Home on iamjjanga bloghttps://blog.iamjjanga.com/Recent content in Home on iamjjanga blogHugoen-USMon, 17 Nov 2025 22:45:03 +0900Vault Auto Unseal With AWS KMShttps://blog.iamjjanga.com/vault-auto-unseal-with-aws-kms/Mon, 17 Nov 2025 22:45:03 +0900https://blog.iamjjanga.com/vault-auto-unseal-with-aws-kms/<nav id="TableOfContents"> <h4>Table Of Contents</h4> <nav id="TableOfContents"> <ol> <li><a href="#intro">Intro</a></li> <li><a href="#sealing-in-vault">Sealing in Vault</a> <ol> <li><a href="#seal--unseal">Seal &amp; Unseal</a></li> <li><a href="#challenge">Challenge</a></li> <li><a href="#solution">Solution</a></li> </ol> </li> <li><a href="#configurations">Configurations</a> <ol> <li><a href="#kms-생성">KMS 생성</a></li> <li><a href="#irsaiam-role-for-serviceaccount-생성">IRSA(IAM Role for ServiceAccount) 생성</a></li> <li><a href="#vault-helm">Vault (Helm)</a></li> </ol> </li> <li><a href="#ref">Ref</a></li> </ol> </nav> </nav> <h1 id="intro">Intro</h1> <h1 id="sealing-in-vault">Sealing in Vault</h1> <h2 id="seal--unseal">Seal &amp; Unseal</h2> <p><a href="https://developer.hashicorp.com/vault/tutorials/auto-unseal/autounseal-aws-kms">Auto-unseal Vault using AWS KMS | Vault | HashiCorp Developer</a></p> <p> <img src="image.png" alt="alt text" loading="lazy"> </p> <p>Vault Server는 기본적으로 시작 시, <code>Sealed</code> 상태로 시작하게 된다. <code>Sealed</code> 상태인경우 Secret에 대한 Decrypt가 불가능하다.</p> <blockquote> <p>Unsealing is the process of constructing the master key necessary to decrypt the data encryption key</p>Aws Vpc Endpoints Reviewhttps://blog.iamjjanga.com/aws-vpc-endpoints-review/Tue, 04 Nov 2025 22:11:13 +0900https://blog.iamjjanga.com/aws-vpc-endpoints-review/<nav id="TableOfContents"> <h4>Table Of Contents</h4> <nav id="TableOfContents"> <ol> <li><a href="#intro">Intro</a></li> <li><a href="#endpoints">Endpoints</a> <ol> <li><a href="#type-of-endpoints">Type of Endpoints</a></li> <li><a href="#hands-on-gateway로-s3-endpoints-설정">(Hands-On) Gateway로 S3 Endpoints 설정</a> <ol> <li><a href="#nat-사용-확인-하기">NAT 사용 확인 하기</a></li> <li><a href="#s3-endpoints-생성">S3 Endpoints 생성</a></li> <li><a href="#nat를-사용하지-않는-것을-확인">NAT를 사용하지 않는 것을 확인</a></li> </ol> </li> </ol> </li> <li><a href="#ref">Ref</a></li> </ol> </nav> </nav> <h1 id="intro">Intro</h1> <p>최근 업무를 진행하면서 Production VPC에서는 S3 Endpoints(Gateway)가 다른 엔지니어분의 작업으로 해당 설정이 유효하게 설정되었지만, Dev VPC는 누락된 부분이 있어서 다시 리서치하는 의미에서 이 글을 작성하게 되었다.</p> <h1 id="endpoints">Endpoints</h1> <p>AWS에서 S3는 다양한 환경에서 사용한다.</p> <ul> <li>Local에서 <code>aws-cli</code> 를 사용해서 Object를 업로드&amp;다운로드</li> <li>(간혹) Static Web Hosting이나 Cloudfront와 연결해서 Redirect로도 사용</li> <li>(주로) VPC 내에서 필요한 정적파일 혹은 백업, 로그를 보관하는 목적</li> </ul> <p>여기서 S3를 참조할때 네트워크 트래픽에 대한 부분을 많이 간과해서 사용하는 경우에 적은 Call수에는 차이가 나지 않을 수 있지만 잦고 다량의 Call이 발생할때는 무시할 수 없는 비용이다.