k8s资源之podSecurityPolicy

た入场券 2023-06-28 11:29 1阅读 0赞

#  欢迎关注我的公众号： #

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAaHhwamF2YTE_size_8_color_FFFFFF_t_70_g_se_x_16][]

目前刚开始写一个月，一共写了18篇原创文章，文章目录如下：

[istio多集群探秘，部署了50次多集群后我得出的结论][istio_50]

[istio多集群链路追踪，附实操视频][istio]

[istio防故障利器，你知道几个,istio新手不要读，太难！][istio_istio]

[istio业务权限控制，原来可以这么玩][istio 1]

[istio实现非侵入压缩，微服务之间如何实现压缩][istio 2]

[不懂envoyfilter也敢说精通istio系列-http-rbac-不要只会用AuthorizationPolicy配置权限][envoyfilter_istio_-http-rbac-_AuthorizationPolicy]

[不懂envoyfilter也敢说精通istio系列-02-http-corsFilter-不要只会vs][envoyfilter_istio_-02-http-corsFilter-_vs]

[不懂envoyfilter也敢说精通istio系列-03-http-csrf filter-再也不用再代码里写csrf逻辑了][envoyfilter_istio_-03-http-csrf filter-_csrf]

[不懂envoyfilter也敢说精通istio系列http-jwt\_authn-不要只会RequestAuthorization][envoyfilter_istio_http-jwt_authn-_RequestAuthorization]

[不懂envoyfilter也敢说精通istio系列-05-fault-filter-故障注入不止是vs][envoyfilter_istio_-05-fault-filter-_vs]

[不懂envoyfilter也敢说精通istio系列-06-http-match-配置路由不只是vs][envoyfilter_istio_-06-http-match-_vs]

[不懂envoyfilter也敢说精通istio系列-07-负载均衡配置不止是dr][envoyfilter_istio_-07-_dr]

[不懂envoyfilter也敢说精通istio系列-08-连接池和断路器][envoyfilter_istio_-08-]

[不懂envoyfilter也敢说精通istio系列-09-http-route filter][envoyfilter_istio_-09-http-route filter]

[不懂envoyfilter也敢说精通istio系列-network filter-redis proxy][envoyfilter_istio_-network filter-redis proxy]

[不懂envoyfilter也敢说精通istio系列-network filter-HttpConnectionManager][envoyfilter_istio_-network filter-HttpConnectionManager]

[不懂envoyfilter也敢说精通istio系列-ratelimit-istio ratelimit完全手册][envoyfilter_istio_-ratelimit-istio ratelimit]

————————————————

# PodSecurityPolicy： #

•Pod 安全策略 是集群级别的资源，它能够控制 Pod 运行的行为，以及它具有访问什么的能力。 PodSecurityPolicy对象定义了一组条件，指示 Pod 必须按系统所能接受的顺序运行

# 允许的控制： #

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70][]

**开启****PodSecurityPolicy：**

•配置apiserver增加admission plugin PodSecurityPolicy即可。

•\--enable-admission-plugins=NodeRestriction,PodSecurityPolicy

# privileged： #

[root@master01 privileged]# cat ./*
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      containers:
      - image: nginx
        name: nginx
        securityContext:
          privileged: true
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: privileged
      annotations:
        seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
    spec:
      privileged: true
      allowPrivilegeEscalation: true
      allowedCapabilities:
      - '*'
      volumes:
      - '*'
      hostNetwork: true
      hostPorts:
      - min: 0
        max: 65535
      hostIPC: true
      hostPID: true
      runAsUser:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'

**RunAsUser：**

[root@master01 runAsUser]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: runasuser
    spec:
      runAsUser:
        rule: 'MustRunAsNonRoot'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'MustRunAs'
        ranges:
          - min: 1
            max: 65535
      fsGroup:
        rule: 'MustRunAs'
        ranges:
          - min: 1
            max: 65535
      volumes:
        - 'configMap'
        - 'emptyDir'
        - 'projected'
        - 'secret'
        - 'downwardAPI'
        - 'persistentVolumeClaim'
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: runasuser
    spec:
      runAsUser:
        rule: 'MustRunAs'
        ranges:
          - min: 1
            max: 65535
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      volumes:
        - 'configMap'
        - 'emptyDir'
        - 'projected'
        - 'secret'
        - 'downwardAPI'
        - 'persistentVolumeClaim'
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      containers:
      - image: nginx
        name: nginx
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: runasuser
    spec:
      runAsUser:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      volumes:
        - 'configMap'
        - 'emptyDir'
        - 'projected'
        - 'secret'
        - 'downwardAPI'
        - 'persistentVolumeClaim'

