๋กœ์ผ“๐Ÿพ
article thumbnail

 

 

์ฟ ๋ฒ„๋„คํ‹ฐ์Šค์—์„  ์ปจํ”ผ๊ทธ๋งต๊ณผ ์‹œํฌ๋ฆฟ์„ ํ†ตํ•ด ํ™˜๊ฒฝ๋ณ€์ˆ˜๋‚˜ ํŒŒ์ผ์„ ์ „๋‹ฌํ•ด์ค„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

ํŠนํžˆ ๋ฏผ๊ฐํ•œ ์ •๋ณด์ธ ๊ฒฝ์šฐ ์‹œํฌ๋ฆฟ์„ ํ†ตํ•ด ๋ฐฐํฌํ•˜๊ฒŒ ๋ฉ๋‹ˆ๋‹ค. ํ•˜์ง€๋งŒ ์‹œํฌ๋ฆฟ์€ ๋ฌธ์ œ๊ฐ€ ํ•˜๋‚˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด๋ฆ„์€ ์‹œํฌ๋ฆฟ์ธ๋ฐ.. ์ธ์ฝ”๋”ฉ๋งŒ ํ•ด์ค„๋ฟ ์ „ํ˜€ ์‹œํฌ๋ฆฟ์Šค๋Ÿฝ์ง€ ๋ชปํ•ฉ๋‹ˆ๋‹ค.

 

๋””์ฝ”๋”ฉ ํ•˜๋ฉด ๊ฐ’์ด ๋ณด์—ฌ์ง

 

๋”ฐ๋ผ์„œ ์‹œํฌ๋ฆฟ์„ ์‚ฌ์šฉํ•˜๋Š” Helm Chart ์„ ์ƒ์„ฑํ•œ ํ›„, ๊นƒํ—ˆ๋ธŒ์— ์˜ฌ๋ฆฌ๊ฒŒ ๋œ๋‹ค๋ฉด ๊ฒฐ๊ตญ ๊ทธ ์‹œํฌ๋ฆฟ ๊ฐ’์€ ๊ทธ๋Œ€๋กœ ๋…ธ์ถœ๋ฉ๋‹ˆ๋‹ค. 

ํ”„๋ผ์ด๋น— ๋ ˆํฌ์ง€ํ† ๋ฆฌ๋ผ ํ•ด๋„, ๋ฏผ๊ฐํ•œ ์ •๋ณด๋Š” ๊นƒ ํ—ˆ๋ธŒ์— ์˜ฌ๋ฆฌ๋ฉด ์•ˆ๋œ๋‹ค๊ณ , ๊นƒํ—™ ์ž์ฒด์—์„œ๋„ ๊ฐ€์ด๋“œํ•ฉ๋‹ˆ๋‹ค

 

๊ทธ๋Ÿผ ์ด๋Ÿฐ ์‹œํฌ๋ฆฟ์„ ์–ด๋–ป๊ฒŒ ์‹œํฌ๋ฆฟ์Šค๋Ÿฝ๊ฒŒ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์„๊นŒ์š”? ๋‹คํ–‰ํžˆ ์ด๋ฏธ ์ข‹์€ ์†”๋ฃจ์…˜์ด ์กด์žฌํ•ฉ๋‹ˆ๋‹ค. 

๋ฐ”๋กœ HashiCorp ์˜ Vault ์ž…๋‹ˆ๋‹ค. 

 

Vault ๋Š” Secret Manager ์‹œ์Šคํ…œ์œผ๋กœ ์ด๋ฆ„ ๊ทธ๋Œ€๋กœ ์‹œํฌ๋ฆฟ์„ ๊ด€๋ฆฌํ•ด์ฃผ๋Š” ์‹œ์Šคํ…œ์ž…๋‹ˆ๋‹ค. 

