ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข > ื”ืงื“ืžื” ืฆื• Hashicorp Consul's Kubernetes Authorization

ื”ืงื“ืžื” ืฆื• Hashicorp Consul's Kubernetes Authorization

ื”ืงื“ืžื” ืฆื• Hashicorp Consul's Kubernetes Authorization

ืึทื– ืก ืจืขื›ื˜, ื ืึธืš ืžืขืœื“ื•ื ื’ ื”ืึทืฉื™ืงืึธืจืคึผ ืงืึธื ืกื•ืœ 1.5.0 ืื™ืŸ ื“ื™ ืึธื ื”ื™ื™ื‘ ืคื•ืŸ ืžืื™ 2019, ืื™ืŸ ืงืึธื ืกื•ืœ ืื™ืจ ืงืขื ืขืŸ ื“ืขืจืœื•ื™ื‘ืŸ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื– ืื•ืŸ ื‘ืึทื“ื™ื ื•ื ื’ืก ื•ื•ืึธืก ื–ืขื ืขืŸ ื’ืขื‘ื•ื™ืจืŸ ืื™ืŸ Kubernetes.

ืื™ืŸ ื“ืขื ื˜ื•ื˜ืึธืจื™ืึทืœ ืžื™ืจ ื•ื•ืขืœืŸ ืฉืึทืคึฟืŸ ืฉืจื™ื˜ ื“ื•ืจืš ืฉืจื™ื˜ POC (ื“ืขืจื•ื•ื™ื™ึทื– ืคื•ืŸ ื‘ืึทื’ืจื™ืฃ, PoC) ื“ืขืžืึทื ืกื˜ืจื™ื™ื˜ื™ื ื’ ื“ืขื ื ื™ื™ึทืข ืฉื˜ืจื™ืš. ืื™ืจ ื–ืขื ื˜ ื“ืขืจื•ื•ืึทืจื˜ ืฆื• ื”ืึธื‘ืŸ ื™ืงืขืจื“ื™ืง ื•ื•ื™ืกืŸ ืคื•ืŸ Kubernetes ืื•ืŸ Hashicorp ืก ืงืึธื ืกื•ืœ. ื‘ืฉืขืช ืื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ืงื™ื™ืŸ ื•ื•ืึธืœืงืŸ ืคึผืœืึทื˜ืคืึธืจืžืข ืึธื“ืขืจ ืื•ื™ืฃ-ืœืึธืงืึทืœ ืกื•ื•ื™ื•ื•ืข, ืื™ืŸ ื“ืขื ื˜ื•ื˜ืึธืจื™ืึทืœ ืžื™ืจ ื•ื•ืขืœืŸ ื ื•ืฆืŸ Google ืก ืงืœืึธื•ื“ ืคึผืœืึทื˜ืคืึธืจื.

ืึธืคึผืฉืึทืฆื•ื ื’

ืื•ื™ื‘ ืžื™ืจ ื’ื™ื™ืŸ ืฆื• ื‘ืึทืจืึทื˜ื  ื–ื™ืš ื“ืึทืงื™ื•ืžืขื ื˜ื™ื™ืฉืึทืŸ ื•ื•ืขื’ืŸ ื–ื™ื™ึทืŸ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืื•ืคึฟืŸ, ืžื™ืจ ื•ื•ืขื˜ ื‘ืึทืงื•ืžืขืŸ ืึท ืฉื ืขืœ ืื™ื‘ืขืจื‘ืœื™ืง ืคื•ืŸ ื–ื™ื™ึทืŸ ืฆื™ืœ ืื•ืŸ ื ื•ืฆืŸ ืคืึทืœ, ื•ื•ื™ ื’ืขื–ื•ื ื˜ ื•ื•ื™ ืขื˜ืœืขื›ืข ื˜ืขื›ื ื™ืฉ ื“ืขื˜ืึทื™ืœืก ืื•ืŸ ืึท ื’ืขื ืขืจืึทืœ ืื™ื‘ืขืจื‘ืœื™ืง ืคื•ืŸ ื“ื™ ืœืึธื’ื™ืง. ืื™ืš ื”ืขื›ืกื˜ ืจืขืงืึธืžืขื ื“ื™ืจืŸ ืœื™ื™ืขื ืขืŸ ืขืก ื‘ื™ื™ึท ืžื™ื ื“ืกื˜ืขืจ ืึทืžืึธืœ ืื™ื™ื“ืขืจ ืคึผืจืึทืกื™ื“ื™ื ื’, ื•ื•ื™ ืื™ืš ื•ื•ืขื˜ ืื™ืฆื˜ ื“ืขืจืงืœืขืจืŸ ืื•ืŸ ื˜ืฉื•ื™ื ื’ ืื•ื™ืฃ ืขืก ืึทืœืข.

ื”ืงื“ืžื” ืฆื• Hashicorp Consul's Kubernetes Authorization

ื“ื™ืึทื’ืจืึทืžืข 1: ืึทืคื™ืฉืึทืœ ืื™ื‘ืขืจื‘ืœื™ืง ืคื•ืŸ ื“ื™ ืงืึธื ืกื•ืœ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืื•ืคึฟืŸ

ืœืึธืžื™ืจ ืึทืจืฒึทื ืงื•ืงืŸ ื“ืึทืงื™ื•ืžืขื ื˜ื™ื™ืฉืึทืŸ ืคึฟืึทืจ ืึท ืกืคึผืขืฆื™ืคื™ืฉ Kubernetes ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืื•ืคึฟืŸ.

ื–ื™ื›ืขืจ, ืขืก ืื™ื– ื ื•ืฆื™ืง ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื“ืึธืจื˜, ืึธื‘ืขืจ ืขืก ืื™ื– ืงื™ื™ืŸ ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ ื•ื•ื™ ืฆื• ื ื•ืฆืŸ ืขืก ืึทืœืข. ืึทื–ื•ื™, ื•ื•ื™ ื™ืขื“ืขืจ ื‘ืึทื–ืึธืจื’ื˜ ืžืขื ื˜ืฉ, ืื™ืจ ื•ื™ืกืคืึธืจืฉืŸ ื“ื™ ืื™ื ื˜ืขืจื ืขื˜ ืคึฟืึทืจ ื’ื™ื™ื“ืึทื ืก. ืื•ืŸ ื“ืขืžืึธืœื˜ ... ืื™ืจ ืคืึทืจืœืึธื–ืŸ. ืขืก ื’ืขืฉืขื”ื˜. ื–ืืœ ืก ืคืึทืจืจื™ื›ื˜ืŸ ื“ืขื.

ืื™ื™ื“ืขืจ ืžื™ืจ ืคืึธืจื–ืขืฆืŸ ืฆื• ืฉืึทืคึฟืŸ ืื•ื ื“ื–ืขืจ POC, ืœืึธื–ืŸ ืื•ื ื“ื– ื’ื™ื™ืŸ ืฆื•ืจื™ืง ืฆื• ื“ื™ ืื™ื‘ืขืจื‘ืœื™ืง ืคื•ืŸ ืงืึธื ืกื•ืœ ืก ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืžืขื˜ื”ืึธื“ืก (ื“ื™ืึทื’ืจืึทืžืข 1) ืื•ืŸ ืจืึทืคื™ื ื™ืจืŸ ืขืก ืื™ืŸ ื“ืขื ืงืึธื ื˜ืขืงืกื˜ ืคื•ืŸ Kubernetes.

ืึทืจืงืึทื˜ืขืงื˜ืฉืขืจ

ืื™ืŸ ื“ืขื ื˜ื•ื˜ืึธืจื™ืึทืœ, ืžื™ืจ ื•ื•ืขืœืŸ ืฉืึทืคึฟืŸ ืึท ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ ืื•ื™ืฃ ืึท ื‘ืึทื–ื•ื ื“ืขืจ ืžืึทืฉื™ืŸ ื•ื•ืึธืก ื•ื•ืขื˜ ื™ื‘ืขืจื’ืขื‘ืŸ ืžื™ื˜ ืึท Kubernetes ืงื ื•ื™ืœ ืžื™ื˜ ื“ื™ ืงืึธื ืกื•ืœ ืงืœื™ืขื ื˜ ืื™ื ืกื˜ืึทืœื™ืจืŸ. ื“ืขืจื ืึธืš, ืžื™ืจ ื•ื•ืขืœืŸ ืฉืึทืคึฟืŸ ืื•ื ื“ื–ืขืจ ื‘ืึธืง ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ื“ื™ ืคึผืึธื“ ืื•ืŸ ื ื•ืฆืŸ ืื•ื ื“ื–ืขืจ ืงืึทื ืคื™ื’ื™ืขืจื“ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืื•ืคึฟืŸ ืฆื• ืœื™ื™ืขื ืขืŸ ืคึฟื•ืŸ ืื•ื ื“ื–ืขืจ ืงืึทื ืกืึทืœ ืฉืœื™ืกืœ / ื•ื•ืขืจื˜ ืงืจืึธื.

ื“ื™ ื“ื™ืึทื’ืจืึทืžืข ืื•ื ื˜ืŸ ื“ืขื˜ืึทื™ืœืก ื“ื™ ืึทืจืงืึทื˜ืขืงื˜ืฉืขืจ ื•ื•ืึธืก ืžื™ืจ ืฉืึทืคึฟืŸ ืื™ืŸ ื“ืขื ื˜ื•ื˜ืึธืจื™ืึทืœ, ื•ื•ื™ ื’ืขื–ื•ื ื˜ ื•ื•ื™ ื“ื™ ืœืึธื’ื™ืง ื”ื™ื ื˜ืขืจ ื“ื™ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืื•ืคึฟืŸ, ื•ื•ืึธืก ื•ื•ืขื˜ ื–ื™ื™ืŸ ื“ืขืจืงืœืขืจื˜ ืฉืคึผืขื˜ืขืจ.

