当前位置：首页 > news >正文

Kubernetes安全与权限管理最佳实践：构建安全可靠的容器环境

news 2026/5/27 0:18:28

Kubernetes安全与权限管理最佳实践：构建安全可靠的容器环境

一、安全概述

Kubernetes安全涉及集群的多个层面，包括网络安全、身份认证、访问控制和运行时安全等。

1.1 安全架构

┌─────────────────────────────────────────────────────────────────┐ │ 安全控制层 │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ RBAC │ │ NetworkPolicy│ │ Secrets │ │ │ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ │ └─────────┼─────────────────┼─────────────────┼─────────────────┘ │ │ │ ▼ ▼ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ 运行时安全层 │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ seccomp │ │ AppArmor │ │ PodSecurity │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ │ └─────────────────────────────────────────────────────────────────┘

1.2 安全组件

组件	功能
RBAC	基于角色的访问控制
NetworkPolicy	网络访问控制
Secrets	敏感信息管理
seccomp	系统调用限制
AppArmor	应用程序沙箱

二、RBAC配置

2.1 Role配置

apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: pod-reader namespace: default rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch"]

2.2 RoleBinding配置

apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: pod-reader-binding namespace: default subjects: - kind: User name: jane apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: pod-reader apiGroup: rbac.authorization.k8s.io

2.3 ClusterRole配置

apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: cluster-admin rules: - apiGroups: ["*"] resources: ["*"] verbs: ["*"]

三、ServiceAccount配置

3.1 ServiceAccount创建

apiVersion: v1 kind: ServiceAccount metadata: name: my-service-account namespace: default automountServiceAccountToken: true

3.2 ServiceAccount权限绑定

apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: my-service-account-binding subjects: - kind: ServiceAccount name: my-service-account namespace: default roleRef: kind: Role name: my-role apiGroup: rbac.authorization.k8s.io

四、Secret配置

4.1 创建Secret

apiVersion: v1 kind: Secret metadata: name: my-secret type: Opaque data: username: YWRtaW4= password: MWYyZDFlMmU2N2Rm

4.2 使用Secret

apiVersion: apps/v1 kind: Deployment metadata: name: my-app spec: template: spec: containers: - name: app image: my-app:latest env: - name: DB_USERNAME valueFrom: secretKeyRef: name: my-secret key: username - name: DB_PASSWORD valueFrom: secretKeyRef: name: my-secret key: password

五、网络安全配置

5.1 NetworkPolicy配置

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all-ingress spec: podSelector: {} policyTypes: - Ingress ingress: []

5.2 允许特定端口

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-http spec: podSelector: matchLabels: app: web policyTypes: - Ingress ingress: - ports: - protocol: TCP port: 80

六、Pod安全配置

6.1 SecurityContext配置

apiVersion: v1 kind: Pod metadata: name: secure-pod spec: securityContext: runAsNonRoot: true runAsUser: 1000 fsGroup: 2000 containers: - name: app image: my-app:latest securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true

6.2 seccomp配置

apiVersion: v1 kind: Pod metadata: name: seccomp-pod annotations: seccomp.security.alpha.kubernetes.io/pod: runtime/default spec: containers: - name: app image: my-app:latest

6.3 AppArmor配置

apiVersion: v1 kind: Pod metadata: name: apparmor-pod annotations: container.apparmor.security.beta.kubernetes.io/app: runtime/default spec: containers: - name: app image: my-app:latest

七、PodSecurityPolicy配置

7.1 PodSecurityPolicy定义

apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restrictive-psp spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' - 'persistentVolumeClaim' runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: - min: 1 max: 65535 readOnlyRootFilesystem: true

7.2 PSP权限绑定

apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: psp:restrictive rules: - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: - restrictive-psp

八、安全最佳实践

8.1 最小权限原则

apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: minimal-role rules: - apiGroups: ["apps"] resources: ["deployments"] verbs: ["get", "list", "watch", "update"]

8.2 定期密钥轮换

#!/bin/bash kubectl delete secret my-secret kubectl create secret generic my-secret \ --from-literal=username=admin \ --from-literal=password=$(openssl rand -hex 16)

8.3 安全扫描集成

apiVersion: batch/v1 kind: CronJob metadata: name: security-scan spec: schedule: "0 3 * * *" jobTemplate: spec: template: spec: containers: - name: trivy image: aquasec/trivy:latest command: - /bin/sh - -c - "trivy image --severity HIGH,CRITICAL my-app:latest" restartPolicy: OnFailure