 

Vault ๋ฅผ ์ด์šฉํ•œ๋‹ค๋ฉด ๋ฏผ๊ฐํ•œ ๋ฐ์ดํ„ฐ๋ฅผ ์‹œํฌ๋ฆฟ ๋ฆฌ์†Œ์Šค์— ๋ช…์‹œํ•˜์ง€ ์•Š์•„๋„ ๋˜๊ธฐ ๋•Œ๋ฌธ์— ๋…ธ์ถœ๋  ์ผ์ด ์—†์–ด์ง€๊ฒŒ ๋ฉ๋‹ˆ๋‹ค.

๊ทธ๋Ÿผ Vault ๋Š” ์–ด๋–ป๊ฒŒ ์ด๊ฑธ ๊ฐ€๋Šฅํ•˜๊ฒŒ ํ• ๊นŒ์š”?

 

์ด๋ฒˆ ๊ธ€์—์„œ๋Š” ๊ฐ„๋‹จํ•œ ์˜ˆ์ œ๋ฅผ ํ†ตํ•ด Vault ๋ฅผ ์•Œ์•„๋ณด๊ณ ์ž ํ•ฉ๋‹ˆ๋‹ค.

 

๊ทธ๋Ÿผ ๋ ›์ธ ๋‘๋”์ฝ”๋“œ~

 

 

Vault ์„ค์น˜


Vault Install Mode ๋Š” ํฌ๊ฒŒ Dev Mode, Single Node Mode(Stand Alone), HA Mode ๊ฐ€ ์žˆ๋Š”๋ฐ, ์ด๋ฒˆ ๊ธ€์—์„œ๋Š” Dev Mode ๋กœ ์„ค์น˜ํ•ฉ๋‹ˆ๋‹ค.

 

Vault ์—๋Š” Seal, Unseal ์ด๋ผ๋Š” ์•„์ฃผ ์ค‘์š”ํ•œ ๊ฐœ๋…์ด ์žˆ๋Š”๋ฐ Dev Mode ๋กœ ์ง„ํ–‰ํ•˜๋ฉด ํ•ญ์ƒ Unseal ์ƒํƒœ๋กœ ์กด์žฌํ•˜๊ธฐ ๋•Œ๋ฌธ์— ์ด๋ฅผ ์‹ ๊ฒฝ์“ธ ํ•„์š”๊ฐ€ ์—†์ฃ . ๊ทธ๋ž˜์„œ Dev Mode ๋กœ ์ง„ํ–‰ํ•ฉ๋‹ˆ๋‹ค.

 

์„ค์น˜๋Š” Helm Chart ๋กœ ์ง„ํ–‰ํ•˜๊ณ , Dev Mode ๋Š” ๋งค์šฐ ๊ฐ„๋‹จํ•ฉ๋‹ˆ๋‹ค.

 

์„ค์น˜ ๊ด€๋ จ ๊ณต์‹ ๋ฌธ์„œ์€ ์—ฌ๊ธฐ!

 

value ๋ช‡ ๊ฐœ๋ฅผ ์ˆ˜์ •ํ•˜๊ธฐ ์œ„ํ•ด์„œ values.yaml ์ด๋ผ๋Š” ํŒŒ์ผ์„ ๋”ฐ๋กœ ๋งŒ๋“  ํ›„ ์ œ๊ณต๋˜๋Š” ์ฐจํŠธ์˜ values.yaml ์„ ๊ทธ๋Œ€๋กœ ๋ณต์‚ฌํ•ด์ค๋‹ˆ๋‹ค.

 

์ดํ›„ .dev.enabled ๋Š” true ๋กœ, .standalone.enabled ๋Š” false ๋กœ ํ•ด์ค๋‹ˆ๋‹ค.

 

๊ทธ๋ฆฌ๊ณ  ui ๋ฅผ ์‚ฌ์šฉํ•  ๊ฒƒ์ด๊ธฐ ๋•Œ๋ฌธ์— .ui.enabled ๋˜ํ•œ true ๋กœ ํ•ด์ค๋‹ˆ๋‹ค.