ื”ืงื“ืžื” ืฆื• Hashicorp Consul's Kubernetes Authorization

ื“ื™ืึทื’ืจืึทืžืข 2: Kubernetes Authorization Method ืื™ื‘ืขืจื‘ืœื™ืง

ื ืฉื ืขืœ ื˜ืึธืŸ: ื“ืขืจ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ ื“ืึทืจืฃ ื ื™ืฉื˜ ืœืขื‘ืŸ ืึทืจื•ื™ืก ืคื•ืŸ ื“ื™ Kubernetes ืงื ื•ื™ืœ ืคึฟืึทืจ ื“ืขื ืฆื• ืึทืจื‘ืขื˜ืŸ. ืึธื‘ืขืจ ื™ืึธ, ืขืจ ืงืขืŸ ื“ืึธืก ื˜ืึธืŸ ืึทื–ื•ื™ ืื•ืŸ ืึทื–.

ืึทื–ื•ื™, ืื•ื™ื‘ ืื™ืจ ื ืขืžืขืŸ ื“ื™ ืงืึธื ืกื•ืœ ืื™ื‘ืขืจื‘ืœื™ืง ื“ื™ืึทื’ืจืึทืžืข (ื“ื™ืึทื’ืจืึทืžืข 1) ืื•ืŸ ืึทืคึผืœื™ื™ื™ื ื’ ืงื•ื‘ืขืจื ืขื˜ืขืก, ืžื™ืจ ื‘ืึทืงื•ืžืขืŸ ื“ื™ ื“ื™ืึทื’ืจืึทืžืข ืื•ื™ื‘ืŸ (ื“ื™ืึทื’ืจืึทืžืข 2), ืื•ืŸ ื“ื™ ืœืึธื’ื™ืง ื“ืึธ ืื™ื– ื•ื•ื™ ื’ื™ื™ื˜:

  1. ื™ืขื“ืขืจ ืคึผืึธื“ ื•ื•ืขื˜ ื”ืึธื‘ืŸ ืึท ืกืขืจื•ื•ื™ืก ื—ืฉื‘ื•ืŸ ืึทื˜ืึทื˜ืฉื˜ ืฆื• ืื™ื ืžื™ื˜ ืึท JWT ื˜ืึธืงืขืŸ ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ืื•ืŸ ื‘ืึทื•ื•ื•ืกื˜ ื“ื•ืจืš Kubernetes. ื“ืขื ืกื™ืžืขืŸ ืื™ื– ืื•ื™ืš ื™ื ืกืขืจื˜ืึทื“ ืื™ืŸ ื“ื™ ืคึผืึธื“ ื“ื•ืจืš ืคืขืœื™ืงื™ื™ึทื˜.
  2. ืื•ื ื“ื–ืขืจ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืึธื“ืขืจ ืกืขืจื•ื•ื™ืก ืื™ืŸ ื“ื™ ืคึผืึธื“ ื™ื ื™ืฉื™ืึทืฅ ืึท ืœืึธื’ื™ืŸ ื‘ืึทืคึฟืขืœ ืฆื• ืื•ื ื“ื–ืขืจ ืงืึธื ืกื•ืœ ืงืœื™ืขื ื˜. ื“ื™ ืœืึธื’ื™ืŸ ื‘ืขื˜ืŸ ื•ื•ืขื˜ ืื•ื™ืš ืึทืจื™ื™ึทื ื ืขืžืขืŸ ืื•ื ื“ื–ืขืจ ืกื™ืžืขืŸ ืื•ืŸ ื ืึธืžืขืŸ ืกืคึผืขืฆื™ืขืœ ื‘ืืฉืืคืŸ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืื•ืคึฟืŸ (Kubernetes ื˜ื™ืคึผ). ื“ืขืจ ืฉืจื™ื˜ #2 ืงืึธืจืึทืกืคึผืึทื ื“ื– ืฆื• ืฉืจื™ื˜ 1 ืคื•ืŸ ื“ื™ ืงืึธื ืกื•ืœ ื“ื™ืึทื’ืจืึทืžืข (ืกืงื™ืžืข 1).
  3. ืื•ื ื“ื–ืขืจ ืงืึธื ืกื•ืœ ืงืœื™ืขื ื˜ ื•ื•ืขื˜ ื“ืขืจื ืึธืš ืคืึธืจืœื™ื™ื’ืŸ ื“ืขื ื‘ืงืฉื” ืฆื• ืื•ื ื“ื–ืขืจ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ.
  4. ืžืึทื’ื™ืฉ! ื“ืึธืก ืื™ื– ื•ื•ื• ื“ืขืจ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ ื•ื•ืขืจืึทืคื™ื™ื– ื“ื™ ืึธื˜ืึทื ื˜ื™ืกื™ื˜ื™ ืคื•ืŸ ื“ื™ ื‘ืขื˜ืŸ, ืงืึทืœืขืงืฅ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ื™ ืื™ื“ืขื ื˜ื™ื˜ืขื˜ ืคื•ืŸ ื“ื™ ื‘ืขื˜ืŸ ืื•ืŸ ืงืึทืžืคึผืขืจื– ืขืก ืžื™ื˜ ืงื™ื™ืŸ ืคืืจื‘ื•ื ื“ืŸ ืคึผืจื™ื“ื™ืคื™ื™ื ื“ ื›ึผืœืœื™ื. ื•ื ื˜ืขืจ ืื™ื– ืืŸ ืื ื“ืขืจ ื“ื™ืึทื’ืจืึทืžืข ืฆื• ืื™ืœื•ืกื˜ืจื™ืจืŸ ื“ืขื. ื“ืขืจ ืฉืจื™ื˜ ืงืึธืจืึทืกืคึผืึทื ื“ื– ืฆื• ืกื˜ืขืคึผืก 3, 4 ืื•ืŸ 5 ืคื•ืŸ ื“ื™ ืงืึทื ืกืึทืœ ืื™ื‘ืขืจื‘ืœื™ืง ื“ื™ืึทื’ืจืึทืžืข (ื“ื™ืึทื’ืจืึทืžืข 1).
  5. ืื•ื ื“ื–ืขืจ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ ื“ื–ืฉืขื ืขืจื™ื™ืฅ ืึท ืงืึธื ืกื•ืœ ืกื™ืžืขืŸ ืžื™ื˜ ืคึผืขืจืžื™ืฉืึทื ื– ืœื•ื™ื˜ ืื•ื ื“ื–ืขืจ ืกืคึผืขืกื™ืคื™ืขื“ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืžืขื˜ื”ืึธื“ืก (ื•ื•ืึธืก ืžื™ืจ ื”ืึธื‘ืŸ ื“ื™ืคื™ื™ื ื“) ื•ื•ืขื’ืŸ ื“ื™ ืื™ื“ืขื ื˜ื™ื˜ืขื˜ ืคื•ืŸ ื“ื™ ืจื™ืงื•ื•ืขืกื˜. ืขืก ื•ื•ืขื˜ ื“ืขืจื™ื‘ืขืจ ืฉื™ืงืŸ ื“ืขื ืกื™ืžืขืŸ ืฆื•ืจื™ืง. ื“ืึธืก ืงืึธืจืึทืกืคึผืึทื ื“ื– ืฆื• ืฉืจื™ื˜ 6 ืคื•ืŸ ื“ื™ ืงืึธื ืกื•ืœ ื“ื™ืึทื’ืจืึทืžืข (ื“ื™ืึทื’ืจืึทืžืข 1).
  6. ืื•ื ื“ื–ืขืจ ืงืึธื ืกื•ืœ ืงืœื™ืขื ื˜ ืคืึธืจื•ื•ืขืจื“ื– ื“ื™ ืกื™ืžืขืŸ ืฆื• ื“ื™ ืจื™ืงื•ื•ืขืกื˜ื™ื ื’ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืึธื“ืขืจ ื“ื™ื ืกื˜.

ืื•ื ื“ื–ืขืจ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืึธื“ืขืจ ืกืขืจื•ื•ื™ืก ืงืขื ืขืŸ ืื™ืฆื˜ ื ื•ืฆืŸ ื“ืขื ืงืึธื ืกื•ืœ ืกื™ืžืขืŸ ืฆื• ื™ื‘ืขืจื’ืขื‘ืŸ ืžื™ื˜ ืื•ื ื“ื–ืขืจ ืงืึธื ืกื•ืœ ื“ืึทื˜ืŸ, ื•ื•ื™ ื‘ืืฉืœืืกืŸ ื“ื•ืจืš ื“ื™ ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉืึทื– ืคื•ืŸ ื“ื™ ืกื™ืžืขืŸ.

ื“ื™ ืžืึทื’ื™ืฉ ืื™ื– ื’ื™ืœื•ื™!

ืคืืจ ื“ื™ ืคื•ืŸ ืื™ื™ืš ื•ื•ืืก ื–ืขื ืขืŸ ื ื™ืฉื˜ ืฆื•ืคืจื™ื“ืŸ ืžื™ื˜ ืกืชื ื ืงื™ื ื™ื’ืœ ืืจื•ื™ืก ืคื•ืŸ ื ื”ื•ื˜ ืื•ืŸ ื•ื•ื™ืœืŸ ื•ื•ื™ืกืŸ ื•ื•ื™ืื–ื•ื™ ืขืก ืืจื‘ืขื˜... ืœืืžื™ืจ ื“ื™ืจ "ื•ื•ื™ื™ื–ืŸ ื•ื•ื™ ื˜ื™ืฃ ืงื™ื ื™ื’ืœ ืœืึธืš'.

