ã€ã³ãããã¯ã·ã§ã³ Amazon VPC Lattice ã¯ãAWS ãããã¯ãŒã¯ã€ã³ãã©ã¹ãã©ã¯ãã£ã«çŽæ¥çµã¿èŸŒãŸããããã«ãããŒãžããªã¢ããªã±ãŒã·ã§ã³ãããã¯ãŒãã³ã°ãµãŒãã¹ã§ããè€æ°ã®ã¢ã«ãŠã³ããè€æ°ã®ä»®æ³ãã©ã€ããŒãã¯ã©ãŠã (VPC) ã«ãŸãããå
šãŠã®ãµãŒãã¹ã®æ¥ç¶ãã»ãã¥ã¢åãç£èŠã«äœ¿çšã§ããŸãã Amazon Elastic Kubernetes Service ( Amazon EKS ) ã§ã¯ã Kubernetes Gateway API ã®å®è£
ã§ãã AWS Gateway API ã³ã³ãããŒã©ãŒ ãéããŠãAmazon VPC Lattice ã䜿çšã§ããŸããAmazon EKS ã®ã客æ§ã¯ãAmazon VPC Lattice ãçšããããšã§ãã·ã³ãã«ãã€äžè²«æ§ã®ããæ¹æ³ã§ãæšæºç㪠Kubernetes ã®ã»ãã³ãã£ã¯ã¹ã«ããã¯ã©ã¹ã¿ãŒããŸããã æ¥ç¶ãèšå®ã§ããŸãã äžæ¹ã§ãç¹å®ã®ã客æ§ã§ã¯ã¢ããªã±ãŒã·ã§ã³ã¬ã€ã€ãŒã®ã»ãã¥ãªãã£ã匷åããããšããèŠæããããŸãããAmazon VPC Lattice ã®ãã¶ã€ã³ã¯ã»ãã¥ã¢ãã€ããã©ã«ãã§ããããã¯ãã©ã®ãµãŒãã¹ãå
±æãããã®ããã©ã® VPC ã«ã¢ã¯ã»ã¹ãæäŸãããã®ãããæç¢ºã«ããå¿
èŠãããããã§ãã Amazon VPC Lattice 㯠3 ã¬ã€ã€ãŒã®ãã¬ãŒã ã¯ãŒã¯ ãæäŸããŠããããããã¯ãŒã¯ã®è€æ°ã®ã¬ã€ã€ãŒã§å€å±€é²åŸ¡æŠç¥ãå®è£
ã§ããŸãããããã®ã¬ã€ã€ãŒã«ã¯ããµãŒãã¹ãããã¯ãŒã¯ãš VPC ã®é¢é£ä»ããã»ãã¥ãªãã£ã°ã«ãŒãããããã¯ãŒã¯ã¢ã¯ã»ã¹ã³ã³ãããŒã«ãªã¹ã (ACL)ãAWS Identity and Access Management ( AWS IAM ) èªèšŒããªã·ãŒãå«ãŸããAmazon VPC Lattice ãæ§æããããšã§ã»ãã¥ãªãã£ãšã³ã³ãã©ã€ã¢ã³ã¹ã®ç®æšãéæããããšãã§ããŸãã VPC å
ã®ã»ãã¥ãªãã£ã°ã«ãŒãã®ãµãŒãã¹ãããã¯ãŒã¯ãžã®é¢é£ä»ããšèªèšŒããªã·ãŒã¯ãã©ã¡ãããªãã·ã§ã³ã§ããã»ãã¥ãªãã£ã°ã«ãŒããèšå®ããã«ããµãŒãã¹ãããã¯ãŒã¯ã VPC ã«é¢é£ä»ããããšãã§ããŸãããŸããèªèšŒã¿ã€ãã NONE ã«èšå®ããŠãèªèšŒããªã·ãŒã䜿çšããªãããšãã§ããŸãã æ¬èšäºã§ã¯ã3 ã€ç®ã®ã¬ã€ã€ãŒãããªãã¡ãµãŒãã¹ãããã¯ãŒã¯ãšåã
ã®ãµãŒãã¹ã«é©çšã§ãããVPC Lattice ã®èªèšŒããªã·ãŒã«çŠç¹ãåœãŠãŸããéåžžããµãŒãã¹ãããã¯ãŒã¯ã®èªèšŒããªã·ãŒã¯ãããã¯ãŒã¯ç®¡çè
ãããã¯ã¯ã©ãŠã管çè
ã«ãã£ãŠéçšãããç²ãç²åºŠã§ã®èªèšŒãå®è£
ããŸããäŸãã°ãAWS Organizations ã®æå®ããçµç¹ããã®èªèšŒæžã¿ãªã¯ãšã¹ãã®ã¿èš±å¯ããŸããäžæ¹ããµãŒãã¹ã®èªèšŒããªã·ãŒã§ã¯ããµãŒãã¹ã®ãªãŒããŒã¯ãããã¯ãŒã¯ç®¡çè
ãã¯ã©ãŠã管çè
ããµãŒãã¹ãããã¯ãŒã¯ã®ã¬ãã«ã§é©çšããç²ãç²åºŠã§ã®èªèšŒã«ãŒã«ãããå¶éã®å³ããããã现ãããªå¶åŸ¡ãèšå®ã§ããŸããèªèšŒããªã·ãŒã䜿çšããããšã§ãã客æ§ã¯ã¢ããªã±ãŒã·ã§ã³ã®ã³ãŒãã倿Žããããšãªãã 誰ããã©ã®ãµãŒãã¹ã«å¯ŸããŠãã©ã®ã¢ã¯ã·ã§ã³ãå®è¡ã§ããã ãå®çŸ©ããããšãã§ããŸãã æã
ã®å®è£
ã§ã¯ã以äžã®æ¹æ³ã瀺ããŸãã Amazon VPC Lattice ãµãŒãã¹ãããã¯ãŒã¯ãš Amazon EKS ãæ§ç¯ããAmazon VPC Lattice ãµãŒãã¹ã®èªèšŒããªã·ãŒãæå¹ã«ããŸãã Amazon EKS ãš Amazon VPC Lattice ã§ã®ãµã€ãã«ãŒãã¿ãŒã³ãš Init ã³ã³ãããã¿ãŒã³ãçšããŠããµãŒãã¹ã®åŒã³åºãå
ã AWS IAM èªèšŒã§ Amazon VPC Lattice ãµãŒãã¹ã«å¯ŸããŠã® HTTP ãªã¯ãšã¹ãã®çæãèªåçã«ãããªããããã«ãããœãªã¥ãŒã·ã§ã³ãæ§ç¯ããŸããåŒã³åºãå
ã®ã¢ããªã±ãŒã·ã§ã³ã®ãœãŒã¹ã³ãŒãã®å€æŽã¯å¿
èŠãããŸããã ãµãŒãã¹ã®åŒã³åºãå
ã Amazon VPC Lattice ãµãŒãã¹ãããã¯ãŒã¯å
ã®è€æ°ã®ãµãŒãã¹ã«æ¥ç¶ã§ããããšã確èªããŸãã ãœãªã¥ãŒã·ã§ã³æŠèŠ Amazon VPC Lattice 㯠AWS IAM ãšçµ±åãããã客æ§ç¬èªã®ãµãŒãã¹ééä¿¡ã®ããã«ãçŸåš AWS ãµãŒãã¹ãšããåãããæã«æ
£ã芪ããã§ããã®ãšåæ§ã®èªèšŒã»èªå¯ã®æ©èœãæäŸããŸãã ãµãŒãã¹ã®ã¢ã¯ã»ã¹å¶åŸ¡ãèšå®ããããã«ãã¢ã¯ã»ã¹ããªã·ãŒã䜿çšã§ããŸããã¢ã¯ã»ã¹ããªã·ãŒã¯ããµãŒãã¹ãããã¯ãŒã¯ãšåã
