Kubernetes教程FG050-Kubernetes Pod Security Policies实战
本文档风哥主要介绍Kubernetes Pod Security Policies (PSP)实战，包括Pod Security Policies概述、Pod Security Policies工作原理、使用场景、Pod Security Policies规划、安全规划、最佳实践规划、Pod Security Policies实现、安全实现、管理实现、Pod Security Policies案例、安全案例、集成案例等内容，风哥教程参考Kubernetes官方文档和安全相关文档，适合想使用和理解Kubernetes安全管理的开发人员和运维人员。
Part01-基础概念与理论知识
1.1 Pod Security Policies概述
Pod Security Policies (PSP)是Kubernetes中用于控制Pod安全上下文的API对象，它定义了Pod可以使用的安全相关配置。
Pod Security Policies的主要特性包括：
- 安全上下文控制：控制Pod的安全上下文，如运行用户、特权模式等
- 卷访问控制：控制Pod可以使用的卷类型
- 主机访问控制：控制Pod对主机资源的访问
- 网络控制：控制Pod的网络相关配置
- 权限控制：通过RBAC控制谁可以使用哪些Pod Security Policies
1.2 Pod Security Policies工作原理
Pod Security Policies的工作原理：
- 策略定义：管理员定义Pod Security Policies，指定允许的安全配置
- 权限绑定：通过RBAC将Pod Security Policies绑定到用户、组或ServiceAccount
- Pod创建：当创建Pod时，Kubernetes会检查是否有匹配的Pod Security Policy
- 策略验证：验证Pod的安全配置是否符合Pod Security Policy的要求
- 安全上下文应用：如果验证通过，应用Pod Security Policy中定义的安全上下文
1.3 使用场景
Pod Security Policies的使用场景包括：
- 多租户环境：在多租户环境中，确保不同租户的Pod不会相互干扰
- 安全合规：确保Pod符合组织的安全合规要求
- 最小权限原则：确保Pod只拥有必要的权限
- 特权访问控制：控制哪些Pod可以使用特权模式
- 网络安全：控制Pod的网络相关配置，提高网络安全性
Part02-生产环境规划与建议
2.1 Pod Security Policies规划
Kubernetes Pod Security Policies的规划：
# Pod Security Policies规划
– 目标：
– 实现Pod的安全控制
– 确保Pod符合组织的安全合规要求
– 最小化安全风险
– 简化安全管理
– 范围：
– 安全需求分析
– Pod Security Policies设计
– RBAC配置
– 测试和验证
– 监控和告警
– 工具选择：
– kubectl：用于创建和管理Pod Security Policies
– RBAC：用于权限管理
– Prometheus：用于监控
– Grafana：用于可视化监控数据
– 流程设计：
– 安全需求分析：分析组织的安全需求和合规要求
– Pod Security Policies设计：设计符合需求的Pod Security Policies
– RBAC配置：配置RBAC权限，控制谁可以使用哪些Pod Security Policies
– 测试和验证：测试Pod Security Policies的效果，确保其正常工作
– 监控和告警：配置监控和告警，及时发现安全问题
– 资源分配：
– 人力资源：安全专家、集群管理员、运维人员
– 时间资源：设计时间、部署时间、测试时间
– 基础设施：计算资源、存储资源、网络资源
– 目标：
– 实现Pod的安全控制
– 确保Pod符合组织的安全合规要求
– 最小化安全风险
– 简化安全管理
– 范围：
– 安全需求分析
– Pod Security Policies设计
– RBAC配置
– 测试和验证
– 监控和告警
– 工具选择：
– kubectl：用于创建和管理Pod Security Policies
– RBAC：用于权限管理
– Prometheus：用于监控
– Grafana：用于可视化监控数据
– 流程设计：
– 安全需求分析：分析组织的安全需求和合规要求
– Pod Security Policies设计：设计符合需求的Pod Security Policies
– RBAC配置：配置RBAC权限，控制谁可以使用哪些Pod Security Policies
– 测试和验证：测试Pod Security Policies的效果，确保其正常工作
– 监控和告警：配置监控和告警，及时发现安全问题
– 资源分配：
– 人力资源：安全专家、集群管理员、运维人员
– 时间资源：设计时间、部署时间、测试时间
– 基础设施：计算资源、存储资源、网络资源
2.2 安全规划
Kubernetes安全的规划：
# 安全规划
– 目标：
– 确保Kubernetes集群的安全性
– 保护应用和数据的安全
– 符合组织的安全合规要求
– 最小化安全风险
– 范围：
– 集群安全
– 应用安全
– 数据安全
– 网络安全
– 身份和访问管理
– 工具选择：
– Pod Security Policies：用于控制Pod的安全上下文
– RBAC：用于身份和访问管理
– Network Policies：用于网络安全
– Secrets Management：用于管理敏感信息
– Audit Logging：用于审计
– 流程设计：
– 安全需求分析：分析组织的安全需求和合规要求
– 安全架构设计：设计符合需求的安全架构
– 安全配置：配置各种安全组件
– 测试和验证：测试安全配置的效果，确保其正常工作
– 监控和告警：配置监控和告警，及时发现安全问题
– 资源分配：
– 人力资源：安全专家、集群管理员、运维人员
– 时间资源：设计时间、部署时间、测试时间
– 基础设施：计算资源、存储资源、网络资源
– 目标：
– 确保Kubernetes集群的安全性
– 保护应用和数据的安全
– 符合组织的安全合规要求
– 最小化安全风险
– 范围：
– 集群安全
– 应用安全
– 数据安全
– 网络安全
– 身份和访问管理
– 工具选择：
– Pod Security Policies：用于控制Pod的安全上下文
– RBAC：用于身份和访问管理
– Network Policies：用于网络安全
– Secrets Management：用于管理敏感信息
– Audit Logging：用于审计
– 流程设计：
– 安全需求分析：分析组织的安全需求和合规要求
– 安全架构设计：设计符合需求的安全架构
– 安全配置：配置各种安全组件
– 测试和验证：测试安全配置的效果，确保其正常工作
– 监控和告警：配置监控和告警，及时发现安全问题
– 资源分配：
– 人力资源：安全专家、集群管理员、运维人员
– 时间资源：设计时间、部署时间、测试时间
– 基础设施：计算资源、存储资源、网络资源
2.3 最佳实践规划
Kubernetes Pod Security Policies的最佳实践规划：
# 最佳实践规划
– Pod Security Policies最佳实践：
– 遵循最小权限原则：只授予Pod必要的权限
– 使用多个Pod Security Policies：为不同类型的应用创建不同的Pod Security Policies
– 定期审查和更新：定期审查和更新Pod Security Policies，确保其符合最新的安全要求
– 测试Pod Security Policies：在生产环境中使用前，在测试环境中测试Pod Security Policies
– 监控Pod Security Policies：监控Pod Security Policies的使用情况，及时发现问题
– 安全最佳实践：
– 使用RBAC：使用RBAC控制谁可以使用哪些Pod Security Policies
– 限制特权模式：避免使用特权模式，只在必要时使用
– 限制主机访问：限制Pod对主机资源的访问
– 加密敏感数据：使用Secrets管理敏感数据，确保数据加密
– 定期安全审计：定期进行安全审计，发现和解决安全问题
– 部署最佳实践：
– 使用命名空间隔离：使用命名空间隔离不同的应用和环境
– 配置网络策略：使用网络策略控制Pod之间的通信
– 定期更新集群：定期更新Kubernetes集群，获取最新的安全补丁
– 监控安全事件：监控集群中的安全事件，及时发现和处理安全问题
– 备份和恢复：定期备份集群数据，确保在安全事件发生时能够快速恢复
– 运维最佳实践：
– 文档化安全配置：文档化所有的安全配置，便于维护和审计
– 培训和教育：对开发人员和运维人员进行安全培训，提高安全意识
– 应急响应计划：制定安全应急响应计划，确保在安全事件发生时能够快速响应
– 定期安全评估：定期进行安全评估，发现和解决安全问题
– 持续改进：持续改进安全配置和流程，提高安全性
– Pod Security Policies最佳实践：
– 遵循最小权限原则：只授予Pod必要的权限
– 使用多个Pod Security Policies：为不同类型的应用创建不同的Pod Security Policies
– 定期审查和更新：定期审查和更新Pod Security Policies，确保其符合最新的安全要求
– 测试Pod Security Policies：在生产环境中使用前，在测试环境中测试Pod Security Policies
– 监控Pod Security Policies：监控Pod Security Policies的使用情况，及时发现问题
– 安全最佳实践：
– 使用RBAC：使用RBAC控制谁可以使用哪些Pod Security Policies
– 限制特权模式：避免使用特权模式，只在必要时使用
– 限制主机访问：限制Pod对主机资源的访问
– 加密敏感数据：使用Secrets管理敏感数据，确保数据加密
– 定期安全审计：定期进行安全审计，发现和解决安全问题
– 部署最佳实践：
– 使用命名空间隔离：使用命名空间隔离不同的应用和环境
– 配置网络策略：使用网络策略控制Pod之间的通信
– 定期更新集群：定期更新Kubernetes集群，获取最新的安全补丁
– 监控安全事件：监控集群中的安全事件，及时发现和处理安全问题
– 备份和恢复：定期备份集群数据，确保在安全事件发生时能够快速恢复
– 运维最佳实践：
– 文档化安全配置：文档化所有的安全配置，便于维护和审计
– 培训和教育：对开发人员和运维人员进行安全培训，提高安全意识
– 应急响应计划：制定安全应急响应计划，确保在安全事件发生时能够快速响应
– 定期安全评估：定期进行安全评估，发现和解决安全问题
– 持续改进：持续改进安全配置和流程，提高安全性
Part03-生产环境项目实施方案
3.1 Pod Security Policies实现
Pod Security Policies实现的具体步骤：
# Pod Security Policies实现
1. 启用Pod Security Policies：
# 检查Pod Security Policies是否启用
$ kubectl api-versions | grep policy
# 输出
policy/v1beta1
2. 创建Pod Security Policy：
