# 安全规划示例
– 身份认证：使用OAuth2、LDAP等身份认证系统
– 授权：使用RBAC控制资源访问
– 加密：使用TLS加密网络通信
– 审计：启用审计日志，记录所有操作
– 监控：监控安全事件，及时发现异常
– 备份：定期备份集群数据，确保数据安全
# 安全等级划分
– 高安全区域：包含敏感数据的应用
– 中安全区域：一般业务应用
– 低安全区域：测试和开发环境
# 安全策略制定
– 制定安全策略文档
– 定期进行安全评估，风哥提示：。
– 建立安全事件响应流程
– 培训安全意识

# 安全控制措施
– 身份认证：使用强密码，启用多因素认证
– 授权：最小权限原则，只授予必要的权限
– 加密：使用TLS加密网络通信，加密敏感数据
– 网络隔离：使用网络策略，隔离不同应用
– 容器安全：使用安全的容器镜像，定期扫描漏洞
– 准入控制：使用准入控制器，限制Pod的创建
– 审计：启用审计日志，记录所有操作
– 监控：监控安全事件，及时发现异常
# 安全控制工具
– RBAC：基于角色的访问控制
– Pod Security Policy：Pod安全策略
– Network Policy：网络策略
– Secrets：存储敏感信息
– TLS：传输层安全
– Audit Logging：审计日志
– Security Context：安全上下文

# 安全合规标准
– PCI DSS：支付卡行业数据安全标准
– HIPAA：健康保险可携性和责任法案
– GDPR：通用数据保护条例
– SOC 2：服务组织控制
– ISO 27001：信息安全管理体系
# 合规要求
– 数据加密：敏感数据必须加密
– 访问控制：严格的访问控制
– 审计日志：完整的审计日志
– 漏洞管理：定期漏洞扫描
– 安全测试：定期安全测试
– 事件响应：安全事件响应流程

# 创建Role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: pod-reader
namespace: default
rules:
– apiGroups: [“”]
resources: [“pods”]
verbs: [“get”, “list”, “watch”]
# 创建RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: read-pods
namespace: default
subjects:
– kind: User
name: fgedu
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role，学习交流加群风哥微信: itpux-com。
name: pod-reader
apiGroup: rbac.authorization.k8s.io
# 创建ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cluster-admin
rules:
– apiGroups: [“”]
resources: [“*”]
verbs: [“*”]
# 创建ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: cluster-admin-binding
subjects:
– kind: User
name: admin
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
# 查看RBAC配置
$ kubectl get roles
$ kubectl get rolebindings
$ kubectl get clusterroles
$ kubectl get clusterrolebindings

# 配置Pod安全上下文
apiVersion: v1
kind: Pod
metadata:
name: secure-pod
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
containers:
– name: nginx
image: nginx
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: [“ALL”]
# 创建Pod安全策略
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: restricted
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: ‘docker/default’
apparmor.security.beta.kubernetes.io/allowedProfileNames: ‘runtime/default’
seccomp.security.alpha.kubernetes.io/defaultProfileName: ‘docker/default’
apparmor.security.beta.kubernetes.io/defaultProfileName: ‘runtime/default’
spec:
privileged: false
allowPrivilegeEscalation: false
requiredDropCapabilities:
– ALL
volumes:
– ‘configMap’
– ’emptyDir’
– ‘projected’
– ‘secret’，学习交流加群风哥QQ113257174。
– ‘downwardAPI’
– ‘persistentVolumeClaim’
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
rule: ‘MustRunAsNonRoot’
seLinux:
rule: ‘RunAsAny’
supplementalGroups:
rule: ‘MustRunAs’
ranges:
– min: 1
max: 65535
fsGroup:
rule: ‘MustRunAs’
ranges:
– min: 1
max: 65535
readOnlyRootFilesystem: true

# 创建网络策略
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
namespace: default
spec:
podSelector: {}
policyTypes:
– Ingress
– Egress
# 创建允许特定Pod访问的网络策略
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-nginx
namespace: default
spec:
podSelector:
matchLabels:
app: nginx
policyTypes:
– Ingress
ingress:
– from:
– podSelector:
matchLabels:
app: frontend
ports:
– protocol: TCP
port: 80
# 配置TLS
apiVersion: v1
kind: Secret
metadata:
name: tls-secret
type: kubernetes.io/tls
data:
tls.crt: base64-encoded-cert
tls.key: base64-encoded-key
apiVersion: v1
kind: Service
metadata:
name: nginx-tls
spec:
selector:
app: nginx
ports:，更多视频教程www.fgedu.net.cn。
– port: 443
targetPort: 443
type: LoadBalancer
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: nginx-ingress
spec:
tls:
– hosts:
– example.com
secretName: tls-secret
rules:
– host: example.com
http:
paths:
– path: /
pathType: Prefix
backend:
service:
name: nginx-tls
port:
number: 443

