Logo

【揭秘K8s集群】安全配置与防护之道，保障容器化应用安全无忧

作者：用户JGZZ 更新时间：2025-05-29 06:51:10 阅读时间： 2分钟

引言

随着云计算和容器技术的快速发展，Kubernetes（K8s）已经成为容器编排领域的领导者。K8s集群的安全配置与防护对于保障容器化应用的安全至关重要。本文将深入探讨K8s集群的安全配置与防护之道，帮助您构建一个安全无忧的容器化应用环境。

K8s集群安全概述

Kubernetes集群的安全性主要涉及以下几个方面：

  1. 认证（Authentication）：确保只有授权用户才能访问K8s API。
  2. 授权（Authorization）：控制用户对资源的访问权限。
  3. 准入控制（Admission Control）：在资源被创建或修改之前进行检查，确保其符合安全策略。
  4. 网络策略（Network Policies）：控制Pod之间的通信。
  5. 容器镜像安全：确保容器镜像的安全性。
  6. 集群审计与监控：实时监控集群状态，及时发现并处理安全事件。

K8s集群安全配置

1. 基础系统安全配置

  • 系统时间同步：安装NTP服务并配置可靠的NTP服务器，确保系统时间同步。
sudo apt update
sudo apt install ntpdate ntp
sudo ntpdate ntp1.aliyun.com
  • 禁用Swap功能：Kubernetes要求所有节点禁用Swap，通过编辑/etc/fstab文件并注释掉Swap行实现，然后执行swapoff --all命令。
sudo swapoff --all
  • 配置容器运行时环境：推荐使用Docker或Containerd作为容器运行时。
sudo apt-get update
sudo apt-get install docker.io

2. 网络策略

  • 创建网络策略：限制Pod之间的通信。
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend-to-frontend
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: frontend
  policyTypes:
  - Ingress
  - Egress

3. 镜像安全

  • 利用ImagePolicyWebhook策略管理镜像来源：防止使用未经验证的镜像。
apiVersion: policy/v1
kind: PodSecurityPolicy
metadata:
  name: strict-image-policy
spec:
  podSecurityContext:
    runAsUser: 1000
  runAsGroup: 3000
  fsGroup: 2000
  seLinux: {}
  supplementalGroups: [3000]
  allowedCapabilities: ['NET_ADMIN', 'SYS_ADMIN']
  forbiddenCapabilities: ['ALL']
  volumes:
  - configMap
  - emptyDir
  - secret
  - persistentVolumeClaim
  - projected
  - downwardAPI
  - gitRepo
  - all
  imagePolicyWebhook:
    enabled: true
  allowedScopes:
  - 'image-pullers'
  - 'system:authenticated'
  - 'system:unauthenticated'
  - 'system:serviceaccount'
  - 'system:serviceaccount:kube-system:kubelet'
  - 'system:serviceaccount:kube-system:statefulset-nginx'
  - 'system:serviceaccount:kube-system:replica-set-nginx'
  - 'system:serviceaccount:kube-system:deployment-nginx'
  - 'system:serviceaccount:kube-system:daemonset-nginx'
  - 'system:serviceaccount:kube-system:deployment-nginx-ingress'
  - 'system:serviceaccount:kube-system:replica-set-nginx-ingress'
  - 'system:serviceaccount:kube-system:daemonset-nginx-ingress'

4. 集群审计与监控

  • 配置集群审计：记录集群操作日志，便于事后分析。

”`yaml apiVersion: audit.k8s.io/v1 kind: Policy metadata: name: default spec: # The Policy and its Rules specify what events are logged, and under what conditions. # Rules are applied in order, and the first matching rule is used. # If no rules match, the default behavior is to log all requests. rules:

  • level: Request resources:
    • groups: [“”] resources: [“pods”, “services”, “nodes”, “persistentvolumes”, “persistentvolumeclaims”]
    • groups: [“apps”] resources: [“deployments”, “replicasets”, “statefulsets”]
    • groups: [“rbac.authorization.k8s.io”] resources: [“roles”, “rolebindings”, “clusterroles”, “clusterrolebindings”]
    • groups: [“extensions”] resources: [“ingresses”]
    • groups: [“batch”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“admissionregistration.k8s.io”] resources: [“validatingwebhookconfigurations”, “mutatingwebhookconfigurations”]
    • groups: [“policy”] resources: [“podsecuritypolicies”]
    • groups: [“networking.k8s.io”] resources: [“networkpolicies”]
    • groups: [“authentication.k8s.io”] resources: [“tokenreviews”, “selfsubjectaccessreviews”, “selfsubjectrulesreviews”]
    • groups: [“authorization.k8s.io”] resources: [“selfsubjectaccessreviews”, “selfsubjectrulesreviews”, “subjectaccessreviews”, “subjectrulesreviews”]
    • groups: [“apiextensions.k8s.io”] resources: [“customresourcedefinitions”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
    • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
    • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
    • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
    • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”] -
上一问答：【C语言编程教程】轻松绘制老鼠动画，解锁编程新技能
下一问答：【揭秘C语言 Hook 技术的奥秘】轻松实现代码插桩，解锁编程新境界
大家都在看
问

如何治好卵巢囊肿更有效？

发布时间：2024-11-01 18:03
最近，听说了许多关于囊肿类疾病的产生。我相信很多朋友们对于囊种类疾病的认知还是很低，我想通过今天这个机会，好好的跟大家分析一下，关于如何治好卵巢囊肿这一问题。
问

想知道: 石家庄市 石家庄地铁一号线站点

发布时间：2024-12-11 05:35
西王站:中山路与长兴街交叉口东侧时光街站:中山西路时光街交叉口长城桥站:中山西路与西二环交叉口和平医院站:中山西路与友谊大街交叉口（1号线、5号线换乘站）烈士陵园站:中山西路与规划泰华街交叉口东侧新百广场站（原称“中山广场”站）:中山西路与。
问

慕江南古诗白居易

发布时间：2024-11-19 06:39
忆江南三首白居易 〔唐代〕江南好，风景旧曾谙；日出江花红胜火，春来江水绿如蓝。能不忆江南？江南忆，最忆是杭州；山寺月中寻桂子，郡亭枕上看潮头。何日更重游！江南忆，其次忆吴宫；吴酒一杯春竹叶，吴娃双舞醉芙蓉。早晚复相逢！诗人早年因避乱来到江南。
问

马小红结局

发布时间：2024-11-11 12:01
《封神演义》中，姜子牙的妻子马小红受炮烙之刑而死。马小红为大局着想，也为了保护自己的丈夫姜子牙，帮助他离开朝歌，她选择牺牲自己。当商王事后得知真相后，在申公豹的怂恿下对马小红使用了炮烙之刑。。
问

九亭地铁有哪几条线

发布时间：2024-12-14 06:33
从3号口出来右转沿着沪松公路走大约400米到九新公路，左转走1公里左右就到九亭大街了。公交的话可以坐706路或者松江43路（外环）。
问

如何从北京站最快到南苑机场

发布时间：2024-12-10 12:29
公交线路：地铁2号线 → 地铁4号线大兴线 → 501路，全程约21.9公里，1小时20分钟。1、从北京站乘内坐地铁2号线,经过容4站, 到达宣武门站2、乘坐地铁4号线大兴线,经过5站, 到达角门西站3、步行约340米,到达嘉园二里东门站4。
问

斯皮仁诺胶囊说明书

发布时间：2024-10-30 00:22
斯皮仁诺胶囊，对于这个药物名称来说，相信一部分人会有一些熟悉的情况，这是一种主要以治疗真菌感染为主的药物，可以治疗妇科阴道念珠菌感染，各种由于真菌引起的皮肤。
问

四川师范大学是几本

发布时间：2024-11-11 12:01
一本。四川师范大学是一本高校。学校是四川省属重点大学、国家首批“中西部高校基础能力建设工程”实施高校及全国深化创新创业教育改革示范校，是四川省举办本科师范教育最早、师范类院校中办学历史最为悠久的大学。学校位于四川省省会——成都市，现有狮。
问

临安到杭州东站时刻表

发布时间：2024-12-10 09:41
公交线路：598a路，全程约55.4公里1、从临安市政府步行约1.2公里,到达临安东站2、乘坐598a路,经过3站, 到达火车东站东站3、步行约1000米,到达杭州东站。
问

高铁G1339列车属于哪个客运段

发布时间：2024-12-13 22:55
G1339次列车属 成都局 由重庆客运段值乘。