 

์ด์ œ helm install ๋ช…๋ น์–ด๋ฅผ ํ†ตํ•ด Dev Mode ์˜ Vault ๋ฅผ ์„ค์น˜ํ•ด์ค์‹œ๋‹ค.

 

์„ฑ๊ณต์ ์œผ๋กœ ์„ค์น˜๊ฐ€ ๋˜์—ˆ๋„ค์š”!

 

๊ทธ๋Ÿผ ui ๋„ ํ™•์ธํ•ด๋ณผ๊นŒ์š”?

8200 ํฌํŠธ๋กœ port-forwarding ์„ ํ†ตํ•ด์„œ ์ ‘๊ทผ์ด ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค.

Token ๊ฐ’์€ values.yaml ์— ๋ช…์‹œ๋˜์–ด ์žˆ์œผ๋ฉฐ, ๊ธฐ๋ณธ ๊ฐ’์€ root ์ž…๋‹ˆ๋‹ค.

 

 

์ข‹์Šต๋‹ˆ๋‹ค!

 

 

Agent Injector vs Vault CSI Provider


 

์‹ค์Šต์— ์•ž์„œ ์•„์ฃผ ์ค‘์š”ํ•œ Vault Component ๋ฅผ ์ž ๊น ์•Œ์•„๋ณด๊ณ ์ž ํ•ฉ๋‹ˆ๋‹ค.

๋ฐ”๋กœ Agent Injector ๊ณผ Vault CSI Provider ์ด์ฃ .

 

๋จผ์ € Agent Injector ์ž…๋‹ˆ๋‹ค. 

Agent Injector ์ถœ์ฒ˜ : Vault Docs

ํ•ต์‹ฌ ๊ฐœ๋…์€ ๋ฐ”๋กœ Admission Controller ์˜ Mutate ๊ธฐ๋Šฅ์„ ์‚ฌ์šฉํ•œ๋‹ค๋Š” ๊ฒƒ์ด์ฃ !

์ด์Šคํ‹ฐ์˜ค๊ฐ€ Admission Controller ๋ฅผ ํ†ตํ•ด์„œ ํŒŒ๋“œ ์ƒ์„ฑ ์‹œ ํ”„๋ก์‹œ๋ฅผ ์ƒ์„ฑํ•ด์ฃผ๋Š” ๊ฒƒ๊ณผ ๋งˆ์ฐฌ๊ฐ€์ง€๋กœ Agent Injector ๋Š” ํŒŒ๋“œ๊ฐ€ Vault ์˜ ์‹œํฌ๋ฆฟ์„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋„๋ก ํŒŒ๋“œ ์ŠคํŽ™์„ ๋ณ€๊ฒฝ(Mutate) ํ•ด์ค๋‹ˆ๋‹ค.

 

Admission Controller ๊ฐ€ ๊ถ๊ธˆํ•˜๋‹ค๋ฉด ์—ฌ๊ธฐ๋ฅผ ์ฐธ๊ณ ํ•ด์ฃผ์„ธ์š”!

 

๊ทธ๋ฆฌ๊ณ  PV ๊ฐ€ ์•„๋‹Œ EmptyDir ์„ ์ด์šฉํ•ด ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ๊ณต์œ ํ•ฉ๋‹ˆ๋‹ค. ์ด๊ฑด ๋’ค์—์„œ ์˜ˆ์ œ ๋ณด์‹œ๋ฉด ์‰ฝ๊ฒŒ ์ดํ•ด๊ฐ€ ๋˜์‹ค ๊ฒ๋‹ˆ๋‹ค.

 

๋‹ค๋ฅธ ํ•˜๋‚˜๋Š” Vault CSI Provider ์ž…๋‹ˆ๋‹ค.

