强化 TKE 集群安全性¶

# 错误示例：授予过多权限
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dev-team-binding
subjects:
- kind: Group
  name: dev-team
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin  # ❌ 不要直接授予 cluster-admin
  apiGroup: rbac.authorization.k8s.io

# 正确示例：按需授权
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: dev-team-role
  namespace: dev-namespace
rules:
- apiGroups: ["", "apps"]
  resources: ["pods", "deployments", "services"]
  verbs: ["get", "list", "watch", "create", "update", "delete"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]  # ✅ 只允许读取 Secret，不允许创建或修改
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: dev-team-binding
  namespace: dev-namespace
subjects:
- kind: Group
  name: dev-team
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: dev-team-role
  apiGroup: rbac.authorization.k8s.io

# 推荐：通过群组管理权限
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sre-team-binding
subjects:
- kind: Group
  name: "sre-team@company.com"  # ✅ 使用群组
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: sre-cluster-role
  apiGroup: rbac.authorization.k8s.io

# 限制默认 ServiceAccount 的权限
apiVersion: v1
kind: ServiceAccount
metadata:
  name: default
  namespace: production
automountServiceAccountToken: false  # ✅ 禁止自动挂载 token

# kube-apiserver 配置（TKE 托管集群通过控制台配置）
apiServer:
  extraArgs:
    # 禁用匿名访问（保留健康检查端点）
    anonymous-auth: "false"
    # 启用审计日志
    audit-log-path: "/var/log/kubernetes/audit.log"

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anonymous-discovery
rules:
- nonResourceURLs: ["/healthz", "/readyz", "/livez"]
  verbs: ["get"]
# 不包含 /api, /apis 等发现端点

# 在 TKE 控制台配置 RBAC 授权
# 或使用 kubectl 配置

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cam-admin-binding
subjects:
- kind: User
  name: "100000000001"  # CAM 用户 UIN
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: tke:admin  # TKE 预设管理员角色
  apiGroup: rbac.authorization.k8s.io

# 默认拒绝命名空间内所有入站流量
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}  # 选择所有 Pod
  policyTypes:
  - Ingress
  - Egress

# 允许 frontend 访问 backend
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

# 允许所有 Pod 访问 DNS（必须配置，否则服务发现失效）
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53

# 租户 A 只能访问自己命名空间内的服务
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tenant-isolation
  namespace: tenant-a
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          tenant: a  # ✅ 只允许同租户流量
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          tenant: a
  - to:  # 允许访问 DNS
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system

# 在 TKE 控制台启用增强网络策略
# 集群 -> 组件管理 -> 安装 cilium 组件

# 使用 Cilium NetworkPolicy（支持 L7 过滤）
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-http-only
  namespace: production
spec:
  endpointSelector:
    matchLabels:
      app: api-server
  ingress:
  - fromEndpoints:
    - matchLabels:
        app: frontend
    toPorts:
    - ports:
      - port: "8080"
        protocol: TCP
      rules:
        http:
        - method: "GET"  # ✅ L7 层过滤，只允许 GET 请求
          path: "/api/.*"

# 节点安全组规则示例
入站规则:
  # 允许集群内部通信
  - 协议: ALL
    端口: ALL
    来源: 10.0.0.0/8  # Pod CIDR 和 Service CIDR

  # 允许健康检查
  - 协议: TCP
    端口: 10250,10255
    来源: 安全组 sg-xxxxxxxx  # 仅允许 Master 安全组

  # 允许 NodePort 服务（如果需要）
  - 协议: TCP
    端口: 30000-32767
    来源: CLB 安全组

出站规则:
  # 允许访问 TKE 管理 API
  - 协议: TCP
    端口: 443
    目的: 腾讯云内网 CIDR

  # 允许访问 DNS
  - 协议: UDP
    端口: 53
    目的: 0.0.0.0/0

apiVersion: apps/v1
kind: Deployment
metadata:
  name: secure-app
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true  # ✅ 强制以非 root 用户运行
        runAsUser: 10000    # 指定非 root UID
        runAsGroup: 10000
        fsGroup: 10000
        seccompProfile:
          type: RuntimeDefault  # ✅ 启用默认 seccomp 配置
      containers:
      - name: app
        image: myapp:v1
        securityContext:
          privileged: false            # ✅ 禁止特权模式
          allowPrivilegeEscalation: false  # ✅ 禁止提权
          readOnlyRootFilesystem: true     # ✅ 只读根文件系统
          capabilities:
            drop:
            - ALL                       # ✅ 移除所有 capabilities
            add:
            - NET_BIND_SERVICE          # 按需添加必要的 capability
        resources:
          limits:
            cpu: "500m"
            memory: "256Mi"
          requests:
            cpu: "100m"
            memory: "128Mi"