ื•ื•ื™ ื“ืขืจืžืื ื˜ ืคืจื™ืขืจ, ืื•ื ื“ื–ืขืจ "ืžืึทื’ื™ืฉ" ืฉืจื™ื˜ (ืคื™ื’ื•ืจืข 2: ืกื˜ืขืคึผ 4) ืื™ื– ื•ื•ื• ื“ืขืจ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฅ ื“ื™ ื‘ืขื˜ืŸ, ืงืึทืœืขืงืฅ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ื™ ื‘ืขื˜ืŸ ืื•ืŸ ืงืึทืžืคึผืขืจื– ืขืก ืฆื• ืงื™ื™ืŸ ืคืืจื‘ื•ื ื“ืŸ ืคึผืจื™ื“ื™ืคื™ื™ื ื“ ื›ึผืœืœื™ื. ื“ืขืจ ืฉืจื™ื˜ ืงืึธืจืึทืกืคึผืึทื ื“ื– ืฆื• ืกื˜ืขืคึผืก 3, 4 ืื•ืŸ 5 ืคื•ืŸ ื“ื™ ืงืึทื ืกืึทืœ ืื™ื‘ืขืจื‘ืœื™ืง ื“ื™ืึทื’ืจืึทืžืข (ื“ื™ืึทื’ืจืึทืžืข 1). ื•ื ื˜ืขืจ ืื™ื– ืึท ื“ื™ืึทื’ืจืึทืžืข (ื“ื™ืึทื’ืจืึทืžืข 3), ื“ืขืจ ืฆื™ืœ ืคื•ืŸ ื•ื•ืึธืก ืื™ื– ืฆื• ืงืœืืจ ื•ื•ื™ื™ึทื–ืŸ ื•ื•ืึธืก ืื™ื– ืคืืงื˜ื™ืฉ ื’ืขืฉืขืขื ื™ืฉ ืื•ื ื˜ืขืจ ื“ื™ ืงืึทืคึผื˜ืขืจ ืกืคึผืขืฆื™ืคื™ืฉ Kubernetes ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืื•ืคึฟืŸ.

ื”ืงื“ืžื” ืฆื• Hashicorp Consul's Kubernetes Authorization

ื“ื™ืึทื’ืจืึทืžืข 3: ื“ื™ ืžืึทื’ื™ืฉ ืื™ื– ื’ื™ืœื•ื™!

  1. ื•ื•ื™ ืึท ืกื˜ืึทืจื˜ื™ื ื’ ืคื•ื ื˜, ืื•ื ื“ื–ืขืจ ืงืึธื ืกื•ืœ ืงืœื™ืขื ื˜ ืคืึธืจื•ื•ืขืจื“ื– ื“ื™ ืœืึธื’ื™ืŸ ื‘ืขื˜ืŸ ืฆื• ืื•ื ื“ื–ืขืจ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ ืžื™ื˜ ื“ื™ Kubernetes ื—ืฉื‘ื•ืŸ ืกื™ืžืขืŸ ืื•ืŸ ืกืคึผืขืฆื™ืคื™ืฉ ื‘ื™ื™ึทืฉืคึผื™ืœ ื ืึธืžืขืŸ ืคื•ืŸ ื“ื™ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืื•ืคึฟืŸ ื•ื•ืึธืก ืื™ื– ื’ืขื•ื•ืขืŸ ื‘ืืฉืืคืŸ ืคืจื™ืขืจ. ื“ืขืจ ืฉืจื™ื˜ ืงืึธืจืึทืกืคึผืึทื ื“ื– ืฆื• ืฉืจื™ื˜ 3 ืื™ืŸ ื“ื™ ืคืจื™ืขืจื“ื™ืงืข ืงืจื™ื™ึทื– ื“ืขืจืงืœืขืจื•ื ื’.
  2. ืื™ืฆื˜ ื“ืขืจ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ (ืึธื“ืขืจ ืคื™ืจืขืจ) ื“ืึทืจืฃ ืฆื• ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื“ื™ ืึธื˜ืึทื ื˜ื™ืกื™ื˜ื™ ืคื•ืŸ ื“ื™ ื‘ืืงื•ืžืขืŸ ืกื™ืžืขืŸ. ื“ืขืจื™ื‘ืขืจ, ืขืก ื•ื•ืขื˜ ื‘ืึทืจืึทื˜ื  ื–ื™ืš ื“ื™ Kubernetes ืงื ื•ื™ืœ (ื“ื•ืจืš ื“ื™ ืงืึธื ืกื•ืœ ืงืœื™ืขื ื˜) ืื•ืŸ, ืžื™ื˜ ื“ื™ ืฆื•ื ืขืžืขืŸ ืคึผืขืจืžื™ืฉืึทื ื–, ืžื™ืจ ื•ื•ืขืœืŸ ื’ืขืคึฟื™ื ืขืŸ ืื•ื™ืก ืฆื™ ื“ืขืจ ืกื™ืžืขืŸ ืื™ื– ืขื›ื˜ ืื•ืŸ ืฆื• ื•ื•ืขืžืขืŸ ืขืก ื’ืขื”ืขืจื˜.
  3. ื“ื™ ื•ื•ืึทืœืึทื“ื™ื™ื˜ืึทื“ ื‘ืขื˜ืŸ ืื™ื– ื“ืึทืŸ ืื•ืžื’ืขืงืขืจื˜ ืฆื• ื“ืขืจ ืงืึธื ืกื•ืœ ืคื™ืจืขืจ, ืื•ืŸ ื“ืขืจ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ ืงื•ืงื˜ ืึทืจื•ื™ืฃ ื“ื™ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืžืขื˜ืึธื“ ื‘ื™ื™ึทืฉืคึผื™ืœ ืžื™ื˜ ื“ื™ ืกืคึผืขืกื™ืคื™ืขื“ ื ืึธืžืขืŸ ืคึฟื•ืŸ ื“ื™ ืœืึธื’ื™ืŸ ื‘ืขื˜ืŸ (ืื•ืŸ Kubernetes ื˜ื™ืคึผ).
  4. ื“ืขืจ ืงืึธื ืกื•ืœ ืคื™ืจืขืจ ื™ื™ื“ืขื ืึทืคื™ื™ื“ ื“ื™ ืกืคึผืขืกื™ืคื™ืขื“ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืžืขื˜ืึธื“ ื‘ื™ื™ึทืฉืคึผื™ืœ (ืื•ื™ื‘ ื’ืขืคื•ื ืขืŸ) ืื•ืŸ ืœื™ื™ืขื ื˜ ื“ื™ ื’ืึทื ื’ ืคื•ืŸ ื‘ื™ื™ื ื“ื™ื ื’ ื›ึผืœืœื™ื ื•ื•ืึธืก ื–ืขื ืขืŸ ืึทื˜ืึทื˜ืฉื˜ ืฆื• ืขืก. ื“ืขืจื ืึธืš ืœื™ื™ืขื ื˜ ื“ื™ ื›ึผืœืœื™ื ืื•ืŸ ืงืึทืžืคึผืขืจื– ื–ื™ื™ ืฆื• ื“ื™ ื•ื•ืขืจืึทืคื™ื™ื“ ืื™ื“ืขื ื˜ื™ื˜ืขื˜ ืึทื˜ืจื™ื‘ื™ื•ืฅ.
  5. ื˜ืึทืงืข! ื–ืืœ ืก ืžืึทืš ืื•ื™ืฃ ืฆื• ืฉืจื™ื˜ 5 ืื™ืŸ ื“ื™ ืคืจื™ืขืจื“ื™ืงืข ืงืจื™ื™ึทื– ื“ืขืจืงืœืขืจื•ื ื’.

ืœื•ื™ืคืŸ ืงืึธื ืกื•ืœ-ืกืขืจื•ื•ืขืจ ืื•ื™ืฃ ืึท ืจืขื’ื•ืœืขืจ ื•ื•ื™ืจื˜ื•ืึทืœ ืžืึทืฉื™ืŸ

ืคึฟื•ืŸ ืื™ืฆื˜ ืื•ื™ืฃ, ืื™ืš ื•ื•ืขื˜ ืžืขืจืกื˜ื ืก ื’ืขื‘ืŸ ื™ื ืกื˜ืจืึทืงืฉืึทื ื– ืื•ื™ืฃ ื•ื•ื™ ืฆื• ืฉืึทืคึฟืŸ ื“ืขื POC, ืึธืคื˜ ืื™ืŸ ืงื•ื™ืœ ื•ื•ื™ื™ื–ื˜, ืึธืŸ ืคื•ืœ ื–ืึทืฅ ื“ืขืจืงืœืขืจื•ื ื’ืขืŸ. ืื•ื™ืš, ื•ื•ื™ ืฉื•ื™ืŸ ืคืจื™ืขืจ, ืื™ืš ื•ื•ืขืœ ื ื•ืฆืŸ GCP ืฆื• ืฉืึทืคึฟืŸ ืึทืœืข ื“ื™ ื™ื ืคืจืึทืกื˜ืจืึทืงื˜ืฉืขืจ, ืึธื‘ืขืจ ืื™ืจ ืงืขื ืขืŸ ืžืึทื›ืŸ ื“ื™ ื–ืขืœื‘ืข ื™ื ืคืจืึทืกื˜ืจืึทืงื˜ืฉืขืจ ืขืจื’ืขืฅ ืึทื ื“ืขืจืฉ.

  • ืึธื ื”ื™ื™ื‘ ื“ื™ ื•ื•ื™ืจื˜ื•ืึทืœ ืžืึทืฉื™ืŸ (ืœืžืฉืœ / ืกืขืจื•ื•ืขืจ).