# 创建Pod Security Policy
$ cat > restrictive-psp.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restrictive-psp spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: - min: 1 max: 65535 EOF $ kubectl apply -f restrictive-psp.yaml # 创建特权Pod Security Policy $ cat > privileged-psp.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged-psp spec: privileged: true allowPrivilegeEscalation: true allowedCapabilities: - '*' volumes: - '*' hostNetwork: true hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' EOF $ kubectl apply -f privileged-psp.yaml 3. 查看Pod Security Policies： # 查看Pod Security Policies $ kubectl get psp # 输出 NAME PRIV CAPS SELINUX RUNASUSER FSGROUP SUPGROUP READONLYROOTFS VOLUMES privileged-psp true * RunAsAny RunAsAny RunAsAny RunAsAny false * restrictive-psp false RunAsAny MustRunAsNonRoot MustRunAs MustRunAs false configMap,emptyDir,projected,secret,downwardAPI,persistentVolumeClaim 4. 配置RBAC： # 创建ClusterRole $ cat > psp-clusterrole.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:restrictive rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: ['restrictive-psp'] EOF $ kubectl apply -f psp-clusterrole.yaml # 创建ClusterRoleBinding $ cat > psp-clusterrolebinding.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: psp:restrictive subjects: - kind: Group name: system:authenticated apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: psp:restrictive apiGroup: rbac.authorization.k8s.io EOF $ kubectl apply -f psp-clusterrolebinding.yaml 5. 测试Pod Security Policies： # 创建测试Pod $ cat > test-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: test-pod spec: containers: - name: test-container image: nginx:latest securityContext: runAsNonRoot: true EOF $ kubectl apply -f test-pod.yaml # 查看Pod状态 $ kubectl get pods # 输出 NAME READY STATUS RESTARTS AGE test-pod 1/1 Running 0 1m # 创建特权Pod $ cat > privileged-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: privileged-pod spec: containers: - name: privileged-container image: nginx:latest securityContext: privileged: true EOF $ kubectl apply -f privileged-pod.yaml # 查看Pod状态 $ kubectl get pods # 输出 NAME READY STATUS RESTARTS AGE privileged-pod 0/1 CreateContainerConfigError 0 1m # 查看Pod事件，风哥提示：。 $ kubectl describe pod privileged-pod # 输出 Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 2m default-scheduler Successfully assigned default/privileged-pod to node1 Warning FailedCreatePodSandBox 2m kubelet, node1 Failed to create pod sandbox: rpc error: code = Unknown desc = failed to create pod sandbox: failed to validate pod: [spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed] 6. 清理资源： # 清理Pod $ kubectl delete pod test-pod privileged-pod # 清理Pod Security Policies $ kubectl delete psp restrictive-psp privileged-psp # 清理RBAC $ kubectl delete clusterrole psp:restrictive $ kubectl delete clusterrolebinding psp:restrictive
1. 启用Pod Security Policies：
# 检查Pod Security Policies是否启用
$ kubectl api-versions | grep policy
# 输出
policy/v1beta1
2. 创建Pod Security Policy：
# 创建Pod Security Policy
$ cat > restrictive-psp.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restrictive-psp spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: - min: 1 max: 65535 EOF $ kubectl apply -f restrictive-psp.yaml # 创建特权Pod Security Policy $ cat > privileged-psp.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged-psp spec: privileged: true allowPrivilegeEscalation: true allowedCapabilities: - '*' volumes: - '*' hostNetwork: true hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' EOF $ kubectl apply -f privileged-psp.yaml 3. 查看Pod Security Policies： # 查看Pod Security Policies $ kubectl get psp # 输出 NAME PRIV CAPS SELINUX RUNASUSER FSGROUP SUPGROUP READONLYROOTFS VOLUMES privileged-psp true * RunAsAny RunAsAny RunAsAny RunAsAny false * restrictive-psp false RunAsAny MustRunAsNonRoot MustRunAs MustRunAs false configMap,emptyDir,projected,secret,downwardAPI,persistentVolumeClaim 4. 配置RBAC： # 创建ClusterRole $ cat > psp-clusterrole.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:restrictive rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: ['restrictive-psp'] EOF $ kubectl apply -f psp-clusterrole.yaml # 创建ClusterRoleBinding $ cat > psp-clusterrolebinding.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: psp:restrictive subjects: - kind: Group name: system:authenticated apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: psp:restrictive apiGroup: rbac.authorization.k8s.io EOF $ kubectl apply -f psp-clusterrolebinding.yaml 5. 测试Pod Security Policies： # 创建测试Pod $ cat > test-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: test-pod spec: containers: - name: test-container image: nginx:latest securityContext: runAsNonRoot: true EOF $ kubectl apply -f test-pod.yaml # 查看Pod状态 $ kubectl get pods # 输出 NAME READY STATUS RESTARTS AGE test-pod 1/1 Running 0 1m # 创建特权Pod $ cat > privileged-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: privileged-pod spec: containers: - name: privileged-container image: nginx:latest securityContext: privileged: true EOF $ kubectl apply -f privileged-pod.yaml # 查看Pod状态 $ kubectl get pods # 输出 NAME READY STATUS RESTARTS AGE privileged-pod 0/1 CreateContainerConfigError 0 1m # 查看Pod事件，风哥提示：。 $ kubectl describe pod privileged-pod # 输出 Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 2m default-scheduler Successfully assigned default/privileged-pod to node1 Warning FailedCreatePodSandBox 2m kubelet, node1 Failed to create pod sandbox: rpc error: code = Unknown desc = failed to create pod sandbox: failed to validate pod: [spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed] 6. 清理资源： # 清理Pod $ kubectl delete pod test-pod privileged-pod # 清理Pod Security Policies $ kubectl delete psp restrictive-psp privileged-psp # 清理RBAC $ kubectl delete clusterrole psp:restrictive $ kubectl delete clusterrolebinding psp:restrictive
