From 4e25e0c0339f95f596e1f9d61714ee9a56200070 Mon Sep 17 00:00:00 2001 From: shaohq Date: Thu, 31 Mar 2022 22:39:38 +0800 Subject: [PATCH] 4C Security Model --- .vuepress/config-sidebar.js | 73 +++++++------ .../k8s-advanced/sec/overview.assets/4c.png | Bin 0 -> 21381 bytes learning/k8s-advanced/sec/overview.md | 103 ++++++++++++++++++ learning/k8s-advanced/sec/psa.md | 11 ++ learning/k8s-advanced/sec/pss.md | 11 ++ learning/k8s-advanced/sec/secure-a-cluster.md | 15 +++ 6 files changed, 181 insertions(+), 32 deletions(-) create mode 100644 learning/k8s-advanced/sec/overview.assets/4c.png create mode 100644 learning/k8s-advanced/sec/overview.md create mode 100644 learning/k8s-advanced/sec/psa.md create mode 100644 learning/k8s-advanced/sec/pss.md create mode 100644 learning/k8s-advanced/sec/secure-a-cluster.md diff --git a/.vuepress/config-sidebar.js b/.vuepress/config-sidebar.js index 918a9fe..f137a54 100644 --- a/.vuepress/config-sidebar.js +++ b/.vuepress/config-sidebar.js @@ -372,36 +372,45 @@ let sidebar = { collapsable: true, children: [ { - title: '认证及授权', + title: '安全', collapsable: true, children: [ + 'k8s-advanced/sec/overview', + 'k8s-advanced/sec/pss', + 'k8s-advanced/sec/psa', { - title: '用户认证', + title: '认证及授权', collapsable: true, children: [ - 'k8s-advanced/sec/authenticate/', - 'k8s-advanced/sec/sa-admin', - // 'k8s-advanced/sec/authenticate/install', - // 'k8s-advanced/sec/authenticate/ldap', - ] - }, { - title: '用户授权', - collapsable: true, - children: [ - // 'k8s-advanced/sec/kuboard', - 'k8s-advanced/sec/rbac/auth-namespace.html', - // 'k8s-advanced/sec/rbac/list-namespace.html', - // 'k8s-advanced/sec/rbac/logs.html', - 'k8s-advanced/sec/rbac/api', - 'k8s-advanced/sec/rbac/default', - 'k8s-advanced/sec/rbac/escalation', - 'k8s-advanced/sec/rbac/cmd', - 'k8s-advanced/sec/rbac/sa', - 'k8s-advanced/sec/rbac/permissive', - 'k8s-advanced/sec/rbac/example', + { + title: '用户认证', + collapsable: true, + children: [ + 'k8s-advanced/sec/authenticate/', + 'k8s-advanced/sec/sa-admin', + // 'k8s-advanced/sec/authenticate/install', + // 'k8s-advanced/sec/authenticate/ldap', + ] + }, { + title: '用户授权', + collapsable: true, + children: [ + // 'k8s-advanced/sec/kuboard', + 'k8s-advanced/sec/rbac/auth-namespace.html', + // 'k8s-advanced/sec/rbac/list-namespace.html', + // 'k8s-advanced/sec/rbac/logs.html', + 'k8s-advanced/sec/rbac/api', + 'k8s-advanced/sec/rbac/default', + 'k8s-advanced/sec/rbac/escalation', + 'k8s-advanced/sec/rbac/cmd', + 'k8s-advanced/sec/rbac/sa', + 'k8s-advanced/sec/rbac/permissive', + 'k8s-advanced/sec/rbac/example', + ] + }, ] }, - ] + ], }, { title: '问题诊断', @@ -431,19 +440,19 @@ let sidebar = { 'k8s-advanced/logs/loki-addon' ] }, - { - title: '调度', - collapsable: true, - children: [ - 'k8s-advanced/schedule/', - 'k8s-advanced/schedule/tuning', - 'k8s-advanced/schedule/framework', - ] - }, { title: '策略', collapsable: true, children: [ + { + title: '调度', + collapsable: true, + children: [ + 'k8s-advanced/schedule/', + 'k8s-advanced/schedule/tuning', + 'k8s-advanced/schedule/framework', + ] + }, { title: 'Limit Range', collapsable: true, diff --git a/learning/k8s-advanced/sec/overview.assets/4c.png b/learning/k8s-advanced/sec/overview.assets/4c.png new file mode 100644 index 0000000000000000000000000000000000000000..100a1567420fdb9b63aae09a8aaae22ff8730784 GIT binary patch literal 21381 zcmeFZcT`i|(=d7vk={jm69EMY0wTQ#N)=EPA`n2j^w6aUC;_A+i1eZ~X+e7E8bCTo z4ILv*x|GmEzQgnU-uvBu@4EM{``-0^u7xCf&z_kxZO@)Phlt0z>eLi$6aWBFYic~u z2Y@Rm03iNFMhuRaIY(E3zb@O|*SQY>6>*ej79`+z9xDxf9RTnX0Dxcw0GxnB!G8e2 z>ka^{y#N5&6aZj`XEZ#K2LPhp$B&*pBoGK7%vrniN|i)qlwgn*2lN3WGXu%sCy3KC z77;#*qi<5Vfj3yLQnGV$l3-eVM2h;rQsP^W9c}$a$f%b#@GBwE5HS7<o=b-&)$HobHZ)Z*En55IH&0_1NHj)z|u@q_Y05cHHLZ z;%t9tSmAI_MO$?+B_*Y?v9X+-91jmqK|#Ug%a@s$nD+PgYiep178U{n1M~CqPft%> zTwD?p6X)mWSy)(xhK5#FR-BxihKGkC5XhT1Z?v?uL_|d1zklD@*hpA-OIXV#{7EBV z0|*;sguQ;k=?-D%J7M0VuJ6DvXX{<@->!)x!Y?1~pjC0_WsBJLsl^k*R$X$)c2f#ZLP7Ux2Ib6fY0{~dkFMfzLy+S^K zgQT9CIuA(~NSNu!$oI)BuK>W~&zcYJKYKN`IU5mlwe!;-|D=zsB7Btg06Po$CRxby zK3k_d_i7hd%B5l#G^7&Z-LJ1MXWbUm{YLXE{u|Lo?rGMIxyD0$eR+vr_Uh{D&?7w` zFG5SU2glFbY=gq_D1>2LKvwT|4pf-(^Ogzp)%P_XWOv zr#`5uH(jN{Jk~UDJW6`6nhOB^9Bi!YhMPhw0x%(y@HmdwOh8UiZaHV->e}E#R8Po{ zY}`>qUh6UtJRTj(sx&~E)EDmfGQ){TS?!A_&PE=l@R0Y1TH?7rF)+38Q;hdVcqIq2 za;QvIGboh^*z|zC`(E28`p6C?fMBuJx&m1D(DO!arkJJlz*%Qy`zA$zu9P7Q-l;o{ zcVe(Ylw#iEtL36V&a5uSwT|()YXx^e0&XcTM9Nnl1loj`|V$!VJVb`e_{Fkq?2{EPp3f4&!A0+@Ww+pBZ^y?BhO^382evv;0~U5^7Hg z)g(LU1%j#AnLdBWhf_0k?Bul;0Kw9nu5Pv#J!l&$RLT=FAl3VG2QRb--4RR)h;O4< z`gBnztZ*XbWlm>jON$1yBoB=s9(NgN-+Zp^SU=2!{4AZYpUeo*)zLrc(?a=8+$9Fw ze|@17*{De`hT|f!d97(c@DX*?Tr{FYuPI@l8H8=EFw}L=7lM(9{pUOVlP(R^ggG9U*F!s&|i5J0&T{O^ASOUK4? z`8qp22Y@N-R~tv~a}mNwcnp`)$9*3bpz_be&b6tBs5RNo#ga0T3KEpS%f$NCBF!TX6IXb0AWFWLp@`U1ddj@?8gYDMQ{R zK%vk!@x1nu^2Z`iPC?k_>bM2(@}K}-ge15$J)QaYUrqE_LvEYOZ2|n||q<$a*IK|~|JxHvgBu}0nvT)l97@k)L zy5ja$+TkAR;NW1lRdgMYlY32|1O8OvE?M%R1#b!oEx;)`y*Q(SUc#~Mi32$c%V{Q{ zZ_4Z5q2&S?zD|tB!O=@%0s^8p@SDWJ9I}G350##4pkTQiH!lZ2=%Wx*LDAg(m8N&% zPYN7YPqg=en51u9X1{t#`TBsA*y43q77^yz@VpGrRr1g+8ZNnh*$xHph*1s&MKVIB z=?g$W_hr8FrR%U-v2oA^+zUGHU>z9LDTsLPQ>r|eaZH9AsfE6Pz5+A`@}yNzY3_)J zFd#m!=!;-IS@M#kKpU}gLO}-$)}bdwI%!{u8rXG$tZh)Cmk^G!tFCOo;$$fuqU2UM zIWur00xlU917d!nhWfl&rH#rEZFd@;zYBC#Q9cQZWrTpCzDOAb#&j^&gGLXA{p+xc z9pEAAVl#+>6J59gxD|l09|Q%r0nlZ@9pV3r1xZe*Yqr-4F9VC6i=)5$E@6iyVRnO$ z1n@MMf^YPR*8YT`lb)dxY}<*g(@y$61i zUEI`;JXsB!mM+y|CpE8m(o76!*1L}#iAj6qaDPDvzk!