**SELinux：**

[root@master01 selinux]# cat ./*
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      securityContext:
        seLinuxOptions:
          level: "s0:c123,c456"
      containers:
      - image: nginx
        name: nginx
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: selinux
    spec:
      volumes:
        - 'configMap'
        - 'emptyDir'
        - 'projected'
        - 'secret'
        - 'downwardAPI'
        - 'persistentVolumeClaim'
      hostNetwork: false
      hostIPC: false
      hostPID: false
      runAsUser:
        rule: 'RunAsAny'
      seLinux:
        rule: 'MustRunAs'
        seLinuxOptions:
          level: "s0:c2,c3"
      supplementalGroups:
        rule: 'MustRunAs'
        ranges:
          - min: 0
            max: 65535
      fsGroup:
        rule: 'MustRunAs'
        ranges:
          - min: 0
            max: 65535
      readOnlyRootFilesystem: false

**s****upplementalGroups：**

[root@master01 supplementalGroups]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: supplementalgroups
    spec:
      volumes:
        - 'configMap'
        - 'emptyDir'
        - 'projected'
        - 'secret'
        - 'downwardAPI'
        - 'persistentVolumeClaim'
      runAsUser:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'MustRunAs'
        ranges:
          - min: 10
            max: 65535
      fsGroup:
        rule: 'RunAsAny'
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      containers:
      - image: nginx
        name: nginx
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: supplementalgroups
    spec:
      volumes:
        - 'configMap'
        - 'emptyDir'
        - 'projected'
        - 'secret'
        - 'downwardAPI'
        - 'persistentVolumeClaim'
      runAsUser:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'

**FSGroup：**

[root@master01 fsGroup]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: fsgroups
    spec:
      volumes:
        - 'configMap'
        - 'emptyDir'
        - 'projected'
        - 'secret'
        - 'downwardAPI'
        - 'persistentVolumeClaim'
      runAsUser:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'MustRunAs'
        ranges:
          - min: 10
            max: 65535
      fsGroup:
        rule: 'MustRunAs'
        ranges:
        - min: 20
          max:65535
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      containers:
      - image: nginx
        name: nginx
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: fsgroups
    spec:
      volumes:
        - 'configMap'
        - 'emptyDir'
        - 'projected'
        - 'secret'
        - 'downwardAPI'
        - 'persistentVolumeClaim'
      runAsUser:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'

# runAsGroup： #

[root@master01 runAsGroup]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: runasgroup
    spec:
      volumes:
        - 'configMap'
        - 'emptyDir'
        - 'projected'
        - 'secret'
        - 'downwardAPI'
        - 'persistentVolumeClaim'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'MustRunAs'
        ranges:
          - min: 10
            max: 65535
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      containers:
      - image: nginx
        name: nginx
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: runasgroup
    spec:
      volumes:
        - 'configMap'
        - 'emptyDir'
        - 'projected'
        - 'secret'
        - 'downwardAPI'
        - 'persistentVolumeClaim'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'

# HostPorts： #

[root@master01 HostPorts]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: hostports
    spec:
      volumes:
        - 'configMap'
        - 'emptyDir'
        - 'projected'
        - 'secret'
        - 'downwardAPI'
        - 'persistentVolumeClaim'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      hostPorts:
      - min: 65532
        max: 65535
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      containers:
      - image: nginx
        name: nginx
        ports:
        - containerPort: 80
          hostPort: 8080

# AllowedHostPaths： #

[root@master01 allowedHostPaths]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: allowedhostpaths
    spec:
      volumes:
        - '*'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      allowedHostPaths:
      - pathPrefix: "/foo"
        readOnly: true
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      containers:
      - image: nginx
        name: nginx
        ports:
        - containerPort: 80
        volumeMounts:
        - mountPath: /usr/share/nginx/html
          name: html
      volumes:
      - name: html
        hostPath:
          path: /data
          type: DirectoryOrCreate

# hostIPC： #

[root@master01 hostIPC]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: hostipc
    spec:
      volumes:
        - '*'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      hostIPC: false
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      hostIPC: true
      containers:
      - image: nginx
        name: nginx
        ports:
        - containerPort: 80
        volumeMounts:
        - mountPath: /usr/share/nginx/html
          name: html
      volumes:
      - name: html
        hostPath:
          path: /data
          type: DirectoryOrCreate

# hostPID： #

[root@master01 hostPID]#  cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: hostpid
    spec:
      volumes:
        - '*'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      hostPID: false
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      hostPID: true
      containers:
      - image: nginx
        name: nginx
        ports:
        - containerPort: 80

# hostNetwork： #

[root@master01 hostNetwork]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: hostnetwork
    spec:
      volumes:
        - '*'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      hostNetwork: false
      hostPorts:
      - min: 0
        max: 65536
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      hostNetwork: true
      containers:
      - image: nginx
        name: nginx
        ports:
        - containerPort: 80

# allowPrivilegeEscalation： #

[root@master01 allowPrivilegeEscalation]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: allowprivilegeescalation
    spec:
      volumes:
        - '*'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      allowPrivilegeEscalation: false
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      containers:
      - image: nginx
        name: nginx
        securityContext:
          allowPrivilegeEscalation: true

# requiredDropCapabilities： #

[root@master01 requiredDropCapabilities]# cat ./*
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      containers:
      - image: nginx
        name: nginx
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: requireddropcapabilities
    spec:
      volumes:
        - '*'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      requiredDropCapabilities:
      - CHOWN

