4장 실습 - Amazon EKS Secure Access - Teleport 구성하기

cd cnaee_class_tf/ch4

export TF_VAR_KeyName=[각자 ssh keypair] export TF_VAR_MyIamUserAccessKeyID=[각자 iam 사용자의 access key id] export TF_VAR_MyIamUserSecretAccessKey=[각자 iam 사용자의 secret access key] export TF_VAR_SgIngressSshCidr=$(curl -s ipinfo.io/ip)/32

terraform init terraform plan terraform apply -auto-approve -var="create_eks_bastion_2=false"

aws eks update-kubeconfig \ --region $AWS_DEFAULT_REGION \ --name $CLUSTER_NAME

kubens default

echo $AWS_DEFAULT_REGION echo $CLUSTER_NAME echo $VPCID echo $PublicSubnet1,$PublicSubnet2,$PublicSubnet3 echo $PrivateSubnet1,$PrivateSubnet2,$PrivateSubnet3

eksctl get cluster

eksctl get nodegroup \ --cluster $CLUSTER_NAME \ --name ${CLUSTER_NAME}-node-group

kubectl get node -owide

IAM_USER=$(aws iam get-user --query 'User.UserName' --output text) echo "export IAM_USER=$IAM_USER" >> /etc/profile echo $IAM_USER

PublicN1=$(kubectl get node --label-columns=topology.kubernetes.io/zone --selector=topology.kubernetes.io/zone=ap-northeast-2a -o jsonpath={.items[0].status.addresses[0].address}) PublicN2=$(kubectl get node --label-columns=topology.kubernetes.io/zone --selector=topology.kubernetes.io/zone=ap-northeast-2b -o jsonpath={.items[0].status.addresses[0].address}) PublicN3=$(kubectl get node --label-columns=topology.kubernetes.io/zone --selector=topology.kubernetes.io/zone=ap-northeast-2c -o jsonpath={.items[0].status.addresses[0].address}) echo "export PublicN1=$PublicN1" >> /etc/profile echo "export PublicN2=$PublicN2" >> /etc/profile echo "export PublicN3=$PublicN3" >> /etc/profile echo $PublicN1, $PublicN2, $PublicN3

for node in $PublicN1 $PublicN2 $PublicN3; \ do \ ssh -i ~/.ssh/kp_node.pem -o StrictHostKeyChecking=no ec2-user@$node hostname; \ done

TELEPORT_EDITION="oss" TELEPORT_VERSION="17.2.1"

curl https://cdn.teleport.dev/install-v17.2.1.sh \ | bash -s ${TELEPORT_VERSION?} ${TELEPORT_EDITION?}

teleport version

MyDomain=[각자 도메인 주소]; echo $MyDomain echo "export MyDomain=$MyDomain" >> /etc/profile

HostedZoneID=$(aws route53 list-hosted-zones-by-name --dns-name "${MyDomain}" --query "HostedZones[0].Id" --output text | sed 's|/hostedzone/||'); echo $HostedZoneID echo "export HostedZoneID=$HostedZoneID" >> /etc/profile

BastionPublicIP=$(curl -s ipinfo.io/ip); echo $BastionPublicIP echo "export BastionPublicIP=$BastionPublicIP" >> /etc/profile

aws route53 list-resource-record-sets \ --hosted-zone-id $HostedZoneID \ --query "ResourceRecordSets[*].[Name,Type]" \ --output table

aws route53 change-resource-record-sets --hosted-zone-id $HostedZoneID --change-batch " { \"Comment\": \"Add A record for teleport\", \"Changes\": [ { \"Action\": \"CREATE\", \"ResourceRecordSet\": { \"Name\": \"teleport.${MyDomain}\", \"Type\": \"A\", \"TTL\": 300, \"ResourceRecords\": [ { \"Value\": \"${BastionPublicIP}\" } ] } } ] }"

aws route53 change-resource-record-sets --hosted-zone-id $HostedZoneID --change-batch " { \"Comment\": \"Add A record for *.teleport\", \"Changes\": [ { \"Action\": \"CREATE\", \"ResourceRecordSet\": { \"Name\": \"*.teleport.${MyDomain}\", \"Type\": \"A\", \"TTL\": 300, \"ResourceRecords\": [ { \"Value\": \"${BastionPublicIP}\" } ] } } ] }"

aws route53 list-resource-record-sets \ --hosted-zone-id $HostedZoneID \ --query "ResourceRecordSets[*].[Name,Type]" \ --output table

