $*$%
    4ZTUFNT
    5ISPVHI
    F#1' • σϞ ◦ Ϗϧυதͷ HP
    ϑΝΠϧͷॻ׵ 
    4*(,*-- ◦ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 
    4*(,*-- ◦ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 
    4*(,*--
22. 4FDVSJOH
    $*$%
    4ZTUFNT
    5ISPVHI
    F#1'
23. 4FDVSJOH
    $*$%
    4ZTUFNT
    5ISPVHI
    F#1' • σϞ ◦ Ϗϧυதͷ HP
    ϑΝΠϧͷॻ׵ 
    4*(,*-- ◦ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 
    4*(,*-- ◦ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 
    4*(,*--
24. 4FDVSJOH
    $*$%
    4ZTUFNT
    5ISPVHI
    F#1' (JU)VC
    "DUJPOT্ͷઃఆϑΝΠϧ͔Β $JMJVN
    5FUSBHPOͷઃఆΛੜ੒
25. ·ͱΊ • F#1'
    $JMJVN
    5FUSBHPO͸ύϫϑϧͳςΫϊϩδʔ • $*$%͸F#1'ʹΑͬͯ͞ΒʹηΩϡΞʹͳΔ • ࠓޙ͸1P$Ͱ࢖ͬͨ"HFOUΛ044Խ༧ఆ ◦ ͞Εͯ·ͨ͠ IUUQTHJUIVCDPN$ZDPEF-BCTFCQGBHFOUBDUJPO • $POUSJCVUF଴ͬͯΔΑʂ
26. ײ૝ • 5FUSBHPOͷڧྗ͞Λेೋ෼ʹ׆͔͢ൃද ◦ 0CTFSWBCJMJUZ
    3VOUJNF
    &OGPSDFNFOU ◦ ϕετϑΟοτ • ʮؾΛ͚ͭΔʯҎ্ͷ͜ͱ͕ग़དྷΔΑ͏ʹ ◦ $*$%ͷΑ͏ʹʮॏཁ͚ͩͲ޻਺ׂ͕͔Εʹ͍͘ʯ෺͸ ಛʹ͜ͷΑ͏ͳऔΓ૊Έ͕ඞཁʹͳΓͦ͏
27. αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ ϓϥΠϕʔτΫϥ΢υͰͷ(JU)VC
    "DUJPOTج൫Λ ։ൃɾӡ༻த IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT XJUIZPVSTIPFT
28. αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT XJUIZPVSTIPFT ಈతͳTFMGIPTUFE
    SVOOFS
    XIZXBJUBNZTIPFT
29. 4FDVSJOH
    $*$%
    4ZTUFNT
    5ISPVHI
    F#1'
30. αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT XJUIZPVSTIPFT ಈతͳ TFMGIPTUFE
    SVOOFS
    XIZXBJUBNZTIPFT .BOBHFE 1P$
    "HFOU
    4FSWFS
31. Q?