1
security_layers:
2
  # 基础设施层
3
  infra:
4
    - cloud_account_security
5
    - network_segmentation
6
    - identity_foundation
7

8
  # 容器平台层
9
  platform:
10
    - kubernetes_security
11
    - container_registry
12
    - secret_management
13

14
  # 应用层
15
  application:
16
    - image_scanning
17
    - vulnerability_management
18
    - network_policy
19

20
  # 运行时层
21
  runtime:
22
    - behavior_monitoring
23
    - threat_detection
24
    - incident_response

1
image_scanning:
2
  # 构建阶段
3
  build_time:
4
    # 阻断规则
5
    block_critical: true
6
    block_high_with_exploit: true
7
    block_malware: true
8

9
    # 扫描项
10
    checks:
11
      - CVE 漏洞
12
      - 恶意软件
13
      - 敏感信息
14
      - 配置错误
15
      - 证书过期
16

17
  # 部署阶段
18
  deploy_time:
19
    admission_control: true
20
    block_untrusted_images: true
21
    require_signed: true
22

23
  # 运行时
24
  runtime:
25
    continuous_scanning: true
26
    alert_on_new_critical: true

1
# OPA Gatekeeper 策略
2
admission_policies:
3
  # 禁止特权容器
4
  - name: no_privileged_containers
5
    enforcement: deny
6
    condition: |
7
      input.request.object.spec.containers.any(c, c.securityContext.privileged == true)
8

9
  # 只允许已签名镜像
10
  - name: require_signed_images
11
    enforcement: deny
12
    condition: |
13
      input.request.kind == "Pod"
14
      not input.image_signature_valid
15

16
  # 资源限制
17
  - name: enforce_resource_limits
18
    enforcement: audit
19
    condition: |
20
      all_containers_have_limits

1
# ServiceAccount 配置
2
service_accounts:
3
  # 应用场景分配
4
  web_app:
5
    name: web-sa
6
    namespace: production
7
    rules:
8
      - apiGroups: [""]
9
        resources: ["pods", "services"]
10
        verbs: ["get", "list"]
11

12
  # 数据库访问
13
  db_app:
14
    name: db-sa
15
    namespace: production
16
    rules:
17
      - apiGroups: [""]
18
        resources: ["configmaps", "secrets"]
19
        verbs: ["get"]
20
      - apiGroups: [""]
21
        resources: ["pods/exec"]
22
        verbs: ["create"]
23
        resourceNames: ["db-backup-command"]

1
# 默认拒绝所有入站流量
2
network_policy:
3
  name: default-deny-ingress
4
  spec:
5
    podSelector: {}
6
    policyTypes:
7
      - Ingress
8

9
# 允许特定流量
10
web_to_db_policy:
11
  name: allow-web-to-db
12
  podSelector:
13
    matchLabels:
14
      app: database
15
  ingress:
16
    - from:
17
        - podSelector:
18
            matchLabels:
19
              app: web
20
      ports:
21
        - port: 5432

1
pod_security_standards:
2
  # 基线级别
3
  baseline:
4
    seccomp: RuntimeDefault
5
    capabilities: DROP ALL
6
    privileged: false
7

8
  # 限制级别
9
  restricted:
10
    allowPrivilegeEscalation: false
11
    readOnlyRootFilesystem: true
12
    runAsNonRoot: true
13
    seccompProfile:
14
      type: RuntimeDefault

1
falco_rules:
2
  # 异常行为检测
3
  rules:
4
    - name: shell_in_container
5
      condition: >
6
        spawned_process
7
        and container
8
        and proc.name in (shell_binaries)
9
      output: >
10
        Shell spawned in container
11
        (user=%user.name container=%container.name
12
        shell=%proc.name command=%proc.cmdline)
13
      priority: WARNING
14

15
    - name: write_binary_dir
16
      condition: >
17
        open_write
18
        and container
19
        and dirs_in_etc
20
      output: >
21
        File to /etc directory
22
        (user=%user.name container=%container.name
23
        file=%fd.name command=%proc.cmdline)
24
      priority: CRITICAL

1
tetragon_policy:
2
  # 敏感操作追踪
3
  tracing:
4
    - name:敏感文件访问
5
      event: openat
6
      args:
7
        - path
8
      selectors:
9
        - pid: 0
10
          comm:
11
            - malware
12
          flags:
13
            - O_WRONLY
14

15
    - name: 网络连接
16
      event: connect
17
      args:
18
        - remote_addr
19
      selectors:
20
        - pid: 0

1
cis_benchmark_checks:
2
  # Master 节点
3
  master:
4
    - id: "1.1.1"
5
      title: "API Server 加密传输"
6
      check: |
7
        kubectl get pod -n kube-system kube-apiserver -o yaml |
8
        grep -q "tls-cert-file"
9

10
  # Worker 节点
11
  worker:
12
    - id: "4.2.1"
13
      title: "容器镜像扫描"
14
      check: |
15
        kubelet 配置 ImageWebhook
16

17
# 合规报告
18
compliance_report:
19
  format: pdf
20
  standards:
21
    - CIS Kubernetes
22
    - PCI-DSS
23
    - SOC2

1
aliyun_ack_security:
2
  # 网络策略
3
  network:
4
    Terway 网络模式: CNI_Elastic
5
    NetworkPolicy 强制: true
6

7
  # 容器运行时
8
  runtime:
9
    镜像沙箱: 开启
10
    Root 权限检查: 开启
11

12
  # 密钥管理
13
  secrets:
14
    阿里云 KMS 加密: true
15
    外部密钥: HashiCorp Vault
16

17
  # 合规
18
  compliance:
19
    等保 2.0: 开启
20
    CIS 基线: 自动检查

1
container_registry:
2
  # 镜像签名
3
  sign:
4
    mechanism: KMS + kritis-validation-hook
5
    notary: 阿里云镜像公证
6

7
  # 漏洞扫描
8
  scan:
9
   阻断策略:阻断 Critical
10
    扫描范围: 依赖镜像
11

12
  # 访问控制
13
  access:
14
    vpc 内网推送: true
15
    扫码授权: RAM Role