mcpField
I
implementing-network-policies-for-kubernetes

implementing-network-policies-for-kubernetes

github.com/mukul975安全35.2k75 次安装8 周前更新
代码仓库

关于 implementing-network-policies-for-kubernetes

这项 Kubernetes 安全技能面向集群管理员和安全工程师，指导使用 NetworkPolicy 控制 Pod 间及出入站流量。它提供从默认拒绝到应用规则和连通性验证的配置流程。

主要功能

  1. 01默认拒绝所有流量
  2. 02配置 DNS 出站访问
  3. 03按应用与命名空间定义策略
  4. 04限制外部出站流量
  5. 05阻止云元数据访问
  6. 06验证策略与连通性

适用场景

  1. 01为命名空间实施网络隔离
  2. 02限制应用 Pod 的出站访问
  3. 03降低集群内横向移动风险

安装

复制下面的命令，在终端中运行。

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill implementing-network-policies-for-kubernetes

安装后在 Claude Code 中输入/implementing-network-policies-for-kubernetes确认已加载。

包含的文件

除 SKILL.md 外，安装时一起下载的参考资料和脚本。

LICENSE
assets/
template.md
references/
api-reference.md
standards.md
workflows.md
scripts/
agent.py
process.py

详细介绍

为 Kubernetes 实施网络策略

概述

Kubernetes 网络策略通过定义入站和出站规则来控制 Pod、命名空间与外部端点之间的流量，从而在 Pod 层面实现网络隔离。结合 Calico 或 Cilium 等 CNI 插件，网络策略可强制实施零信任微隔离，防止集群内的横向移动。

使用场景

  • 在环境中部署或配置 Kubernetes 网络策略功能时
  • 制定符合合规要求的安全控制措施时
  • 构建或改进此领域的安全架构时
  • 开展需要实施此方案的安全评估时

前提条件

  • 配备支持 NetworkPolicy 的 CNI（Calico、Cilium、Antrea）的 Kubernetes 集群
  • 已配置具备管理员访问权限的 kubectl
  • 了解 Pod 标签和选择器

工作流

步骤 1：默认拒绝所有流量
# default-deny-all.yaml - Apply to every namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}  # Applies to all pods
  policyTypes:
    - Ingress
    - Egress
步骤 2：允许 DNS 出站流量（服务发现所必需）
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
步骤 3：特定于应用的策略
# Allow frontend to reach backend only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-allow-frontend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080
---
# Allow backend to reach database only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: database-allow-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: database
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: backend
      ports:
        - protocol: TCP
          port: 5432
步骤 4：跨命名空间策略
# Allow monitoring namespace to scrape metrics
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-monitoring-scrape
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              purpose: monitoring
      ports:
        - protocol: TCP
          port: 9090  # Prometheus metrics port
步骤 5：出站限制
# Restrict egress to specific external services
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-egress
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Egress
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - protocol: TCP
          port: 5432
    - to:  # Allow external API
        - ipBlock:
            cidr: 203.0.113.0/24
      ports:
        - protocol: TCP
          port: 443
    - to:  # DNS
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
步骤 6：阻止访问云元数据
# Prevent SSRF to cloud metadata service
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: block-metadata
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.169.254/32  # AWS/GCP metadata
              - 100.100.100.200/32  # Azure metadata

验证命令

# Verify policies are applied
kubectl get networkpolicies -n production

# Test connectivity (should be blocked)
kubectl run test-pod --image=busybox --restart=Never -n production -- wget -qO- --timeout=2 http://database-service:5432
# Expected: timeout (blocked by policy)

# Test allowed traffic
kubectl run frontend-test --image=busybox --labels=app=frontend --restart=Never -n production -- wget -qO- --timeout=2 http://backend-service:8080
# Expected: connection succeeds

参考资料

评论

支持 Markdown