calofmijuck/blog
1
0
Fork 0
mirror of https://github.com/calofmijuck/blog.git synced 2025-12-06 22:53:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: reorganize all image files and linted documents (#80)

Browse Source 
* [PUBLISHER] upload files #62

* [PUBLISHER] upload files #63

* [PUBLISHER] upload files #64

* [PUBLISHER] upload files #65

* [PUBLISHER] upload files #66

* [PUBLISHER] upload files #67

* PUSH NOTE : test-document.md

* PUSH NOTE : 09. Lp Functions.md

* PUSH ATTACHMENT : mt-09.png

* PUSH NOTE : 03. Measure Spaces.md

* PUSH ATTACHMENT : mt-03.png

* PUSH NOTE : 08. Comparison with the Riemann Integral.md

* PUSH ATTACHMENT : mt-08.png

* PUSH NOTE : 07. Dominated Convergence Theorem.md

* PUSH ATTACHMENT : mt-07.png

* PUSH NOTE : 06. Convergence Theorems.md

* PUSH ATTACHMENT : mt-06.png

* PUSH NOTE : 05. Lebesgue Integration.md

* PUSH ATTACHMENT : mt-05.png

* PUSH NOTE : test-document.md

* [PUBLISHER] upload files #68

* [PUBLISHER] upload files #69

* PUSH NOTE : 08. Comparison with the Riemann Integral.md

* PUSH ATTACHMENT : mt-08.png

* PUSH NOTE : 02. Construction of Measure.md

* PUSH ATTACHMENT : mt-02.png

* DELETE FILE : _posts/2023-09-09-test-document.md

* DELETE FILE : _posts/Mathematics/Measure Theory/2023-09-09-test-document.md

* [PUBLISHER] upload files #70

* PUSH NOTE : Rules of Inference with Coq.md

* PUSH NOTE : 수학 공부에 대한 고찰.md

* PUSH NOTE : 04. Measurable Functions.md

* PUSH ATTACHMENT : mt-04.png

* PUSH NOTE : 07. Dominated Convergence Theorem.md

* PUSH ATTACHMENT : mt-07.png

* PUSH NOTE : 08. Comparison with the Riemann Integral.md

* PUSH ATTACHMENT : mt-08.png

* PUSH NOTE : 05. Lebesgue Integration.md

* PUSH ATTACHMENT : mt-05.png

* PUSH NOTE : 03. Measure Spaces.md

* PUSH ATTACHMENT : mt-03.png

* PUSH NOTE : 09. Lp Functions.md

* PUSH ATTACHMENT : mt-09.png

* PUSH NOTE : 06. Convergence Theorems.md

* PUSH ATTACHMENT : mt-06.png

* PUSH NOTE : 02. Construction of Measure.md

* PUSH ATTACHMENT : mt-02.png

* PUSH NOTE : 01. Algebra of Sets and Set Functions.md

* PUSH ATTACHMENT : mt-01.png

* PUSH NOTE : 블로그 이주 이야기.md

* PUSH ATTACHMENT : blog-logo.png

* PUSH ATTACHMENT : github-publisher.png

* PUSH NOTE : 05. Services - Enabling Clients to Discover and Talk to Pods.md

* PUSH ATTACHMENT : k8s-05.jpeg

* PUSH NOTE : 18. Extending Kubernetes.md

* PUSH ATTACHMENT : k8s-18.jpeg

* PUSH NOTE : 11. Understanding Kubernetes Internals.md

* PUSH ATTACHMENT : k8s-11.jpeg

* PUSH NOTE : 04. Replication and Other Controllers - Deploying Managed Pods.md

* PUSH ATTACHMENT : k8s-04.jpeg

* PUSH NOTE : 10. StatefulSets - Deploying Replicated Stateful Applications.md

* PUSH ATTACHMENT : k8s-10.jpeg

* PUSH NOTE : 02. First Steps with Docker and Kubernetes.md

* PUSH ATTACHMENT : k8s-02.jpeg

* PUSH NOTE : 06. Volumes - Attaching Disk Storage to Containers.md

* PUSH ATTACHMENT : k8s-06.jpeg

* PUSH NOTE : 12. Securing the Kubernetes API Server.md

* PUSH ATTACHMENT : k8s-12.jpeg

* PUSH NOTE : 07. ConfigMaps and Secrets - Configuring Applications.md

* PUSH ATTACHMENT : k8s-07.jpeg

* PUSH NOTE : 13. Securing Cluster Nodes and the Network.md

* PUSH ATTACHMENT : k8s-13.jpeg

* PUSH NOTE : 09. Deployments - Updating Applications Declaratively.md

* PUSH ATTACHMENT : k8s-09.jpeg

* PUSH NOTE : 17. Best Practices for Developing Apps.md

* PUSH ATTACHMENT : k8s-17.jpeg

* PUSH NOTE : 16. Advanced Scheduling.md

* PUSH ATTACHMENT : k8s-16.jpeg

* PUSH NOTE : 08. Accessing Pod Metadata and Other Resources from Applications.md