3.2 安全实现
安全实现的具体步骤：
# 安全实现
1. 配置RBAC：
# 创建ServiceAccount
$ kubectl create serviceaccount app-sa
# 创建ClusterRole
$ cat > app-clusterrole.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: app-clusterrole rules: - apiGroups: [''] resources: ['pods'] verbs: ['get', 'list', 'create', 'update', 'delete'] EOF $ kubectl apply -f app-clusterrole.yaml # 创建ClusterRoleBinding $ cat > app-clusterrolebinding.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: app-clusterrolebinding subjects: - kind: ServiceAccount name: app-sa namespace: default roleRef: kind: ClusterRole name: app-clusterrole apiGroup: rbac.authorization.k8s.io EOF $ kubectl apply -f app-clusterrolebinding.yaml 2. 配置Network Policies： # 创建Network Policy $ cat > app-networkpolicy.yaml << 'EOF' apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: app-networkpolicy spec: podSelector: matchLabels: app: app policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 8080 egress: - to: - podSelector: matchLabels: app: database ports: - protocol: TCP port: 3306 EOF $ kubectl apply -f app-networkpolicy.yaml 3. 配置Secrets Management： # 创建Secret $ kubectl create secret generic app-secret --from-literal=username=fgedu --from-literal=password=password # 查看Secret $ kubectl get secrets # 输出 NAME TYPE DATA AGE app-secret Opaque 2 1m 4. 配置Audit Logging： # 配置审计日志 $ cat > audit-policy.yaml << 'EOF' apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: RequestResponse resources: - group: '' resources: ['pods'] EOF # 配置kube-apiserver # 在kube-apiserver的启动参数中添加： # --audit-policy-file=/etc/kubernetes/audit-policy.yaml # --audit-log-path=/var/log/kubernetes/audit.log 5. 测试安全配置： # 创建测试Pod $ cat > app-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: app-pod labels: app: app spec: serviceAccountName: app-sa containers: - name: app-container image: nginx:latest ports: - containerPort: 8080 env: - name: USERNAME valueFrom: secretKeyRef: name: app-secret key: username - name: PASSWORD valueFrom: secretKeyRef: name: app-secret key: password securityContext: runAsNonRoot: true EOF $ kubectl apply -f app-pod.yaml # 查看Pod状态 $ kubectl get pods # 输出 NAME READY STATUS RESTARTS AGE app-pod 1/1 Running 0 1m 6. 清理资源： # 清理Pod $ kubectl delete pod app-pod # 清理ServiceAccount $ kubectl delete serviceaccount app-sa # 清理RBAC $ kubectl delete clusterrole app-clusterrole $ kubectl delete clusterrolebinding app-clusterrolebinding # 清理Network Policy $ kubectl delete networkpolicy app-networkpolicy # 清理Secret $ kubectl delete secret app-secret
1. 配置RBAC：
# 创建ServiceAccount
$ kubectl create serviceaccount app-sa
# 创建ClusterRole
$ cat > app-clusterrole.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: app-clusterrole rules: - apiGroups: [''] resources: ['pods'] verbs: ['get', 'list', 'create', 'update', 'delete'] EOF $ kubectl apply -f app-clusterrole.yaml # 创建ClusterRoleBinding $ cat > app-clusterrolebinding.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: app-clusterrolebinding subjects: - kind: ServiceAccount name: app-sa namespace: default roleRef: kind: ClusterRole name: app-clusterrole apiGroup: rbac.authorization.k8s.io EOF $ kubectl apply -f app-clusterrolebinding.yaml 2. 配置Network Policies： # 创建Network Policy $ cat > app-networkpolicy.yaml << 'EOF' apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: app-networkpolicy spec: podSelector: matchLabels: app: app policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 8080 egress: - to: - podSelector: matchLabels: app: database ports: - protocol: TCP port: 3306 EOF $ kubectl apply -f app-networkpolicy.yaml 3. 配置Secrets Management： # 创建Secret $ kubectl create secret generic app-secret --from-literal=username=fgedu --from-literal=password=password # 查看Secret $ kubectl get secrets # 输出 NAME TYPE DATA AGE app-secret Opaque 2 1m 4. 配置Audit Logging： # 配置审计日志 $ cat > audit-policy.yaml << 'EOF' apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: RequestResponse resources: - group: '' resources: ['pods'] EOF # 配置kube-apiserver # 在kube-apiserver的启动参数中添加： # --audit-policy-file=/etc/kubernetes/audit-policy.yaml # --audit-log-path=/var/log/kubernetes/audit.log 5. 测试安全配置： # 创建测试Pod $ cat > app-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: app-pod labels: app: app spec: serviceAccountName: app-sa containers: - name: app-container image: nginx:latest ports: - containerPort: 8080 env: - name: USERNAME valueFrom: secretKeyRef: name: app-secret key: username - name: PASSWORD valueFrom: secretKeyRef: name: app-secret key: password securityContext: runAsNonRoot: true EOF $ kubectl apply -f app-pod.yaml # 查看Pod状态 $ kubectl get pods # 输出 NAME READY STATUS RESTARTS AGE app-pod 1/1 Running 0 1m 6. 清理资源： # 清理Pod $ kubectl delete pod app-pod # 清理ServiceAccount $ kubectl delete serviceaccount app-sa # 清理RBAC $ kubectl delete clusterrole app-clusterrole $ kubectl delete clusterrolebinding app-clusterrolebinding # 清理Network Policy $ kubectl delete networkpolicy app-networkpolicy # 清理Secret $ kubectl delete secret app-secret
3.3 管理实现
Pod Security Policies管理的具体步骤。，风哥提示：。
# 管理实现
1. 监控Pod Security Policies：
# 安装Prometheus和Grafana
$ helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
$ helm repo update
$ helm install prometheus prometheus-community/kube-prometheus-stack