ã®ãµãŒãã¹ã«é¢é£ä»ããããšãã§ãã AWS IAM ãªãœãŒã¹ããªã·ãŒã§ããã¢ã¯ã»ã¹ããªã·ãŒã§ã¯ãPARC (PrincipalãActionãResourceãCondition) ã¢ãã«ã䜿çšããŠããµãŒãã¹ã®ã³ã³ããã¹ãåºæã®ã¢ã¯ã»ã¹å¶åŸ¡ãé©çšã§ããŸããäŸãã°ãææãããµãŒãã¹ã«å¯ŸããŠã¢ã¯ã»ã¹å¯èœãªãµãŒãã¹ãå®çŸ©ããããã«ãã¢ã¯ã»ã¹ããªã·ãŒã䜿çšã§ããŸãã Amazon VPC Lattice ã¯ã¯ã©ã€ã¢ã³ãèªèšŒã« AWS Signature Version 4 (SigV4) ã䜿çšããŸããAmazon VPC Lattice ã®ãµãŒãã¹ã§èªèšŒããªã·ãŒãæå¹åããåŸã«ã眲åä»ã Authorization ããããŒã x-amz-content-sha256 ã x-amz-date ã x-amz-security-token ã HTTP ãªã¯ãšã¹ãã«å«ãŸããããããµãŒãã¹ãåŒã³åºãåŽã倿Žããå¿
èŠããããŸããAWS SigV4 ã®è©³çŽ°ã¯ ãã¡ã ãåç
§ããŠãã ããã Amazon VPC Lattice ãµãŒãã¹ãžã®ãªã¯ãšã¹ãã«çœ²åããããã«ãã客æ§ã«ã¯ä»¥äžã®éžæè¢ããããŸãã AWS SDK ãçšããŠã察å¿ããããã°ã©ãã³ã°èšèªã§ãªã¯ãšã¹ãã«çœ²åããŸãããã®ãœãªã¥ãŒã·ã§ã³ã¯ããã©ãŒãã³ã¹ãæé©åãããŸãããã¢ããªã±ãŒã·ã§ã³éçºè
ã«ããã³ãŒãã®å€æŽãå¿
èŠãšããŸããå®è£
ã«ã€ããŠã¯ Amazon VPC Lattice ã®ããã¥ã¡ã³ã ãåç
§ããŠãã ããã AWS SIGv4 ãããã·ã¢ãããã·ã§ã³ã³ã³ãããŒã©ãŒã掻çšãã AWS SIGv4 ãããã· ãçšã㊠HTTP ãªã¯ãšã¹ãããã©ã¯ãŒãããAWS Sigv4 ããããŒã远å ããŸãã詳现ã«ã€ããŠã¯ããã¡ãã® èš äº ãåç
§ããŠãã ãããããããäžèšã®ãœãªã¥ãŒã·ã§ã³ã«ã¯ 1 ã€ã®å¶éããããŸããAWS SIGv4 ãããã·ã¢ãããã·ã§ã³ã³ã³ãããŒã©ãŒã䜿çšããå Žåãåäžã®ãã¹ããããµããŒããããŸããã ãµã³ãã«ã®ãããã§ã¹ã ã§ã¯ãããã³ããšã³ãã®ã³ã³ãã㯠localhost:8005 ã«ãªã¯ãšã¹ããããŠããŠãHost ããããŒã¯ sidecar.aws.signing-proxy/host Annotations ã§éçã«å®çŸ©ããã datastore-lambda.sarathy.io ã«çœ®ãæããããŠããããšãããããŸããèšãæãããšãåŒã³åºãå
ã®ãµãŒãã¹ã¯åäžã® Amazon VPC Lattice ãµãŒãã¹ã«ã®ã¿æ¥ç¶ã§ããŸããã¯ã©ã€ã¢ã³ããè€æ°ã® Amazon VPC Lattice ãµãŒãã¹ã«æ¥ç¶ããå Žåã«ã課é¡ãšãªããŸãã ãã®èšäºã§ã¯ãå®å
šã«ééçã«è€æ°ã® Amazon VPC Lattice ãµãŒãã¹ã«å¯Ÿããæ¥ç¶ããµããŒããããæé©åããããœãªã¥ãŒã·ã§ã³ã玹ä»ããŸãã ã¯ããã«ãKubernetes ã® Pod ã« Init ã³ã³ãããšãµã€ãã«ãŒã³ã³ãããå°å
¥ããŸãã Init ã³ã³ããïŒ iptables ãå®è¡ããããŒã 8080 ããªãã¹ã³ãã AWS SigV4 ãããã·ãã Amazon VPC Lattice ãµãŒãã¹ãžã®ãã©ãã£ãã¯ãã€ã³ã¿ãŒã»ããããŸãã SigV4 ãããã·ïŒ --name vpc-lattice-svcs, --unsigned-payload ãã©ã°ãšãã®ã³ã°ã®ãªãã·ã§ã³ãå«ã args ãæå®ããŠå®è¡ããŸãããããã·ã³ã³ãã㯠AWS IAM roles for service accounts (IRSA) ã«ãã£ãŠååŸãããèªèšŒæ
å ±ã䜿çšããŠãèªåçã«ãªã¯ãšã¹ãã«çœ²åããŸãã æ¬¡ã«ãInit ã³ã³ãããšãµã€ãã«ãŒã³ã³ãããèªåçã«æ³šå
¥ããŸããéçºããŒã ãæ¢åã® Kubernetes ãããã§ã¹ãã«å€æŽãå ããªãããã«ããããã§ããããªã·ãŒãšã³ãžã³ãšã㊠Kyverno ã䜿çšããŸããKyverno 㯠Kubernetes ã®ããã«èšèšãããŠãããKubernetes ã¯ã©ã¹ã¿ãŒå
ã§ Dynamic Admission Controller ãšããŠåäœããŸãããã®å ŽåãKyverno 㯠Kubernetes API ãµãŒããŒãã Mutating Admission Webhook ã® HTTP ã³ãŒã«ããã¯ãåãåãããããããããªã·ãŒãé©çšããŠãAdmission Policy ã匷å¶ããçµæãè¿ããŸããèšãæãããšãKyverno 㯠Init ã³ã³ãããšãµã€ãã«ãŒã³ã³ãããã³ãŒãã£ã³ã°ãå¿
é ãšããã«èªåçã«æ³šå
¥ããããšãã§ããŸãã ãŠã©ãŒã¯ã¹ã«ãŒ Amazon EKS ã«ããã Amazon VPC Lattice ãšèªèšŒããªã·ãŒ åææ¡ä»¶ 管çè
æš©éãæã€ AWS ã¢ã«ãŠã³ã AWS Command Line Interface ( AWS CLI )ã kubectl ã eksctl ã Git ã®ã€ã³ã¹ããŒã« Amazon EKS ã¯ã©ã¹ã¿ãŒãš Amazon VPC Lattice ãµãŒãã¹ã®æºå ãœãªã¥ãŒã·ã§ã³ããã¹ãããããã®ç°å¢ãæºåããå¿