</p>Cilium Study Security Network Policyhttps://blog.iamjjanga.com/cilium-study-security-network-policy/Sat, 06 Sep 2025 22:17:12 +0900https://blog.iamjjanga.com/cilium-study-security-network-policy/<nav id="TableOfContents"> <h4>Table Of Contents</h4> <nav id="TableOfContents"> <ol> <li><a href="#intro">Intro</a></li> <li><a href="#cilium-security">Cilium Security</a> <ol> <li><a href="#cilium-envoy-proxy">Cilium Envoy Proxy</a></li> <li><a href="#identity-based">Identity-Based</a> <ol> <li><a href="#special-identities">Special Identities</a></li> <li><a href="#identity-management-in-the-cluster">Identity Management in the cluster</a></li> </ol> </li> <li><a href="#network-policy">Network Policy</a> <ol> <li><a href="#policy-enforcement-modes">Policy Enforcement Modes</a></li> <li><a href="#network-policy-editor">Network Policy Editor</a></li> <li><a href="#example-layer-3-예시">[Example] Layer 3 예시</a></li> <li><a href="#example-layer-4-예시">[Example] Layer 4 예시</a></li> <li><a href="#example-layer-7-예시">[Example] Layer 7 예시</a></li> </ol> </li> </ol> </li> <li><a href="#lab">Lab</a> <ol> <li><a href="#lab1-locking-down-external-access-with-dns-based-policies">[Lab1] Locking Down External Access with DNS-Based Policies</a> <ol> <li><a href="#dns-egress-policy-mediabot-pod가-apigithubcom-에만-액세스하도록-허용">[DNS Egress Policy] mediabot Pod가 <a href="http://api.github.com">api.github.com</a> 에만 액세스하도록 허용</a></li> </ol> </li> </ol> </li> </ol> </nav> </nav> <h1 id="intro">Intro</h1> <h1 id="cilium-security">Cilium Security</h1> <p><a href="https://docs.cilium.io/en/stable/security/network/policyenforcement/#policy-enforcement">Policy Enforcement — Cilium 1.18.1 documentation</a></p> <p> <figure> <img src="image.png" alt="" loading="lazy"> <figcaption>ID 기반 보안 정책 (<a href="https://docs.cilium.io/en/stable/security/network/identity/">https://docs.cilium.io/en/stable/security/network/identity/</a>)</figcaption> </figure> </p> <ul> <li>Cilium에서의 보안정책은 “세션 기반 프로토콜”에 대해 <strong>상태 저장 정책</strong>이 적용되어, 응답 패킷은 자동으로 허용됨. <ul> <li>정책이 A =&gt; B를 허용한다면, B에서 A로의 응답 패킷도 자동으로 허용</li> <li>그러나 B가 A로의 연결을 시작하는 것은 자동으로 허용 X (양방향은 <strong>명시적</strong> 허용 필요)</li> </ul> </li> <li>보안 정책은 입력(수신) 또는 출력(송신)에서 적용</li> <li><strong>ID 기반</strong> 보안정책을 사용 (다중 클러스터 환경도 포함)</li> <li>기본 보안 정책 <ul> <li>기본(Default) 동작 (= 정책이 없는 경우)은 “Allow All”</li> <li>첫번째 정책 규칙이 적용되면 화이트리스트(WhiteList) 기반으로 동작해 화이트리스트에 없는 패킷은 Drop</li> <li>L4 정책도 동일</li> </ul> </li> </ul> <h2 id="cilium-envoy-proxy">Cilium Envoy Proxy</h2> <p> <figure> <img src="image-1.png" alt="Cilium Envoy Proxy" loading="lazy"> <figcaption><a href="https://docs.cilium.io/en/stable/security/network/proxy/envoy/">https://docs.cilium.io/en/stable/security/network/proxy/envoy/</a></figcaption> </figure> </p>[Kubernetes] Check Performance using Kube Burnerhttps://blog.iamjjanga.com/kubernetes-check-performance-using-kube-burner/Sat, 30 Aug 2025 01:03:49 +0900https://blog.iamjjanga.com/kubernetes-check-performance-using-kube-burner/<nav id="TableOfContents"> <h4>Table Of Contents</h4> <nav id="TableOfContents"> <ol> <li><a href="#intro">Intro</a> <ol> <li><a href="#실습환경구성">실습환경구성</a></li> </ol> </li> <li><a href="#kube-burner">Kube-burner</a> <ol> <li><a href="#features">Features</a></li> <li><a href="#installation">Installation</a> <ol> <li><a href="#add-container-image">(Add) Container Image</a></li> </ol> </li> <li><a href="#configuration">Configuration</a> <ol> <li><a href="#template-config-file">Template config file</a></li> <li><a href="#global-section">Global Section</a></li> <li><a href="#jobs-section">Jobs Section</a></li> </ol> </li> <li><a href="#scenario-1-deployment-1-생성">Scenario 1] Deployment 1 생성</a> <ol> <li><a href="#생성">생성</a></li> <li><a