๋กœ์ผ“๐Ÿพ
article thumbnail
๋ฐ˜์‘ํ˜•

 

์ฟ ๋ฒ„๋„คํ‹ฐ์Šค API ์š”์ฒญ ๊ณผ์ •

 

๊ฐ„๋‹จํ•˜๊ฒŒ API Server์— ์ ‘๊ทผํ•˜๊ธฐ ๊นŒ์ง€ ํ”„๋กœ์„ธ์Šค๋ฅผ ๋ณด๋ฉด,

 

์ฒซ๋ฒˆ์งธ, ์š”์ฒญ์„ ๋ณด๋ƒˆ์„ ๋•Œ ์ธ์ฆ(Authentication) ๊ณผ์ •์„ ๊ฑฐ์นœ๋‹ค. 

"๋„ˆ๋Š” k8s cluster์— ๋“ฑ๋ก๋œ ์‚ฌ์šฉ์ž๊ฐ€ ๋งž๋Š”๊ฑฐ์ง€?"

 

๋‘๋ฒˆ์งธ, ์ธ์ฆ ๊ณผ์ •์„ ํ†ต๊ณผํ•œ ํ›„ ์ธ๊ฐ€(Authorization) ๊ณผ์ •์„ ๊ฑฐ์นœ๋‹ค.

"๋“ฑ๋ก๋œ ์‚ฌ์šฉ์ž๋Š” ๋งž๊ณ  ์ด ์•ก์…˜์„ ํ•  ์ˆ˜ ์žˆ๋Š” ๊ถŒํ•œ์€ ์žˆ๋‹ˆ?"

 

์„ธ๋ฒˆ์งธ, ์ธ์ฆ๊ณผ ์ธ๊ฐ€๋ฅผ ํ†ต๊ณผํ•˜๊ฒŒ ๋˜๋ฉด Admission Control์„ ๊ฑฐ์นœ๋‹ค.

"๋„ˆ๊ฐ€ ๋ณด๋‚ธ ์š”์ฒญ์„ ์ ์ ˆํ•œ์ง€ ํ™•์ธํ•ด๋ณผ๊นŒ?"

 

์ด ๊ณผ์ •์„ ๋ฌด์‚ฌํžˆ ๋งˆ์น˜๋ฉด "์š”์ฒญ ์Šน์ธ"์ด ๋œ๋‹ค. ํ•˜์ง€๋งŒ ๋งŒ์•ฝ ํ•œ ๊ณผ์ •์ด๋ผ๋„ ์ ์ ˆ์น˜ ์•Š๋‹ค๋ฉด "์š”์ฒญ ๋ฐ˜๋ ค"๊ฐ€ ๋œ๋‹ค.

 

๊ทธ๋Ÿผ ๋ณธ๊ฒฉ์ ์œผ๋กœ AWS EKS๋ฅผ ์ด์šฉํ•˜์—ฌ ๋งŒ๋“  ํด๋Ÿฌ์Šคํ„ฐ์— ์ตœ์ดˆ ์ƒ์„ฑํ•œ IAM ์‚ฌ์šฉ์ž๊ฐ€ ์•„๋‹Œ ์ƒˆ๋กญ๊ฒŒ ๋งŒ๋“  IAM ์‚ฌ์šฉ์ž๋ฅผ ์ถ”๊ฐ€ํ•ด๋ณด๊ฒ ๋‹ค. ์•„๋ž˜ ๋งํฌ๋ฅผ ํด๋ฆญํ•˜๋ฉด AWS ๊ณต์‹๋ฌธ์„œ๋กœ ์ด๋™ํ•  ์ˆ˜ ์žˆ๋‹ค.

 

 

ํด๋Ÿฌ์Šคํ„ฐ์˜ ์‚ฌ์šฉ์ž ๋˜๋Š” IAM ์—ญํ•  ๊ด€๋ฆฌ - Amazon EKS

"Error from server (NotFound): configmaps "aws-auth" not found"์™€ ๊ฐ™์€ ์˜ค๋ฅ˜๊ฐ€ ๋ฐœ์ƒํ•  ๊ฒฝ์šฐ, ์•ž์˜ ์ ˆ์ฐจ๋ฅผ ํ†ตํ•ด ์žฌ๊ณ  ConfigMap์„ ์ ์šฉํ•ฉ๋‹ˆ๋‹ค.

docs.aws.amazon.com

 