èŠããããŸãã Amazon EKS ã¯ã©ã¹ã¿ãŒã®äœæãšãAmazon VPC Lattice ã®ããã® Gateway API ã³ã³ãããŒã©ãŒã®ã€ã³ã¹ããŒã« Kyverno ã®ã€ã³ã¹ããŒã« ãµã³ãã« httpbin ã¢ããªã±ãŒã·ã§ã³ã Amazon VPC Lattice ãµãŒãã¹ãšããŠãããã€ãã 以äžã®ã³ãã³ãã䜿çšããŠãhttpbin ã Amazon VPC Lattice ãµãŒãã¹ãšããŠãããã€ããŸãã git clone https://github.com/aws/aws-application-networking-k8s.git cd aws-application-networking-k8s/examples ## Create the GatewayClass, Gateway, HTTPRoute, Service and Deployment objects kubectl apply -f gatewayclass.yaml kubectl apply -f my-hotel-gateway.yaml kubectl apply -f httpbin.yaml kubectl apply -f httpbin-route.yaml ## Create another VPC Lattice Service (HTTPRoute), Service and Deployment object cat << EOF > another-httpbin.yaml apiVersion: apps/v1 kind: Deployment metadata: name: another-httpbin labels: app: another-httpbin spec: replicas: 1 selector: matchLabels: app: another-httpbin template: metadata: labels: app: another-httpbin spec: containers: - name: httpbin image: mccutchen/go-httpbin --- apiVersion: v1 kind: Service metadata: name: another-httpbin spec: selector: app: another-httpbin ports: - protocol: TCP port: 80 targetPort: 8080 EOF cat << EOF > another-httpbin-route.yaml apiVersion: gateway.networking.k8s.io/v1beta1 kind: HTTPRoute metadata: name: another-httpbin spec: parentRefs: - name: my-hotel sectionName: http rules: - backendRefs: - name: another-httpbin kind: Service port: 80 EOF ## Another VPC Lattice Service kubectl apply -f another-httpbin.yaml kubectl apply -f another-httpbin-route.yaml Bash ãµãŒãã¹ãããã¯ãŒã¯ã®ä¿è· ãã®æ©èœãå®èšŒããããã«ã httpbin ãµãŒãã¹ã«èªèšŒããªã·ãŒãé©çšããèªèšŒãããã¢ã¯ã»ã¹ã®ã¿ãèš±å¯ããŸãã ããã¥ã¡ã³ã ãåç
§ããããšã§ãç²åºŠã®çްããããªã·ãŒãå®çŸ©ã§ããŸãã AWS ã³ã³ãœãŒã«ã® VPC ã»ã¯ã·ã§ã³ã«ç§»åãã VPC Lattice ã®äžã® Services ãå³ãã€ã³ã® httpbin-default ãµãŒãã¹ãéžæããŸãã æ¬¡ã®ããŒãžã§ Access ã¿ãã® Edit access settings ãéžæããŸãã 衚瀺ããã Service access ç»é¢ã§ã AWS IAM ãã Apply policy template > Allow only authenticated access ãéžæããŸããæ¬¡ã« Save changes ãéžæããŸãã ããã§ããµãŒãã¹ã AWS IAM èªèšŒãå¿
èŠãšããããã§ãªããã° HTTP 403 Forbidden ãšã©ãŒãè¿ããã瀺ããã¹ãã宿œããŸãã kubectl run curl --image alpine/curl -ti -- /bin/sh curl -v http://httpbin-default-09ff9bb5d43b72048.7d67968.vpc-lattice-svcs.us-west-2.on.aws * Trying 169.254 .171.32:80 .. . * Connected to httpbin-default-09ff9bb5d43b72048.7d67968.vpc-lattice-svcs.us-west-2.on.aws ( 169.254 .171.32 ) port 80 ( #0) > GET / HTTP/1.1 > Host: httpbin-default-09ff9bb5d43b72048.7d67968.vpc-lattice-svcs.us-west-2.on.aws > User-Agent: curl/8.0.1 > Accept: / < HTTP/1.1 403 Forbidden < content-length: 253 < content-type: text/plain < date: Mon, 31 Jul 2023 07:24:10 GMT < * Connection #0 to host httpbin-default-09ff9bb5d43b72048.7d67968.vpc-lattice-svcs.us-west-2.on.aws left intact AccessDeniedException: User: anonymous is not authorized to perform: vpc-lattice-svcs:Invoke on resource: arn:aws:vpc-lattice:us-west-2:091550601287:service/svc-09ff9bb5d43b72048/ because no service-based policy allows the vpc-lattice-svcs:Invoke action # Bash åŒã³åºãå