# 查看监控面板，学习交流加群风哥微信: itpux-com。
$ kubectl port-forward deployment/prometheus-grafana 3000:3000
# 打开浏览器访问 http://localhost:3000
2. 配置Pod Security Policies告警：
# 创建告警规则
$ cat > psp-alert.yaml << 'EOF' apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: psp-alerts spec: groups: - name: pod-security-policies rules: - alert: PodSecurityPolicyViolation expr: sum by (namespace, pod) (rate(kube_apiserver_admission_controller_admission_total{controller="PodSecurityPolicy",result="denied"}[5m])) > 0
for: 5m
labels:
severity: critical
annotations:
summary: “Pod Security Policy violation”
description: “Pod {{ $labels.pod }} in namespace {{ $labels.namespace }} has violated Pod Security Policy”
EOF
$ kubectl apply -f psp-alert.yaml
3. 管理Pod Security Policies：
# 列出所有Pod Security Policies
$ kubectl get psp
# 查看Pod Security Policy详情
$ kubectl describe psp restrictive-psp
# 更新Pod Security Policy
$ kubectl patch psp restrictive-psp -p ‘{“spec”:{“allowedCapabilities”:[“NET_ADMIN”]}}’
# 删除Pod Security Policy
$ kubectl delete psp restrictive-psp
4. 查看Pod Security Policies使用情况：
# 查看Pod的安全上下文
$ kubectl get pod test-pod -o jsonpath='{.spec.securityContext}’
# 查看Pod的事件
$ kubectl get events –field-selector involvedObject.kind=Pod
5. 配置Pod Security Policies的最佳实践：
# 创建多个Pod Security Policies
$ cat > psps.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted-psp spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: - min: 1 max: 65535 --- apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged-psp spec: privileged: true allowPrivilegeEscalation: true allowedCapabilities: - '*' volumes: - '*' hostNetwork: true hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' EOF $ kubectl apply -f psps.yaml # 配置RBAC $ cat > psp-rbac.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:restricted rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: ['restricted-psp'] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:privileged rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: ['privileged-psp'] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: psp:restricted subjects: - kind: Group name: system:authenticated apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: psp:restricted apiGroup: rbac.authorization.k8s.io --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: psp:privileged subjects: - kind: Group name: system:masters apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: psp:privileged apiGroup: rbac.authorization.k8s.io EOF $ kubectl apply -f psp-rbac.yaml
1. 监控Pod Security Policies：
# 安装Prometheus和Grafana
$ helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
$ helm repo update
$ helm install prometheus prometheus-community/kube-prometheus-stack
# 查看监控面板，学习交流加群风哥微信: itpux-com。
$ kubectl port-forward deployment/prometheus-grafana 3000:3000
# 打开浏览器访问 http://localhost:3000
2. 配置Pod Security Policies告警：
# 创建告警规则
$ cat > psp-alert.yaml << 'EOF' apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: psp-alerts spec: groups: - name: pod-security-policies rules: - alert: PodSecurityPolicyViolation expr: sum by (namespace, pod) (rate(kube_apiserver_admission_controller_admission_total{controller="PodSecurityPolicy",result="denied"}[5m])) > 0
for: 5m
labels:
severity: critical
annotations:
summary: “Pod Security Policy violation”
description: “Pod {{ $labels.pod }} in namespace {{ $labels.namespace }} has violated Pod Security Policy”
EOF
$ kubectl apply -f psp-alert.yaml
3. 管理Pod Security Policies：
# 列出所有Pod Security Policies
$ kubectl get psp
# 查看Pod Security Policy详情
$ kubectl describe psp restrictive-psp
# 更新Pod Security Policy
$ kubectl patch psp restrictive-psp -p ‘{“spec”:{“allowedCapabilities”:[“NET_ADMIN”]}}’
# 删除Pod Security Policy
$ kubectl delete psp restrictive-psp
4. 查看Pod Security Policies使用情况：
# 查看Pod的安全上下文
$ kubectl get pod test-pod -o jsonpath='{.spec.securityContext}’
# 查看Pod的事件
$ kubectl get events –field-selector involvedObject.kind=Pod
5. 配置Pod Security Policies的最佳实践：
# 创建多个Pod Security Policies
$ cat > psps.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted-psp spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: - min: 1 max: 65535 --- apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged-psp spec: privileged: true allowPrivilegeEscalation: true allowedCapabilities: - '*' volumes: - '*' hostNetwork: true hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' EOF $ kubectl apply -f psps.yaml # 配置RBAC $ cat > psp-rbac.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:restricted rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: ['restricted-psp'] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:privileged rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: ['privileged-psp'] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: psp:restricted subjects: - kind: Group name: system:authenticated apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: psp:restricted apiGroup: rbac.authorization.k8s.io --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: psp:privileged subjects: - kind: Group name: system:masters apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: psp:privileged apiGroup: rbac.authorization.k8s.io EOF $ kubectl apply -f psp-rbac.yaml
Part04-生产案例与实战讲解
4.1 Pod Security Policies案例
Pod Security Policies的实战案例。。
# 案例：使用Pod Security Policies保护多租户集群
# 场景：在多租户Kubernetes集群中，使用Pod Security Policies确保不同租户的Pod不会相互干扰
# 问题：
– 多租户集群中，不同租户的Pod可能会相互干扰
