Kubernetes RBAC 与安全上下文

用户/组/ServiceAccount  ──Binding──→  Role/ClusterRole  ──包含──→  权限规则

# Role：命名空间级别的权限，只影响指定 namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get"]
  resourceNames: ["app-config"]  # 限制只能访问特定 ConfigMap

# ClusterRole：集群级别的权限
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-reader
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "watch"]

# RoleBinding：将 ClusterRole 绑定到指定命名空间的 ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: production
  name: pod-reader-binding
subjects:
- kind: ServiceAccount
  name: myapp-sa
  namespace: production
roleRef:
  kind: ClusterRole    # 引用 ClusterRole，但权限范围被 RoleBinding 限制在 production 命名空间
  name: pod-reader     # ClusterRole 名
  apiGroup: rbac.authorization.k8s.io

# ClusterRoleBinding：集群范围绑定
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-admin-binding
subjects:
- kind: User
  name: admin@example.com
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-viewer
rules:
- apiGroups: ["", "apps", "batch", "extensions"]
  resources: ["*"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods/exec", "pods/portforward"]
  verbs: []  # 显式拒绝 exec 和端口转发

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: deployer
rules:
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "watch", "update", "patch"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch", "delete"]  # 可以删 Pod 触发滚动更新
- apiGroups: [""]
  resources: ["services", "configmaps", "secrets"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "list", "watch", "update", "patch"]

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: team-a
  name: namespace-admin
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
# 注意：Role 的 * 只影响当前命名空间，不影响集群级资源

# 模拟 SA 验证权限
kubectl auth can-i --list \
  --as=system:serviceaccount:production:myapp-sa \
  -n production

# 模拟 SA 验证特定操作
kubectl auth can-i delete pods \
  --as=system:serviceaccount:production:myapp-sa \
  -n production

# 批量检查敏感权限
for verb in create delete deletecollection patch update; do
  for resource in pods secrets configmaps deployments; do
    result=$(kubectl auth can-i $verb $resource \
      --as=system:serviceaccount:production:myapp-sa \
      -n production 2>/dev/null)
    if [ "$result" = "yes" ]; then
      echo "[WARN] myapp-sa can $verb $resource"
    fi
  done
done

apiVersion: v1
kind: ServiceAccount
metadata:
  name: myapp-sa
  namespace: production
  annotations:
    description: "MyApp backend service account"
automountServiceAccountToken: false  # 如果应用不需要访问 K8s API，设为 false

# Pod 中引用 SA
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  template:
    spec:
      serviceAccountName: myapp-sa
      automountServiceAccountToken: true  # 覆盖 SA 级别的设置
      containers:
      - name: app
        image: myapp:v1

# 为 SA 生成临时 token（默认1小时过期）
kubectl create token myapp-sa -n production

# 指定有效期
kubectl create token myapp-sa -n production --duration=24h

apiVersion: v1
kind: Secret
metadata:
  name: myapp-sa-token
  namespace: production
  annotations:
    kubernetes.io/service-account.name: myapp-sa
type: kubernetes.io/service-account-token

# 查看某个 SA 的所有绑定
kubectl get rolebindings,clusterrolebindings -A -o json | \
  jq '.items[] | select(.subjects[]? | select(.kind=="ServiceAccount" and .name=="myapp-sa" and .namespace=="production")) | .metadata.name'

# 查看 SA 可以做什么
kubectl auth can-i --list --as=system:serviceaccount:production:myapp-sa -n production

# 检查 SA 是否有敏感权限
kubectl auth can-i --list --as=system:serviceaccount:production:myapp-sa -n production | \
  grep -E "delete|exec|create.*secrets"

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    # 强制当前命名空间使用 restricted 策略
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest

    # 审计模式：违规只记录日志，不拒绝
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest

    # 告警模式：违规发出告警事件
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest

spec:
  securityContext:
    runAsNonRoot: true        # 必须非 root 运行
    runAsUser: 1000           # 必须指定非 0 的 UID
    fsGroup: 2000             # 必须指定 fsGroup
    seccompProfile:
      type: RuntimeDefault    # 必须使用默认 seccomp profile
  containers:
  - name: app
    securityContext:
      allowPrivilegeEscalation: false  # 禁止提权
      readOnlyRootFilesystem: true     # 只读根文件系统
      runAsNonRoot: true
      runAsUser: 1000
      capabilities:
        drop:
          - ALL              # 必须丢弃所有 Linux capabilities
        add:
          - NET_BIND_SERVICE  # 按需添加