=dtJeaHSz4Iu*x~Ci%0v}d zbHcvK6(GU;IE-!uLWkTBcO3XLzLYl)0phPng{HXr1@dCoJW;yjZtrig0y#~$+O4Zb zKno6Uv+-PKv#SHXxi5XD(;0x=fMrr+GU%YL{CGv8;Qd!CX(>)yFTuqxQJ|?xHjn^Z z7}3b?0^65#NZqh?bRMb;jL(1ThcB#ltQ(%m_|}&dc)aB9v0hIGC2f=Jlz#<~!K;e6 z%Mc|Y*feHnVxSM8%x22CH$;1l0XY!rX#7u%2B3%(0oW=fCREc+V)gI}kT=pVU<*RT zhW4_+#d7I@OU)zg@lkNE+b}8=kb_LO%!22O!0av}wJ9c-;K>imq`ET%Trv4jOckZi zgnYQ8Htb3PXjGLv(Q~Iq(u6u{!L&|vhyZ(U%}4aeXQ5GeFCw1Nr7u+yWYA7@hhiu| z_dAmAAA3~%*B)80k+p-63u}$PQup~hfd9fW_22w=H{$<>e)Ydu`tK3n{0{%owp=#Ztg{60q+w zybYdK-@)zakt}*}a5jw>CJW9^G=k_}hQL?pAlrS>adW3lI)ZsFPr=pKFXoA*MC+6s zrw`BXS^YD_hUoRk`@3*Ym(bWhq;dhohFJHg6UnaI@i%WY6$RNLLg(K{%{+v0*X;Ro ze;t%xx)dLX&<=suH(s4{SvgevbLrLxO64_r2>OEZMefi;@=wBGkX(|LN z$9{NQ3n04><_jRsi>%@%^FOJ?e- zK4;KR0f&2R+~AS5NF7zlh#Yhwwe5Vpf66VDwiuWWC(=+rC#AyiXSs*$q3ifVCCVT< z5Ox)WWk6D;+y^>y$;FDTO^<*3!3ajVI7gR$UWm^qKFU5me*Akk7D*d$r9Nrsva4-B}g zjuO9yq-C3Z0}6%XLMSfW`!whNAflp&C^G2JW^l#mbr?eUj~Rke*#Q(Olcy;7Fg2iB zC>p?wF5Vd2O-W`icoYHk@^ZAtttSTOnGnK^*ppHV_{@6Nnf&6W^1pmPK+W_zk2UHphEsQ1Gk|b`2w_U>E{t&0 z<~MI&r@1};U(yz*LuS9eY9Wo2kaAHf@fZ9@-pL2plV7jnP6WRyo=tev(XK@|{44dT z@ZRaNLzR}XZNKd!-@mW_9W|oB_RkDZhxT|40X@dU(UWd6#_Ay`<{t+5Gwt-UyW}!|2=IGRP$PC0fCHUlgWKdnS z7igSaWdA3XT!-C11c~WK!Re7X|JO7uY=u3k9^zcv<|bUjUdkc9FvizIH>J5B2>nMZ z>{tgBlf{2oAZSx@Z_AxG%nldrEdI;*@1b$NA-@BD&v1FmTzDoi0<;NtQTW+;X0TZD zDb=Us1(3bF%Aoy1e7t|0ZU>!pb8dUZ&o}SQb#BFQBU&!Z_aC3Z*l{;+y9xdsvKU#? z`Bzxch~D`^Ih@PU&9ncq9xc?|iL@3V7 zrbgp-8e`^Y{>8I_STC!a!{4|8Ge2wEnFjsh!uRswtaJGNflN^se_HZDztbo=A4Pl< zmX9ADY77mf(`>!+EedXP8&<{(WA$F&?Jto+p!{&l$^8oPa9(H7S9U@2xPksCwA;?6 zPui=SSd}R-RxRB}Rj%n^eJUcJF#pey)p7P>L#a8G=Tfis_|NtJt~ddh20N%pc{1p| zA{WytTH3jWydE$9wOn%M;V>}H(V~+yg`TG*P3n3f=!O)=ON8Q@lrRL9ehYbcJL?!1M4i1uC=bCsSb8vM2 zmiuOmb~3U^U9yUW>LuU54}7J&h}Ctp*`W4MnvA!8jkum?x8dxw)`omGn=tK%180BJ z-7~yzttzqYM*fE*XdA;`{V&-gF6%0PkZF9?+9R;IG#f7xAy=sks}nZ%(=F z{`@xfwd04l*4B-v^l?+y=R{9is@uG}l{_gGE|IrK!0qXfgR@x=Pz8pRfodr6o3~-m zGs^e#)mQA?#Xp@sk%LL$^*n1LB>R+2=pmr#rA{ZtDMs(~|D9CNWSjaFf(+vrDWSkH zIX+qtd_Mff`&09RnP%J@_7AjkF`LbQ>;1#l@uCTVR-c{cXi_tF@(H!V z%NtR`-?0t64ma?2s=D+LPV~~iz@4T;dydVMvk|?fY(zclq+7QH^Vg~L8f=5H6znaW zm!B+|279uBr-{P7yCK`F#QOE1c8VS&_Z^!cLD$;!J8?goTIM0jlMG{$T|M`?U`F%g zb;Lc2rm$`sNyoo_RVyeBCjDR6E{?Zz_Kci=#fXu&>sjH{jC@a|Y#Pp_Ox^968q|sA zizG_uG$MBnnw3$*+>mX3B+Uy*Kmn|X)4eDrWAS{8`Sm(#?(5d8vB}d_k@erEyUYgb zsNg&n*VQjddgRaq?Ao92=xly`?F0XA8q@uj@@I7}T`!Igx={S`a(2?`&P~`^nKsio zuXTo8(HjVOz9`J=DQMjv93OF|JUYWiNRVYl{BC0=S)t=q-)Zjf(V zYQ(EaiEVu3ikoZI0waURzb8(|igUe??4TLHB(_MmHxdaR9cJ8J-Y0bq*L7L09{9}YQud_lsu4AZFBHbEJ-fg?+rtjHZx^J*os4|ASTRCX z59Gx9ToedyffC@@hA}46`(XHC5s3BuTQ#CmfO5V2 zlXq49cn%OdP4aEbL)(`?@NNNJqKD2o3s}XV!K~J6+IA2JyFYz*yd2BOfV_d`w|n`n zWaASN&mm;~rMn_8R!az0D4M~j0{>(L9D6@Bd)1hV15<|Y@JvMoDZK_@F|B8O^i5z6 z1M&gd>tugFZ%3i=Kw#u9u=o>K=gOjVX(c^FM+3zG5~CC{{r#Ig8Dd`V9$I4xma;$Y zENt!OmoP8swI16Fg7n+lY^43wYAAtS+rWy|dIUn41e>OH5*^5HZlr3)>0nJ#1(_ zARN31r&u8YPY;d=?JBrVdWb|12~QnavKdy^mD?~627uvzl?nNDfLsjJP}eOqc$iwA zE#l~lB#qZYXqUh<5Bu(Cw8rnJlL86KsA>vKw9kQjVLhmn|%Iv1v3ti!1CWEGf z()PKE^LomMEDpaC>L^t0x#!_jK*V$U&s@@BXyDkW%s+GMAIPL+bQ%Ebe;D(ijuRd5 z_(rGvgC0_buK9V?$Ku!sSaV!3O>Z0YHT_C(G#|__)Uo18oi0B<_EK;PJ){}!)pEZM zrNJEBcQIEo6u<5??0OS;$BrGo4a2HJAfA^%%E`9a1~??o#4aIFj!60JLdoWl>V&Fm zyXdFv%aO~Vy|o7A8DtotZ8x(N^2Q z>Sf{L&~qj**e)q_9R{A)hVQ}lG+TY>O7^1WilkS5%Y2(S><~3Pv>dwkl)AERz`CxZ^X*Xu34tp-ip&CzVWS=` zPY%$Ns}fJ6MzThpR#jEG2i$WEIP0sfk+rliRCE|Zb!