ã®ã¢ããªã±ãŒã·ã§ã³ã®ããã〠ããã§ãAWS IAM roles for service accounts (IRSA) ã䜿çšãããããããã·ãæ§æãããããã·ããªã¯ãšã¹ãã«çœ²åããããã« AWS IAM ããŒã«ã®èªèšŒæ
å ±ã䜿çšã§ããããã«ããŸããã¢ã€ãã³ãã£ãã£ããŒã¹ã®ããªã·ãŒã§ãã VPCLatticeServicesInvokeAccess ã AWS IAM ããŒã«ã«ã¢ã¿ããããããšã§ãAmazon VPC Lattice ãµãŒãã¹ãåŒã³åºãæš©éãããŒã«ã«ä»äžã§ããŸãã Service Account çšã® IAM ããŒã«ã®äœæ export CLUSTER_NAME = my-cluster export NAMESPACE = default export SERVICE_ACCOUNT = default eksctl create iamserviceaccount \ --cluster = $CLUSTER_NAME \ --namespace = $NAMESPACE \ --name = $SERVICE_ACCOUNT \ --attach-policy-arn = arn:aws:iam::aws:policy/VPCLatticeServicesInvokeAccess \ --override-existing-serviceaccounts \ --approve Bash æºåãå®äºãããããããã·ã³ã³ãããšäžç·ã«ãµãŒãã¹ãåŒã³åºãã¢ããªã±ãŒã·ã§ã³ãæºåããŸãããããã·ã³ã³ããã¯ããŒã 8080 ããªãã¹ã³ãããŠãŒã¶ãŒ ID 101 ãšããŠå®è¡ããŸããYAML ã¹ããããã¯ä»¥äžã®ãšããã§ãã - name : sigv4proxy image : public.ecr.aws/aws - observability/aws - sigv4 - proxy : latest args : [ "--unsigned-payload" , "--log-failed-requests" , "-v" , "--log-signing-process" , "--name" , "vpc-lattice-svcs" , "--region" , "us-west-2" , "--upstream-url-scheme" , "http" ] ports : - containerPort : 8080 name : proxy protocol : TCP securityContext : runAsUser : 101 YAML ããã§ã¯ãã¡ã€ã³ã®ã¢ããªã±ãŒã·ã§ã³ããã®ãã©ãã£ãã¯ãã€ã³ã¿ãŒã»ãããã iptables ãŠãŒããªãã£ã䜿ã£ãŠ Amazon VPC Lattice CIDR 169.254.171.0/24 ã«æ¥ç¶ãããã©ãã£ãã¯ã EGRESS_PROXY ãã§ãŒã³ã«ã«ãŒãã£ã³ã°ããããŒã«ã«ã®ããŒã 8080 ã«ãªãã€ã¬ã¯ãããŠããŸãããããã·ã³ã³ããã«ãã£ãŠãã©ãã£ãã¯ãéä¿¡ãããéã®ç¡éã«ãŒããé¿ãããããUID ã 101 ãã©ããããã§ãã¯ããããšã§èå¥ããå床ãªãã€ã¬ã¯ããããªãããã«ããŠããŸãã initContainers : # IPTables rules are updated in init container - image : public.ecr.aws/d2c6w7a3/iptables name : iptables - init securityContext : capabilities : add : - NET_ADMIN command : # Adding --uid-owner 101 here to prevent traffic from envoy proxy itself from being redirected, which prevents an infinite loop - /bin/sh - - c - > iptables -t nat -N EGRESS_PROXY; iptables -t nat -A OUTPUT -p tcp -d 169.254.171.0/24 -j EGRESS_PROXY; iptables -t nat -A EGRESS_PROXY -m owner --uid-owner 101 -j RETURN; iptables -t nat -A EGRESS_PROXY -p tcp -j REDIRECT --to-ports 8080; YAML ã³ã³ããã€ã¡ãŒãž public.ecr.aws/d2c6w7a3/iptables ã¯ãã·ã³ãã«ã« iptables ãã€ã³ã¹ããŒã«ããã Ubuntu Linux ãã£ã¹ããªãã¥ãŒã·ã§ã³ã®ããŒã¹ã€ã¡ãŒãžã§ãã FROM ubuntu:focal RUN apt update && apt install -y iptables Bash å®å