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    # ===== Pod 级别 =====
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
    fsGroupChangePolicy: "OnRootMismatch"
    seccompProfile:
      type: RuntimeDefault
    sysctls:
    - name: net.core.somaxconn
      value: "4096"
  containers:
  - name: app
    image: myapp:v1
    securityContext:
      # ===== Container 级别（覆盖 Pod 级别）=====
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      privileged: false
      runAsNonRoot: true
      runAsUser: 1000
      capabilities:
        drop:
          - ALL
        add:
          - NET_BIND_SERVICE
      seccompProfile:
        type: RuntimeDefault
    volumeMounts:
    - name: tmp
      mountPath: /tmp          # 只读根文件系统需要可写目录
    - name: cache
      mountPath: /app/cache
  volumes:
  - name: tmp
    emptyDir: {}
  - name: cache
    emptyDir: {}

containers:
- name: app
  securityContext:
    readOnlyRootFilesystem: true
  volumeMounts:
  - name: tmp
    mountPath: /tmp
  - name: logs
    mountPath: /app/logs
  - name: cache
    mountPath: /app/cache
volumes:
- name: tmp
  emptyDir:
    medium: Memory    # tmpfs，内存支持
- name: logs
  emptyDir: {}
- name: cache
  emptyDir: {}

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}           # 选择命名空间内所有 Pod
  policyTypes:
  - Ingress
  - Egress
  # 不定义 ingress/egress 规则 = 全部拒绝

# 允许前端访问后端
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

---
# 允许后端访问数据库
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend-to-db
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: postgres
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: backend
    ports:
    - protocol: TCP
      port: 5432

---
# 允许所有 Pod 访问 DNS
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53

# 给命名空间打标签
kubectl label namespace kube-system kubernetes.io/metadata.name=kube-system

# 允许后端 Pod 访问外部数据库
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-egress-external-db
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.5.100/32   # 外部数据库 IP
    ports:
    - protocol: TCP
      port: 5432
  - to:
    - namespaceSelector: {}    # 允许访问集群内所有命名空间（用于访问 kube-dns 等）
    ports:
    - protocol: UDP
      port: 53

# /etc/kubernetes/audit/audit-policy.yaml
apiVersion: audit.k8s.io/v1
kind: Policy
omitStages:
  - RequestReceived

rules:
  # 不记录系统组件的 get/list/watch
  - level: None
    users: ["system:apiserver", "system:kube-controller-manager", "system:kube-scheduler"]
    verbs: ["get", "list", "watch"]

  # 记录 Secret 操作（完整记录请求体）
  - level: RequestResponse
    resources:
    - group: ""
      resources: ["secrets"]

  # 记录所有写操作
  - level: Request
    verbs: ["create", "update", "patch", "delete"]

  # 记录认证授权相关操作
  - level: Metadata
    resources:
    - group: "rbac.authorization.k8s.io"

  # 默认：只记录元数据
  - level: Metadata

# /etc/kubernetes/manifests/kube-apiserver.yaml
spec:
  containers:
  - name: kube-apiserver
    command:
    - kube-apiserver
    - --audit-policy-file=/etc/kubernetes/audit/audit-policy.yaml
    - --audit-log-path=/var/log/kubernetes/audit/audit.log
    - --audit-log-maxage=30
    - --audit-log-maxbackup=10
    - --audit-log-maxsize=100
    - --audit-log-format=json
    volumeMounts:
    - mountPath: /etc/kubernetes/audit
      name: audit-policy
      readOnly: true
    - mountPath: /var/log/kubernetes/audit
      name: audit-log
  volumes:
  - name: audit-policy
    hostPath:
      path: /etc/kubernetes/audit
      type: Directory
  - name: audit-log
    hostPath:
      path: /var/log/kubernetes/audit
      type: DirectoryOrCreate

# 查找谁删除了 Pod
cat /var/log/kubernetes/audit/audit.log | \
  jq 'select(.verb=="delete" and .objectRef.resource=="pods") | \
      {user: .user.username, ns: .objectRef.namespace, pod: .objectRef.name, time: .requestReceivedTimestamp}'

# 查找谁访问了 Secret
cat /var/log/kubernetes/audit/audit.log | \
  jq 'select(.objectRef.resource=="secrets") | \
      {user: .user.username, ns: .objectRef.namespace, secret: .objectRef.name, verb: .verb}'

# 统计各用户的 API 调用次数
cat /var/log/kubernetes/audit/audit.log | \
  jq -r '.user.username' | sort | uniq -c | sort -rn

# 查找失败的请求
cat /var/log/kubernetes/audit/audit.log | \
  jq 'select(.responseStatus.code >= 400) | \
      {user: .user.username, verb: .verb, resource: .objectRef.resource, code: .responseStatus.code}'