ื”ืงื“ืžื” ืฆื• Hashicorp Consul's Kubernetes Authorization

  • ืฉืึทืคึฟืŸ ืึท ื”ืขืจืฉืŸ ืคึฟืึทืจ ื“ื™ ืคื™ื™ืจื•ื•ืึทืœ (ื–ื™ื›ืขืจื”ื™ื™ื˜ ื’ืจื•ืคึผืข ืื™ืŸ AWS):
  • ืื™ืš ื•ื•ื™ ืฆื• ื‘ืึทืฉื˜ื™ืžืขืŸ ื“ื™ ื–ืขืœื‘ืข ืžืึทืฉื™ืŸ ื ืึธืžืขืŸ ืฆื• ื‘ื™ื™ื“ืข ื“ื™ ื”ืขืจืฉืŸ ืื•ืŸ ื“ื™ ื ืขืฅ ืงื•ื•ื™ื˜ืœ, ืื™ืŸ ื“ืขื ืคืึทืœ "skywiz-consul-server-poc".
  • ื’ืขืคึฟื™ื ืขืŸ ื“ื™ IP ืึทื“ืจืขืก ืคื•ืŸ ื“ื™ื™ืŸ ื”ื™ื’ืข ืงืึธืžืคึผื™ื•ื˜ืขืจ ืื•ืŸ ืœื™ื™ื’ืŸ ืขืก ืฆื• ื“ืขืจ ืจืฉื™ืžื” ืคื•ืŸ ืžืงื•ืจ IP ืึทื“ืจืขืกืขืก ืึทื–ื•ื™ ืžื™ืจ ืงืขื ืขืŸ ืึทืงืกืขืก ื“ื™ ื‘ืึทื ื™ืฆืขืจ ืฆื•ื‘ื™ื ื“ (UI).
  • ืขืคึฟืขื ืขืŸ ืคึผืึธืจื˜ 8500 ืคึฟืึทืจ ื•ื™. ื“ืจื™ืงื˜ ืฉืึทืคึฟืŸ. ืžื™ืจ ื•ื•ืขืœืŸ ื˜ื•ื™ืฉืŸ ื“ืขื ืคื™ื™ืจื•ื•ืึทืœ ื•ื•ื™ื“ืขืจ ื‘ืึทืœื“ [ืจื•ื ื’].
  • ืœื™ื™ื’ ืึท ืคื™ื™ืจื•ื•ืึทืœ ื”ืขืจืฉืŸ ืฆื• ื“ืขื ื‘ื™ื™ึทืฉืคึผื™ืœ. ื’ื™ื™ืŸ ืฆื•ืจื™ืง ืฆื• ื“ื™ VM ื“ืึทืฉื‘ืึธืจื“ ืื•ื™ืฃ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ื™ืจืขืจ ืื•ืŸ ืœื™ื™ื’ืŸ "skywiz-consul-server-poc" ืฆื• ื“ื™ ื ืขืฅ ื˜ืึทื’ืก ืคืขืœื“. ื“ืจื™ืงื˜ ื”ื™ื˜.

ื”ืงื“ืžื” ืฆื• Hashicorp Consul's Kubernetes Authorization

  • ื™ื ืกื˜ืึทืœื™ืจืŸ ืงืึธื ืกื•ืœ ืื•ื™ืฃ ืึท ื•ื•ื™ืจื˜ื•ืึทืœ ืžืึทืฉื™ืŸ, ื˜ืฉืขืง ื“ืึธ. ื’ืขื“ืขื ืงื˜ ืึทื– ืื™ืจ ื“ืึทืจืคึฟืŸ ืงืึธื ืกื•ืœ ื•ื•ืขืจืกื™ืข โ‰ฅ 1.5 [ืœื™ื ืง]
  • ื–ืืœ ืก ืžืึทื›ืŸ ืึท ืื™ื™ืŸ ื ืึธื“ืข ืงืึธื ืกื•ืœ - ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ืื™ื– ื•ื•ื™ ื’ื™ื™ื˜.

groupadd --system consul
useradd -s /sbin/nologin --system -g consul consul
mkdir -p /var/lib/consul
chown -R consul:consul /var/lib/consul
chmod -R 775 /var/lib/consul
mkdir /etc/consul.d
chown -R consul:consul /etc/consul.d

  • ืคึฟืึทืจ ืึท ืžืขืจ ื“ื™ื˜ื™ื™ืœื“ ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ ืคึฟืึทืจ ื™ื ืกื˜ืึธืœื™ื ื’ ืงืึธื ืกื•ืœ ืื•ืŸ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืึท ืงื ื•ื™ืœ ืคื•ืŸ 3 ื ืึธื•ื“ื–, ื–ืขืŸ ื“ืึธ.
  • ืฉืึทืคึฟืŸ ืึท ื˜ืขืงืข /etc/consul.d/agent.json ื•ื•ื™ ื’ื™ื™ื˜ [ืจื•ื ื’]:

### /etc/consul.d/agent.json
{
 "acl" : {
 "enabled": true,
 "default_policy": "deny",
 "enable_token_persistence": true
 }
}

  • ืึธื ื”ื™ื™ื‘ ืื•ื ื“ื–ืขืจ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ:

consul agent 
-server 
-ui 
-client 0.0.0.0 
-data-dir=/var/lib/consul 
-bootstrap-expect=1 
-config-dir=/etc/consul.d

  • ืื™ืจ ื–ืึธืœ ื–ืขืŸ ืึท ื‘ื™ื ื˜ืœ ืคื•ืŸ ืจืขื–ื•ืœื˜ืึทื˜ ืื•ืŸ ืขื ื“ื™ืงืŸ ืžื™ื˜ "... ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงืŸ ืืคื’ืขืฉื˜ืขืœื˜ ื“ื•ืจืš ืึทืงืœืก."
  • ื’ืขืคึฟื™ื ืขืŸ ื“ื™ ืคื•ื ื“ืจื•ื™ืกื ื“ื™ืง IP ืึทื“ืจืขืก ืคื•ืŸ ื“ื™ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ ืื•ืŸ ืขืคืขื ืขืŸ ืึท ื‘ืœืขื˜ืขืจืขืจ ืžื™ื˜ ื“ืขื IP ืึทื“ืจืขืก ืื•ื™ืฃ ืคึผืึธืจื˜ 8500. ืžืึทื›ืŸ ื–ื™ื›ืขืจ ืึทื– ื“ื™ ื•ื™ ืึธืคึผืขื ืก.
  • ืคึผืจื•ึผื•ื•ื˜ ืฆื• ืœื™ื™ื’ืŸ ืึท ืฉืœื™ืกืœ / ื•ื•ืขืจื˜ ืคึผืึธืจ. ืขืก ืžื•ื– ื–ื™ื™ืŸ ื ื˜ืขื•ืช. ื“ืึธืก ืื™ื– ื•ื•ื™ื™ึทืœ ืžื™ืจ ืœืึธื•ื“ื™ื“ ื“ื™ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ ืžื™ื˜ ืึท ืึทืงืœ ืื•ืŸ ืคืึทืจืงืจื™ืคึผืœื˜ ืึทืœืข ื›ึผืœืœื™ื.
  • ื’ื™ื™ืŸ ืฆื•ืจื™ืง ืฆื• ื“ื™ื™ืŸ ืฉืึธืœ ืื•ื™ืฃ ื“ื™ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ ืื•ืŸ ืึธื ื”ื™ื™ื‘ืŸ ื“ืขื ืคึผืจืึธืฆืขืก ืื™ืŸ ื“ืขืจ ื”ื™ื ื˜ืขืจื’ืจื•ื ื˜ ืึธื“ืขืจ ืขื˜ืœืขื›ืข ืื ื“ืขืจืข ื•ื•ืขื’ ืฆื• ืœื•ื™ืคืŸ ืขืก ืื•ืŸ ืึทืจื™ื™ึทืŸ ื“ื™ ืคืืœื’ืขื ื“ืข:

consul acl bootstrap

  • ื’ืขืคึฟื™ื ืขืŸ ื“ื™ "SecretID" ื•ื•ืขืจื˜ ืื•ืŸ ืฆื•ืจื™ืงืงื•ืžืขืŸ ืฆื• ื“ื™ ื•ื™. ืื™ืŸ ื“ื™ ืึทืงืœ ืงื•ื•ื™ื˜ืœ, ืึทืจื™ื™ึทืŸ ื“ื™ ืกื•ื“ ืฉื™ื™ึทืŸ ืคื•ืŸ ื“ื™ ืกื™ืžืขืŸ ืื™ืจ ื ืึธืจ ืงืึทืคึผื™ื“. ืงืึธืคึผื™ SecretID ืขืจื’ืขืฅ ืึทื ื“ืขืจืฉ, ืžื™ืจ ื•ื•ืขืœืŸ ื“ืึทืจืคึฟืŸ ืขืก ืฉืคึผืขื˜ืขืจ.
  • ืื™ืฆื˜ ืœื™ื™ื’ืŸ ืึท ืฉืœื™ืกืœ / ื•ื•ืขืจื˜ ืคึผืึธืจ. ืคึฟืึทืจ ื“ืขื POC, ืœื™ื™ื’ืŸ ื“ื™ ืคืืœื’ืขื ื“ืข: ืฉืœื™ืกืœ: "custom-ns/test_key", ื•ื•ืขืจื˜: "ืื™ืš ื‘ื™ืŸ ืื™ืŸ ื“ื™ Custom-ns ื˜ืขืงืข!"

ืœืึธื ื˜ืฉื™ื ื’ ืึท Kubernetes ืงื ื•ื™ืœ ืคึฟืึทืจ ืื•ื ื“ื–ืขืจ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืžื™ื˜ ื“ื™ ืงืึธื ืกื•ืœ ืงืœื™ืขื ื˜ ื•ื•ื™ ืึท ื“ืึทืขืžืึธื ืกืขื˜

  • ืฉืึทืคึฟืŸ ืึท K8s (Kubernetes) ืงื ื•ื™ืœ. ืžื™ืจ ื•ื•ืขืœืŸ ืžืึทื›ืŸ ืขืก ืื™ืŸ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ื–ืึธื ืข ื•ื•ื™ ื“ื™ ืกืขืจื•ื•ืขืจ ืคึฟืึทืจ ืคืึทืกื˜ืขืจ ืึทืงืกืขืก, ืื•ืŸ ืึทื–ื•ื™ ืžื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ื“ื™ ื–ืขืœื‘ืข ืกื•ื‘ื ืขื˜ ืฆื• ืœื™ื™ื›ื˜ ืคืึทืจื‘ื™ื ื“ืŸ ืžื™ื˜ ื™ื ืขืจืœืขืš IP ืึทื“ืจืขืกืขืก. ืžื™ืจ ื•ื•ืขืœืŸ ืจื•ืคืŸ ืขืก "ืกืงื™ื•ื•ื™ื–-ืึทืคึผ-ืžื™ื˜-ืงืึทื ืกื•ืœ-ืงืœื™ืขื ื˜-ืคึผืึธืง".