+_!WnEYGmY$7Qb7;hE#<_$>TYUtcrcgeqO)P7is%KM?(dT=689m z`WFshhf1N$wy9*2T)C6^T-0rLMx_TapFkt{m(z;A6w}>9eAGBag!#O^KJ{u$A`3)YQqq%xzh_aV?$6JK^`&oW<&Y&9ntH*}dNJJ)D&gr|aJ`gwomUiHPUS+h(?LYqItHU}C(;+m9jje=Ij87!v(q+l z4T_HGU!~l|3`iJZ({@JToD72b_YNn#XpV{(XK*tnt7FKiAT=bxrQ% z-x;xfum%}P+?MiTq)ug#e8e!<`Dl_*yMu7VZdA*q!{@d#MPZ5Fv@08NvLsd6h6)bj z>@qw=7iO;`NQVp!d0q7>{3rG0!Q&Q!t|dZBtnd)EWI6*7HlIU!z=jy-Mz4ORY;R2o;X z4l*##)&y&LW|Xo+Uns)j)7rg8tCorJZa$bu__~T+TgMypMmhtLhtP80*!RSP zN8U?K@IklZHUr6$$DBA1+e?uzvBioIBQJ^gtLQOzlx}u}VTSoxCFiWAngz|5`vGH@ z=JygU%?f&1Z{Moqb>IsB%VkPMhN=FWbvcR!xt7Xvpv?=@0I#+bVDDp@&QGA)y###8 z$HopbJzqMw5hHFew`gR{@vR-gjx%|0C>Y*->pvN28s;U}X$zV|}^+UE9oM!EgU#@qw)Q>H$+EUwk>x@`%0U%D(Wxwvf1_5i#-WH>zjE*66W~b7xU%ti>x7vr##Ry zE)Oi*ar{Z;hC-Lcl|->Bm1Lm8C{nn@#!xbZT8pz47e~Q*+cd%z)u+r3VLJmm_a)iV zl_V7MV~>n_Pu{lKn2Wef`NipG$?_?=ACw+nU11MfKWoBwHxb;g!!*V-SOj1?z9N6h zH;jgUZr`hGKNuD@ULCjGn>YXC_`@e+*mv;d>9cQ2wrhy>4~)pYt&#prMOUO+mNN_F z6!m%UE(OTbzxR^wzbQ}`uo}M{inOvJd~NiLW&^c(}5@+kd+V8x~Md9Hfg1!fDgL?BU-h847oD17335o*zfY& zVK?@js&5rkc^q(x_6@wsy8XMYOwYSEqLElE{i-?{)Z=ZTMth(E1iVNaeoLoL4)yr) zmR&z6?#MNe;13Qui*tIpT*10?kk2i9TZr>WwVt1p5RSJ^O$p<}8B`JLdBnl?ifgyP zYll92?o575p5^K%67#IAMI8%tMqvNWrAhQ zT>?5kv&7c6L9n~5Wp(yBw=vM~qQ`Zluy)Bo3l#v~cTeosb=WyC#`-T-&IoCKZt}}f zapF7rDTlyi03+jedp9@=?wk3g5vlcY9n(r3Fhp1Y?CNaOPh&4B*NWW3@nyh$n+*>s z_}o=du7S))#X*zSwE~k=TtL(EgGEUgqU49gU~HbjBGYLL4Tq;B6cWpDDR{7yE}rwgM-B!i|1=5&w`Q&cah5cTfounNB6{XIORdvq6Glyg>O}Lq}wYOI2pTpKu zA3_vCrz>Z@k0V3`_)>GTz2cvAURjWqQY@(UoY~J}sA;rYsujvCRe_&|zFAF!$!pgD zJl|#l68Ff-p?G&rskahL-cH*apFL8Mt}W*$hs%pkHeQW*fQ&vdMUV?2UeTr^d16e z@S$xe`mTXP`@Asy*?)%E(PKO&d6d9#C|qXJ4<`7}=NsGDlaEK3L3oNKVc2_hlfk8CHVzHX z5!^~%YZMUA=SzW^KW7p%`4Ox=w;h=4FSB}LH$1NfHk@#Tt`E+u^&5`D>sL?I|7k*r zIYX>x&#MiLw}tC1y$*_Y9~3;y?mj(Vchw9MB;pZtXGAJ}8Km=4eHP1_v;vdU0zYFJ~49T{nJqxitD^9o)VDd7sVzJ zBRhw*N3Fr3Zx=&11hFSo0VlTiUWso7mPa%yiEj}wd9BGnJf#ddCOeG-USt$XoA&Bk z6%y&1c+ph@S-b%Y+KiNLoc(++*wwa+pZnVtHsB|b40-a*+O6NC(SmVX1Zy+Y;$-t_ z+~?Sa#YmfjK_Hl>OC5C%$yU$`$_hGsJ?7|lAU(`+LTc)i4YuXHkAvf()x<$@fn)(j zgV$j$yPWjQE_v4+aaH3*cYm{WeHf8e8solB%93_g2Upt;Chi{h-dD0ul{VHUCBq|(- z#{G@hzWw|cGW_=aE5Wf{s;EmJxu>%lvS;M{a|K{6$LwAQqShCzs&Juk7)W87nl-+Ej6w z6}$>0#Zo*E+(>^yPnVYlZ~lv1DXv1tz^E9k=Z{&Me%om zorfFY+KO&}cdZ;-3s+pcROH?d;{_I<7b;t()zGYWLdD&Os+3wTy; zlEoKdySeu0=|4l>aHf%@C4LOy+7+gWz*7T-+YX8%K=u{2!R`gkX5>as$G zdG~9d2Zp#;j?WB(8c0Dc@faG>Cc^?@D~QpMDWOSBQuTpfo&l+2)4`ef^JfGU>rmhXn4U> zUnM6}$%o{&QsDWoA-um*^@(v~3t{zqgj8}peo5A^i{q6NP&{(-TaX28>rhYD@NxP=RkG&N9YDo^Jl$MQYCfoHm z&6juc5!!cRwdvRhk1xCd1L(>(!q+u5Y)U1Jw}!rTjtl#4D9kRwfJw#JqnnGjw!xdu zcLud>xN>B1H`D#pRdCfX{noltR-29wQ3UB9uq8F!{y zeA>cZMl?xzdIs%ch2W^>{|_;rZ*l69_)RT|U=CaK4LI2XW|p|K#uN^Y;__OHfOwlp zn&gI3&1O7YXPo~=b~mHZ!6?-V(YQ60q{2cYBxvkXH)+6W-M_G`wBQE(RMB;!Lg5tn zRaH2U(vx}jrCw0b`QK2Fn8iX~y@KCAmj42Dh0)>Ko3z}D8kL1G&)K>{+gAeAQal)geMoJI&wxEjl?2 z7S2=mrLM9{2p}|0B!OFrczE;4p=)EQQAo_72W#NbkOxNauvv$av#w|}_ndEaThR01 zq-&?5qT>B~i~=_wOgV-Fu|7u7SD;|Otq}0Lv1PH!Uum{Ah_KUK9Hl!)