๋งŒ์•ฝ EKS๊ฐ€ ์•„๋‹Œ ์˜จํ”„๋ ˆ๋ฏธ์Šค ํ™˜๊ฒฝ์ด๋‚˜ ์ปค์Šคํ…€์œผ๋กœ ํด๋Ÿฌ์Šคํ„ฐ๋ฅผ ์ƒ์„ฑํ–ˆ์„ ๊ฒฝ์šฐ ์•„๋ž˜ ์„ค๋ช…ํ•˜๋Š” ๋ฐฉ๋ฒ•์œผ๋กœ๋Š” ์‚ฌ์šฉ์ž๋ฅผ ์ถ”๊ฐ€ํ•  ์ˆ˜ ์žˆ๋‹ค. ์ด ๋ถ€๋ถ„์— ๋Œ€ํ•ด์„œ ์ถ”ํ›„ ์ถ”๊ฐ€ํ•˜๊ฒ ๋‹ค.


๋“ค์–ด๊ฐ€๊ธฐ ์•ž์„œ, ์ตœ์ดˆ ํด๋Ÿฌ์Šคํ„ฐ ์ƒ์„ฑ์ž๊ฐ€ ์•„๋‹Œ ๋‹ค๋ฅธ ์ƒ์„ฑ์ž๊ฐ€ ์ ‘๊ทผ ํ–ˆ์„ ์‹œ ์ง„์งœ ํด๋Ÿฌ์Šคํ„ฐ์— ์ ‘๊ทผ์ด ์•ˆ๋˜๋Š”์ง€ ํ™•์ธํ•ด๋ณด์ž

 

$ aws configure

 

์ž์‹ ์˜ access-key๋ฅผ ๋„ฃ์–ด aws ์ ‘์† ํ•œ ํ›„ ์•„๋ž˜ ๋ช…๋ น์–ด๋ฅผ ์ž…๋ ฅํ•˜๊ฒŒ ๋˜๋ฉด,

$ kubectl get configmaps

์ด๋Ÿฐ ๋ฉ”์‹œ์ง€๊ฐ€ ๋‚˜์˜จ๋‹ค. ์ธ์ฆ์ด ๋˜์ง€ ์•Š์€ IAM ์‚ฌ์šฉ์ž์—ฌ์„œ ์ด๋Ÿฐ ๋ฉ”์‹œ์ง€๊ฐ€ ๋‚˜์˜ค๋Š” ๊ฒƒ์ด๋‹ค. ์ง„์งœ๋กœ ์ ‘๊ทผ์ด ์•ˆ๋œ๋‹ค.

 

๊ทธ๋Ÿผ ์ด IAM ์‚ฌ์šฉ์ž๊ฐ€ kubectl๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ด์ฃผ๊ฒ ๋‹ค.

 

$ kubectl edit configmap -n kube-system aws-auth

 

apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: <ARN of instance role (not instance profile)>
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes

 

๊ทธ๋Ÿผ ์œ„์™€ ๊ฐ™์ด ์ถœ๋ ฅ๋œ๋‹ค. ์ดํ›„ ์•„๋ž˜์˜ ์ฝ”๋“œ๋ฅผ ์ถ”๊ฐ€ํ•ด์ค€๋‹ค. ๊ธฐ์กด์— ์žˆ๋Š”๊ฑด ์ ˆ๋Œ€ ์ˆ˜์ •ํ•˜์‹œ๋ฉด ์•ˆ๋œ๋‹ค.

data:
  mapRoles: |
    - rolearn: <arn:aws:iam::111122223333:role/eksctl-my-cluster-nodegroup-standard-wo-NodeInstanceRole-1WP3NUE3O6UCF>
      username: <system:node:{{EC2PrivateDNSName}}>
      groups:
        - <system:bootstrappers>
        - <system:nodes>
  mapUsers: |
    - userarn: <arn:aws:iam::111122223333:user/admin>
      username: <admin>
      groups:
        - <system:masters>
    - userarn: <arn:aws:iam::111122223333:user/ops-user>
      username: <ops-user>
      groups:
        - <system:masters>

 

groups์—๋Š” clusterbinding ๋˜๋Š” rolebinding์„ ๋„ฃ์–ด์ค€๋‹ค. ์ € ๊ฐ™์€ ๊ฒฝ์šฐ role๊ณผ rolebinding์„ ๋งŒ๋“ค์–ด์ฃผ์–ด ์•„๋ž˜์™€ ๊ฐ™์ด ํ•ด์ฃผ์—ˆ๋‹ค.