# 为生产命名空间启用严格模式
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    # 强制执行 restricted 策略
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest

    # 以 baseline 级别审计
    pod-security.kubernetes.io/audit: baseline
    pod-security.kubernetes.io/audit-version: latest

    # 以 baseline 级别警告
    pod-security.kubernetes.io/warn: baseline
    pod-security.kubernetes.io/warn-version: latest

# 使用 TKE 沙箱容器（基于 gVisor）
apiVersion: v1
kind: Pod
metadata:
  name: sandbox-pod
spec:
  runtimeClassName: gvisor  # ✅ 指定沙箱运行时
  containers:
  - name: untrusted-app
    image: untrusted-image:v1

# 常见危险 Capabilities 及其风险
# CAP_SYS_ADMIN: 允许大量系统管理操作，几乎等同于 root
# CAP_NET_ADMIN: 可修改网络配置，可能用于中间人攻击
# CAP_SYS_PTRACE: 可 debug 其他进程，可能读取敏感信息

# 推荐配置
securityContext:
  capabilities:
    drop:
    - ALL  # 先移除所有
    add:
    # 仅按需添加：
    - NET_BIND_SERVICE  # 允许绑定 1024 以下端口
    # - CHOWN            # 如需修改文件所有者
    # - SETUID           # 如需切换用户（谨慎使用）

# 推荐使用 TencentOS 或容器优化镜像
nodePool:
  osName: "tlinux3.1x86_64"  # TencentOS Server 3.1
  # 或
  osName: "cos-x86_64"       # Container-Optimized OS

# 使用腾讯云 SSM（Secrets Manager）
# 安装 External Secrets Operator
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: app-secrets
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: tencent-ssm
    kind: ClusterSecretStore
  target:
    name: app-secrets
    creationPolicy: Owner
  data:
  - secretKey: db-password
    remoteRef:
      key: production/database/password  # SSM 中的密钥路径

# 通过 CSI 驱动挂载 Secret
apiVersion: secrets-store.csi.x8s.io/v1
kind: SecretProviderClass
metadata:
  name: tencent-ssm-provider
spec:
  provider: tencent
  parameters:
    objects: |
      - objectName: "production/database/password"
        objectType: "secret"
        objectAlias: "db-password"
---
apiVersion: v1
kind: Pod
metadata:
  name: app-with-secrets
spec:
  containers:
  - name: app
    image: myapp:v1
    volumeMounts:
    - name: secrets-store
      mountPath: "/mnt/secrets"
      readOnly: true
  volumes:
  - name: secrets-store
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: tencent-ssm-provider

# 如必须使用 Kubernetes Secret，启用加密
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
  namespace: production
type: Opaque
data:
  password: cGFzc3dvcmQxMjM=  # base64 编码（注意：这不是加密！）

# encryption-config.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  - configmaps
  providers:
  - aescbc:
      keys:
      - name: key1
        secret: <base64-encoded-32-byte-key>
  - identity: {}  # 允许读取未加密的旧数据

# RBAC 限制 Secret 访问
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: app-secret-reader
  namespace: production
rules:
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["app-secrets"]  # ✅ 仅允许访问特定 Secret
  verbs: ["get"]
# 不允许 list，防止枚举所有 Secret

# 通过 TKE 控制台启用审计日志
# 集群 -> 日志 -> 审计日志 -> 开启

# 审计日志将存储到 CLS（日志服务）
# 支持的审计级别：
# - None: 不记录
# - Metadata: 记录请求元数据
# - Request: 记录元数据和请求体
# - RequestResponse: 记录元数据、请求体和响应体

# audit-policy.yaml
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
# 不记录健康检查
- level: None
  nonResourceURLs:
  - /healthz*
  - /readyz*
  - /livez*

