k8s-security-policies

Kubernetes 安全策略

在 Kubernetes 中实施 NetworkPolicy、PodSecurityPolicy、RBAC 和 Pod 安全标准的综合指南。

用途

使用网络策略、Pod 安全标准和 RBAC，为 Kubernetes 集群实施纵深防御。

何时使用此技能

• 实施网络分段
• 配置 Pod 安全标准
• 设置 RBAC，实现最小权限访问
• 创建符合合规要求的安全策略
• 实施准入控制
• 保护多租户集群

Pod 安全标准

1. 特权（不受限制）

apiVersion: v1
kind: Namespace
metadata:
  name: privileged-ns
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged

2. 基线（限制最少）

apiVersion: v1
kind: Namespace
metadata:
  name: baseline-ns
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/audit: baseline
    pod-security.kubernetes.io/warn: baseline

3. 受限（限制最严格）

apiVersion: v1
kind: Namespace
metadata:
  name: restricted-ns
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

网络策略

默认拒绝所有流量

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

允许前端访问后端

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

允许 DNS

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: kube-system
    ports:
    - protocol: UDP
      port: 53

**参考：**请参阅 assets/network-policy-template.yaml

RBAC 配置

Role（命名空间范围）

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: production
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

ClusterRole（集群范围）

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

RoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: production
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
  name: default
  namespace: production
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

**参考：**请参阅 references/rbac-patterns.md

Pod 安全上下文

受限 Pod

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:1.0
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL

使用 OPA Gatekeeper 强制执行策略

ConstraintTemplate

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        openAPIV3Schema:
          type: object
          properties:
            labels:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        violation[{"msg": msg, "details": {"missing_labels": missing}}] {
          provided := {label | input.review.object.metadata.labels[label]}
          required := {label | label := input.parameters.labels[_]}
          missing := required - provided
          count(missing) > 0
          msg := sprintf("missing required labels: %v", [missing])
        }

Constraint

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-app-label
spec:
  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]
  parameters:
    labels: ["app", "environment"]

服务网格安全（Istio）

PeerAuthentication（mTLS）

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT

AuthorizationPolicy

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-frontend
  namespace: production
spec:
  selector:
    matchLabels:
      app: backend
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/frontend"]

最佳实践

1. 在命名空间级别实施 Pod 安全标准
2. 使用网络策略实现网络分段
3. 为所有服务账户应用最小权限 RBAC
4. 启用准入控制（OPA Gatekeeper/Kyverno）
5. 以非 root 用户运行容器
6. 使用只读根文件系统
7. 除非必要，否则移除所有能力
8. 实施资源配额和限制范围
9. 为安全事件启用审计日志
10. 定期扫描镜像安全性

合规框架

CIS Kubernetes 基准

• 使用 RBAC 授权
• 启用审计日志
• 使用 Pod 安全标准
• 配置网络策略
• 实施静态加密的 Secret
• 启用节点身份验证

NIST 网络安全框架

• 实施纵深防御
• 使用网络分段
• 配置安全监控
• 实施访问控制
• 启用日志记录和监控

故障排查

NetworkPolicy 不起作用：

# Check if CNI supports NetworkPolicy
kubectl get nodes -o wide
kubectl describe networkpolicy <name>

RBAC 权限被拒绝：

# Check effective permissions
kubectl auth can-i list pods --as system:serviceaccount:default:my-sa
kubectl auth can-i '*' '*' --as system:serviceaccount:default:my-sa

参考文件

• assets/network-policy-template.yaml - 网络策略示例
• assets/pod-security-template.yaml - Pod 安全策略
• references/rbac-patterns.md - RBAC 配置模式

相关技能

• k8s-manifest-generator - 用于创建安全的清单
• gitops-workflow - 用于自动部署策略