šãª YAML ãããã§ã¹ãã¯ä»¥äžã®ããã«ãªããŸãã apiVersion: apps/v1 kind: Deployment metadata: name: client-app labels: app: client-app spec: replicas: 1 selector: matchLabels: app: client-app template: metadata: labels: app: client-app spec: serviceAccountName: default initContainers: # IPTables rules are updated in init container - image: public.ecr.aws/d2c6w7a3/iptables name: iptables-init securityContext: capabilities: add: - NET_ADMIN command: # Adding --uid-owner 101 here to prevent traffic from aws-sigv4-proxy proxy itself from being redirected, which prevents an infinite loop - /bin/sh - -c - > iptables -t nat -N EGRESS_PROXY ; iptables -t nat -A OUTPUT -p tcp -d 169.254 .171.0/24 -j EGRESS_PROXY ; iptables -t nat -A EGRESS_PROXY -m owner --uid-owner 101 -j RETURN ; iptables -t nat -A EGRESS_PROXY -p tcp -j REDIRECT --to-ports 8080 ; containers: - name: app image: alpine/curl command: [ "/bin/sh" , "-c" , "sleep infinity" ] - name: sigv4proxy image: public.ecr.aws/aws-observability/aws-sigv4-proxy:latest args: [ "--unsigned-payload" , "--log-failed-requests" , "-v" , "--log-signing-process" , "--name" , "vpc-lattice-svcs" , "--region" , "us-west-2" , "--upstream-url-scheme" , "http" ] ports: - containerPort: 8080 name: proxy protocol: TCP securityContext: runAsUser: 101 Bash curl ãå®è¡ããããšã§ã/get ã®ã¬ã¹ãã³ã¹ã衚瀺ãããŸããã¬ã¹ãã³ã¹ã¯ HTTP 200 OK ã§ãã â kubectl get gateway -o yaml | yq '.items[0].status.addresses[].value' another-httpbin-default-03422a15c25e5fca4.7d67968.vpc-lattice-svcs.us-west-2.on.aws httpbin-default-09ff9bb5d43b72048.7d67968.vpc-lattice-svcs.us-west-2.on.aws â VPC_LATTICE_SERVICE_ENDPOINT = http://httpbin-default-09ff9bb5d43b72048.7d67968.vpc-lattice-svcs.us-west-2.on.aws/get â kubectl exec -c app -ti deploy/client-app -- curl $VPC_LATTICE_SERVICE_ENDPOINT { "args" : { } , "headers" : { "Accept" : "*/*" , "Accept-Encoding" : "gzip" , "Host" : "httpbin-default-09ff9bb5d43b72048.7d67968.vpc-lattice-svcs.us-west-2.on.aws" , "User-Agent" : "curl/8.0.1" , "X-Amz-Content-Sha256" : "UNSIGNED-PAYLOAD" , "X-Amzn-Source-Vpc" : "vpc-027db8599a32b83e2" } , "origin" : "192.168.46.245" , "url" : "http://httpbin-default-09ff9bb5d43b72048.7d67968.vpc-lattice-svcs.us-west-2.on.aws/get" } Bash ãããã·ã³ã³ããã®ãã°ã確èªããããšã§ãããããŒããããã·ã«ãã£ãŠè¿œå ãããããšã確èªã§ããŸãã Authorization ããããŒãšã x-amz-content-sha256 ã x-amz-date ã x-amz-security-token ãšãã£ãããããŒããªã¯ãšã¹ãã«è¿œå ãããŠããŸãã â kubectl logs deploy/vpc-lattice-client -c sigv4proxy time = "2023-08-07T10:14:59Z" level = debug msg = "signed request" region = us-west-2 service = vpc-lattice-svcs time = "2023-08-07T10:14:59Z" level = debug msg = "proxying request" request = "GET /get HTTP/1.1 \r \n Host: httpbin-default-09ff9bb5d43b72048.7d67968.vpc-lattice-svcs.us-west-2.on.aws \r \n Accept: */* \r \n Authorization: AWS4-HMAC-SHA256 Credential=ASIARKUGXKBDQVWU6BFX/20230807/us-west-2/vpc-lattice-svcs/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token, Signature=<redacted> \r \n User-Agent: curl/8.0.1 \r \n X-Amz-Content-Sha256: UNSIGNED-PAYLOAD \r \n X-Amz-Date: 20230807T101459Z \r \n X-Amz-Security-Token: IQoJb3JpZ2luX2VjEMr//////////<redacted>== \r \n \r \n " Bash ããã§ã¯ã VPC_LATTICE_SERVICE_ENDPOINT ã 2 ã€ç®ã®ãã¹ãåã«çœ®ãæããããšãã§ããŸããã¢ããªã±ãŒã·ã§ã³ã³ãŒãã®å€æŽã¯å¿
èŠãšããªãã®ã§ãè€æ°ã® Amazon VPC Lattice ãµãŒãã¹ã«æ¥ç¶ããããšãã§ããŸãã â VPC_LATTICE_SERVICE_ENDPOINT = http://another-httpbin-default-03422a15c25e5fca4.7d67968.vpc-lattice-svcs.us-west-2.on.aws/get â kubectl exec -c app -ti deploy/client-app -- curl $VPC_LATTICE_SERVICE_ENDPOINT { "args" : { } , "headers" : { "Accept" : "*/*" , "Accept-Encoding" : "gzip" , "Host" : "another-httpbin-default-03422a15c25e5fca4.7d67968.vpc-lattice-svcs.us-west-2.on.aws" , "User-Agent" : "curl/8.0.1" , "X-Amz-Content-Sha256" : "UNSIGNED-PAYLOAD" , "X-Amzn-Source-Vpc" : "vpc-027db8599a32b83e2" } , "origin" : "192.168.32.152" , "url" : "http://another-httpbin-default-03422a15c25e5fca4.7d67968.vpc-lattice-svcs.us-west-2.on.aws/get" } Bash Kyverno ã䜿ã£ãŠãInit ã³ã³ãããšãµã€ãã«ãŒã³ã³ãããèªåã§æ³šå
¥ãã ããã§ãKyverno ãæŽ»çšããŠãInit ã³ã³ãããšãµã€ãã«ãŒã³ã³ãããèªåã§æ³šå
¥ããããã«ããŸããKyverno ãã€ã³ã¹ããŒã«ãããã¯ã©ã¹ã¿ãŒã§ã¯ã泚å
¥ããããã® ClusterPolicy ãæžãããšãã§ããŸããDeployment ãªããžã§ã¯ãã« vpc-lattices-svcs.amazonaws.com/agent-inject ã true ã§ããã¢ãããŒã·ã§ã³ãèšå®ããããšãDeployment ã« Init ã³ã³ãããšãµã€ãã«ãŒã³ã³ãããæ³šå
¥ãããŸãã ç°å¢å€æ° AWS_REGION ãæå®ããå¿
èŠããããŸãã apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: inject-sidecar annotations: policies.kyverno.io/title: Inject Sidecar Container spec: rules: - name: inject-sidecar match: any: - resources: kinds: - Deployment mutate: patchStrategicMerge: spec: template: metadata: annotations: ( vpc-lattices-svcs.amazonaws.com/agent-inject ) : "true" spec: initContainers: # IPTables rules are updated in init container - image: public.ecr.aws/d2c6w7a3/iptables name: iptables-init securityContext: capabilities: add: - NET_ADMIN command: # Adding --uid-owner 101 here to prevent traffic from envoy proxy itself from being redirected, which prevents an infinite loop - /bin/sh - -c - > iptables -t nat -N EGRESS_PROXY ; iptables -t nat -A OUTPUT -p tcp -d 169.254 .171.0/24 -j EGRESS_PROXY ; iptables -t nat -A EGRESS_PROXY -m owner --uid-owner 101 -j RETURN ; iptables -t nat -A EGRESS_PROXY -p tcp -j REDIRECT --to-ports 8080 ; containers: - name: sigv4proxy env: - name: AWS_REGION value: "us-west-2" image: public.ecr.aws/aws-observability/aws-sigv4-proxy:latest args: [ "--unsigned-payload" , "--log-failed-requests" , "-v" , "--log-signing-process" , "--name" , "vpc-lattice-svcs" , "--region" , \ $( AWS_REGION ) , "--upstream-url-scheme" , "http" ] ports: - containerPort: 8080 name: proxy protocol: TCP securityContext: runAsUser: 101 Bash ãã®ã¢ãããŒãã§ã¯ãKubernetes Deployment ã® YAML ã« vpc-lattices-svcs.amazonaws.com/agent-inject: "true" ãæå®ãããšãDeployment ã« Init ã³ã³ãããšãµã€ãã«ãŒã³ã³ãããæ³šå
¥ãããŸãã ã¯ã©ã€ã¢ã³ãã® YAML ã¯ä»¥äžã§ãã apiVersion: apps/v1 kind: Deployment metadata: name: vpc-lattice-client labels: app: vpc-lattice-client spec: replicas: 1 selector: matchLabels: app: vpc-lattice-client template: metadata: labels: app: vpc-lattice-client annotations: vpc-lattices-svcs.amazonaws.com/agent-inject: "true" spec: serviceAccountName: default containers: - name: app image: alpine:curl command: [ "/bin/sh" , "-c" , "sleep infinity" ] Bash ãµã€ãã«ãŒã¯èªåçã«æ³šå
¥ãããŸãã â kubectl describe deploy vpc-lattice-client Name: vpc-lattice-client Namespace: default CreationTimestamp: Thu, 20 Jul 2023 11 :01:32 +0800 Labels: app = vpc-lattice-client Annotations: deployment.kubernetes.io/revision: 1 policies.kyverno.io/last-applied-patches: inject-sidecar.inject-sidecar.kyverno.io: added /spec/template/spec/containers/0 .. . Bash ããããåœãã£ã YAML ãããã§ã¹ãã¯ä»¥äžã®ããã«ãªããŸãã â kubectl get deploy vpc-lattice-client -o yaml apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" kubectl.kubernetes.io/last-applied-configuration: | { "apiVersion" : "apps/v1" , "kind" : "Deployment" , "metadata" : { "annotations" : { } , "labels" : { "app" : "vpc-lattice-client" } , "name" : "vpc-lattice-client" , "namespace" : "default" } , "spec" : { "replicas" :1, "selector" : { "matchLabels" : { "app" : "vpc-lattice-client" } } , "template" : { "metadata" : { "annotations" : { "vpc-lattices-svcs.amazonaws.com/agent-inject" : "true" } , "labels" : { "app" : "vpc-lattice-client" } } , "spec" : { "containers" : [ { "command" : [ "/bin/sh" , "-c" , "sleep infinity" ] , "env" : [ { "name" : "HTTP_PROXY" , "value" : "localhost:8080" } ] , "image" : "nicolaka/netshoot" , "name" : "app" } ] , "serviceAccountName" : "default" } } } } policies.kyverno.io/last-applied-patches: | inject-sidecar.inject-sidecar.kyverno.io: added /spec/template/spec/containers/0 creationTimestamp: "2023-07-20T03:01: labels: app: vpc-lattice-client name: vpc-lattice-client namespace: default spec: selector: matchLabels: app: vpc-lattice-client template: metadata: annotations: vpc-lattices-svcs.amazonaws.com/agent-inject: " true" creationTimestamp: null labels: app: vpc-lattice-client spec: containers: - args: - --unsigned-payload - --log-failed-requests - -v - --log-signing-process - --name - vpc-lattice-svcs - --region - $( AWS_REGION ) - --upstream-url-scheme - http env: - name: AWS_REGION value: us-west-2 image: public.ecr.aws/aws-observability/aws-sigv4-proxy:latest imagePullPolicy: Always name: sigv4proxy ports: - containerPort: 8080 name: proxy protocol: TCP resources: { } securityContext: runAsUser: 101 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File - command: - /bin/sh - -c - sleep infinity image: alpine:curl imagePullPolicy: Always name: app initContainers: - command: - /bin/sh - -c - | iptables -t nat -N EGRESS_PROXY ; iptables -t nat -A OUTPUT -p tcp -d 169.254 .171.0/24 -j EGRESS_PROXY ; iptables -t nat -A EGRESS_PROXY -m owner --uid-owner 101 -j RETURN ; iptables -t nat -A EGRESS_PROXY -p tcp -j REDIRECT --to-ports 8080 ; image: public.ecr.aws/d2c6w7a3/iptables name: iptables-init securityContext: capabilities: add: - NET_ADMIN .. . Bash ãŸããã¯ã©ã€ã¢ã³ãã Amazon VPC Lattice ãµãŒãã¹ã«æ£åžžã«ã¢ã¯ã»ã¹ã§ããããšã確èªã§ããŸãã ⯠VPC_LATTICE_SERVICE_ENDPOINT = http://httpbin-default-09ff9bb5d43b72048.7d67968.vpc-lattice-svcs.us-west-2.on.aws/get kubectl exec -c app -ti deploy/vpc-lattice-client -- curl $VPC_LATTICE_SERVICE_ENDPOINT { "args" : { } , "headers" : { "Accept" : "*/*" , "Accept-Encoding" : "gzip" , "Host" : "httpbin-default-09ff9bb5d43b72048.7d67968.vpc-lattice-svcs.us-west-2.on.aws" , "User-Agent" : "curl/8.0.1" , "X-Amz-Content-Sha256" : "UNSIGNED-PAYLOAD" , "X-Amzn-Source-Vpc" : "vpc-027db8599a32b83e2" } , "origin" : "192.168.32.152" , "url" : "http://httpbin-default-09ff9bb5d43b72048.7d67968.vpc-lattice-svcs.us-west-2.on.aws/get" } Bash ã¯ãªãŒã³ã¢ãã å°æ¥çãªèª²éãé¿ããããã以äžã®ã³ãã³ãã䜿çšã㊠Amazon VPC Lattice ãªãœãŒã¹ãš Amazon EKS ã¯ã©ã¹ã¿ãŒãå«ããå
šãŠã®ãªãœãŒã¹ãåé€ããŸãã kubectl delete -f httpbin.yaml kubectl delete -f httpbin-route.yaml kubectl delete -f another-httpbin.yaml kubectl delete -f another-httpbin-route.yaml kubectl delete -f my-hotel-gateway.yaml kubectl delete -f gatewayclass.yaml eksctl delete cluster -f $CLUSTER_CONFIG Bash ãŸãšã ãã®èšäºã§ã¯ãAmazon VPC Lattice ã« AWS IAM èªèšŒãå®è£
ããæ¹æ³ãã以äžã®ãããªãœãªã¥ãŒã·ã§ã³ãçšããŠç޹ä»ããŸããã Init ã³ã³ããã䜿ã£ãŠ iptables ã³ãã³ããå®è¡ããVPC Lattice ãžã®ãã©ãã£ãã¯ãã€ã³ã¿ãŒã»ããããã Kyverno ãçšã㊠Init ã³ã³ãããšãµã€ãã«ãŒã³ã³ãããèªåçã«æ³šå
¥ããã åŒã³åºãå
ã®ãµãŒãã¹ã¯ãVPC Lattice ãµãŒãã¹ãããã¯ãŒã¯å
ã® IAM èªèšŒã§è€æ°ã®ãµãŒãã¹ã«æ¥ç¶ã§ããããã«ãªãã VPC Lattice ãããŒã¹ã«ãœãªã¥ãŒã·ã§ã³ãæ§ç¯ããVPC Lattice ã® IAM èªèšŒã掻çšããŠã»ãã¥ãªãã£äœå¶ã匷åãããå Žåã«ãæ¬ããã°ã§å
±æããå
容ãã圹ã«ç«ãŠã°å¬ããã§ããAmazon VPC Lattice ã®è©³çްã«ã€ããŠã¯ã ããã¥ã¡ã³ã ããã®ä»ã® ããã° ãåç
§ããŠãã ããã 翻蚳ã¯ãœãªã¥ãŒã·ã§ã³ã¢ãŒããã¯ãã®åŸè€ãæ
åœããŸãããåæã¯ ãã¡ã ã§ãã