href="#삭제">삭제</a></li> </ol> </li> <li><a href="#scenario-2-다양한-옵션값-확인하기">[Scenario 2] 다양한 옵션값 확인하기</a> <ol> <li><a href="#scenario-1---39358s">scenario 1 - <code>39.358s</code></a></li> <li><a href="#preloadimages-false---3354s">preLoadImages: false - <code>3.354s</code></a></li> <li><a href="#waitwhenfinished-false---1304s">waitWhenFinished: false - <code>1.304s</code></a></li> <li><a href="#jobiteration-5---5265s">jobIteration: 5 - <code>5.265s</code></a></li> <li><a href="#objectsreplicas-2---10294s">objects.replicas: 2 - <code>10.294s</code></a></li> <li><a href="#objecttemplate-내의-deployment에-replicase를-2로-수정---10254s">objectTemplate 내의 deployment에 replicase를 2로 수정 - <code>10.254s</code></a></li> <li><a href="#jobiteration-10---20336s">jobIteration 10 - <code>20.336s</code></a></li> <li><a href="#qps-10-burst-10---1336s">qps: 10, burst: 10 - <code>1.336s</code></a></li> <li><a href="#jobiterations-10-qps-1-burst10-objectsreplicas-1---1290s">jobIterations: 10, qps: 1, burst:10, objects.replicas: 1 - <code>1.290s</code></a></li> <li><a href="#jobiterations-100-qps-1-burst100-objectsreplicas-1---1972s">jobIterations: 100, qps: 1, burst:100, objects.replicas: 1 - <code>1.972s</code></a></li> <li><a href="#jobiterations-10-qps-1-burst10-objectsreplicas-2---11240s">jobIterations: 10, qps: 1, burst:10, objects.replicas: 2 - <code>11.240s</code></a></li> <li><a href="#jobiterations-10-qps-1-burst20-objectsreplicas-2---1112s">jobIterations: 10, qps: 1, burst:20, objects.replicas: 2 - <code>1.112s</code></a></li> <li><a href="#jobiterations-20-qps-2-burst20-objectsreplicas-2---10701s">jobIterations: 20, qps: 2, burst:20, objects.replicas: 2 - <code>10.701s</code></a></li> </ol> </li> <li><a href="#scenario-3-1-노드-1대에-최대-pod-이상-배포-시도">[Scenario 3-1] 노드 1대에 최대 Pod 이상 배포 시도</a> <ol> <li><a href="#jobiterations-100-qps-300-burst-300-objectsreplicas-1">jobIterations: 100, qps: 300, burst: 300, objects.replicas: 1</a></li> </ol> </li> <li><a href="#scenario-3-2-podcidr를-넘는-숫자로-배포-요청">[Scenario 3-2] podCIDR를 넘는 숫자로 배포 요청</a></li> </ol> </li> </ol> </nav> </nav> <!-- raw HTML omitted --> <p><code>Cloud@Net Cilium Study 1기</code> 과정 중 정리 글입니다.</p>Cilium Study Networking Bgp Control Planehttps://blog.iamjjanga.com/cilium-study-networking-bgp-control-plane/Thu, 14 Aug 2025 00:14:50 +0900https://blog.iamjjanga.com/cilium-study-networking-bgp-control-plane/<nav id="TableOfContents"> <h4>Table Of Contents</h4> <nav id="TableOfContents"> <ol> <li><a href="#introduction">Introduction</a> <ol> <li><a href="#실습환경구성">실습환경구성</a></li> <li><a href="#frrouting-frr">FRRouting (frr)</a> <ol> <li><a href="#활용사례">활용사례</a></li> </ol> </li> <li><a href="#bgp">BGP</a> <ol> <li><a href="#특징">특징</a></li> <li><a href="#구성요소">구성요소</a></li> </ol> </li> </ol> </li> <li><a href="#cilium-bgp-control-plane">Cilium BGP Control Plane</a> <ol> <li><a href="#역할">역할</a></li> <li><a href="#구성">구성</a> <ol> <li><a href="#custom-resources로-선언적-정책-사용">Custom Resources로 선언적 정책 사용</a></li> <li><a href="#gobgp-통합">GoBGP 통합</a></li> <li><a href="#ecmp"><strong>ECMP</strong></a></li> <li><a href="#ebgp-multi-hop-지원">eBGP Multi Hop 지원</a></li> <li><a href="#bgp-graceful-restart-고가용성-지원">BGP Graceful Restart: 고가용성 지원</a></li> </ol> </li> <li><a