# 记录 Secret 的所有操作（高敏感）
- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]

# 记录 Pod 执行命令（高风险操作）
- level: RequestResponse
  resources:
  - group: ""
    resources: ["pods/exec", "pods/attach"]

# 记录认证相关事件
- level: Metadata
  resources:
  - group: "authentication.k8s.io"
    resources: ["tokenreviews"]

# 其他资源记录 Metadata
- level: Metadata
  resources:
  - group: ""
  - group: "apps"
  - group: "networking.k8s.io"

# 推荐配置
升级策略:
  控制面升级: 自动（补丁版本）
  节点升级: 手动或滚动升级
  升级窗口: 业务低峰期
  升级顺序:
    1. 非生产环境
    2. 生产环境（灰度节点池）
    3. 生产环境（全量）

# 配置安全公告通知
通知渠道:
  - 邮件: security@company.com
  - 企业微信机器人: https://qyapi.weixin.qq.com/xxx
  - 短信: +86-1xxxxxxxxxx

订阅内容:
  - Kubernetes CVE 公告
  - TKE 安全更新
  - 镜像漏洞告警

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8spspprivilegedcontainer
spec:
  crd:
    spec:
      names:
        kind: K8sPSPPrivilegedContainer
  targets:
  - target: admission.k8s.gatekeeper.sh
    rego: |
      package k8spspprivileged

      violation[{"msg": msg, "details": {}}] {
        c := input_containers[_]
        c.securityContext.privileged == true
        msg := sprintf("Privileged container is not allowed: %v", [c.name])
      }

      input_containers[c] {
        c := input.review.object.spec.containers[_]
      }
      input_containers[c] {
        c := input.review.object.spec.initContainers[_]
      }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPPrivilegedContainer
metadata:
  name: deny-privileged-containers
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Pod"]
    excludedNamespaces:
    - kube-system  # 系统组件可能需要特权

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequirerunasnonroot
spec:
  crd:
    spec:
      names:
        kind: K8sRequireRunAsNonRoot
  targets:
  - target: admission.k8s.gatekeeper.sh
    rego: |
      package k8srequirerunasnonroot

      violation[{"msg": msg}] {
        not input.review.object.spec.securityContext.runAsNonRoot
        not all_containers_run_as_nonroot
        msg := "Containers must run as non-root user"
      }

      all_containers_run_as_nonroot {
        container := input.review.object.spec.containers[_]
        container.securityContext.runAsNonRoot == true
      }

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sdisallowedtags
spec:
  crd:
    spec:
      names:
        kind: K8sDisallowedTags
      validation:
        openAPIV3Schema:
          type: object
          properties:
            tags:
              type: array
              items:
                type: string
  targets:
  - target: admission.k8s.gatekeeper.sh
    rego: |
      package k8sdisallowedtags

      violation[{"msg": msg}] {
        container := input.review.object.spec.containers[_]
        tag := [contains(container.image, ":latest"), 
                not contains(container.image, ":")]
        tag[_]
        msg := sprintf("Container %v uses disallowed tag", [container.name])
      }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedTags
metadata:
  name: no-latest-tag
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Pod"]
  parameters:
    tags: ["latest"]

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredresources
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredResources
  targets:
  - target: admission.k8s.gatekeeper.sh
    rego: |
      package k8srequiredresources

      violation[{"msg": msg}] {
        container := input.review.object.spec.containers[_]
        not container.resources.limits.cpu
        msg := sprintf("Container %v must have CPU limits", [container.name])
      }

      violation[{"msg": msg}] {
        container := input.review.object.spec.containers[_]
        not container.resources.limits.memory
        msg := sprintf("Container %v must have memory limits", [container.name])
      }

# Gatekeeper 支持三种执行模式
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPPrivilegedContainer
metadata:
  name: deny-privileged-containers
spec:
  enforcementAction: deny  # deny | dryrun | warn
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Pod"]

# 使用 TKE + CLS 配置安全告警

# 示例：特权 Pod 创建告警
告警规则:
  名称: 特权 Pod 创建告警
  查询: * | SELECT * WHERE verb='create' AND objectRef.resource='pods' 
        AND requestObject LIKE '%privileged%true%'
  触发条件: 查询结果数 > 0
  告警级别: 严重
  通知渠道:
    - 企业微信
    - 短信

# 示例：敏感操作告警
告警规则:
  名称: Secret 删除告警
  查询: * | SELECT * WHERE verb='delete' AND objectRef.resource='secrets'
  触发条件: 查询结果数 > 0
  告警级别: 严重

# 容器安全服务检测能力
检测项目:
  - 容器逃逸行为检测
  - 异常进程检测
  - 反弹 Shell 检测
  - 恶意文件检测
  - 异常网络连接
  - 挖矿程序检测
  - 特权容器检测

# 配置防护策略
防护策略:
  容器逃逸:
    检测: 开启
    拦截: 开启
  反弹Shell:
    检测: 开启
    拦截: 开启（生产环境）/ 告警（测试环境）

egress:
- to:
  - namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: kube-system
    podSelector:
      matchLabels:
        k8s-app: kube-dns
  ports:
  - protocol: UDP
    port: 53