# 加固API服务器
$ kube-apiserver \
–anonymous-auth=false \
–basic-auth-file=/dev/null \
–insecure-port=0 \
–secure-port=6443 \
–tls-cert-file=/etc/kubernetes/pki/apiserver.crt \
–tls-private-key-file=/etc/kubernetes/pki/apiserver.key \
–client-ca-file=/etc/kubernetes/pki/ca.crt \
–etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt \
–etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt \
–etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key \
–service-account-key-file=/etc/kubernetes/pki/sa.pub \
–service-account-signing-key-file=/etc/kubernetes/pki/sa.key \
–service-account-issuer=https://kubernetes.default.svc.cluster.local \
–audit-log-path=/var/log/kubernetes/audit.log \
–audit-log-maxage=30 \
–audit-log-maxbackup=10 \
–audit-log-maxsize=100 \
–audit-policy-file=/etc/kubernetes/audit-policy.yaml
# 加固kubelet
$ kubelet \
–anonymous-auth=false \
–client-ca-file=/etc/kubernetes/pki/ca.crt \
–tls-cert-file=/var/lib/kubelet/pki/kubelet.crt \
–tls-private-key-file=/var/lib/kubelet/pki/kubelet.key \
–authorization-mode=Webhook \
–kubeconfig=/etc/kubernetes/kubelet.conf \
–pod-manifest-path=/etc/kubernetes/manifests \
–allow-privileged=false \
–protect-kernel-defaults=true \
–make-iptables-util-chains=true \
–cluster-dns=10.96.0.10 \
–cluster-domain=cluster.local
# 加固etcd
$ etcd \
–client-cert-auth=true \
–trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt \
–cert-file=/etc/kubernetes/pki/etcd/server.crt \
–key-file=/etc/kubernetes/pki/etcd/server.key \
–peer-client-cert-auth=true \
–peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt \
–peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt \，更多学习教程公众号风哥教程itpux_com。
–peer-key-file=/etc/kubernetes/pki/etcd/peer.key \
–data-dir=/var/lib/etcd \
–wal-dir=/var/lib/etcd/wal \
–snapshot-count=10000 \
–quota-backend-bytes=8589934592 \
–auto-compaction-retention=2h

# 部署Prometheus和Grafana
$ helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
$ helm install prometheus prometheus-community/kube-prometheus-stack
# 配置安全告警
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: security-alerts
namespace: monitoring
spec:
groups:
– name: security
rules:
– alert: PodSecurityPolicyViolation
expr: sum by (namespace, pod) (rate(kube_apiserver_admission_controller_admission_total{controller=”PodSecurityPolicy”,result=”rejected”}[5m])) > 0
for: 5m
labels:
severity: critical
annotations:
summary: “Pod Security Policy Violation”
description: “Pod {{ $labels.pod }} in namespace {{ $labels.namespace }} violated Pod Security Policy”
– alert: UnauthorizedAccess
expr: sum by (namespace) (rate(kube_apiserver_request_total{verb=”POST”,code=~”401|403″}[5m])) > 10
for: 5m
labels:
severity: critical
annotations:
summary: “Unauthorized Access Attempts”
description: “Multiple unauthorized access attempts to API server in namespace {{ $labels.namespace }}”
# 查看安全告警
$ kubectl get prometheusrules -n monitoring
$ kubectl get alerts -n monitoring

# 配置审计策略
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
– level: Metadata
resources:
– group: “”
resources: [“pods”, “services”, “deployments”]
– level: RequestResponse
resources:
– group: “”
resources: [“secrets”, “configmaps”]
– level: None
resources:
– group: “” # core
resources: [“events”]
# 启用审计日志
$ kube-apiserver \
–audit-log-path=/var/log/kubernetes/audit.log \
–audit-log-maxage=30 \
–audit-log-maxbackup=10 \
–audit-log-maxsize=100 \
–audit-policy-file=/etc/kubernetes/audit-policy.yaml
# 查看审计日志，from K8S+DB视频:www.itpux.com。
$ tail -f /var/log/kubernetes/audit.log
# 分析审计日志
$ kubectl logs -n kube-system deployment/kubernetes-dashboard | grep audit

# 常见问题及解决方案
## 1. 未授权访问
– 原因：RBAC配置不当，使用默认凭证
– 解决方案：配置严格的RBAC规则，使用强密码，启用多因素认证
## 2. 容器漏洞
– 原因：使用过时的容器镜像，未定期扫描漏洞
– 解决方案：使用官方镜像，定期更新镜像，扫描漏洞
## 3. 网络攻击
– 原因：网络策略配置不当，未限制网络访问
– 解决方案：配置严格的网络策略，限制Pod之间的通信
## 4. 配置错误
– 原因：安全配置错误，如使用特权容器
– 解决方案：使用Pod安全策略，禁止特权容器
## 5. 数据泄露
– 原因：敏感数据未加密，Secret配置不当
– 解决方案：加密敏感数据，使用Secret存储敏感信息