– 某些租户可能会创建特权Pod，影响集群安全
– 需要确保所有Pod符合组织的安全合规要求
# 解决方案：
1. 启用Pod Security Policies：
# 检查Pod Security Policies是否启用
$ kubectl api-versions | grep policy
# 输出
policy/v1beta1
2. 创建Pod Security Policies：
# 创建严格的Pod Security Policy，学习交流加群风哥QQ113257174。
$ cat > restricted-psp.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted-psp spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: - min: 1 max: 65535 EOF $ kubectl apply -f restricted-psp.yaml # 创建特权Pod Security Policy $ cat > privileged-psp.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged-psp spec: privileged: true allowPrivilegeEscalation: true allowedCapabilities: - '*' volumes: - '*' hostNetwork: true hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' EOF $ kubectl apply -f privileged-psp.yaml 3. 配置RBAC： # 创建ClusterRoles $ cat > psp-clusterroles.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:restricted rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: ['restricted-psp'] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:privileged rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: ['privileged-psp'] EOF $ kubectl apply -f psp-clusterroles.yaml # 创建ClusterRoleBindings $ cat > psp-clusterrolebindings.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: psp:restricted subjects: - kind: Group name: system:authenticated apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: psp:restricted apiGroup: rbac.authorization.k8s.io --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: psp:privileged subjects: - kind: Group name: system:masters apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: psp:privileged apiGroup: rbac.authorization.k8s.io EOF $ kubectl apply -f psp-clusterrolebindings.yaml 4. 创建命名空间： # 创建租户命名空间 $ kubectl create namespace tenant1 $ kubectl create namespace tenant2 5. 测试Pod Security Policies： # 在tenant1命名空间中创建Pod $ cat > tenant1-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: tenant1-pod namespace: tenant1 spec: containers: - name: tenant1-container image: nginx:latest securityContext: runAsNonRoot: true EOF $ kubectl apply -f tenant1-pod.yaml # 查看Pod状态 $ kubectl get pods -n tenant1 # 输出 NAME READY STATUS RESTARTS AGE tenant1-pod 1/1 Running 0 1m # 尝试在tenant1命名空间中创建特权Pod $ cat > tenant1-privileged-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: tenant1-privileged-pod namespace: tenant1 spec: containers: - name: tenant1-privileged-container image: nginx:latest securityContext: privileged: true EOF $ kubectl apply -f tenant1-privileged-pod.yaml # 查看Pod状态 $ kubectl get pods -n tenant1 # 输出 NAME READY STATUS RESTARTS AGE tenant1-pod 1/1 Running 0 2m tenant1-privileged-pod 0/1 CreateContainerConfigError 0 1m # 查看Pod事件 $ kubectl describe pod tenant1-privileged-pod -n tenant1 # 输出 Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 2m default-scheduler Successfully assigned tenant1/tenant1-privileged-pod to node1 Warning FailedCreatePodSandBox 2m kubelet, node1 Failed to create pod sandbox: rpc error: code = Unknown desc = failed to create pod sandbox: failed to validate pod: [spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed]，更多视频教程www.fgedu.net.cn。 6. 清理资源： # 清理Pod $ kubectl delete pod tenant1-pod tenant1-privileged-pod -n tenant1 # 清理命名空间 $ kubectl delete namespace tenant1 tenant2 # 清理Pod Security Policies $ kubectl delete psp restricted-psp privileged-psp # 清理RBAC $ kubectl delete clusterrole psp:restricted psp:privileged $ kubectl delete clusterrolebinding psp:restricted psp:privileged # 输出结果： # Pod Security Policies配置成功 # 普通Pod创建成功 # 特权Pod创建失败 # 多租户集群的安全性得到保障
# 场景：在多租户Kubernetes集群中，使用Pod Security Policies确保不同租户的Pod不会相互干扰
# 问题：
– 多租户集群中，不同租户的Pod可能会相互干扰
– 某些租户可能会创建特权Pod，影响集群安全
– 需要确保所有Pod符合组织的安全合规要求
# 解决方案：
1. 启用Pod Security Policies：
# 检查Pod Security Policies是否启用
$ kubectl api-versions | grep policy
# 输出
policy/v1beta1
2. 创建Pod Security Policies：
# 创建严格的Pod Security Policy，学习交流加群风哥QQ113257174。
$ cat > restricted-psp.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted-psp spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: - min: 1 max: 65535 EOF $ kubectl apply -f restricted-psp.yaml # 创建特权Pod Security Policy $ cat > privileged-psp.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged-psp spec: privileged: true allowPrivilegeEscalation: true allowedCapabilities: - '*' volumes: - '*' hostNetwork: true hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' EOF $ kubectl apply -f privileged-psp.yaml 3. 配置RBAC： # 创建ClusterRoles $ cat > psp-clusterroles.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:restricted rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: ['restricted-psp'] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:privileged rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: ['privileged-psp'] EOF $ kubectl apply -f psp-clusterroles.yaml # 创建ClusterRoleBindings $ cat > psp-clusterrolebindings.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: psp:restricted subjects: - kind: Group name: system:authenticated apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: psp:restricted apiGroup: rbac.authorization.k8s.io --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: psp:privileged subjects: - kind: Group name: system:masters apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: psp:privileged apiGroup: rbac.authorization.k8s.io EOF $ kubectl apply -f psp-clusterrolebindings.yaml 4. 