Vault CSI Provider ์ถœ์ฒ˜ : Vault Docs

์šฐ์„  ๋ˆˆ์— ๋„๋Š” ๊ฑด Agent Injector ์™€ ๋‹ค๋ฅด๊ฒŒ CSI Provider ๋Š” ๋ฐ๋ชฌ์…‹์œผ๋กœ ๋„์–ด์ง€๊ฒŒ ๋ฉ๋‹ˆ๋‹ค. ๋”ฐ๋ผ์„œ ๋ชจ๋“  ๋…ธ๋“œ์— ๋„์–ด์ง€๊ฒŒ ๋ฉ๋‹ˆ๋‹ค.

CSI(Container Storage Interface) ๋ผ๋Š” ์ด๋ฆ„์— ๊ฑธ๋งž๊ฒŒ ๊ฐ ๋…ธ๋“œ์— ์žˆ๋Š” ๋ณผ๋ฅจ์— Vault ๋ฐ์ดํ„ฐ๋ฅผ ์ €์žฅํ•˜๊ฒŒ ๋˜๊ณ  ํŒŒ๋“œ๊ฐ€ ์ด๋ฅผ ๊ฐ€์ ธ๋‹ค ์‚ฌ์šฉํ•˜๋Š” ๋ฐฉ์‹์ด์ฃ .

 

์ด๊ฑด ์ œ๊ฐ€ ๋”ฐ๋กœ ๋…ธ์…˜์— ์ •๋ฆฌํ•œ ๊ธ€์ธ๋ฐ ๋ณด์‹œ๋ฉด ์•„๋งˆ ๋Œ€๋žต์ ์ธ ์ฐจ์ด์ ์„ ๋Š๋ผ์‹ค ์ˆ˜ ์žˆ์„ ๊ฒ๋‹ˆ๋‹ค.

๋…ธ์…˜

 

์ด๋ฒˆ ์‹ค์Šต์—์„œ๋Š” Vault Agent Injector ๋ฐฉ์‹์„ ์‚ฌ์šฉํ•ฉ๋‹ˆ๋‹ค.

 

์‹ค์Šต


๊ทธ๋Ÿผ ์ด์ œ ๋ฐ”๋กœ ์‹ค์Šต์„ ํ•ด๋ณด์ฃ .

 

์‹ค์Šต์— ์‚ฌ์šฉํ•œ ์‹œํฌ๋ฆฟ ๋ฐ์ดํ„ฐ๋ถ€ํ„ฐ ๋งŒ๋“ค์–ด๋ณด์ฃ . Vault ๋Š” CLI, API, UI ๋ชจ๋‘ ๊ฐ€๋Šฅํ•˜์ง€๋งŒ ์—ฌ๊ธฐ์„  ํŽธํ•˜๊ฒŒ UI ๋ฅผ ์‚ฌ์šฉํ•ด์„œ ๋ฐ์ดํ„ฐ๋ฅผ ๋งŒ๋“ค์–ด๋ณด๊ฒ ์Šต๋‹ˆ๋‹ค. ์˜ค๋ฅธ์ชฝ ์ƒ๋‹จ์— Enable new engine+ ๋ฅผ ํด๋ฆญํ•ฉ๋‹ˆ๋‹ค.

 

KV ๋ฅผ ์„ ํƒํ•ฉ๋‹ˆ๋‹ค (KV ๋Š” Key / Value ์˜ ์ค„์ž„๋ง)

 

path ๋Š” database-secret(์•„๋ฌด๊ฑฐ๋‚˜ ์ƒ๊ด€X) ๋กœ ํ•ด์ค๋‹ˆ๋‹ค. Vault ์— ์žˆ๋Š” ๋ชจ๋“  ๋ฐ์ดํ„ฐ๋Š” ์ „๋ถ€ Path ๋ฅผ ํ†ตํ•ด์„œ ์ ‘๊ทผํ•˜๊ฒŒ ๋ฉ๋‹ˆ๋‹ค.