ื”ืงื“ืžื” ืฆื• Hashicorp Consul's Kubernetes Authorization

  • ื•ื•ื™ ืึท ื–ื™ื™ึทื˜ ื˜ืึธืŸ, ื“ืึธ ืื™ื– ืึท ื’ื•ื˜ ื˜ื•ื˜ืึธืจื™ืึทืœ ื•ื•ืึธืก ืื™ืš ื’ืขืคึฟื•ื ืขืŸ ื•ื•ืขืŸ ืื™ืš ืฉื˜ืขืœืŸ ืึทืจื•ื™ืฃ ืึท POC ืงืึธื ืกื•ืœ ืงื ื•ื™ืœ ืžื™ื˜ Consul Connect.
  • ืžื™ืจ ื•ื•ืขืœืŸ ืื•ื™ืš ื ื•ืฆืŸ Hashicorp ื”ืขืœื ื˜ืฉืึทืจื˜ ืžื™ื˜ ืึทืŸ ืขืงืกื˜ืขื ื“ืขื“ ื•ื•ืึทืœื•ืขืก ื˜ืขืงืข.
  • ื™ื ืกื˜ืึทืœื™ืจืŸ ืื•ืŸ ืงืึทื ืคื™ื’ื™ืขืจ ื”ืขืœื. ืงืึธื ืคื™ื’ื•ืจืึทื˜ื™ืึธืŸ ืกื˜ืขืคึผืก:

kubectl create serviceaccount tiller --namespace kube-system
kubectl create clusterrolebinding tiller-admin-binding 
   --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
./helm init --service-account=tiller
./helm update

  • ื”ืขืœื ื˜ืฉืึทืจื˜: https://www.consul.io/docs/platform/k8s/helm.html
  • ื ื™ืฆืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ื•ื•ืขืจื˜ ื˜ืขืงืข (ื˜ืึธืŸ ืื™ืš ื”ืึธื‘ืŸ ืคืึทืจืงืจื™ืคึผืœื˜ ืจื•ื‘ึฟ):

### poc-helm-consul-values.yaml
global:
 enabled: false
 image: "consul:latest"
# Expose the Consul UI through this LoadBalancer
ui:
 enabled: false
# Allow Consul to inject the Connect proxy into Kubernetes containers
connectInject:
 enabled: false
# Configure a Consul client on Kubernetes nodes. GRPC listener is required for Connect.
client:
 enabled: true
 join: ["<PRIVATE_IP_CONSUL_SERVER>"]
 extraConfig: |
{
  "acl" : {
 "enabled": true,   
 "default_policy": "deny",   
 "enable_token_persistence": true 
  }
}
# Minimal Consul configuration. Not suitable for production.
server:
 enabled: false
# Sync Kubernetes and Consul services
syncCatalog:
 enabled: false

  • ืฆื•ืœื™ื™ื’ืŸ ื”ืขืœื ื˜ืฉืึทืจื˜:

./helm install -f poc-helm-consul-values.yaml ./consul-helm - name skywiz-app-with-consul-client-poc

  • ื•ื•ืขืŸ ืขืก ืคืจื•ื•ื•ื˜ ืฆื• ืœื•ื™ืคืŸ, ืขืก ื•ื•ืขื˜ ื“ืึทืจืคึฟืŸ ืคึผืขืจืžื™ืฉืึทื ื– ืคึฟืึทืจ ื“ื™ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ, ืึทื–ื•ื™ ืœืึธื–ืŸ ืื•ื ื“ื– ืœื™ื™ื’ืŸ ื–ื™ื™.
  • ื‘ืึทืžืขืจืงื•ื ื’ ื“ื™ "ืคึผืึธื“ ืึทื“ืจืขืก ืจืึทื ื’ืข" ืœื™ื’ืŸ ืื•ื™ืฃ ื“ื™ ืงื ื•ื™ืœ ื“ืึทืฉื‘ืึธืจื“ ืื•ืŸ ืึธืคึผืฉื™ืงืŸ ืฆื•ืจื™ืง ืฆื• ืื•ื ื“ื–ืขืจ "skywiz-consul-server-poc" ืคื™ื™ืจื•ื•ืึทืœ ื”ืขืจืฉืŸ.
  • ืœื™ื™ื’ ื“ื™ ืึทื“ืจืขืก ืงื™ื™ื˜ ืคึฟืึทืจ ื“ื™ ืคึผืึธื“ ืฆื• ื“ืขืจ ืจืฉื™ืžื” ืคื•ืŸ IP ืึทื“ืจืขืกืขืก ืื•ืŸ ืขืคืขื ืขืŸ ืคึผืึธืจืฅ 8301 ืื•ืŸ 8300.

ื”ืงื“ืžื” ืฆื• Hashicorp Consul's Kubernetes Authorization

  • ื’ื™ื™ืŸ ืฆื• ื“ื™ ืงืึธื ืกื•ืœ ื•ื™ ืื•ืŸ ื ืึธืš ืึท ื‘ื™ืกืœ ืžื™ื ื•ื˜ ืื™ืจ ื•ื•ืขื˜ ื–ืขืŸ ืื•ื ื“ื–ืขืจ ืงื ื•ื™ืœ ืื™ืŸ ื“ื™ ื ืึธื•ื“ื– ืงื•ื•ื™ื˜ืœ.

ื”ืงื“ืžื” ืฆื• Hashicorp Consul's Kubernetes Authorization

ืงืึทื ืคื™ื’ื™ืขืจ ืึท ืึทื•ื˜ื”ืึธืจื™ื–ืึทื˜ื™ืึธืŸ ืžืขื˜ืึทื“ ื“ื•ืจืš ื™ื ื˜ืึทื’ืจื™ื™ื˜ื™ื ื’ ืงืึธื ืกื•ืœ ืžื™ื˜ Kubernetes

  • ืฆื•ืจื™ืงืงื•ืžืขืŸ ืฆื• ื“ื™ ืงืึธื ืกื•ืœ ืกืขืจื•ื•ืขืจ ืฉืึธืœ ืื•ืŸ ืึทืจื•ื™ืกืคื™ืจืŸ ื“ื™ ืกื™ืžืขืŸ ืื™ืจ ื’ืขืจืื˜ืขื•ื•ืขื˜ ืคืจื™ืขืจ:

export CONSUL_HTTP_TOKEN=<SecretID>

  • ืžื™ืจ ื•ื•ืขืœืŸ ื“ืึทืจืคึฟืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ืคื•ืŸ โ€‹โ€‹ืื•ื ื“ื–ืขืจ Kubernetes ืงื ื•ื™ืœ ืฆื• ืฉืึทืคึฟืŸ ืึท ื‘ื™ื™ึทืฉืคึผื™ืœ ืคื•ืŸ ื“ื™ ืึทื•ื˜ื” ืื•ืคึฟืŸ:
  • kubernetes-host

kubectl get endpoints | grep kubernetes

  • kubernetes-service-account-jwt

kubectl get sa <helm_deployment_name>-consul-client -o yaml | grep "- name:"
kubectl get secret <secret_name_from_prev_command> -o yaml | grep token:

  • ื“ื™ ืกื™ืžืขืŸ ืื™ื– ื‘ื™ื™ืกืข64 ืขื ืงืึธื•ื“ื™ื“, ืึทื–ื•ื™ ื“ืขืงืจื™ืคึผื˜ ืขืก ืžื™ื˜ ื“ื™ื™ืŸ ื‘ืึทืœื™ื‘ืกื˜ืข ื’ืขืฆื™ื™ึทื’ [ืจื•ื ื’]
  • kubernetes-ca-cert

kubectl get secret <secret_name_from_prev_command> -o yaml | grep ca.crt:

  • ื ืขืžืขืŸ ื“ื™ "ca.crt" ื‘ืึทื•ื•ื™ื™ึทื–ืŸ (ื ืึธืš ื‘ืึทื–ืข 64 ื“ื™ืงืึธื•ื“ื™ื ื’) ืื•ืŸ ืฉืจื™ื™ึทื‘ืŸ ืขืก ืื™ืŸ ื“ื™ "ca.crt" ื˜ืขืงืข.
  • ืื™ืฆื˜ ื™ื ืกื˜ืึทื ื˜ื™ื™ื˜ ื“ื™ ืึทื•ื˜ื”ืึธืจืฅ ืื•ืคึฟืŸ, ืจื™ืคึผืœื™ื™ืกื™ื ื’ ื“ื™ ืคึผืœืึทืกื›ืึธื•ืœื“ืขืจื– ืžื™ื˜ ื“ื™ ื•ื•ืึทืœื•ืขืก ืื™ืจ ื ืึธืจ ื‘ืืงื•ืžืขืŸ.

consul acl auth-method create 
-type "kubernetes" 
-name "auth-method-skywiz-consul-poc" 
-description "This is an auth method using kubernetes for the cluster skywiz-app-with-consul-client-poc" 
-kubernetes-host "<k8s_endpoint_retrieved earlier>" 
[email protected] 
-kubernetes-service-account-
jwt="<decoded_token_retrieved_earlier>"

  • ื•ื•ื™ื™ึทื˜ืขืจ ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืฉืึทืคึฟืŸ ืึท ื”ืขืจืฉืŸ ืื•ืŸ ืฆื•ื˜ืฉืขืคึผืขืŸ ืขืก ืฆื• ื“ื™ ื ื™ื™ึทืข ืจืึธืœืข. ืคึฟืึทืจ ื“ืขื ื˜ื™ื™ืœ ืื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ Consul UI, ืึธื‘ืขืจ ืžื™ืจ ื•ื•ืขืœืŸ ื ื•ืฆืŸ ื“ื™ ื‘ืึทืคึฟืขืœืŸ ืฉื•ืจื”.
  • ืฉืจื™ื™ื‘ ื ื›ืœืœ

### kv-custom-ns-policy.hcl
key_prefix "custom-ns/" {
 policy = "write"
}

  • ืฆื•ืœื™ื™ื’ืŸ ื“ื™ ื”ืขืจืฉืŸ

consul acl policy create 
-name kv-custom-ns-policy 
-description "This is an example policy for kv at custom-ns/" 
-rules @kv-custom-ns-policy.hcl

