Kubernetes 安全

# 创建 ServiceAccount
kubectl create serviceaccount myapp-sa

# 查看自动关联的 Secret(1.24 之后需手动创建 Token Secret)
kubectl get serviceaccount myapp-sa -o yaml

spec:
  serviceAccountName: myapp-sa  # 不指定则使用 default
  containers:
    - name: app
      image: myapp:v1

# 1. 定义只读 Role,只允许 get/list/watch
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: dev
  name: dev-readonly
rules:
  - apiGroups: ["", "apps"]
    resources: ["pods", "deployments", "services", "configmaps"]
    verbs: ["get", "list", "watch"]  # 只读三件套
---
# 2. 把 Role 绑定给开发者用户
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: dev
  name: dev-readonly-binding
subjects:
  - kind: User
    name: zhangsan        # 开发者用户名,与认证体系对应
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: dev-readonly
  apiGroup: rbac.authorization.k8s.io

# 检查 zhangsan 是否能在 dev 命名空间删除 Pod
kubectl auth can-i delete pods --as=zhangsan -n dev

# 对 dev 命名空间强制 baseline 标准,违规直接拒绝
kubectl label namespace dev pod-security.kubernetes.io/enforce=baseline

apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  securityContext:
    runAsNonRoot: true        # 禁止以 root 运行
    runAsUser: 1000           # 指定运行 UID
    fsGroup: 2000             # 卷文件的属组
  containers:
    - name: app
      image: myapp:v1
      securityContext:
        allowPrivilegeEscalation: false   # 禁止提权
        readOnlyRootFilesystem: true      # 根文件系统只读
        capabilities:
          drop: ["ALL"]                   # 丢弃全部 Linux capabilities

# 创建仓库凭证 Secret
kubectl create secret docker-registry regcred \
  --docker-server=registry.example.com \
  --docker-username=deploy \
  --docker-password=<密码>

spec:
  imagePullSecrets:
    - name: regcred   # 拉取私有镜像时使用
  containers:
    - name: app
      image: registry.example.com/myapp:v1