 

์ดํ›„ ์˜ค๋ฅธ์ชฝ ์ƒ๋‹จ์— Create secret + ๋ฅผ ๋ˆŒ๋Ÿฌ์ค๋‹ˆ๋‹ค.

 

์‹œํฌ๋ฆฟ ๋ฐ์ดํ„ฐ๋ฅผ ์ž…๋ ฅํ•œ ํ›„ Save ๋ฅผ ๋ˆŒ๋Ÿฌ์ค๋‹ˆ๋‹ค.

 

์ด๋กœ์จ ์šฐ๋ฆฌ๋Š” Vault ์— ์‹œํฌ๋ฆฟ ๋ฐ์ดํ„ฐ๋ฅผ ๋งŒ๋“ค์—ˆ์Šต๋‹ˆ๋‹ค. ๊ทธ๋Ÿผ ์ด์ œ ์ด ๋งŒ๋“  ๋ฐ์ดํ„ฐ๋ฅผ ์ฟ ๋ฒ„๋„คํ‹ฐ์Šค์—์„œ ์‚ฌ์šฉํ•ด์•ผ๊ฒ ์ฃ ?

 

๋“ค์–ด๊ฐ€๊ธฐ ์•ž์„œ ๋˜ ํ•œ๊ฐ€์ง€ ์งš๊ณ  ๋„˜์–ด๊ฐ€์•ผ ํ•˜๋Š” ๋ถ€๋ถ„์ด ์žˆ์Šต๋‹ˆ๋‹ค.

๋ฐ”๋กœ Connectivity ์ž…๋‹ˆ๋‹ค.

์ฟ ๋ฒ„๋„คํ‹ฐ์Šค์—์„œ Vault ์‹œํฌ๋ฆฟ ๋ฐ์ดํ„ฐ์— ์ ‘๊ทผ์ด ๊ฐ€๋Šฅํ•ด์•ผํ•˜๊ณ , ๋ฐ˜๋Œ€๋กœ Vault ๋˜ํ•œ ์ฟ ๋ฒ„๋„คํ‹ฐ์Šค์— ์ ‘๊ทผ์ด ๊ฐ€๋Šฅํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

 

์ด๋ฅผ ์œ„ํ•œ ์ž‘์—…์„ ๋ฐ”๋กœ ํ•ด๋ณด์ฃ .

 

์˜ค๋ฅธ์ชฝ ์ƒ๋‹จ์— Enable new method + ๋ฅผ ๋ˆŒ๋Ÿฌ์ค๋‹ˆ๋‹ค.

 

์ฟ ๋ฒ„๋„คํ‹ฐ์Šค๋ฅผ ์„ ํƒํ•ด์ค๋‹ˆ๋‹ค. 

 

์ด๋Œ€๋กœ Enable Method ๋ฅผ ๋ˆŒ๋Ÿฌ์ค๋‹ˆ๋‹ค.

 

๊ทธ๋ฆฌ๊ณ  k8s host ์™€ k8s cert ๋ฅผ ๋„ฃ์–ด์ค๋‹ˆ๋‹ค.

 

k8s host ์™€ k8s cert ๋ฅผ ํ™•์ธํ•˜๋Š” ๋ฐฉ๋ฒ•์ž…๋‹ˆ๋‹ค.

# get k8s host
kubectl config view --minify | grep server | cut -f 2- -d ":" | tr -d " "

# get k8s cert
kubectl config view --raw --minify --flatten -o jsonpath='{.clusters[].cluster.certificate-authority-data}' | base64 --decode

 

kubernetes auth method ๊ฐ€ ์ƒ์„ฑ๋˜์—ˆ์Šต๋‹ˆ๋‹ค. ํด๋ฆญํ•ด์ค์‹œ๋‹ค.

 

์ฟ ๋ฒ„๋„คํ‹ฐ์Šค์—์„œ ์‚ฌ์šฉํ•˜๊ฒŒ ๋  Vault Role ์„ ์˜ค๋ฅธ์ชฝ Create Role+ ๋ฅผ ๋ˆŒ๋Ÿฌ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค.