  • ื’ืขืคึฟื™ื ืขืŸ ื“ื™ ืฉื™ื™ึทืŸ ืคื•ืŸ ื“ื™ ื”ืขืจืฉืŸ ืื™ืจ ื ืึธืจ ื‘ืืฉืืคืŸ ืคึฟื•ืŸ ื“ืขืจ ืจืขื–ื•ืœื˜ืึทื˜.
  • ืฉืึทืคึฟืŸ ืึท ืจืึธืœืข ืžื™ื˜ ืึท ื ื™ื™ึทืข ื”ืขืจืฉืŸ.

consul acl role create 
-name "custom-ns-role" 
-description "This is an example role for custom-ns namespace" 
-policy-id <policy_id>

  • ืื™ืฆื˜ ืžื™ืจ ื•ื•ืขืœืŸ ืคึฟืึทืจื‘ื•ื ื“ืŸ ืื•ื ื“ื–ืขืจ ื ื™ื™ึทืข ืจืึธืœืข ืžื™ื˜ ื“ื™ ืึทื•ื˜ื” ืื•ืคึฟืŸ. ื‘ืึทืžืขืจืงื•ื ื’ ืึทื– ื“ื™ "ืกืขืœืขืงื˜ืึธืจ" ืคืึธืŸ ื‘ืืฉืœืืกืŸ ืฆื™ ืื•ื ื“ื–ืขืจ ืœืึธื’ื™ืŸ ื‘ืขื˜ืŸ ื•ื•ืขื˜ ื‘ืึทืงื•ืžืขืŸ ื“ืขื ืจืึธืœืข. ืงื•ืง ื“ืึธ ืคึฟืึทืจ ืื ื“ืขืจืข ืกืขืœืขืงื˜ืึธืจ ืึธืคึผืฆื™ืขืก: https://www.consul.io/docs/acl/auth-methods/kubernetes.html#trusted-identity-attributes

consul acl binding-rule create 
-method=auth-method-skywiz-consul-poc 
-bind-type=role 
-bind-name='custom-ns-role' 
-selector='serviceaccount.namespace=="custom-ns"'

ืœืขืกืึธืฃ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทื ื–

ืึทืงืกืขืก ืจืขื›ื˜

  • ืฉืึทืคึฟืŸ ืึทืงืกืขืก ืจืขื›ื˜. ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื’ืขื‘ืŸ ืงืึธื ืกื•ืœ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืฆื• ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืื•ืŸ ื™ื“ืขื ื˜ื™ืคื™ืฆื™ืจืŸ ื“ื™ ืื™ื“ืขื ื˜ื™ื˜ืขื˜ ืคื•ืŸ ื“ื™ K8s ืกืขืจื•ื•ื™ืก ื—ืฉื‘ื•ืŸ ืกื™ืžืขืŸ.
  • ืฉืจื™ื™ื‘ ื“ื™ ืคืืœื’ืขื ื“ืข ืฆื• ื“ืขืจ ื˜ืขืงืข [ืœื™ื ืง]:

###skywiz-poc-consul-server_rbac.yaml
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: review-tokens
 namespace: default
subjects:
- kind: ServiceAccount
 name: skywiz-app-with-consul-client-poc-consul-client
 namespace: default
roleRef:
 kind: ClusterRole
 name: system:auth-delegator
 apiGroup: rbac.authorization.k8s.io
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: service-account-getter
 namespace: default
rules:
- apiGroups: [""]
 resources: ["serviceaccounts"]
 verbs: ["get"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: get-service-accounts
 namespace: default
subjects:
- kind: ServiceAccount
 name: skywiz-app-with-consul-client-poc-consul-client
 namespace: default
roleRef:
 kind: ClusterRole
 name: service-account-getter
 apiGroup: rbac.authorization.k8s.io

  • ื–ืืœ ืก ืžืึทื›ืŸ ืึทืงืกืขืก ืจืขื›ื˜

kubectl create -f skywiz-poc-consul-server_rbac.yaml

ืงืึทื ืขืงื˜ื™ื ื’ ืฆื• ืงืึธื ืกื•ืœ ืงืœื™ืขื ื˜

  • ื•ื•ื™ ืฉื•ื™ืŸ ื“ืขืจืžืื ื˜ ื“ืึธืขืก ื–ืขื ืขืŸ ืขื˜ืœืขื›ืข ืึธืคึผืฆื™ืขืก ืคึฟืึทืจ ืงืึทื ืขืงื˜ื™ื ื’ ืฆื• ื“ืึทืขืžืึธื ืกืขื˜, ืึธื‘ืขืจ ืžื™ืจ ื•ื•ืขืœืŸ ื’ื™ื™ืŸ ืฆื• ื“ื™ ืคืืœื’ืขื ื“ืข ืคึผืฉื•ื˜ ืœื™ื™ื–ื•ื ื’:
  • ืฆื•ืœื™ื™ื’ืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ื˜ืขืงืข [ืจื•ื ื’].

### poc-consul-client-ds-svc.yaml
apiVersion: v1
kind: Service
metadata:
 name: consul-ds-client
spec:
 selector:
   app: consul
   chart: consul-helm
   component: client
   hasDNS: "true"
   release: skywiz-app-with-consul-client-poc
 ports:
 - protocol: TCP
   port: 80
   targetPort: 8500

  • ื“ืขืจื ืึธืš ื ื•ืฆืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ื’ืขื‘ื•ื™ื˜-ืื™ืŸ ื‘ืึทืคึฟืขืœ ืฆื• ืฉืึทืคึฟืŸ ืึท ืงืึธื ืคื™ื’ืžืึทืคึผ [ืจื•ื ื’]. ื‘ื™ื˜ืข ื˜ืึธืŸ ืึทื– ืžื™ืจ ืจื™ืคืขืจื™ื ื’ ืฆื• ื“ื™ ื ืึธืžืขืŸ ืคื•ืŸ ืื•ื ื“ื–ืขืจ ื“ื™ื ืกื˜, ืคืึทืจื‘ื™ื™ึทื˜ืŸ ืขืก ืื•ื™ื‘ ื ื™ื™ื˜ื™ืง.

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
 labels:
   addonmanager.kubernetes.io/mode: EnsureExists
 name: kube-dns
 namespace: kube-system
data:
 stubDomains: |
   {"consul": ["$(kubectl get svc consul-ds-client -o jsonpath='{.spec.clusterIP}')"]}
EOF

ื˜ืขืกื˜ื™ื ื’ ื“ื™ ืึทื•ื˜ื”ืึธืจื™ื˜ื™ ืื•ืคึฟืŸ

ืื™ืฆื˜ ืœืึธื–ืŸ ืก ื–ืขืŸ ื“ื™ ืžืึทื’ื™ืฉ ืื™ืŸ ืงืึทืžืฃ!

  • ืฉืึทืคึฟืŸ ืขื˜ืœืขื›ืข ืžืขืจ ืฉืœื™ืกืœ ืคืึธืœื“ืขืจืก ืžื™ื˜ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ืฉืคึผื™ืฅ-ืžื“ืจื’ื” ืฉืœื™ืกืœ (ื™.ืข. / sample_key) ืื•ืŸ ืึท ื•ื•ืขืจื˜ ืคื•ืŸ ื“ื™ื™ืŸ ื‘ืจื™ืจื”. ืฉืึทืคึฟืŸ ืฆื•ื ืขืžืขืŸ ืคึผืึทืœืึทืกื™ื– ืื•ืŸ ืจืึธืœืขืก ืคึฟืึทืจ ื ื™ื™ึทืข ืฉืœื™ืกืœ ืคึผืึทื˜ืก. ืžื™ืจ ื•ื•ืขืœืŸ ืžืึทื›ืŸ ื“ื™ ื‘ื™ื™ื ื“ื™ื ื’ื– ืฉืคึผืขื˜ืขืจ.

ื”ืงื“ืžื” ืฆื• Hashicorp Consul's Kubernetes Authorization

ืžื ื”ื’ ื ืึทืžืขืกืคึผืึทืกืข ืคึผืจื•ื‘ื™ืจืŸ:

  • ืœืึธืžื™ืจ ืฉืึทืคึฟืŸ ืื•ื ื“ื–ืขืจ ืื™ื™ื’ืขื ืข ื ืึธืžืขืŸ:

kubectl create namespace custom-ns

  • ืœืึธืžื™ืจ ืฉืึทืคึฟืŸ ืึท ืคึผืึธื“ ืื™ืŸ ืื•ื ื“ื–ืขืจ ื ื™ื™ึท ื ืึธืžืขืŸ ืคึผืœืึทืฅ. ืฉืจื™ื™ื‘ ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ืคึฟืึทืจ ื“ื™ ืคึผืึธื“.