创建命名空间： # 创建租户命名空间 $ kubectl create namespace tenant1 $ kubectl create namespace tenant2 5. 测试Pod Security Policies： # 在tenant1命名空间中创建Pod $ cat > tenant1-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: tenant1-pod namespace: tenant1 spec: containers: - name: tenant1-container image: nginx:latest securityContext: runAsNonRoot: true EOF $ kubectl apply -f tenant1-pod.yaml # 查看Pod状态 $ kubectl get pods -n tenant1 # 输出 NAME READY STATUS RESTARTS AGE tenant1-pod 1/1 Running 0 1m # 尝试在tenant1命名空间中创建特权Pod $ cat > tenant1-privileged-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: tenant1-privileged-pod namespace: tenant1 spec: containers: - name: tenant1-privileged-container image: nginx:latest securityContext: privileged: true EOF $ kubectl apply -f tenant1-privileged-pod.yaml # 查看Pod状态 $ kubectl get pods -n tenant1 # 输出 NAME READY STATUS RESTARTS AGE tenant1-pod 1/1 Running 0 2m tenant1-privileged-pod 0/1 CreateContainerConfigError 0 1m # 查看Pod事件 $ kubectl describe pod tenant1-privileged-pod -n tenant1 # 输出 Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 2m default-scheduler Successfully assigned tenant1/tenant1-privileged-pod to node1 Warning FailedCreatePodSandBox 2m kubelet, node1 Failed to create pod sandbox: rpc error: code = Unknown desc = failed to create pod sandbox: failed to validate pod: [spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed]，更多视频教程www.fgedu.net.cn。 6. 清理资源： # 清理Pod $ kubectl delete pod tenant1-pod tenant1-privileged-pod -n tenant1 # 清理命名空间 $ kubectl delete namespace tenant1 tenant2 # 清理Pod Security Policies $ kubectl delete psp restricted-psp privileged-psp # 清理RBAC $ kubectl delete clusterrole psp:restricted psp:privileged $ kubectl delete clusterrolebinding psp:restricted psp:privileged # 输出结果： # Pod Security Policies配置成功 # 普通Pod创建成功 # 特权Pod创建失败 # 多租户集群的安全性得到保障
4.2 安全案例
安全的实战案例。
# 案例：使用Pod Security Policies和其他安全组件保护集群
# 场景：部署一个完整的安全解决方案，包括Pod Security Policies、RBAC、Network Policies和Secrets Management
# 问题：
– 需要全面保护Kubernetes集群的安全
– 需要确保应用和数据的安全
– 需要符合组织的安全合规要求
# 解决方案：
1. 启用Pod Security Policies：
# 检查Pod Security Policies是否启用
$ kubectl api-versions | grep policy
# 输出
policy/v1beta1
2. 创建Pod Security Policies：
# 创建严格的Pod Security Policy
$ cat > restricted-psp.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted-psp spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: - min: 1 max: 65535 EOF $ kubectl apply -f restricted-psp.yaml 3. 配置RBAC： # 创建ServiceAccount $ kubectl create serviceaccount app-sa # 创建ClusterRole $ cat > app-clusterrole.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: app-clusterrole rules: - apiGroups: [''] resources: ['pods', 'services'] verbs: ['get', 'list', 'create', 'update', 'delete'] - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: ['restricted-psp'] EOF $ kubectl apply -f app-clusterrole.yaml # 创建ClusterRoleBinding $ cat > app-clusterrolebinding.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: app-clusterrolebinding subjects: - kind: ServiceAccount name: app-sa namespace: default roleRef: kind: ClusterRole name: app-clusterrole apiGroup: rbac.authorization.k8s.io EOF $ kubectl apply -f app-clusterrolebinding.yaml 4. 配置Network Policies： # 创建Network Policy $ cat > app-networkpolicy.yaml << 'EOF' apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: app-networkpolicy spec: podSelector: matchLabels: app: app policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 8080 egress: - to: - podSelector: matchLabels: app: database ports: - protocol: TCP port: 3306 EOF $ kubectl apply -f app-networkpolicy.yaml 5. 配置Secrets Management： # 创建Secret $ kubectl create secret generic app-secret --from-literal=username=fgedu --from-literal=password=password 6. 部署应用： # 创建应用Pod $ cat > app-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: app-pod labels: app: app spec: serviceAccountName: app-sa containers: - name: app-container image: nginx:latest ports: - containerPort: 8080 env: - name: USERNAME valueFrom: secretKeyRef: name: app-secret key: username - name: PASSWORD valueFrom: secretKeyRef: name: app-secret key: password securityContext:，更多学习教程公众号风哥教程itpux_com。 runAsNonRoot: true EOF $ kubectl apply -f app-pod.yaml # 创建前端Pod $ cat > frontend-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: frontend-pod labels: app: frontend spec: containers: - name: frontend-container image: nginx:latest ports: - containerPort: 80 EOF $ kubectl apply -f frontend-pod.yaml # 创建数据库Pod $ cat > database-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: database-pod labels: app: database spec: containers: - name: database-container image: mysql:8.0 ports: - containerPort: 3306 env: - name: MYSQL_ROOT_PASSWORD value: password - name: MYSQL_DATABASE value: fgedudb EOF $ kubectl apply -f database-pod.yaml 7. 测试安全配置： # 查看Pod状态 $ kubectl get pods # 输出 NAME READY STATUS RESTARTS AGE app-pod 1/1 Running 0 1m frontend-pod 1/1 Running 0 1m database-pod 1/1 Running 0 1m # 测试网络策略 $ kubectl exec frontend-pod -- curl app-pod:8080 # 输出
# 场景：部署一个完整的安全解决方案，包括Pod Security Policies、RBAC、Network Policies和Secrets Management
# 问题：
– 需要全面保护Kubernetes集群的安全
– 需要确保应用和数据的安全
– 需要符合组织的安全合规要求
# 解决方案：
1. 启用Pod Security Policies：
# 检查Pod Security Policies是否启用
$ kubectl api-versions | grep policy
# 输出
policy/v1beta1
2. 创建Pod Security Policies：