href="#실습-1--bgp-설정-후-통신-확인">실습 1 : BGP 설정 후 통신 확인</a> <ol> <li><a href="#실습환경-네트워크-확인">실습환경 네트워크 확인</a></li> <li><a href="#bgp-설정-확인">BGP 설정 확인</a></li> <li><a href="#bgp-설정-후-통신확인-통신-문제-있음">BGP 설정 후 통신확인 (통신 문제 있음)</a></li> <li><a href="#통신-문제-해결-후-확인">통신 문제 해결 후 확인</a></li> </ol> </li> <li><a href="#실습-2--노드-유지보수">실습 2 : 노드 유지보수</a></li> <li><a href="#disabling-crd-status-report">Disabling CRD Status Report</a></li> <li><a href="#실습-3--service-virtual-ips-loadbalancer-external-ip-를-bgp로-광고">실습 3 : Service Virtual IPs (LoadBalancer, External IP) 를 BGP로 광고</a> <ol> <li><a href="#loadbalancerip">LoadBalancerIP</a></li> <li><a href="#광고된-lb의-external-ip에-대한-요청의-부하분산은-정상적인가">광고된 LB의 External IP에 대한 요청의 부하분산은 정상적인가?</a></li> </ol> </li> <li><a href="#external-traffic-policy와-ecmp-설정">External Traffic Policy와 ECMP 설정</a> <ol> <li><a href="#external-traffic-policy--local">External Traffic Policy = Local</a></li> <li><a href="#ecmp-hash-policy">ECMP Hash Policy</a></li> </ol> </li> </ol> </li> <li><a href="#ref">Ref</a></li> </ol> </nav> </nav> <h1 id="introduction">Introduction</h1> <p>Kubernetes 클러스터에서 외부 네트워크로 통신을 위한 방법으로 이전 포스팅에서는 1. Native Routing 모드에서 <strong>직접 Static Routing을 추가</strong>하는 방법과 2. 캡슐화를 통한 <strong>OverLay Network</strong>를 이용하는 방법에 대해서 알아보았다.</p>Cilium Study Networking ServiceLB Ipamhttps://blog.iamjjanga.com/cilium-study-networking-servicelb-ipam/Fri, 08 Aug 2025 00:49:14 +0900https://blog.iamjjanga.com/cilium-study-networking-servicelb-ipam/<nav id="TableOfContents"> <h4>Table Of Contents</h4> <nav id="TableOfContents"> <ol> <li><a href="#intro">Intro</a> <ol> <li><a href="#실습환경">실습환경</a></li> <li><a href="#metallb의-사용사례">MetalLB의 사용사례</a></li> <li><a href="#cilium과-metallb">Cilium과 MetalLB</a></li> </ol> </li> <li><a href="#loadbalancer-ip-address-managementlb-ipam">LoadBalancer IP Address Management(LB IPAM)</a> <ol> <li><a href="#특징">특징</a></li> <li><a href="#구성요소-1-pools">구성요소 1 (Pools)</a> <ol> <li><a href="#cidrs-ranges-and-reserved-ips">CIDRs, Ranges and Reserved IPs</a></li> <li><a href="#service-selector">Service Selector</a></li> <li><a href="#그외-conflict-disabling-a-pool">그외 Conflict, Disabling a Pool</a></li> </ol> </li> <li><a href="#구성요소-2-services">구성요소 2 (Services)</a> <ol> <li><a href="#loadbalancerclass">LoadBalancerClass</a></li> <li><a href="#requesting-ips">Requesting IPs</a></li> <li><a href="#sharing-keys">Sharing Keys</a></li> </ol> </li> <li><a href="#실습-1--클러스터-내부-webpod-서비스를-loadbalancer-type-설정-with-cilium-lb-ipam">실습 1 : (클러스터 내부) webpod 서비스를 LoadBalancer Type 설정 with Cilium LB IPAM</a></li> </ol> </li> <li><a href="#cilium-l2-announcement--l2-aware-lb-beta">Cilium L2 Announcement / L2 Aware LB (beta)</a> <ol> <li><a href="#동작방식">동작방식</a></li> <li><a href="#특징과-장점">특징과 장점</a></li> <li><a href="#한계와-주의사항">한계와 주의사항</a></li> <li><a href="#설정-및-확인">설정 및 확인</a></li> <li><a href="#실습-2--클러스터-외부-webpod-서비스를-lb-external-ip로-호출-with-l2-announcement">실습 2 : (클러스터 외부) webpod 서비스를 LB External IP로 호출 with L2 Announcement</a></li> </ol> </li> <li><a href="#reference">Reference</a></li> </ol> </nav> </nav> <h1 id="intro">Intro</h1> <p><a href="https://isovalent.com/blog/post/migrating-from-metallb-to-cilium/#load-balancer-ipam">Migrating from MetalLB to Cilium</a></p>