MAIL=[각자 메일 주소]

teleport configure -o file \ --acme \ --acme-email=${MAIL} \ --cluster-name=teleport.${MyDomain}

cat /etc/teleport.yaml | yh

systemctl status teleport

systemctl enable teleport systemctl start teleport systemctl status teleport

ss -tulnp | grep teleport

HOSTSGID=$(aws ec2 describe-security-groups --filters Name=group-name,Values=${CLUSTER_NAME}-eks-sec-group --query "SecurityGroups[*].[GroupId]" --output text); echo $HOSTSGID echo "export HOSTSGID=$HOSTSGID" >> /etc/profile

aws ec2 authorize-security-group-ingress \ --group-id $HOSTSGID \ --protocol tcp \ --port 443 \ --cidr 0.0.0.0/0 aws ec2 authorize-security-group-ingress \ --group-id $HOSTSGID \ --protocol tcp \ --port 3022 \ --cidr 0.0.0.0/0 aws ec2 authorize-security-group-ingress \ --group-id $HOSTSGID \ --protocol tcp \ --port 3025 \ --cidr 0.0.0.0/0

ls /var/lib/teleport

tree /var/lib/teleport/log/

tree /var/lib/teleport/acme/

cat /var/lib/teleport/acme/teleport.${MyDomain}

openssl x509 -in /var/lib/teleport/acme/teleport.${MyDomain} -text -noout

tctl users ls

tctl users add tele_admin \ --roles=editor,access,auditor \ --logins=root,ec2-user,ubuntu \ --ttl=2h

tctl nodes ls

tctl nodes add --roles=node --ttl=1h --token=mysecrettoken123

tctl tokens ls

ssh -i ~/.ssh/kp_node.pem ec2-user@$PublicN1

sudo su -

curl https://cdn.teleport.dev/install-v17.2.1.sh | bash -s 17.2.1 teleport configure \ --roles=node \ --token="mysecrettoken123" \ --auth-server=192.168.1.100:3025 -o file sed -i "s/nodename: .*/nodename: eks-n1/" /etc/teleport.yaml systemctl enable --now teleport systemctl start teleport systemctl status teleport

ssh -i ~/.ssh/kp_node.pem ec2-user@$PublicN2

sudo su -

curl https://cdn.teleport.dev/install-v17.2.1.sh | bash -s 17.2.1 teleport configure \ --roles=node \ --token="mysecrettoken123" \ --auth-server=192.168.1.100:3025 -o file sed -i "s/nodename: .*/nodename: eks-n2/" /etc/teleport.yaml systemctl enable --now teleport systemctl start teleport systemctl status teleport

ssh -i ~/.ssh/kp_node.pem ec2-user@$PublicN3

sudo su -

curl https://cdn.teleport.dev/install-v17.2.1.sh | bash -s 17.2.1 teleport configure \ --roles=node \ --token="mysecrettoken123" \ --auth-server=192.168.1.100:3025 -o file sed -i "s/nodename: .*/nodename: eks-n3/" /etc/teleport.yaml systemctl enable --now teleport systemctl start teleport systemctl status teleport

tctl nodes ls

NGSGID=$(aws ec2 describe-security-groups --filters Name=group-name,Values=${CLUSTER_NAME}-node-group-sg --query "SecurityGroups[*].[GroupId]" --output text); echo $NGSGID echo "export NGSGID=$NGSGID" >> /etc/profile

aws ec2 authorize-security-group-ingress \ --group-id $NGSGID \ --protocol tcp \ --port 3022 \ --cidr 192.168.1.100/32

curl -O https://cdn.teleport.dev/teleport-17.2.1.pkg

sudo installer -pkg teleport-17.2.1.pkg -target / rm teleport-17.2.1.pkg

tsh version

mkdir d:\teleport-v17.2.1 cd d:\teleport-v17.2.1

curl.exe -O https://cdn.teleport.dev/teleport-v17.2.1-windows-amd64-bin.zip

Expand-Archive -Path teleport-v17.2.1-windows-amd64-bin.zip -DestinationPath .

[Environment]::SetEnvironmentVariable("Path", $env:Path + ";D:\teleport-v17.2.1", [EnvironmentVariableTarget]::Machine)

tsh version

tsh login --proxy=teleport.ongja2.click --user=tele_admin

tsh status

tsh clusters

tsh ls

tsh ssh ec2-user@eks-n1

tsh ssh ec2-user@eks-n2

tsh ssh ec2-user@eks-n3

tsh latency ssh ec2-user@eks-n1

tsh recordings ls

tsh play [recording_id]

tsh ssh root@eks-n2

tsh sessions ls

tsh join -m observer [session_id]

tsh join -m peer [session_id]

tctl nodes add --roles=kube --ttl=2h --token=mykubernetestoken123

tctl tokens ls

KUBECONFIG=$PWD/.kube/config; echo $KUBECONFIG KUBETOKEN=mykubernetestoken123; echo $KUBETOKEN PROXY_ADDR=teleport.${MyDomain}:443; echo $PROXY_ADDR