# 创建严格的Pod Security Policy
$ cat > restricted-psp.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted-psp spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: - min: 1 max: 65535 EOF $ kubectl apply -f restricted-psp.yaml 3. 配置RBAC： # 创建ServiceAccount $ kubectl create serviceaccount app-sa # 创建ClusterRole $ cat > app-clusterrole.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: app-clusterrole rules: - apiGroups: [''] resources: ['pods', 'services'] verbs: ['get', 'list', 'create', 'update', 'delete'] - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: ['restricted-psp'] EOF $ kubectl apply -f app-clusterrole.yaml # 创建ClusterRoleBinding $ cat > app-clusterrolebinding.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: app-clusterrolebinding subjects: - kind: ServiceAccount name: app-sa namespace: default roleRef: kind: ClusterRole name: app-clusterrole apiGroup: rbac.authorization.k8s.io EOF $ kubectl apply -f app-clusterrolebinding.yaml 4. 配置Network Policies： # 创建Network Policy $ cat > app-networkpolicy.yaml << 'EOF' apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: app-networkpolicy spec: podSelector: matchLabels: app: app policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 8080 egress: - to: - podSelector: matchLabels: app: database ports: - protocol: TCP port: 3306 EOF $ kubectl apply -f app-networkpolicy.yaml 5. 配置Secrets Management： # 创建Secret $ kubectl create secret generic app-secret --from-literal=username=fgedu --from-literal=password=password 6. 部署应用： # 创建应用Pod $ cat > app-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: app-pod labels: app: app spec: serviceAccountName: app-sa containers: - name: app-container image: nginx:latest ports: - containerPort: 8080 env: - name: USERNAME valueFrom: secretKeyRef: name: app-secret key: username - name: PASSWORD valueFrom: secretKeyRef: name: app-secret key: password securityContext:，更多学习教程公众号风哥教程itpux_com。 runAsNonRoot: true EOF $ kubectl apply -f app-pod.yaml # 创建前端Pod $ cat > frontend-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: frontend-pod labels: app: frontend spec: containers: - name: frontend-container image: nginx:latest ports: - containerPort: 80 EOF $ kubectl apply -f frontend-pod.yaml # 创建数据库Pod $ cat > database-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: database-pod labels: app: database spec: containers: - name: database-container image: mysql:8.0 ports: - containerPort: 3306 env: - name: MYSQL_ROOT_PASSWORD value: password - name: MYSQL_DATABASE value: fgedudb EOF $ kubectl apply -f database-pod.yaml 7. 测试安全配置： # 查看Pod状态 $ kubectl get pods # 输出 NAME READY STATUS RESTARTS AGE app-pod 1/1 Running 0 1m frontend-pod 1/1 Running 0 1m database-pod 1/1 Running 0 1m # 测试网络策略 $ kubectl exec frontend-pod -- curl app-pod:8080 # 输出
Welcome to nginx!
…
# 测试Pod Security Policies
$ cat > privileged-pod.yaml << 'EOF'
apiVersion: v1
kind: Pod
metadata:
name: privileged-pod
spec:
containers:
- name: privileged-container
image: nginx:latest
securityContext:
privileged: true
EOF
$ kubectl apply -f privileged-pod.yaml
# 查看Pod状态
$ kubectl get pods
# 输出
NAME READY STATUS RESTARTS AGE
app-pod 1/1 Running 0 2m
frontend-pod 1/1 Running 0 2m
database-pod 1/1 Running 0 2m
privileged-pod 0/1 CreateContainerConfigError 0 1m
8. 清理资源：
# 清理Pod
$ kubectl delete pod app-pod frontend-pod database-pod privileged-pod
# 清理ServiceAccount
$ kubectl delete serviceaccount app-sa
# 清理RBAC
$ kubectl delete clusterrole app-clusterrole
$ kubectl delete clusterrolebinding app-clusterrolebinding
# 清理Network Policy
$ kubectl delete networkpolicy app-networkpolicy
# 清理Secret
$ kubectl delete secret app-secret
# 清理Pod Security Policy
$ kubectl delete psp restricted-psp
# 输出结果：
# 安全组件配置成功
# 应用部署成功
# 网络策略生效
# Pod Security Policies生效
# 集群安全性得到保障
4.3 集成案例
Pod Security Policies的集成案例。。
# 案例：使用Pod Security Policies和云服务提供商的安全服务集成
# 场景：部署一个使用Pod Security Policies和云服务提供商安全服务的完整解决方案
# 问题：
– 需要与云服务提供商的安全服务集成
– 需要确保集群的安全性
– 需要符合组织的安全合规要求
# 解决方案：
1. 启用Pod Security Policies：
# 检查Pod Security Policies是否启用
$ kubectl api-versions | grep policy
# 输出
policy/v1beta1
2. 创建Pod Security Policies：
# 创建严格的Pod Security Policy
$ cat > restricted-psp.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted-psp spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: - min: 1 max: 65535 EOF $ kubectl apply -f restricted-psp.yaml 3. 配置RBAC： # 创建ClusterRole $ cat > psp-clusterrole.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:restricted rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies']，from K8S+DB视频:www.itpux.com。 verbs: ['use'] resourceNames: ['restricted-psp'] EOF $ kubectl apply -f psp-clusterrole.yaml # 创建ClusterRoleBinding $ cat > psp-clusterrolebinding.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: psp:restricted subjects: - kind: Group name: system:authenticated apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole。 name: psp:restricted apiGroup: rbac.authorization.k8s.io EOF $ kubectl apply -f psp-clusterrolebinding.yaml 4. 集成云服务提供商的安全服务： # 在AWS上集成Amazon GuardDuty # 启用Amazon GuardDuty $ aws guardduty create-detector --enable # 在GCP上集成Cloud Security Command Center # 启用Cloud Security Command Center $ gcloud services enable securitycenter.googleapis.com # 在Azure上集成Azure Security Center # 启用Azure Security Center $ az security pricing create --name "VirtualMachines" --tier "Standard" 5. 