 

์•„๋ž˜์ฒ˜๋Ÿผ Role ์„ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค.

 

์ฟ ๋ฒ„๋„คํ‹ฐ์Šค๊ฐ€ ์‚ฌ์šฉํ•˜๊ฒŒ ๋  Vault Role ์ด ์ƒ์„ฑ๋˜์—ˆ์Šต๋‹ˆ๋‹ค.

AWS IRSA ๋™์ž‘๋ฐฉ์‹๊ณผ ๋งค์šฐ ์œ ์‚ฌํ•ฉ๋‹ˆ๋‹ค.

 

์œ„์—์„œ default ๋ผ๋Š” Policy ๋ฅผ Role ์— ๋งตํ•‘์‹œ์ผœ์คฌ๋Š”๋ฐ ํ•ด๋‹น Policy ๋Š” ์•„๊นŒ ๋งŒ๋“  ์‹œํฌ๋ฆฟ ๋ฐ์ดํ„ฐ์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ๊ถŒํ•œ์ด ํ˜„์žฌ ์—†์–ด์š”. ๊ทธ๋ž˜์„œ ๊ถŒํ•œ์„ ์ƒ์„ฑํ•ด์ค๋‹ˆ๋‹ค.

 

default ๋ฅผ ๋ˆ„๋ฆ…๋‹ˆ๋‹ค.

 

์˜ค๋ฅธ์ชฝ ์ƒ๋‹จ์— Edit Policy ๋ฅผ ๋ˆ„๋ฆ…๋‹ˆ๋‹ค.

์•„๋ž˜์™€ ๊ฐ™์ด ๊ถŒํ•œ์„ ์ถ”๊ฐ€ํ•ฉ๋‹ˆ๋‹ค.

 

์ž, Vault ์—์„œ์˜ ์ž‘์—…์€ ๋๋‚ฌ๊ณ , ์ด์ œ ์ฟ ๋ฒ„๋„คํ‹ฐ์Šค๋กœ ๋„˜์–ด๊ฐ€ ๋ด…์‹œ๋‹ค.

 

์„œ๋น„์Šค ์–ด์นด์šดํŠธ์˜ ์ด๋ฆ„๊ณผ ๋„ค์ž„์ŠคํŽ˜์ด์Šค๋Š” ๋ฐ˜๋“œ์‹œ ์œ„์—์„œ ๋งŒ๋“  auth method ์™€ ์ผ์น˜ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: db-auth
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: role-tokenreview-binding
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    name: db-auth
    namespace: default

 

์ดํ›„ deployment ๋ฅผ ์ž‘์„ฑํ•˜๊ณ , ๋ฐฐํฌํ•ฉ๋‹ˆ๋‹ค. ๋” ์ž์„ธํ•œ ์˜ˆ์ œ ์„ค๋ช…์ด ๋ณด๊ณ  ์‹ถ๋‹ค๋ฉด ์—ฌ๊ธฐ!

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-example-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: app-example
  template:
    metadata:
      labels:
        app: app-example
      annotations:
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/agent-inject-secret-db-cred: 'database-secret/cred'
        vault.hashicorp.com/agent-inject-template-db-cred: |
          {{- with secret "database-secret/cred" -}}
          postgres://{{ .Data.data.username }}:{{ .Data.data.password }}@postgres:5432/appdb?sslmode=disable
          {{- end }}
        vault.hashicorp.com/auth-type: 'kubernetes'
        vault.hashicorp.com/auth-path: 'auth/kubernetes'
        vault.hashicorp.com/role: 'db-cred'
    spec:
      containers:
        - name: app
          image: 'nginx'
      serviceAccountName: db-auth
์‹œํฌ๋ฆฟ์„ Injection ํ•˜๋Š” ๋ฐฉ๋ฒ•์€ ์œ„์ฒ˜๋Ÿผ Annotation ์„ ์‚ฌ์šฉํ•˜๋Š” ๋ฐฉ๋ฒ•๊ณผ Configmap ์„ ์‚ฌ์šฉํ•˜๋Š” ๋ฐฉ๋ฒ•์ด ์žˆ์Šต๋‹ˆ๋‹ค.
์œ„์™€ ๊ฐ™์ด Annotation ์„ ์‚ฌ์šฉํ•œ๋‹ค๋ฉด Vault ๊ด€๋ จ Annotation ์„ Deployment ๋ ˆ๋ฒจ์ด ์•„๋‹Œ Pod ๋ ˆ๋ฒจ์— ๋ช…์‹œํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