 

์ˆ˜์ •ํ•œ ๋ถ€๋ถ„์„ ์ €์žฅํ•œ๋‹ค. EKS ํด๋Ÿฌ์Šคํ„ฐ๊ฐ€ ์•„๋‹Œ ๊ฒฝ์šฐ crs, private.key, crt ๋งŒ๋“ค์–ด์„œ user๋ฅผ ์ถ”๊ฐ€ํ•ด์ฃผ์ง€๋งŒ EKS๋ฅผ ์‚ฌ์šฉํ•จ์œผ๋กœ์จ ์ด๋Ÿฌํ•œ ๋ถ€๋ถ„์€ ํ•ด์ฃผ์ง€ ์•Š์•„๋„ ๋œ๋‹ค.

 

AWS ๊ณต์‹๋ฌธ์„œ๋ฅผ ๋ณด๋ฉด ์•„๋ž˜์™€ ๊ฐ™์ด ๋ช…์‹œ๋˜์–ด์žˆ๋‹ค.

 

"Amazon EKS ํด๋Ÿฌ์Šคํ„ฐ๋ฅผ ์ƒ์„ฑํ•  ๊ฒฝ์šฐ, ํด๋Ÿฌ์Šคํ„ฐ๋ฅผ ์ƒ์„ฑํ•˜๋Š” IAM ์—”ํ„ฐํ‹ฐ ์‚ฌ์šฉ์ž ๋˜๋Š” ์—ญํ• (์˜ˆ: ํŽ˜๋”๋ ˆ์ด์…˜ ์‚ฌ์šฉ์ž)์—๋Š” ์ œ์–ด ์˜์—ญ์˜ ํด๋Ÿฌ์Šคํ„ฐ RBAC ๊ตฌ์„ฑ์— system:masters ๊ถŒํ•œ์ด ์ž๋™์œผ๋กœ ๋ถ€์—ฌ๋ฉ๋‹ˆ๋‹ค. ์ด IAM ์—”ํ„ฐํ‹ฐ๋Š” ConfigMap ๋˜๋Š” ๊ธฐํƒ€ ํ‘œ์‹œ๋˜๋Š” ๊ตฌ์„ฑ์— ๋‚˜ํƒ€๋‚˜์ง€ ์•Š์œผ๋ฏ€๋กœ ํด๋Ÿฌ์Šคํ„ฐ๋ฅผ ์›๋ž˜ ์ƒ์„ฑํ•œ IAM ์—”ํ„ฐํ‹ฐ๋ฅผ ์ถ”์ ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. AWS ์‚ฌ์šฉ์ž๋‚˜ ์—ญํ• ์— ํด๋Ÿฌ์Šคํ„ฐ์™€ ์ƒํ˜ธ ์ž‘์šฉํ•  ์ถ”๊ฐ€ ๊ถŒํ•œ์„ ๋ถ€์—ฌํ•˜๋ ค๋ฉด Kubernetes ๋‚ด์—์„œ aws-auth ConfigMap์„ ํŽธ์ง‘ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค."

 

๋”ฐ๋ผ์„œ $ kubectl get configMap --all-namespaces ๋ช…๋ น์–ด๋ฅผ ํ•ด๋„ ์ตœ์ดˆ ํด๋Ÿฌ์Šคํ„ฐ ์ƒ์„ฑ IAM ์ •๋ณด๋ฅผ ์ฐพ์„ ์ˆ˜ ์—†๋‹ค.

 

์ดํ›„ ์•„๋ž˜ ๋ช…๋ น์–ด๋ฅผ ํ•˜๊ฒŒ ๋˜๋ฉด,

$ kubectl get nodes

Error from server (Forbidden): nodes is forbidden: ~~

 

๋ผ๋Š” ์—๋Ÿฌ ๋ฉ”์‹œ์ง€๊ฐ€ ๋‚˜์˜จ๋‹ค. ๋ฐฉ๊ธˆ ์ „์ด๋ž‘์€ ๋‹ค๋ฅธ ๋ฉ”์‹œ์ง€๋‹ค. IAM ์‚ฌ์šฉ์ž๋ฅผ aws-auth์— ๋“ฑ๋กํ•ด์คŒ์œผ๋กœ์จ ์ด์ œ ์ธ์ฆ์€ ๋˜์—ˆ๊ณ , ์ธ๊ฐ€๊ฐ€ ์•ˆ๋˜์„œ ๋‚˜์˜ค๋Š” ๋ฉ”์‹œ์ง€์ด๋‹ค. 