>wiTu>D*j1 zNbXa4ZfAJt=7gjACM_c*M~w?@gIuOC4c~x_6tAED6iZKg-$eo8m~cdIORg`Fl4I7b ztklzAQ{}vefdpFba@>&-e!or;RGlV82nRRMpJNeiw#Xl`V76%++w?=X*o1}wiBTck z1EzY_QEcU^-uDDbh4&xx3C9gZCKel%KX1!R4390EFP`VP0kc9-PJWDo8?DEy)=e8& z6@2r<|GWb$l~>cY&TOYYJQRG^rM8)#_FDEnD&AR!9J=7u<>1~?wIa%;5V-8GGd~~X z!u60!X1J@zs@nR2ZI6$k!!yp?A6g?Bkcqjux$1aYF5JALxVW+Z_h*2*6iml#& zE{Bv}95uI6-ausio?Krmy`VX3ZK04~7Ocr{7d5MM6c%;vi-vY0bo+}mz!E(25`1`knvm)v5qjE}S5WTSQ83R|{M%gw4 z!rk$O_|D2*mNM2o$y>kFj#~vo+Pof6*ZxrJvl#pOq@Y4fre@)9iVXkxJEOaMA-0o! z@YKQ~GUnUqWYH|>Qu?p{zPT?(bl-!z}WQHyu|JaS`l+YTP>_cJ(VL3Pu?P$3l)l8hw-9?Yh(qX)#wR{`m|%we-tzZ$ zt6kaVftH%T~MRJ>t7BTVM)&wz!ezxLYDu>r-#ySoG19Oay2zy=tn0nuzfA zJhGd~>`2ut9a`#6g@wBXHp*7V6v;I-_1*~`A=xUT6ZyXno^IY(Gvvzk%KfyEePsmO zKlwM@e6Qtn7T#^%EdKj1*NalQ7b)V9!&cB;{`q1M*8@~(Lpd8v$5ha=*CHYjzCbd^_rtp#(AYeLD41V-Z!y}ekV3> zqoekkedkKXwWqz`i?8u;lPjh^MCC{=l=tb*fiACljvRx7I@%OBlv|W_$UfQ)>#ZM* z$T{Xv-{6!!TSvuW0u|9D%`vs(6bfwyKAi3n;KS8EnQl9!S>^OXdj6i>?KUcqw+vrj z{PV8SVCs1hCg_}1ommeWr{#PHsd{1L@@rIILSCzr1<0r={^gbD0GybJNQHK_G%w`2`s^;Z(0 z2Uo=zkZ*FVj=hS!x|BFk|41|Qt6+6pOiU^?kfWC7wH#KTT2_AdF#PCBQ>_I&sx2OXUqG*CHpR-Zq-hvULw!#9KLX^y{tZ|DFQ z&p#Qw#~eQE?4clBYvz%A?{~mHuFYj|Lp@V^BW!&vw{s>_vUHl9x!U`4k_~u`2lYv0 zW&v$ZYQ|XV-OSA_Q0a|{;cBsQF`V2oi?f8)KYzYRn0t?+@JaN?(~MbhSuDOb8-FJz zy4G9l*!(x+@uKy)<#AnwUarY;F3Z`z%EcTGVodfF(C?XMOcBQ69IuSJudLJsCd64S zi2*k(OOu|$Zc#!fvox5J(sG7y8*_NlA%&AIf7};WBVQ^&Q=0dIj0Bd=;p8ixoAykF zkOyaYV zDDVxVE&VR0pF}`|+>HmWj+q*!sAyhj)t&_S29~r?`zyy(4Rch3KSKIZJ;0NwOI7EW z1HS5%P!ccGPXZWu?tZ0HC^Nhsie1ZsBNZ>A|G@}=O7_X}ka0at7>SsrN&o7(`&=^4_H2Nj_u z>JD_sEv+Z-+H%W+$^aljPR5d|?uSVxY4!o!Yx^pK&I&AIRQt4d8CKjKEs)QXg3Zq2 zL)02#!L}=R;OE59f?DkZ^Tx`gEx4CYvQ0yK#X`7RsudY9B_rdv$YdlU_Ol=t!GL4LHl)e348Kv5 z?sK@LLjqP;WRf1C{CXJAJ)j|>5taTd&mf9(&&|sASU-MT`sUcQsSdX1%l-*KdHYd% z4PukVCQ6*F9c?5x5;r#44qbMp1_40COByEEJg%&r*;u(y-O^H7xt`IoCe?te94efg zc{wQ12I|@KE=*x|dH$?h zk>LAzihy#V*G-s>70OEromx`RboFx`Y)zO&Kx;|s)SC-@^#N*!9%DXkH+Xu0A6X?m z^^0HztWDL?lDyY-t~yOs&M-PScYJMZwD{3$OmPM1D%M4m+-^6fnp|5m#>M_N#Prv^ z*lg?)0C+-W>5y8F7RquGHp_}U`SAuMKzji(mhGwu=i0~W>VCB_Fwxx!FM+l!Ay=zz-G2k@lO=MH$I^t^lG*0JCVcuzL4Z13#VEQqI7 zsBYkEK&(7laO#LJCbYG!u#A;U!BmlQFuW$mt!Lwin}YZ;un=fEgB6OvTQ`i=G>ArK zEUTobeEPYe>PJCxnszx!<&#ovvTXp@`7FsOeGtmK(Q+dH&deP0?1QMxbF%DD?)Ev4 zZ{oHlxaqK%bsBwobnGmG?m%L5|06}{8~r@|4{xn}GR-w6H1hZ3@|{XPMVWX?x9}3Z zGbMM`?>{iu;)BXizG&g)o{GjT+G{Vql)rTCly{N*R0F4uyuWTmJfJp69FyGQpT&#V z`C$8{uQx1R&nyD(_{?He(UZ;<<*h|1Z}MA2(oO3q4Qlmbjc0#pC4M#Nb28cyPd=`> zisU>s(n9a`b%f;>y~I{-KRamNm`iEZ$iFE{tpUrx7GGVQuOZClLkt6;`R%i+3;D9a zf6fAH)?WSA7KW9q4|F+pv(y++x0xZ!$K}5_FhZ=lBvbY=%(tExraxy>{rKs;<$fbf zB(%hdvoDeF^G>Ch{^}}c{A+v9IbnU2(74-Hg2ShsN}rxJo6dm0jmoH;&?9t>71!@O zjJxiq`DcS+6R1=DFdJX(cQN_Njh0qMUbeof8?qf@=Z%(%&lFWmyB#00a2uH?Ot)^& z)hLZsHht)xO7QzO7d9cDRqW`h?X)?G^_x5@B-_1j_Qrok5iWn@^g3;0%~iC1+Vpx!iOTKrc_#KX$mz7UPYkWgR+P@^aqT^+x~0c1 z51lq$*bXHc_}hEt#>1NBeqZaP_!NEmcG!x#J_Amj^g2;ki{Ib+>8+%`8EV`C(-l8| z`N><6J1$<|ex3>>^5s?Hg2|6R)DYY$C@`^29@#4c3!f*PuZ?