部署应用： # 创建应用Pod $ cat > app-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: app-pod labels: app: app spec: containers: - name: app-container image: nginx:latest ports: - containerPort: 8080 securityContext: runAsNonRoot: true EOF $ kubectl apply -f app-pod.yaml 6. 测试安全配置： # 查看Pod状态 $ kubectl get pods # 输出 NAME READY STATUS RESTARTS AGE app-pod 1/1 Running 0 1m # 尝试创建特权Pod $ cat > privileged-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: privileged-pod spec: containers: - name: privileged-container image: nginx:latest securityContext: privileged: true EOF $ kubectl apply -f privileged-pod.yaml # 查看Pod状态 $ kubectl get pods # 输出 NAME READY STATUS RESTARTS AGE app-pod 1/1 Running 0 2m privileged-pod 0/1 CreateContainerConfigError 0 1m 7. 查看云服务提供商的安全服务： # 在AWS上查看GuardDuty findings $ aws guardduty list-findings --detector-id 1234567890abcdef # 在GCP上查看Security Command Center findings $ gcloud scc findings list --organization 1234567890 # 在Azure上查看Security Center recommendations $ az security recommendation list 8. 清理资源： # 清理Pod $ kubectl delete pod app-pod privileged-pod # 清理Pod Security Policy $ kubectl delete psp restricted-psp # 清理RBAC $ kubectl delete clusterrole psp:restricted $ kubectl delete clusterrolebinding psp:restricted # 输出结果： # Pod Security Policies配置成功 # 云服务提供商安全服务集成成功 # 安全配置生效 # 集群安全性得到保障
# 场景：部署一个使用Pod Security Policies和云服务提供商安全服务的完整解决方案
# 问题：
– 需要与云服务提供商的安全服务集成
– 需要确保集群的安全性
– 需要符合组织的安全合规要求
# 解决方案：
1. 启用Pod Security Policies：
# 检查Pod Security Policies是否启用
$ kubectl api-versions | grep policy
# 输出
policy/v1beta1
2. 创建Pod Security Policies：
# 创建严格的Pod Security Policy
$ cat > restricted-psp.yaml << 'EOF' apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted-psp spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: - min: 1 max: 65535 EOF $ kubectl apply -f restricted-psp.yaml 3. 配置RBAC： # 创建ClusterRole $ cat > psp-clusterrole.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:restricted rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies']，from K8S+DB视频:www.itpux.com。 verbs: ['use'] resourceNames: ['restricted-psp'] EOF $ kubectl apply -f psp-clusterrole.yaml # 创建ClusterRoleBinding $ cat > psp-clusterrolebinding.yaml << 'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: psp:restricted subjects: - kind: Group name: system:authenticated apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole。 name: psp:restricted apiGroup: rbac.authorization.k8s.io EOF $ kubectl apply -f psp-clusterrolebinding.yaml 4. 集成云服务提供商的安全服务： # 在AWS上集成Amazon GuardDuty # 启用Amazon GuardDuty $ aws guardduty create-detector --enable # 在GCP上集成Cloud Security Command Center # 启用Cloud Security Command Center $ gcloud services enable securitycenter.googleapis.com # 在Azure上集成Azure Security Center # 启用Azure Security Center $ az security pricing create --name "VirtualMachines" --tier "Standard" 5. 部署应用： # 创建应用Pod $ cat > app-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: app-pod labels: app: app spec: containers: - name: app-container image: nginx:latest ports: - containerPort: 8080 securityContext: runAsNonRoot: true EOF $ kubectl apply -f app-pod.yaml 6. 测试安全配置： # 查看Pod状态 $ kubectl get pods # 输出 NAME READY STATUS RESTARTS AGE app-pod 1/1 Running 0 1m # 尝试创建特权Pod $ cat > privileged-pod.yaml << 'EOF' apiVersion: v1 kind: Pod metadata: name: privileged-pod spec: containers: - name: privileged-container image: nginx:latest securityContext: privileged: true EOF $ kubectl apply -f privileged-pod.yaml # 查看Pod状态 $ kubectl get pods # 输出 NAME READY STATUS RESTARTS AGE app-pod 1/1 Running 0 2m privileged-pod 0/1 CreateContainerConfigError 0 1m 7. 查看云服务提供商的安全服务： # 在AWS上查看GuardDuty findings $ aws guardduty list-findings --detector-id 1234567890abcdef # 在GCP上查看Security Command Center findings $ gcloud scc findings list --organization 1234567890 # 在Azure上查看Security Center recommendations $ az security recommendation list 8. 清理资源： # 清理Pod $ kubectl delete pod app-pod privileged-pod # 清理Pod Security Policy $ kubectl delete psp restricted-psp # 清理RBAC $ kubectl delete clusterrole psp:restricted $ kubectl delete clusterrolebinding psp:restricted # 输出结果： # Pod Security Policies配置成功 # 云服务提供商安全服务集成成功 # 安全配置生效 # 集群安全性得到保障
Part05-风哥经验总结与分享
5.1 Pod Security Policies使用技巧
Kubernetes Pod Security Policies使用的技巧：
- 遵循最小权限原则：只授予Pod必要的权限，避免过度授权
- 使用多个Pod Security Policies：为不同类型的应用创建不同的Pod Security Policies，提高安全性
- 定期审查和更新：定期审查和更新Pod Security Policies，确保其符合最新的安全要求
- 测试Pod Security Policies：在生产环境中使用前，在测试环境中测试Pod Security Policies，确保其正常工作
- 监控Pod Security Policies：监控Pod Security Policies的使用情况，及时发现问题
- 配置RBAC：使用RBAC控制谁可以使用哪些Pod Security Policies，提高安全性
- 限制特权模式：避免使用特权模式，只在必要时使用
- 限制主机访问：限制Pod对主机资源的访问，提高安全性
5.2 安全管理技巧
Kubernetes安全管理的技巧：
- 综合安全策略：结合使用Pod Security Policies、RBAC、Network Policies等多种安全组件，构建全面的安全策略
- 定期安全审计：定期进行安全审计，发现和解决安全问题
- 持续安全监控：配置持续的安全监控，及时发现安全事件
- 安全培训：对开发人员和运维人员进行安全培训，提高安全意识
- 安全应急响应：制定安全应急响应计划，确保在安全事件发生时能够快速响应
- 定期更新集群：定期更新Kubernetes集群，获取最新的安全补丁
- 使用安全工具：使用安全工具，如漏洞扫描、安全评估等，提高安全性
- 文档化安全配置：文档化所有的安全配置，便于维护和审计
5.3 未来趋势
Kubernetes安全的未来趋势：
- Pod Security Admission：Kubernetes将逐步淘汰Pod Security Policies，转向Pod Security Admission（PSA）
- 更细粒度的安全控制：提供更细粒度的安全控制，如Pod Security Standards（PSS）
- 智能化安全：使用AI技术实现智能化安全管理，自动识别和处理安全问题
- 多云安全：支持在多个云服务提供商之间实现统一的安全策略
- 边缘计算安全：扩展安全控制到边缘节点，支持边缘计算场景
- 零信任安全：采用零信任安全模型，提高安全性
- 安全自动化：实现安全配置的自动化，减少人工干预
- 安全合规：提供更完善的安全合规功能，满足不同行业的合规要求
本文由风哥教程整理发布,仅用于学习测试使用,转载注明出处:http://www.fgedu.net.cn/10327.html