 

๊ทธ๋Ÿผ ์ด์ œ ์ธ๊ฐ€๋ฅผ ํ•ด๋ณด์ž.


์ธ๊ฐ€ ๋ถ€๋ถ„์€ role๊ณผ rolebinding์„ ๋งŒ๋“ค์–ด์ฃผ๋ฉด ๋œ๋‹ค. ๋ฐฉ๊ธˆ aws-auth ๋ถ€๋ถ„์— groups๋ฅผ ์ถ”๊ฐ€ํ–ˆ์—ˆ๋Š”๋ฐ ์ด ๋ถ€๋ถ„์— ์ง€๊ธˆ๋ถ€ํ„ฐ ๋งŒ๋“œ๋Š” rolebinding ์ด๋ฆ„์„ ๋„ฃ์–ด์ฃผ๋ฉด ๋œ๋‹ค.

 

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: guest:pods-get-list-role
rules:
- apiGroups:
  - ""
  resources: 
  - pods
  verbs:
  - get
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: guest:pods-get-list-role-binding
  namespace: default
subjects:
- kind: User
  name: <username>
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: guest:pods-get-list-role
  apiGroup: rbac.authorization.k8s.io

 

์œ„์™€ ๊ฐ™์€ yaml ํŒŒ์ผ์„ ๋งŒ๋“  ํ›„ ์•„๋ž˜ ๋ช…๋ น์–ด๋ฅผ ์‹คํ–‰ํ•ด role๊ณผ rolebinding์„ ๋งŒ๋“ค์–ด์ค€๋‹ค.

 

$ kubectl apply -f role.yaml # yaml ํŒŒ์ผ์ด๋ฆ„์€ ๋งŒ๋“ค์–ด์ค€ ์ด๋ฆ„์œผ๋กœ ์ง€์ •ํ•ด์ค˜์•ผํ•œ๋‹ค.

 

์ด์ œ ๋‹ค์‹œ ํ„ฐ๋ฏธ๋„๋กœ ๊ฐ€์„œ ์•„๋ž˜ ๋ช…๋ น์„ ์‹คํ–‰ํ•ด๋ณด์ž

$ kubectl get pods

role์—์„œ ๋ฆฌ์†Œ์Šค๋ฅผ pods ๋กœ ์ œํ•œํ–ˆ๊ธฐ ๋•Œ๋ฌธ์— pods์— ๋Œ€ํ•ด์„œ๋งŒ ์ ‘๊ทผ์ด ๊ฐ€๋Šฅํ•˜๋‹ค.

์ ‘๊ทผ์ด ์•„์ฃผ ์ž˜๋˜๋Š” ๊ฑธ ํ™•์ธ ํ•  ์ˆ˜ ์žˆ๋‹ค. ๋งŒ์•ฝ service์— ์ ‘๊ทผํ•˜๊ฒŒ ๋œ๋‹ค๋ฉด ์•„๋ž˜์™€ ๊ฐ™์€ ์—๋Ÿฌ๋ฉ”์‹œ์ง€๊ฐ€ ์ถœ๋ ฅ๋œ๋‹ค.

 

์ด๋ ‡๊ฒŒ ํ•ด์„œ EKS๋กœ ๋งŒ๋“  ํด๋Ÿฌ์Šคํ„ฐ์— IAM ์‚ฌ์šฉ์ž๋ฅผ ์ถ”๊ฐ€ํ•ด์ฃผ๋Š” ๋ฐฉ๋ฒ•์— ๋Œ€ํ•ด ์•Œ์•„๋ณด์•˜๋‹ค.

 

๋งŒ์•ฝ default namespace๊ฐ€ ์•„๋‹Œ ์‚ฌ์šฉ์ž namespace์—๋„ ์ด ์ธ์ฆ์ธ๊ฐ€๋ฅผ ์ ์šฉํ•˜๊ณ  ์‹ถ๋‹ค๋ฉด ์‚ฌ์šฉ์ž namespace๋กœ ์ด๋™ ํ›„ role๊ณผ rolebinding์„ ๋งŒ๋“ค์–ด ์ค€ํ›„ aws-auth groups์— ์ถ”๊ฐ€ํ•ด์ฃผ๋ฉด ๋œ๋‹ค.

๋ฐ˜์‘ํ˜•
profile on loading

Loading...