@mS9*MX+&uSo1;@sX z+-D2Qs|;xV@w5ES6YqiT6Z42PcJXJoQp06Vmq^-4`zXJ%)v=iK`>$!lHPyZ<%C2hH z$W1{@KD(o)C2Z=`Y*+luDw@`r?UR^aZLylwfNPBTW<7SzI5}>Hv3D)Zh83~^ZB(0X zFoc$dyj`EJe6f3Fk9@JLvDjgtw#Da|^hO>R)_e?_^*E7k1CFDbs=C)#Prjv5YE9GM z;Qyn{!%ElNuW!LSzxc^dgrr@?d=|O589rBu2iAO$Nm^RSCN33t%Y;ugU4d8p7mkLy znA!QPx#ZFFm6=lCYX;@*H=XZ~8@|deoN#Qp^RT6X*I!FR?0}qCdG9wlCVmGK;9~%} zbl{X;QQ}_dvgr7b|IzC;CcekQ4r@OO8oo0loh#~FT3o1FO4T_jRA4cawBH?ykp17&El!()-Nok_&VEn zh4Z+OE&DO9xGUdkVb^y_R`Qtnc{KB)-3wMF{hJ@*-61>frPlo2mTESd8*JPk6`r=; zkbw0Tzib@CPJKNet8>iP+*-JCuz9Um!VE3H|5B;%Y@u`#Yh1T-m2aNnyKluMo3ll( zMlDIKkP$Hpj=1@SLcVMYR8pX_>t~Ub+b)p-v(OiEOsoR*!FjWoxoviRLhgV( zItOFIQT{yW@m^BTN*Y-JzZ&Pm`!PSPM-~g;SAF^MTC~i%IWJRXqi`&k_#Gc?xBQ(^ zvW^!*Z^}fHcHii=@lLqo!`ZLSOn;D^NRf&;-klOtN zzcfhKVx#($lQQ4Lp55BcuExfe^gVqb=Zz{2@nxb%J^yN*^erHmKqHA=^OzcUrKKw4 zxBPBE70^7+X@m0H@Mr3W>i=zJz&3q;i;p-hQ~HV@4$FAkbL%EmeY~t2!tvYWb04p^ zG|dXTXAVYqKO;~)?zBuuuT;V6z6#7oPNeCI#zLfjpWEb|i%=ZE2rIvs9p62G-h zD5LL^L4ujS5c&8$%swV=l!Ym5k#5}AZIxjuzO47?HcDx$vqW7-61)58Q=Lk+Rm{f> zisQ>IbN5#mO**Q7ysasJ@G4emD}`vLLh(I*SZM40Smho<*$?c=SSSm`ltoX>ZWtSX z49QKlB-mh1TGB$EFd<`_k@>H4@1=`t`KyFFLeCw1iX2}%T8#v>Crp?pqdS1!bW_TVkrhEVz9 zUf zLP(i2@4*-sn)#B6%Pep%E%i)onK~|wt@UhG zX5>`V3Dcf!ZW*`UjjU>@ED)$Khp@Lo{TEwcMn=%q`8kss?x7lApCF%(Nh>Q4=l)l+ z3xUf84F^GWQvK#$Mc++^&0pl*H=mG!493|?Tu)kqC(Y2m8@prIT4?#$M1CnT1ohT; zt2-@(iw?4KXo!j&xE!Cuw4ddc!lYo1+ED)zHrB#0$nDcLYc<4;eEV1Pq>=Pl6d$Zn zN71?i+Td-;$^1dTe@3x`JX!E^=r6cI465gV4)Rq*?%Ykc3S0b2fceV)xWsI(W!9VB z&|WU%VmOFU4>fwV`@APs;$4-wR(8hewk5szus|$a(!YBF+zERJSmPZ82)@ibaZql* zlB2*{QZ6CSd#>4EdVcEKe`!1cOpj!coLJ<&yV?eoE7tq6d!#z5jB@wOF^QFF9BcG5(6f&FX&v-PTTu%Jb5u$X;V#;gwQeXao z%-(_Sn#^K&5})%6+8Y94@XdRt@wlXG$Yv(nI7;{Li}UhD=C6Xn^iWSc?4qGfw0pOI z2u+Ph$x93?G|J*qY5(>;=Pp(J_?!`We`OxJe0Iot7;W4=TVFIiNhbCeXUu(5T8vHH z++$PNZEJ%|X|sd^8h7~8dU#$o$B+%plrDKbOQ!ujQydBDm;A#uH0`$b(`u8^f*YP_ z;!@0guy7DZF!LaC@9xiuHXhO)LDVd{bjbXGA}5`S1z}meq^#%zMs5^ z3?exdY@G?Q|5E2Y_UxhacbBSzrTE6Bt^G9OY{kJhZv*#il7*RYi?+W;*Ex5a%z{u4 zw&PbAF-;7I1G}_#XP>lwaF5T-L!G_M#o}TjTR7_<%9|+i##oYJX7fU9Oe_jjq{Es# zn(&R^N;t{-qo~p+Su2^Pa7K)5VLvjRM-5N`>GOtH6b7BBpY_cyk}7b!ZEvMJK(b9A z);zBclKazmsTXx(5sqdN{ww6`_K^x}v@rc!60Q)L>`yFTeMsZK zQgI8xX2~)x#Wbzeu-|zZ_a-A7JD#MRq3XGeQ;Z}Y$WV6d9(j?k9#%5n8Z+_}k%@fk zq1I)_XHc4Y+ngOz7!@)esMm7n-0karSX69QF4wF&u=PiZ`_7Yl zM&wLe&~GpKlPw=obkHI3WQWE^Vuf7yQ_$6axbd;O~Wh1BzQN;y=Y#d zmZf-D(@%fN3yYt4vA4(hE9B&^l zX8b(XJe$;yMBI%H(Hzm%99!$Jo8mNeN>%Np@L#(LGIsbi?XbYzJRZwwEu`~NU0RldU`l7 zx#c)x71SGT&RJq|zUdyk!3XOKWkDN6-&tf3R)d-uCtrWUygpTjm4K5Z@$SmR2CTyz#zG1GE4$2*vM^^#${+mb8M=9Y_n4?cZ+ploeU zg5uEoukGKDgu1kSo~)2i}O>IOY)nDO+r-D+$9Somz0XM8CfQpRc^)BV!8aPbzzI2uzt0c zOUY%(gs;mem+Z>FZyMKVAc9^xWZwaHMx6uFs?x?ITGP?4HcDJ*#u**?yn&~ z-fEey8Lb)@-2V6mW8UJsZ=R%^2LAR!vTodx)Fhj#Qd7_ap#Y}&=4tUp%?75krT>>N zyrmM}I6)?D*AR&&EXz*!G3vWB6FTKB=e;DNkw{dBALq^o8!22kaYJ4sn~IKC)oj+K z`Qo_+C*2h#g$u3}flby(n$)8ia_nFk$f6C~QE#&uoTg}?69cGc`{iYzft-LYGLS`2 z&faGBNNEG!cS^uI^gi5J5ZXo_00fy|bj4+)=HuYe+s=)7e?1_V_Fk9CnQ83p0%(?b zw%?