* PUSH ATTACHMENT : k8s-08.jpeg

* PUSH NOTE : 15. Automatic Scaling of Pods and Cluster Nodes.md

* PUSH ATTACHMENT : k8s-15.jpeg

* PUSH NOTE : 01. Introducing Kubernetes.md

* PUSH ATTACHMENT : k8s-01.jpeg

* PUSH NOTE : 03. Pods - Running Containers in Kubernetes.md

* PUSH ATTACHMENT : k8s-03.jpeg

* PUSH NOTE : 14. Managing Pods' Computational Resources.md

* PUSH ATTACHMENT : k8s-14.jpeg

* [PUBLISHER] upload files #71

* PUSH NOTE : test-document.md

* PUSH NOTE : test-document.md

* PUSH ATTACHMENT : test-image.png

* DELETE FILE : assets/img/posts/test/test-image.png

* [PUBLISHER] upload files #72

* PUSH NOTE : test-document.md

* PUSH ATTACHMENT : test-image.png

* DELETE FILE : assets/img/posts/test/test-image.png

* [PUBLISHER] upload files #73

* PUSH NOTE : test-document.md

* PUSH ATTACHMENT : test-image.png

* chore: remove test files

* [PUBLISHER] upload files #74

* PUSH NOTE : 01. Algebra of Sets and Set Functions.md

* PUSH ATTACHMENT : mt-01.png

* DELETE FILE : assets/img/posts/Mathematics/Measure Theory/mt-01.png

* [PUBLISHER] upload files #76

* PUSH NOTE : 01. Algebra of Sets and Set Functions.md

* PUSH ATTACHMENT : mt-01.png

* [PUBLISHER] upload files #77

* PUSH NOTE : 09. Lp Functions.md

* PUSH ATTACHMENT : mt-09.png

* PUSH NOTE : 08. Comparison with the Riemann Integral.md

* PUSH ATTACHMENT : mt-08.png

* PUSH NOTE : 07. Dominated Convergence Theorem.md

* PUSH ATTACHMENT : mt-07.png

* PUSH NOTE : 06. Convergence Theorems.md

* PUSH ATTACHMENT : mt-06.png

* PUSH NOTE : 05. Lebesgue Integration.md

* PUSH ATTACHMENT : mt-05.png

* PUSH NOTE : 04. Measurable Functions.md

* PUSH ATTACHMENT : mt-04.png

* PUSH NOTE : 03. Measure Spaces.md

* PUSH ATTACHMENT : mt-03.png

* PUSH NOTE : 01. Algebra of Sets and Set Functions.md

* PUSH ATTACHMENT : mt-01.png

* chore: remove images

* [PUBLISHER] upload files #78

* PUSH NOTE : 09. Lp Functions.md

* PUSH ATTACHMENT : mt-09.png

* PUSH NOTE : 08. Comparison with the Riemann Integral.md

* PUSH ATTACHMENT : mt-08.png

* PUSH NOTE : 07. Dominated Convergence Theorem.md

* PUSH ATTACHMENT : mt-07.png

* PUSH NOTE : 06. Convergence Theorems.md

* PUSH ATTACHMENT : mt-06.png

* PUSH NOTE : 05. Lebesgue Integration.md

* PUSH ATTACHMENT : mt-05.png

* PUSH NOTE : 04. Measurable Functions.md

* PUSH ATTACHMENT : mt-04.png

* PUSH NOTE : 03. Measure Spaces.md

* PUSH ATTACHMENT : mt-03.png

* PUSH NOTE : 01. Algebra of Sets and Set Functions.md

* PUSH ATTACHMENT : mt-01.png

* PUSH NOTE : 18. Extending Kubernetes.md

* PUSH ATTACHMENT : k8s-18.jpeg

* PUSH NOTE : 17. Best Practices for Developing Apps.md

* PUSH ATTACHMENT : k8s-17.jpeg

* PUSH NOTE : 16. Advanced Scheduling.md

* PUSH ATTACHMENT : k8s-16.jpeg

* PUSH NOTE : 15. Automatic Scaling of Pods and Cluster Nodes.md

* PUSH ATTACHMENT : k8s-15.jpeg

* PUSH NOTE : 14. Managing Pods' Computational Resources.md

* PUSH ATTACHMENT : k8s-14.jpeg

* PUSH NOTE : 13. Securing Cluster Nodes and the Network.md

* PUSH ATTACHMENT : k8s-13.jpeg

* PUSH NOTE : 12. Securing the Kubernetes API Server.md

* PUSH ATTACHMENT : k8s-12.jpeg

* PUSH NOTE : 11. Understanding Kubernetes Internals.md

* PUSH ATTACHMENT : k8s-11.jpeg

* PUSH NOTE : 10. StatefulSets - Deploying Replicated Stateful Applications.md

* PUSH ATTACHMENT : k8s-10.jpeg

* PUSH NOTE : 09. Deployments - Updating Applications Declaratively.md

* PUSH ATTACHMENT : k8s-09.jpeg

* PUSH NOTE : 08. Accessing Pod Metadata and Other Resources from Applications.md