###poc-ubuntu-custom-ns.yaml
apiVersion: v1
kind: Pod
metadata:
 name: poc-ubuntu-custom-ns
 namespace: custom-ns
spec:
 containers:
 - name: poc-ubuntu-custom-ns
   image: ubuntu
   command: ["/bin/bash", "-ec", "sleep infinity"]
 restartPolicy: Never

  • ืฉืึทืคึฟืŸ ืื•ื ื˜ืขืจ:

kubectl create -f poc-ubuntu-custom-ns.yaml

  • ืึทืžืึธืœ ื“ืขืจ ืงืึทื ื˜ื™ื™ื ืขืจ ืื™ื– ืคืœื™ืกื ื“ื™ืง, ื’ื™ื™ืŸ ื“ืึธืจื˜ ืื•ืŸ ื™ื ืกื˜ืึทืœื™ืจืŸ ืงืขืจืœ.

kubectl exec poc-ubuntu-custom-ns -n custom-ns -it /bin/bash
apt-get update && apt-get install curl -y

  • ืื™ืฆื˜ ืžื™ืจ ื•ื•ืขืœืŸ ืฉื™ืงืŸ ืึท ืœืึธื’ื™ืŸ ื‘ืขื˜ืŸ ืฆื• ืงืึธื ืกื•ืœ ื ื™ืฆืŸ ื“ื™ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืื•ืคึฟืŸ ืžื™ืจ ื‘ืืฉืืคืŸ ืคืจื™ืขืจ [ืจื•ื ื’].
  • ืฆื• ื–ืขืŸ ื“ื™ ืึทืจื™ื™ึทื ื’ืขืฉื™ืงื˜ ื˜ืึธืงืขืŸ ืคึฟื•ืŸ ื“ื™ื™ืŸ ืกืขืจื•ื•ื™ืก ื—ืฉื‘ื•ืŸ:

cat /run/secrets/kubernetes.io/serviceaccount/token

  • ืฉืจื™ื™ื‘ ื“ื™ ืคืืœื’ืขื ื“ืข ืฆื• ืึท ื˜ืขืงืข ืื™ืŸ ื“ืขื ืงืึทื ื˜ื™ื™ื ืขืจ:

### payload.json
{
 "AuthMethod": "auth-method-test",
 "BearerToken": "<jwt_token>"
}

  • ืฆื™ื™ื›ืŸ ืืจื™ื™ืŸ!

curl 
--request POST 
--data @payload.json 
consul-ds-client.default.svc.cluster.local/v1/acl/login

  • ืฆื• ืคืึทืจืขื ื“ื™ืงืŸ ื“ื™ ืื•ื™ื‘ืŸ ืกื˜ืขืคึผืก ืื™ืŸ ืื™ื™ืŸ ืฉื•ืจื” (ื–ื™ื ื˜ ืžื™ืจ ื•ื•ืขืœืŸ ืœื•ื™ืคืŸ ืงื™ื™ืคืœ ื˜ืขืกืฅ), ืื™ืจ ืงืขื ืขืŸ ื˜ืึธืŸ ื“ื™ ืคืืœื’ืขื ื“ืข:

echo "{ 
"AuthMethod": "auth-method-skywiz-consul-poc", 
"BearerToken": "$(cat /run/secrets/kubernetes.io/serviceaccount/token)" 
}" 
| curl 
--request POST 
--data @- 
consul-ds-client.default.svc.cluster.local/v1/acl/login

  • ืึทืจื‘ืขื˜! ืื™ืŸ ืžื™ื ื“ืกื˜ืขืจ ืขืก ื–ืึธืœ. ืื™ืฆื˜ ื ืขืžืขืŸ ื“ื™ SecretID ืื•ืŸ ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ืึทืงืกืขืก ื“ื™ ืฉืœื™ืกืœ / ื•ื•ืขืจื˜ ื•ื•ืึธืก ืžื™ืจ ื–ืึธืœ ื”ืึธื‘ืŸ ืึทืงืกืขืก ืฆื•.

curl 
consul-ds-client.default.svc.cluster.local/v1/kv/custom-ns/test_key --header โ€œX-Consul-Token: <SecretID_from_prev_response>โ€

  • ืื™ืจ ืงืขื ืขืŸ ื‘ื™ื™ืกืข64 ื“ืขืงืึธื“ืข "ื•ื•ืขืจื˜" ืื•ืŸ ื–ืขืŸ ืึทื– ืขืก ื’ืœื™ื™ึทื›ืŸ ื“ื™ ื•ื•ืขืจื˜ ืื™ืŸ Custom-ns/test_key ืื™ืŸ ื“ื™ ื•ื™. ืื•ื™ื‘ ืื™ืจ ื’ืขื•ื•ื™ื™ื ื˜ ื“ื™ ื–ืขืœื‘ืข ื•ื•ืขืจื˜ ืื•ื™ื‘ืŸ ืื™ืŸ ื“ืขื ื˜ื•ื˜ืึธืจื™ืึทืœ, ื“ื™ื™ืŸ ืขื ืงืึธื•ื“ื™ื“ ื•ื•ืขืจื˜ ื•ื•ืึธืœื˜ ื–ื™ื™ืŸ IkknbSBpbiB0aGUgY3VzdG9tLW5zIGZvbGRlciEi.

ื‘ืึทื ื™ืฆืขืจ ืกืขืจื•ื•ื™ืก ืึทืงืึทื•ื ื˜ ืคึผืจื•ื‘ื™ืจืŸ:

  • ืฉืึทืคึฟืŸ ืึท ืžื ื”ื’ ืกืขืจื•ื•ื™ืก ืึทืงืึทื•ื ื˜ ื ื™ืฆืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ื‘ืึทืคึฟืขืœ [ืจื•ื ื’].

kubectl apply -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
 name: custom-sa
EOF

  • ืฉืึทืคึฟืŸ ืึท ื ื™ื™ึทืข ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข ืคึฟืึทืจ ื“ื™ ืคึผืึธื“. ื‘ื™ื˜ืข ื˜ืึธืŸ ืึทื– ืื™ืš ื™ื ืงืœื•ื“ืขื“ ืงืขืจืœ ื™ื ืกื˜ืึทืœื™ืจื•ื ื’ ืฆื• ืฉืคึผืึธืจืŸ ืึทืจื‘ืขื˜ :)

###poc-ubuntu-custom-sa.yaml
apiVersion: v1
kind: Pod
metadata:
 name: poc-ubuntu-custom-sa
 namespace: default
spec:
 serviceAccountName: custom-sa
 containers:
 - name: poc-ubuntu-custom-sa
   image: ubuntu
   command: ["/bin/bash","-ec"]
   args: ["apt-get update && apt-get install curl -y; sleep infinity"]
 restartPolicy: Never

  • ื ืึธืš ื“ืขื, ืœื•ื™ืคืŸ ืึท ืฉืึธืœ ืื™ืŸ ื“ืขื ืงืึทื ื˜ื™ื™ื ืขืจ.

kubectl exec -it poc-ubuntu-custom-sa /bin/bash

  • ืฆื™ื™ื›ืŸ ืืจื™ื™ืŸ!

echo "{ 
"AuthMethod": "auth-method-skywiz-consul-poc", 
"BearerToken": "$(cat /run/secrets/kubernetes.io/serviceaccount/token)" 
}" 
| curl 
--request POST 
--data @- 
consul-ds-client.default.svc.cluster.local/v1/acl/login

  • ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืฆื•ืจื™ืงื’ืขื•ื•ื™ื–ืŸ. ืึธื”, ืžื™ืจ ืคืืจื’ืขืกืŸ ืฆื• ืœื™ื™ื’ืŸ ืึท ื ื™ื™ึทืข ื›ึผืœืœื™ื ื‘ื™ื ื“ื™ื ื’ ืžื™ื˜ ื“ื™ ืฆื•ื ืขืžืขืŸ ืคึผืขืจืžื™ืฉืึทื ื–, ืœืึธื–ืŸ ืื•ื ื“ื– ื˜ืึธืŸ ื“ืึธืก ืื™ืฆื˜.

ืื™ื‘ืขืจื—ื–ืจืŸ ื“ื™ ืคืจื™ืขืจื“ื™ืงืข ืกื˜ืขืคึผืก ืื•ื™ื‘ืŸ:
ืึท) ืฉืึทืคึฟืŸ ืึทืŸ ื™ื™ื“ืขื ื™ืงืึทืœ ืคึผืึธืœื™ื˜ื™ืง ืคึฟืึทืจ ื“ื™ ืคึผืจืขืคื™ืงืก "ืงืึทืกื˜ืึทื-ืกืึท/".
ื‘) ืฉืึทืคึฟืŸ ืึท ืจืึธืœืข, ืจื•ืคืŸ ืขืก "ืงืึทืกื˜ืึทื-ืกืึท-ืจืึธืœืข"
c) ืฆื•ื˜ืฉืขืคึผืขืŸ ื“ื™ ืคึผืึธืœื™ื˜ื™ืง ืฆื• ื“ื™ ืจืึธืœืข.

  • ืฉืึทืคึฟืŸ ืึท ื”ืขืจืฉืŸ-ื‘ื™ื™ื ื“ื™ื ื’ (ื‘ืœื•ื™ื– ืžืขื’ืœืขืš ืคึฟื•ืŸ ืงืœื™ / ืึทืคึผื™). ื‘ืึทืžืขืจืงื•ื ื’ ื“ื™ ืคืึทืจืฉื™ื“ืขื ืข ื˜ื™ื™ึทื˜ืฉ ืคื•ืŸ ื“ื™ ืกืขืœืขืงื˜ืึธืจ ืคืึธืŸ.

consul acl binding-rule create 
-method=auth-method-skywiz-consul-poc 
-bind-type=role 
-bind-name='custom-sa-role' 
-selector='serviceaccount.name=="custom-sa"'

  • ืœืึธื’ื™ืŸ ื•ื•ื™ื“ืขืจ ืคึฟื•ืŸ ื“ื™ "poc-ubuntu-custom-sa" ืงืึทื ื˜ื™ื™ื ืขืจ. ื”ืฆืœื—ื”!
  • ืงื•ืง ืื™ืŸ ืื•ื ื“ื–ืขืจ ืึทืงืกืขืก ืฆื• ื“ื™ ืงืึทืกื˜ืึทื-ืกืึท / ืฉืœื™ืกืœ ื“ืจืš.

curl 
consul-ds-client.default.svc.cluster.local/v1/kv/custom-sa/test_key --header โ€œX-Consul-Token: <SecretID>โ€

  • ืื™ืจ ืงืขื ื˜ ืื•ื™ืš ืคืึทืจื–ื™ื›ืขืจืŸ ืึทื– ื“ืขื ืกื™ืžืขืŸ ื˜ื•ื˜ ื ื™ืฉื˜ ื’ืขื‘ืŸ ืึทืงืกืขืก ืฆื• ืงื•ื• ืื™ืŸ "ืงืึทืกื˜ืึทื-ื ืก/". ื ืึธืจ ืื™ื‘ืขืจื—ื–ืจืŸ ื“ื™ ืื•ื™ื‘ืŸ ื‘ืึทืคึฟืขืœ ื ืึธืš ืจื™ืคึผืœื™ื™ืกื™ื ื’ "ืงืึทืกื˜ืึทื-ืกืึท" ืžื™ื˜ ื“ื™ ืคึผืจืขืคื™ืงืก "ืงืึทืกื˜ืึทื-ื ืก".
    ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืฆื•ืจื™ืงื’ืขื•ื•ื™ื–ืŸ.