`U#?D0c$v;S67tQv~-BI48d&SrEyZ%=8)^EB{yLtu5rzeeTAfZ^Xb93b5Gnf`iq0hgJ^7pIGg8 z*<2XC_v}MQy4`$Hy0*7}GIYV<&eR8AJt&}J%>KX&+mWk%%bA-tXf5W{dyKi>ZL!bl znWFGCK7O4-ZMfHNSRQSHn#3GSgnB@sEFZ?e_2^1vPpqupMW#n~INClV>zGbod{&Ca z7m|N}we*ya21c6l_YY#pCf%gSW@n>onQN*hr6uwu%jX>KK^r&ck%O_r*c~rx?s&y| z=I+s}J)u2akP5mSP}3K2BP2iQ-IB~zWLqQ%Xm%p|FSva1J*^W_6tv?mV&X82|&XU3Do=|r9@|cKl;Fl0n;k+-gUo6Ao$pu z2(MG;{}fJ2-Gme3UK_O1q={#pa^nZ=upi)jhLe zZ7-o{XSq+PX@os1@l&_n)p=S^tuTX-rUeywErjIt7BJo%_o;~QsThMG_66Rulhvhi z37QE#e=#Tm_fHtDTsQbOizSDOz9+bSQCHdwCB>?!TGAv3@hV!^K6$tD(>@H}WN=li zS7I<{ZF(N#%iZxjaJ@w3W2M%2?QRAFQnuiWW}9P}lXW(tT0S zg!;evem~0{myjj#-TfM+~^UX0VKYM>%jTQsH@g8!dh3xb*68P+C-;me$jrwEC zV-;;48WvRt4;B$?$BH);Dw~8eu4v2;iIPcly{U~pz!+?GVL6PDMt2x%3-6ff%>}X6 zLNUoiB%s!>1%) zewJv^6+Ew#bu3f1S?BoW6eL7^z@|;IO=$ zLFAhW5#ZY2#X)zNLG?sVdz2EJOQ$gSO*aX+IokjqcG!$e>_l7YZE>GBNP&2np+{yb z&SBnyVWODV`Q=Y*!8S+3VlZn3S?pJeJMaFfMhjhO?L&<0tajw~U+dlVfOnDrjiiGD z6*9cL?wGp|Lei)CBSA#7#%45z&v)p+tsYAjC@6G!MFC?USFUPZY@|I5QpgChmS10{ z9FUXmQ~ZY@@&*0>Remk5E1q7-c$~1NB9#YXiuVY>UpSA)!oy;*a-(2lW$g&FvWMB& zBCPkrtq#c5+{y}WWu@A5TmI_rzW`A&7cPaz|8D?E=(OQKsUGt< + +本文概述了云原生环境中 Kubernetes 的安全需要考量的主要方面。 + +## 云原生 4C 安全模型 + +云原生 4C 安全模型，是指在四个层面上考虑云原生的安全： +* Cloud（云或基础设施层） +* Cluster（Kubernetes 集群层） +* Container（容器层） +* Code（代码层） + +如下图所示，云原生的每一层安全防护都是基于其外层防护之上的。没有Cloud层、Cluster层、Container层的安全防护，Code层的防护将形同虚设。因为，您在代码层所做的任何安全防护，都不能保护其外层（Cloud层、Cluster层、Container层）经受住安全入侵的攻击。 + +![云原生 4C 安全模型](./overview.assets/4c.png) + +下面我们将逐个介绍每一层安全防护需要考量的内容。 + +## Cloud 云或基础设施层安全 + +通常，Kubernetes 集群都认为其所依赖的基础设施（云、服务器、或者企业的数据中心）是安全和可信的。如果基础本身不安全（或者没有进行合理的安全防护配置），将无法保证构建在其上的组件是安全的。每一个云供应商都给出了相关的安全建议。 + +### 云安全 + +如果您的 Kubernetes 集群运行在您自己的硬件上，您需要自行考虑基础设施层面的安全防护。下表给出了部分云供应商提供的安全文档： + +| IaaS 供应商 | 链接 | +| ----------- | ----------- | +| 阿里云 | [https://www.alibabacloud.com/trust-center](https://www.alibabacloud.com/trust-center) | +| 亚马逊云 | [https://aws.amazon.com/security/](https://aws.amazon.com/security/) | +| 微软 Azure | [https://docs.microsoft.com/en-us/azure/security/azure-security](https://docs.microsoft.com/en-us/azure/security/azure-security) | + +### 基础设施安全 + +与 Kubernetes 相关的基础设施安全建议： + +| 关注点 | 建议 | +| ----------- | ----------- | +| APIServer的网络（控制节点） | 空直接点上所有端口都不应该暴露在互联网上 | +| 节点的网络 | 工作节点的端口应该只允许接受来自控制节点的网络访问，同时可以暴露一些 Service 的节点端口。工作节点应该尽可能不暴露在公网上 | +| ETCD的网络 | ETCD（Kubernetes的数据存储）应该只允许控制节点访问。尽可能使用 ETCD 的 TLS 连接（基于 kuboard-spray安装的集群已经确保了这一点）。更多信息请参考 [ETCD 文档](https://github.com/etcd-io/etcd/tree/master/Documentation) | +| ETCD 加密 | 如果可能，尽量加密存储 etcd 数据所使用的磁盘 | + +## Cluster 集群层安全 + +Kubernetes 集群的安全主要考虑如下两方面因素： +* 集群组件的安全防护 +* 集群中运行的应用程序的安全防护 + +### 集群的组件 + +如果您希望保护您的集群组件以避免非法访问，请参考文档 [集群的安全防护](./secure-a-cluster) + +### 集群中应用的安全（您的应用程序） + +不同类型的应用程序可能会暴露不同的易受安全攻击的点，因此，您最好是有针对性地进行安全防护。例如：如果您在集群上运行了应用A和应用B，其中应用A是一个关键应用，而应用B很容易受到攻击而导致资源（CPU/内存）耗尽，在这种情况下，如果您不限制应用B的最大资源（CPU/内存）使用量，应用A也会被应用B所牵连。 + +下表罗列了在 Kubernetes 集群中运行应用程序时应该主要关注的安全因素以及相关建议： + +| 关注点 | 建议 | +| ----------- | ----------- | +| 用户认证（API Server） | [用户认证概述](./authenticate/) | +| RBAC授权（API Server） | [授权用户访问名称空间](./rbac/auth-namespace) | +| 密文管理（以及存储加密） | [Secret概述](/learning/k8s-intermediate/config/secrets/)