helm repo add teleport https://charts.releases.teleport.dev helm repo update

helm install teleport-agent teleport/teleport-kube-agent \ --version 17.2.1 \ --set kubeClusterName=${CLUSTER_NAME} \ --set proxyAddr=${PROXY_ADDR} \ --set authToken=${KUBETOKEN} \ --set labels.env=${CLUSTER_NAME} \ --create-namespace \ --namespace=teleport-agent

kubectl get statefulset -n teleport-agent

kubectl get pod -n teleport-agent

kubectl get pod -n teleport-agent -o yaml

kubectl get configmap teleport-agent -n teleport-agent -o yaml

kubectl get secret teleport-kube-agent-join-token \ -n teleport-agent \ -o yaml

kubectl get secret teleport-kube-agent-join-token \ -n teleport-agent \ -o jsonpath="{.data.auth-token}" | base64 --decode

brew install kubernetes-cli@1.30

kubectl version --client

mkdir d:\kubectl-v1.30.0 cd d:\kubectl-v1.30.0

curl.exe -LO https://dl.k8s.io/release/v1.30.0/bin/windows/amd64/kubectl.exe

[Environment]::SetEnvironmentVariable("Path", $env:Path + ";D:\kubectl-v1.30.0", [EnvironmentVariableTarget]::Machine)

kubectl version --client

tsh kube ls

mkdir tele-kube && cd tele-kube touch tele-kubeconfig

export KUBECONFIG=$PWD/tele-kubeconfig

tsh kube login myeks

tsh kube ls

cat tele-kubeconfig

kubectl get node

tsh status

tctl users add tele_viewer \ --roles=access \ --logins=root,ec2-user,ubuntu \ --ttl=2h

tctl users ls

cat << EOF > tele-kube-admin.yaml kind: role metadata: name: tele-kube-admin version: v7 spec: allow: kubernetes_labels: '*': '*' kubernetes_groups: - system:masters kubernetes_users: - '{{internal.kubernetes_users}}' kubernetes_resources: - kind: '*' namespace: '*' name: '*' verbs: ['*'] deny: {} EOF

tctl create -f tele-kube-admin.yaml

tctl get roles/tele-kube-admin

cat <<EoF> pod-viewer-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: pod-viewer-role rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "watch"] EoF kubectl apply -f pod-viewer-role.yaml

kubectl create clusterrolebinding pod-viewer-role-binding \ --clusterrole=pod-viewer-role \ --group=pod-viewer

cat << EOF > tele-kube-guest.yaml kind: role metadata: name: tele-kube-guest version: v7 spec: allow: kubernetes_labels: '*': '*' kubernetes_groups: - pod-viewer kubernetes_users: - '{{internal.kubernetes_users}}' kubernetes_resources: - kind: '*' namespace: '*' name: '*' verbs: ['*'] deny: {} EOF

tctl create -f tele-kube-guest.yaml

tctl get roles/tele-kube-guest

tctl users update tele_admin \ --set-roles=editor,access,auditor,tele-kube-admin

tctl users update tele_viewer \ --set-roles=access,tele-kube-guest

tsh logout

tsh login --proxy=teleport.ongja2.click --user=tele_admin

tsh kube ls

tsh kube login myeks tsh kube ls

kubectl get node -v=6

kubectl auth can-i get pods --all-namespaces kubectl auth can-i create pods --all-namespaces kubectl auth can-i delete pods --all-namespaces

curl -O https://raw.githubusercontent.com/cloudneta/cnaeelab/refs/heads/master/_data/mario.yaml cat mario.yaml kubectl apply -f mario.yaml

kubectl delete -f mario.yaml

tsh logout

tsh login --proxy=teleport.ongja2.click --user=tele_viewer

tsh kube login myeks tsh kube ls

kubectl get node -v=6

kubectl auth can-i get pods --all-namespaces kubectl auth can-i create pods --all-namespaces kubectl auth can-i delete pods --all-namespaces

tsh logout tsh status

helm uninstall teleport-agent -n teleport-agent

aws route53 change-resource-record-sets --hosted-zone-id $HostedZoneID --change-batch " { \"Comment\": \"Add A record for teleport\", \"Changes\": [ { \"Action\": \"DELETE\", \"ResourceRecordSet\": { \"Name\": \"teleport.${MyDomain}\", \"Type\": \"A\", \"TTL\": 300, \"ResourceRecords\": [ { \"Value\": \"${BastionPublicIP}\" } ] } } ] }" aws route53 change-resource-record-sets --hosted-zone-id $HostedZoneID --change-batch " { \"Comment\": \"Add A record for *.teleport\", \"Changes\": [ { \"Action\": \"DELETE\", \"ResourceRecordSet\": { \"Name\": \"*.teleport.${MyDomain}\", \"Type\": \"A\", \"TTL\": 300, \"ResourceRecords\": [ { \"Value\": \"${BastionPublicIP}\" } ] } } ] }"

terraform destroy -auto-approve