# allowedCapabilities： #

[root@master01 allowedCapabilities]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: requireddropcapabilities
    spec:
      volumes:
        - '*'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      allowedCapabilities:
      - NET_ADMIN
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-6
    spec:
      securityContext:
        runAsNonRoot: true
      containers:
      - name: sec-ctx-4
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"
        securityContext:
          capabilities:
            add: ["NET_ADMIN", "SYS_TIME"]

# defaultAddCapabilities： #

[root@master01 defaultAddCapabilities]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: requireddropcapabilities
    spec:
      volumes:
        - '*'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      defaultAddCapabilities:
      - NET_ADMIN
      - SYS_TIME
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-6
    spec:
      securityContext:
        runAsNonRoot: true
      containers:
      - name: sec-ctx-4
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"
        securityContext:
          capabilities:
            add: ["NET_ADMIN", "SYS_TIME"]

# readOnlyRootFilesystem： #

[root@master01 readOnlyRootFilesystem]# cat ./*
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx
    spec:
      containers:
      - image: nginx
        name: nginx
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: readonlyrootfilesystem
    spec:
      volumes:
        - '*'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      readOnlyRootFilesystem: true

# allowedUnsafeSysctls： #

[root@master01 allowedUnsafeSysctls]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: allowedunsafesysctls
    spec:
      volumes:
        - '*'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      allowedUnsafeSysctls:
      - net.ipv4.ip_forward
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-10
    spec:
      securityContext:
        sysctls:
        - name: net.ipv4.ip_forward
          value: "1"
      containers:
      - name: sec-ctx-4
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"

# forbiddenSysctls： #

[root@master01 forbiddenSysctls]# cat ./*
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: forbiddensysctls
    spec:
      volumes:
        - '*'
      runAsUser:
        rule: 'RunAsAny'
      runAsGroup:
        rule: 'RunAsAny'
      seLinux:
        rule: 'RunAsAny'
      supplementalGroups:
        rule: 'RunAsAny'
      fsGroup:
        rule: 'RunAsAny'
      forbiddenSysctls:
      - net.ipv4.ip_forward
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-10
    spec:
      securityContext:
        sysctls:
        - name: net.ipv4.ip_forward
          value: "1"
      containers:
      - name: sec-ctx-4
        image: busybox
        args:
        - "sh"
        - "-c"
        - "sleep 36000"

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAaHhwamF2YTE_size_8_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/20211007094240106.jpg?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAaHhwamF2YTE=,size_8,color_FFFFFF,t_70,g_se,x_16
[istio_50]: https://mp.weixin.qq.com/s/_OPMjmWCDSTlmbAxytg33A
[istio]: https://mp.weixin.qq.com/s/kjvtno_UzJAGr1joxm3tvw
[istio_istio]: https://mp.weixin.qq.com/s/e2-p_NY31Mc5y07S4Bb1JQ
[istio 1]: https://mp.weixin.qq.com/s/iTV0SCQLhSOTYncp3PxoHQ
[istio 2]: https://mp.weixin.qq.com/s/eINlrT242RlAwfuZu1_PcA
[envoyfilter_istio_-http-rbac-_AuthorizationPolicy]: https://mp.weixin.qq.com/s/Q-yTGBNqkjOov49LTXPrPA
[envoyfilter_istio_-02-http-corsFilter-_vs]: https://mp.weixin.qq.com/s/bFMdrT7OKSqoWv8pDXOIqQ
[envoyfilter_istio_-03-http-csrf filter-_csrf]: https://mp.weixin.qq.com/s/dlG9phV-kMMxs4UPzuRNYg
[envoyfilter_istio_http-jwt_authn-_RequestAuthorization]: https://mp.weixin.qq.com/s/IfrJ-FdLYsdhPkDrcO_YXA
[envoyfilter_istio_-05-fault-filter-_vs]: https://mp.weixin.qq.com/s/a4gDXqD8uswgglMwkUph2Q
[envoyfilter_istio_-06-http-match-_vs]: https://mp.weixin.qq.com/s/TpS3DHdcaJiPivIS_jsIGw
[envoyfilter_istio_-07-_dr]: https://mp.weixin.qq.com/s/k-zJm7n7OOKg6MotQJYPAA
[envoyfilter_istio_-08-]: https://mp.weixin.qq.com/s/n_bJ3saNeTtXRprIymhwzg
[envoyfilter_istio_-09-http-route filter]: https://mp.weixin.qq.com/s/JAeZr0BMVQxIrB3S_7Ru0A
[envoyfilter_istio_-network filter-redis proxy]: https://mp.weixin.qq.com/s/B9IPTI8F3q42nVkqbQRlPw
[envoyfilter_istio_-network filter-HttpConnectionManager]: https://mp.weixin.qq.com/s/W3OPQWkCVvuHGS49cTNhlg
[envoyfilter_istio_-ratelimit-istio ratelimit]: https://mp.weixin.qq.com/s/KgiDsELNol27mgZvDbFsqw
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200109112808141.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx,size_16,color_FFFFFF,t_70