1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: Role
3
metadata:
4
  name: pod-reader
5
  namespace: production
6
rules:
7
  - apiGroups: [""]
8
    resources: ["pods", "pods/log"]
9
    verbs: ["get", "list", "watch"]
10
  - apiGroups: [""]
11
    resources: ["pods/exec"]
12
    verbs: ["create"]            # 允许 exec 进入容器
13
  - apiGroups: ["apps"]
14
    resources: ["deployments"]
15
    verbs: ["get", "list"]
16
    resourceNames: ["nginx"]     # 限制为特定资源名

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: ClusterRole
3
metadata:
4
  name: node-reader
5
rules:
6
  - apiGroups: [""]
7
    resources: ["nodes"]
8
    verbs: ["get", "list", "watch"]
9
  - apiGroups: [""]
10
    resources: ["namespaces"]
11
    verbs: ["get", "list"]

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: RoleBinding
3
metadata:
4
  name: jane-pod-reader
5
  namespace: production
6
subjects:
7
  - kind: User
8
    name: jane
9
    apiGroup: rbac.authorization.k8s.io
10
roleRef:
11
  kind: Role
12
  name: pod-reader
13
  apiGroup: rbac.authorization.k8s.io

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: ClusterRoleBinding
3
metadata:
4
  name: admin-binding
5
subjects:
6
  - kind: User
7
    name: admin
8
    apiGroup: rbac.authorization.k8s.io
9
roleRef:
10
  kind: ClusterRole
11
  name: cluster-admin
12
  apiGroup: rbac.authorization.k8s.io

1
# 检查用户是否有权限执行操作
2
kubectl auth can-i get pods --as=jane -n production
3
kubectl auth can-i delete deployments --as=jane -n production
4

5
# 检查 ServiceAccount 的权限
6
kubectl auth can-i list secrets --as=system:serviceaccount:default:my-sa
7

8
# 查看 RoleBinding 详情
9
kubectl describe rolebinding jane-pod-reader -n production
10

11
# 查看 ClusterRole 的规则
12
kubectl describe clusterrole cluster-admin

1
kubectl get sa -n production
2
# NAME      SECRETS   AGE
3
# default   0         30d

1
apiVersion: v1
2
kind: ServiceAccount
3
metadata:
4
  name: api-reader
5
  namespace: production
6
automountServiceAccountToken: true   # 自动挂载 API Token

1
# Pod 使用专用 ServiceAccount
2
spec:
3
  serviceAccountName: api-reader
4
  containers:
5
    - name: my-app
6
      image: my-app:v1

1
/var/run/secrets/kubernetes.io/serviceaccount/
2
  ├── ca.crt      # API Server CA 证书
3
  ├── namespace   # Pod 所在 Namespace
4
  └── token       # 短期 JWT Token（默认 1 小时有效期）

1
apiVersion: v1
2
kind: Namespace
3
metadata:
4
  name: production
5
  labels:
6
    pod-security.kubernetes.io/enforce: restricted      # 强制执行
7
    pod-security.kubernetes.io/audit: restricted        # 审计日志
8
    pod-security.kubernetes.io/warn: restricted         # 警告提示
9
    pod-security.kubernetes.io/enforce-version: v1.29   # 使用 v1.29 版本标准

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: secure-app
5
spec:
6
  securityContext:
7
    runAsNonRoot: true          # 必须以非 root 运行
8
    runAsUser: 1000
9
    fsGroup: 2000
10
    seccompProfile:
11
      type: RuntimeDefault      # 使用默认 seccomp 配置
12
  containers:
13
    - name: app
14
      image: my-app:v1
15
      securityContext:
16
        allowPrivilegeEscalation: false  # 禁止提权
17
        readOnlyRootFilesystem: true     # 只读根文件系统
18
        capabilities:
19
          drop: ["ALL"]                  # 删除所有 Linux 能力
20
      volumeMounts:
21
        - name: tmp
22
          mountPath: /tmp
23
  volumes:
24
    - name: tmp
25
      emptyDir: {}              # 临时目录用于写入

1
securityContext:
2
  capabilities:
3
    add: ["NET_BIND_SERVICE"]   # 允许绑定 1024 以下端口
4
    drop: ["ALL"]               # 删除所有其他能力

1
apiVersion: networking.k8s.io/v1
2
kind: NetworkPolicy
3
metadata:
4
  name: deny-all-ingress
5
  namespace: production
6
spec:
7
  podSelector: {}              # 空选择器 = Namespace 内所有 Pod
8
  policyTypes:
9
    - Ingress                  # 拒绝所有入站

1
# API 层策略：只允许 Frontend 访问
2
apiVersion: networking.k8s.io/v1
3
kind: NetworkPolicy
4
metadata:
5
  name: api-policy
6
  namespace: production
7
spec:
8
  podSelector:
9
    matchLabels:
10
      app: api
11
  policyTypes:
12
    - Ingress
13
    - Egress
14
  ingress:
15
    - from:
16
        - podSelector:
17
            matchLabels:
18
              app: web
19
      ports:
20
        - port: 8080
21
  egress:
22
    - to:
23
        - podSelector:
24
            matchLabels:
25
              app: mysql
26
      ports:
27
        - port: 3306
28
    - to:                        # 允许 DNS 解析
29
        - namespaceSelector: {}
30
      ports:
31
        - port: 53
32
          protocol: UDP

1
# 允许 monitoring Namespace 的 Pod 访问 metrics
2
ingress:
3
  - from:
4
      - namespaceSelector:
5
          matchLabels:
6
            name: monitoring
7
        podSelector:
8
          matchLabels:
9
            app: prometheus
10
    ports:
11
      - port: 9090

1
# EncryptionConfiguration
2
apiVersion: apiserver.config.k8s.io/v1
3
kind: EncryptionConfiguration
4
resources:
5
  - resources:
6
      - secrets
7
    providers:
8
      - aescbc:
9
          keys:
10
            - name: key1
11
              secret: <base64-encoded-32-byte-key>
12
      - identity: {}            # 回退到明文（用于读取未加密的旧数据）

1
# 配置 API Server 使用加密配置
2
kube-apiserver --encryption-provider-config=/etc/kubernetes/encryption-config.yaml

1
# ExternalSecret 示例
2
apiVersion: external-secrets.io/v1beta1
3
kind: ExternalSecret
4
metadata:
5
  name: db-credentials
6
spec:
7
  refreshInterval: 1h
8
  secretStoreRef:
9
    name: vault-backend
10
    kind: ClusterSecretStore
11
  target:
12
    name: db-credentials        # 同步创建的 Kubernetes Secret 名称
13
  data:
14
    - secretKey: password       # Kubernetes Secret 中的键
15
      remoteRef:
16
        key: secret/data/db     # Vault 中的路径
17
        property: password       # Vault 中的字段

1
# 安装 kubeseal CLI
2
kubeseal --format yaml < secret.yaml > sealed-secret.yaml
3

4
# sealed-secret.yaml 可以安全提交到 Git
5
# 集群中的 Sealed Secrets Controller 解密并创建真正的 Secret
6
kubectl apply -f sealed-secret.yaml