* PUSH ATTACHMENT : k8s-08.jpeg

* PUSH NOTE : 07. ConfigMaps and Secrets - Configuring Applications.md

* PUSH ATTACHMENT : k8s-07.jpeg

* PUSH NOTE : 06. Volumes - Attaching Disk Storage to Containers.md

* PUSH ATTACHMENT : k8s-06.jpeg

* PUSH NOTE : 05. Services - Enabling Clients to Discover and Talk to Pods.md

* PUSH ATTACHMENT : k8s-05.jpeg

* PUSH NOTE : 04. Replication and Other Controllers - Deploying Managed Pods.md

* PUSH ATTACHMENT : k8s-04.jpeg

* PUSH NOTE : 03. Pods - Running Containers in Kubernetes.md

* PUSH ATTACHMENT : k8s-03.jpeg

* PUSH NOTE : 02. First Steps with Docker and Kubernetes.md

* PUSH ATTACHMENT : k8s-02.jpeg

* PUSH NOTE : 01. Introducing Kubernetes.md

* PUSH ATTACHMENT : k8s-01.jpeg

* [PUBLISHER] upload files #79

* PUSH NOTE : 02. Construction of Measure.md

* PUSH ATTACHMENT : mt-02.png
This commit is contained in:
Sungchan Yi
2023-09-10 17:38:27 +09:00
committed by GitHub
parent e5f865ff0c
commit 3c0c6a13ca
54 changed files with 266 additions and 132 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
_posts/Development/Kubernetes/2021-06-29-13-securing-nodes-and-network.md
View File

@@ -7,10 +7,12 @@ title: "13. Securing Cluster Nodes and the Network"
date: "2021-06-29"
github_title: "2021-06-29-13-securing-nodes-and-network"
image:
path: /assets/img/posts/k8s-13.jpeg
path: /assets/img/posts/Development/Kubernetes/k8s-13.jpeg
attachment:
folder: assets/img/posts/Development/Kubernetes
---
![k8s-13.jpeg](../../../assets/img/posts/k8s-13.jpeg) _A pod with hostNetwork: true uses the node's network interfaces instead of its own. (출처: https://livebook.manning.com/book/kubernetes-in-action/chapter-13)_
![k8s-13.jpeg](../../../assets/img/posts/Development/Kubernetes/k8s-13.jpeg) _A pod with hostNetwork: true uses the node's network interfaces instead of its own. (출처: https://livebook.manning.com/book/kubernetes-in-action/chapter-13)_
### 주요 내용
@@ -20,6 +22,7 @@ image:
컨테이너는 독립적인 환경을 제공한다고 하긴 했지만, 공격자가 API server 에 접근하게 되면 컨테이너에 무엇이든 집어넣고 악의적인 코드를 실행할 수 있고, 이는 실행 중인 다른 컨테이너에 영향을 줄 수도 있다!
## 13.1 Using the host node's namespaces in a pod
---
컨테이너는 별도의 linux namespace 에서 실행된다고 했었다.
@@ -64,6 +67,7 @@ spec:
호스트의 네트워크 namespace 를 사용할 수 있었던 것처럼 `hostPID`, `hostIPC` 값을 `true` 로 설정해 주면 노드의 PID 와 IPC namespace 를 사용하게 된다. `spec` 아래에 넣어주면 된다.
## 13.2 Configuring the container's security context
---
`securityContext` property 를 이용하면 보안과 관련된 기능들을 pod 과 내부 컨테이너에 설정할 수 있다.
@@ -271,6 +275,7 @@ total 4
> `supplementalGroups` 에 대한 설명이 좀 부족하다. 단순히 user 와 엮인 추가 group ID 를 설정할 수 있다고만 적혀있다.
## 13.3 Restricting the use of security-related features in pods
---
클러스터 관리자는 PodSecurityPolicy 리소스를 이용해서 pod 의 보안과 관련된 기능들을 제한할 수 있다.
@@ -387,11 +392,12 @@ $ kubectl create clusterrolebinding <CLUSTER_ROLE_BINDING_NAME> \
--clusterrole=<CLUSTER_ROLE_NAME> --group=<GROUP_NAME>
```
> `kubectl` 에서 사용자를 추가하려면 `kubectl config set-credentials <NAME> --username=<USERNAME> --password=<PASSWORD>` 를 입력하면 된다.
> `kubectl` 에서 사용자를 추가하려면 `kubectl config set-credentials <NAME> --username=<USERNAME> --password=<PASSWORD> ` 를 입력하면 된다.
> 다른 사용자의 이름으로 리소스를 생성하려면 `kubectl --user <USERNAME> create` 를 하면 된다.
## 13.4 Isolating the pod network
---
앞서 살펴본 방법들은 pod 와 컨테이너 단에서 적용되는 보안 관련 설정을 살펴봤다. 이번에는 pod 사이의 네트워크 통신 측면에서 보안을 적용하는 방법을 알아본다.