[Encrypting Secret Data at Rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) | +| Pod Security Standards | [Pod Security Standards](./pss) | +| Quality Of Service（集群资源管理） | [Configure Quality of Service for Pods](https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/)
[管理容器的计算资源](/learning/k8s-intermediate/config/computing-resource.html) | +| Network Policies | [网络策略 Network Policies](/learning/k8s-intermediate/service/np.html) | +| Ingress TLS | [为 Ingress 配置 HTTPS 证书](/learning/k8s-intermediate/service/ingress.html#实战-使用-ingress-访问-web-应用) | + +## Container 容器层安全 + +本文档将不会展开容器安全的话题，下面是一些建议以及可以参考的链接： + +| 关注点 | 建议 | +| ----------- | ----------- | +| 容器安全扫描以及操作系统相关的安全性 | 在容器镜像的构建阶段，您应该对容器执行安全扫描，以便发现和修复已知的安全漏洞 | +| 镜像签名 | 使用已签名的第三方容器镜像，以确保您使用的镜像来源是可靠的。 | +| 避免使用 root 用户 | 在容器中使用非 root 用户，并避免过度授权 | + + +## Code 代码层安全 + +应用程序的代码是最容易受到攻击，同时也是您掌控面最大的地方。以下是一些建议： + +| 关注点 | 建议 | +| ----------- | ----------- | +| 使用 TLS | 如果您的代码需要 TCP 通信，请使用 TLS 传输协议。 | +| 减少通信端口 | 只暴露必须的服务通信端口或者性能信息采集端口 | +| 第三方依赖安全性 | 定期扫描应用程序的第三方依赖库，以排除潜在的安全漏洞 | +| 静态代码分析 | 执行代码安全扫描，以排除潜在的安全漏洞 | +| 动态漏洞扫描 | 使用漏洞扫描工具发现可能的安全漏洞，例如 SQL注入、CSRF、XSS 等 | \ No newline at end of file diff --git a/learning/k8s-advanced/sec/psa.md b/learning/k8s-advanced/sec/psa.md new file mode 100644 index 0000000..ec7c3ee --- /dev/null +++ b/learning/k8s-advanced/sec/psa.md @@ -0,0 +1,11 @@ +--- +layout: LearningLayout +description: Kubernetes教程_本文面向集群管理员，阐述 Pod Security Admission 的相关概念。 +meta: + - name: keywords + content: Kubernetes 教程,Pod Security Admission +--- + +# Pod Security Admission + + \ No newline at end of file diff --git a/learning/k8s-advanced/sec/pss.md b/learning/k8s-advanced/sec/pss.md new file mode 100644 index 0000000..5f6343a --- /dev/null +++ b/learning/k8s-advanced/sec/pss.md @@ -0,0 +1,11 @@ +--- +layout: LearningLayout +description: Kubernetes教程_本文面向集群管理员，阐述Pod Security Standards 的概念。 +meta: + - name: keywords + content: Kubernetes 教程,Pod Security Standards +--- + +# Pod Security Standards + + \ No newline at end of file diff --git a/learning/k8s-advanced/sec/secure-a-cluster.md b/learning/k8s-advanced/sec/secure-a-cluster.md new file mode 100644 index 0000000..005233f --- /dev/null +++ b/learning/k8s-advanced/sec/secure-a-cluster.md @@ -0,0 +1,15 @@ +--- +layout: LearningLayout +description: Kubernetes教程_本文面向集群管理员，概述了云原生安全的相关概念。 +meta: + - name: keywords + content: Kubernetes 教程,Secure a Cluster +--- + +# 集群的安全防护 + +本文档主要参考了 Kubernetes 官方文档：[Securing a Cluster](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/) + + + +...文档待完善 \ No newline at end of file