 

 

๋ฌธ์ œ ์—†์ด ์ƒ์„ฑ์ด ์ž˜๋˜์—ˆ์Šต๋‹ˆ๋‹ค.

 

๋งŒ์•ฝ ์ƒ์„ฑ์ด ์•ˆ๋œ๋‹ค๋ฉด ์•„๋ž˜์™€ ๊ฐ™์€ ๋ฐฉ๋ฒ•์œผ๋กœ ๋””๋ฒ„๊น…์ด ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค.

 

๊ทธ๋Ÿผ ์ด์ œ ์ƒ์„ฑํ•œ ํŒŒ๋“œ์— ๋“ค์–ด๊ฐ€์„œ Vault ์˜ ์‹œํฌ๋ฆฟ ๋ฐ์ดํ„ฐ๋ฅผ ์ œ๋Œ€๋กœ ๊ฐ€์ ธ์™”๋Š”์ง€ ํ™•์ธํ•ด๋ณด์ฃ !

/vault/secrets ์€ Vault ์—์„œ ์‚ฌ์šฉํ•˜๋Š” ์˜ˆ์•ฝ ๊ฒฝ๋กœ์ด๋ฉฐ, tmpfs ๋กœ ํœ˜๋ฐœ์„ฑ ๋ฐ์ดํ„ฐ๋ฅผ ์ €์žฅํ•ฉ๋‹ˆ๋‹ค. 

์‚ฌ์ด๋“œ์นด ํŒจํ„ด์œผ๋กœ ์ƒ์„ฑ๋˜๋Š” Agent Injector ์ปจํ…Œ์ด๋„ˆ์™€ EmptyDir ๋กœ ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ๊ณต์œ ํ•ฉ๋‹ˆ๋‹ค.

 

Vault ์—์„œ ์‹œํฌ๋ฆฟ ๋ฐ์ดํ„ฐ๋ฅผ ์•ˆ์ „ํ•˜๊ฒŒ ๊ฐ€์ ธ์˜ฌ ๊ฒƒ์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. 

 

์ถ”๊ฐ€์ ์œผ๋กœ ์‚ฌ์ด๋“œ์นด๋กœ ์‹คํ–‰๋˜๋Š” vault-agent ๋„ ํ™•์ธํ•ด๋ณด์ฃ !

 

๊ฐ™์€ ๊ฒฝ๋กœ๋ฅผ ๊ณต์œ ํ•œ๋‹ค๋Š” ์‚ฌ์‹ค์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๊ทธ๋ฆฌ๊ณ  ์ € ๊ฒฝ๋กœ์— ๊ฐ€๋ฉด db-cred ์ •๋ณด๊ฐ€ ์žˆ์ฃ . ์œ„์—์„œ ๋ณธ ํŒŒ์ผ๊ณผ ๊ฐ™์€ ํŒŒ์ผ์ž…๋‹ˆ๋‹ค.

 

K8S ์—์„œ Secret ๋ฅผ ์ƒ์„ฑํ•˜์ง€ ์•Š์•˜๋Š”๋ฐ ๋ฏผ๊ฐํ•œ ๋ฐ์ดํ„ฐ๋ฅผ ๋ถˆ๋Ÿฌ์˜ฌ ์ˆ˜ ์žˆ์ฃ !!
์‹ ๊ธฐํ•˜์ง€ ์•Š๋‚˜์š”? :)

 

API Explorer


์ถ”๊ฐ€์ ์ธ ํŒ์ž…๋‹ˆ๋‹ค.

