【揭秘K8s集群】安全配置與防護之道，保障容器化應用安全無憂

引言

隨着雲打算跟容器技巧的疾速開展，Kubernetes（K8s）曾經成為容器編排範疇的領導者。K8s集群的保險設置與防護對保證容器化利用的保險至關重要。本文將深刻探究K8s集群的保險設置與防護之道，幫助妳構建一個保險無憂的容器化利用情況。

K8s集群保險概述

Kubernetes集群的保險性重要涉及以下多少個方面：

1. 認證（Authentication）：確保只有受權用戶才幹拜訪K8s API。
2. 受權（Authorization）：把持用戶對資本的拜訪權限。
3. 准入把持（Admission Control）：在資本被創建或修改之行停止檢查，確保其符合保險戰略。
4. 收集戰略（Network Policies）：把持Pod之間的通信。
5. 容器鏡像保險：確保容器鏡像的保險性。
6. 集群審計與監控：及時監控集群狀況，及時發明並處理保險變亂。

K8s集群保險設置

1. 基本體系保險設置

• 體系時光同步：安裝NTP效勞並設置堅固的NTP效勞器，確保體系時光同步。

sudo apt update
sudo apt install ntpdate ntp
sudo ntpdate ntp1.aliyun.com

• 禁用Swap功能：Kubernetes請求全部節點禁用Swap，經由過程編輯/etc/fstab文件並注釋掉落Swap行實現，然後履行swapoff --all命令。

sudo swapoff --all

• 設置容器運轉時情況：推薦利用Docker或Containerd作為容器運轉時。

sudo apt-get update
sudo apt-get install docker.io

2. 收集戰略

• 創建收集戰略：限制Pod之間的通信。

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend-to-frontend
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: frontend
  policyTypes:
  - Ingress
  - Egress

3. 鏡像保險

• 利用ImagePolicyWebhook戰略管理鏡像來源：避免利用未經驗證的鏡像。

apiVersion: policy/v1
kind: PodSecurityPolicy
metadata:
  name: strict-image-policy
spec:
  podSecurityContext:
    runAsUser: 1000
  runAsGroup: 3000
  fsGroup: 2000
  seLinux: {}
  supplementalGroups: [3000]
  allowedCapabilities: ['NET_ADMIN', 'SYS_ADMIN']
  forbiddenCapabilities: ['ALL']
  volumes:
  - configMap
  - emptyDir
  - secret
  - persistentVolumeClaim
  - projected
  - downwardAPI
  - gitRepo
  - all
  imagePolicyWebhook:
    enabled: true
  allowedScopes:
  - 'image-pullers'
  - 'system:authenticated'
  - 'system:unauthenticated'
  - 'system:serviceaccount'
  - 'system:serviceaccount:kube-system:kubelet'
  - 'system:serviceaccount:kube-system:statefulset-nginx'
  - 'system:serviceaccount:kube-system:replica-set-nginx'
  - 'system:serviceaccount:kube-system:deployment-nginx'
  - 'system:serviceaccount:kube-system:daemonset-nginx'
  - 'system:serviceaccount:kube-system:deployment-nginx-ingress'
  - 'system:serviceaccount:kube-system:replica-set-nginx-ingress'
  - 'system:serviceaccount:kube-system:daemonset-nginx-ingress'

4. 集群審計與監控

• 設置集群審計：記錄集群操縱日記，便於過後分析。

”`yaml apiVersion: audit.k8s.io/v1 kind: Policy metadata: name: default spec: # The Policy and its Rules specify what events are logged, and under what conditions. # Rules are applied in order, and the first matching rule is used. # If no rules match, the default behavior is to log all requests. rules:

• level: Request resources:
  • groups: [“”] resources: [“pods”, “services”, “nodes”, “persistentvolumes”, “persistentvolumeclaims”]
  • groups: [“apps”] resources: [“deployments”, “replicasets”, “statefulsets”]
  • groups: [“rbac.authorization.k8s.io”] resources: [“roles”, “rolebindings”, “clusterroles”, “clusterrolebindings”]
  • groups: [“extensions”] resources: [“ingresses”]
  • groups: [“batch”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“admissionregistration.k8s.io”] resources: [“validatingwebhookconfigurations”, “mutatingwebhookconfigurations”]
  • groups: [“policy”] resources: [“podsecuritypolicies”]
  • groups: [“networking.k8s.io”] resources: [“networkpolicies”]
  • groups: [“authentication.k8s.io”] resources: [“tokenreviews”, “selfsubjectaccessreviews”, “selfsubjectrulesreviews”]
  • groups: [“authorization.k8s.io”] resources: [“selfsubjectaccessreviews”, “selfsubjectrulesreviews”, “subjectaccessreviews”, “subjectrulesreviews”]
  • groups: [“apiextensions.k8s.io”] resources: [“customresourcedefinitions”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”]
  • groups: [“autoscaling.k8s.io”] resources: [“horizontalpodautoscalers”]
  • groups: [“batch”, “extensions”] resources: [“jobs”, “cronjobs”]
  • groups: [“storage.k8s.io”] resources: [“storageclasses”, “volumeattachments”, “storagepods”]
  • groups: [“coordination.k8s.io”] resources: [“leases”, “configmaps”] -