ื‘ื™ื™ืฉืคึผื™ืœ ืคื•ืŸ ืึธื•ื•ื•ืขืจืœื™ื™:

  • ืขืก ืื™ื– ื›ื“ืื™ ืฆื• ื‘ืืžืขืจืงืŸ ืึทื– ืึทืœืข ื”ืขืจืฉืŸ-ื‘ื™ื™ื ื“ื™ื ื’ ืžืึทืคึผื™ื ื’ืก ื•ื•ืขื˜ ื–ื™ื™ืŸ ืžื•ืกื™ืฃ ืฆื• ื“ื™ ืกื™ืžืขืŸ ืžื™ื˜ ื“ื™ ืจืขื›ื˜.
  • ืื•ื ื“ื–ืขืจ ืงืึทื ื˜ื™ื™ื ืขืจ "poc-ubuntu-custom-sa" ืื™ื– ืื™ืŸ ื“ื™ ืคืขืœื™ืงื™ื™ึทื˜ ื ืึทืžืขืกืคึผืึทืกืข - ืึทื–ื•ื™ ืœืึธื–ืŸ ืื•ื ื“ื– ื ื•ืฆืŸ ืขืก ืคึฟืึทืจ ืึท ืึทื ื“ืขืจืฉ ื”ืขืจืฉืŸ-ื‘ื™ื™ื ื“ื™ื ื’.
  • ืื™ื‘ืขืจื—ื–ืจืŸ ื“ื™ ืคืจื™ืขืจื“ื™ืงืข ืกื˜ืขืคึผืก:
    ืึท) ืฉืึทืคึฟืŸ ืึทืŸ ื™ื™ื“ืขื ื™ืงืึทืœ ืคึผืึธืœื™ื˜ื™ืง ืคึฟืึทืจ ื“ื™ "ืคืขืœื™ืงื™ื™ึทื˜ /" ืฉืœื™ืกืœ ืคึผืจืขืคื™ืงืก.
    ื‘) ืฉืึทืคึฟืŸ ืึท ืจืึธืœืข, ื ืึธืžืขืŸ ืขืก "Default-ns-role"
    c) ืฆื•ื˜ืฉืขืคึผืขืŸ ื“ื™ ืคึผืึธืœื™ื˜ื™ืง ืฆื• ื“ื™ ืจืึธืœืข.
  • ืฉืึทืคึฟืŸ ืึท ื”ืขืจืฉืŸ-ื‘ื™ื™ื ื“ื™ื ื’ (ื‘ืœื•ื™ื– ืžืขื’ืœืขืš ืคึฟื•ืŸ ืงืœื™ / ืึทืคึผื™)

consul acl binding-rule create 
-method=auth-method-skywiz-consul-poc 
-bind-type=role 
-bind-name='default-ns-role' 
-selector='serviceaccount.namespace=="default"'

  • ื’ื™ื™ืŸ ืฆื•ืจื™ืง ืฆื• ืื•ื ื“ื–ืขืจ "poc-ubuntu-custom-sa" ืงืึทื ื˜ื™ื™ื ืขืจ ืื•ืŸ ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ืึทืงืกืขืก ื“ื™ "ืกื˜ืึทื ื“ืึทืจื˜ /" ืงื•ื• ื“ืจืš.
  • ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืฆื•ืจื™ืงื’ืขื•ื•ื™ื–ืŸ.
    ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ื“ื™ ืกืคึผืขืกื™ืคื™ืขื“ ืงืจืึทื“ืขื ื˜ืฉืึทืœื– ืคึฟืึทืจ ื™ืขื“ืขืจ ืกื™ืžืขืŸ ืื™ืŸ ื“ื™ ื•ื™ ืื•ื ื˜ืขืจ ACL> ื˜ืึธืงืขื ืก. ื•ื•ื™ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ, ืื•ื ื“ื–ืขืจ ืงืจืึทื ื˜ ืกื™ืžืขืŸ ื”ืื˜ ื‘ืœื•ื™ื– ืื™ื™ืŸ "ืžื ื”ื’-ืกืึท-ืจืึธืœืข" ืึทื˜ืึทื˜ืฉื˜ ืฆื• ืขืก. ื“ืขืจ ืกื™ืžืขืŸ ื•ื•ืึธืก ืžื™ืจ ืื™ืฆื˜ ื ื•ืฆืŸ ืื™ื– ื’ืขื•ื•ืขืŸ ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ื•ื•ืขืŸ ืžื™ืจ ืœืึธื’ื“ ืื™ืŸ ืื•ืŸ ืขืก ืื™ื– ื’ืขื•ื•ืขืŸ ื‘ืœื•ื™ื– ืื™ื™ืŸ ื”ืขืจืฉืŸ-ื‘ื™ื™ื ื“ื™ื ื’ ื•ื•ืึธืก ืื™ื– ืžืึทื˜ืฉื˜ ื“ืขืžืึธืœื˜. ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืœืึธื’ื™ืŸ ื•ื•ื™ื“ืขืจ ืื•ืŸ ื ื•ืฆืŸ ื“ื™ ื ื™ื™ึทืข ืกื™ืžืขืŸ.
  • ืžืึทื›ื˜ ื–ื™ื›ืขืจ ืึทื– ืื™ืจ ืงืขื ืขืŸ ืœื™ื™ืขื ืขืŸ ื‘ื™ื™ื“ืข ื“ื™ "ืงืึทืกื˜ืึทื-ืกืึท/" ืื•ืŸ "ืคืขืœื™ืงื™ื™ึทื˜/" ืงื•ื• ืคึผืึทื˜ืก.
    ื”ืฆืœื—ื”!
    ื“ืึธืก ืื™ื– ื•ื•ื™ื™ึทืœ ืื•ื ื“ื–ืขืจ "ืคึผืึธืง-ื•ื‘ื•ื ื˜ื•-ืงืึทืกื˜ืึทื-ืกืึท" ืฉื•ื•ืขื‘ืขืœืขืš ื“ื™ "ืงืึทืกื˜ืึทื-ืกืึท" ืื•ืŸ "ืคืขืœื™ืงื™ื™ึทื˜-ื ืก" ื”ืขืจืฉืŸ ื‘ื™ื™ื ื“ื™ื ื’ื–.

ืกืึธืฃ

TTL token mgmt?

ืื™ืŸ ื“ืขืจ ืฆื™ื™ื˜ ืคื•ืŸ ื“ืขื ืฉืจื™ื™ื‘ืŸ, ืขืก ืื™ื– ืงื™ื™ืŸ ื™ื ืึทื’ืจื™ื™ื˜ื™ื“ ื•ื•ืขื’ ืฆื• ื‘ืึทืฉืœื™ืกืŸ ื“ื™ TTL ืคึฟืึทืจ ื˜ืึธืงืขื ืก ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ื“ื•ืจืš ื“ืขื ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืื•ืคึฟืŸ. ืขืก ื•ื•ืึธืœื˜ ื–ื™ื™ืŸ ืึท ืคืึทื ื˜ืึทืกื˜ื™ืฉ ื’ืขืœืขื’ื ื”ื™ื™ื˜ ืฆื• ืฆื•ืฉื˜ืขืœืŸ ื–ื™ื›ืขืจ ืึธื˜ืึทืžื™ื™ืฉืึทืŸ ืคื•ืŸ ืงืึธื ืกื•ืœ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ.

ืขืก ืื™ื– ืึทืŸ ืึธืคึผืฆื™ืข ืฆื• ืžืึทื ื™ื•ืึทืœื™ ืฉืึทืคึฟืŸ ืึท ืกื™ืžืขืŸ ืžื™ื˜ TTL:

  • https://www.consul.io/docs/acl/acl-system.html#acl-tokens
    ืขืงืกืคึผื™ืจืึทื˜ื™ืึธืŸ ืฆื™ื™ื˜ - ื“ื™ ืฆื™ื™ื˜ ืื™ืŸ ื•ื•ืึธืก ื“ืขื ื˜ืึธืงืขืŸ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืจื™ื•ื•ืึธื•ืงื˜. (ืึธืคึผื˜ื™ืึธื ืึทืœ; ืฆื•ื’ืขื’ืขื‘ืŸ ืื™ืŸ ืงืึธื ืกื•ืœ 1.5.0)
  • ืขืงืกื™ืกื˜ื™ืจื˜ ื‘ืœื•ื™ื– ืคึฟืึทืจ ืžืึทื ื•ืึทืœ ืฉืึทืคื•ื ื’ / ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงืŸ https://www.consul.io/api/acl/tokens.html#expirationtime

ืึทืœืขื•ื•ื™ื™ึท ืื™ืŸ ื“ืขื ืœืขื‘ืŸ ืฆื•ืงื•ื ืคึฟื˜ ืžื™ืจ ืงืขื ืขืŸ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื•ื•ื™ ื˜ืึธืงืขื ืก ื–ืขื ืขืŸ ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ (ืคึผืขืจ ื”ืขืจืฉืŸ ืึธื“ืขืจ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืื•ืคึฟืŸ) ืื•ืŸ ืœื™ื™ื’ืŸ TTL.

ื‘ื™ื– ื“ืขืžืึธืœื˜, ืขืก ืื™ื– ืกืึทื’ื“ื–ืฉืขืกื˜ื™ื“ ืึทื– ืื™ืจ ื ื•ืฆืŸ ืึท ืœืึธื’ืึธื•ื˜ ืขื ื“ืคึผื•ื™ื ื˜ ืื™ืŸ ื“ื™ื™ืŸ ืœืึธื’ื™ืง.

ืœื™ื™ืขื ืขืŸ ืื•ื™ืš ืื ื“ืขืจืข ืึทืจื˜ื™ืงืœืขืŸ ืื•ื™ืฃ ืื•ื ื“ื–ืขืจ ื‘ืœืึธื’:

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’