Vault UI ์—์„œ ํ„ฐ๋ฏธ๋„์„ ํด๋ฆญํ•œ ํ›„ api ๋ฅผ ์‹คํ–‰ํ•˜๋ฉด ์Šค์›จ๊ฑฐ ๊ธฐ๋ฐ˜์œผ๋กœ ๋งŒ๋“ค์–ด์ง„ API ๋ฌธ์„œ์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

 

์ด๊ฒƒ์ €๊ฒƒ ํ™•์ธํ•ด๋ณผ ์ˆ˜ ์žˆ์–ด์„œ ํŽธ๋ฆฌํ•ฉ๋‹ˆ๋‹ค.

 

 

๋งˆ๋ฌด๋ฆฌ


ํ˜„์žฌ Vault ๋ฅผ ๊ณต๋ถ€ํ•˜๊ณ  ์žˆ๋Š”๋ฐ, ์ •๋ง ์œ ์šฉํ•œ ํ”„๋กœ์ ํŠธ์ธ๊ฑฐ ๊ฐ™์•„์š”. ์˜ˆ์ „๋ถ€ํ„ฐ ์ฟ ๋ฒ„๋„คํ‹ฐ์Šค ์‹œํฌ๋ฆฟ ๊ด€๋ฆฌ๊ฐ€ ๋ฌธ์ œ์˜€๊ณ , ์ด๋ฅผ Vault ๋กœ ๊ด€๋ฆฌํ•ด์•ผ์ง€~ ํ–ˆ๋Š”๋ฐ ์ด์ œ์„œ์•ผ ์ง„ํ–‰ํ•˜๊ฒŒ ๋˜๋„ค์š”.

 

AWS EKS Best Practice ๋ฅผ ๋ณด๋ฉด ์‹œํฌ๋ฆฟ์„ ๊ด€๋ฆฌํ•  ๋•Œ Vault ๋ฅผ ์“ฐ๋ผ๊ณ  ๋ช…์‹œ๋˜์–ด ์žˆ์„ ๋งŒํผ ์ฟ ๋ฒ„๋„คํ‹ฐ์Šค ํด๋Ÿฌ์Šคํ„ฐ์— ์žˆ์–ด์„œ ํ•ต์‹ฌ์ ์ธ ์ปดํฌ๋„ŒํŠธ์ž…๋‹ˆ๋‹ค.

 

Vault ์‚ฌ์šฉ์€ Karpenter ๋•Œ์™€ ๋น„์Šทํ•˜๊ฒŒ ๋˜๊ฒŒ ์‹ ์„ ํ•œ ๊ฒฝํ—˜์ด์˜€๊ณ , ์ถฉ๋ถ„ํžˆ ๊นŠ๊ฒŒ ๊ณต๋ถ€ํ• ๋งŒํ•œ ๊ฐ€์น˜๊ฐ€ ์žˆ๋‹ค๊ณ  ์ƒ๊ฐํ•ฉ๋‹ˆ๋‹ค.

 

์œ„์—์„œ ๋ณด์—ฌ๋“œ๋ฆฐ Vault ๋Š” 1% ๋„ ์•ˆ๋˜๋Š” ๊ธฐ๋Šฅ์œผ๋กœ์จ, ์•ž์œผ๋กœ ๋” ์—ด์‹ฌํžˆ Vault ๋ฅผ ๊ณต๋ถ€ํ•ด๋ด์•ผ ๊ฒ ์Šต๋‹ˆ๋‹ค.

 

๊ทธ๋Ÿผ ์˜ค๋Š˜์€ ์—ฌ๊ธฐ๊นŒ์ง€!

profile on loading

Loading...