云原生环境中的容器安全最佳实践指南

# 使用Trivy扫描镜像
trivy image nginx:latest

# 使用Clair扫描镜像
clair-scanner -c http://localhost:6060 --ip 127.0.0.1 nginx:latest

# 使用Anchore扫描镜像
anchore-cli image add nginx:latest
anchore-cli image wait nginx:latest
anchore-cli image vuln nginx:latest all

# 使用官方基础镜像
FROM alpine:3.15

# 设置非root用户
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

# 安装必要的依赖
RUN apk add --no-cache nodejs npm

# 复制应用代码
COPY --chown=appuser:appgroup . /app

# 安装依赖
WORKDIR /app
RUN npm install --production

# 暴露端口
EXPOSE 8080

# 运行应用
CMD ["node", "index.js"]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app1
spec:
  replicas: 3
  selector:
    matchLabels:
      app: app1
  template:
    metadata:
      labels:
        app: app1
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
      - name: app1
        image: app1:latest
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
          readOnlyRootFilesystem: true

apiVersion: policy/v1
kind: PodSecurityPolicy
metadata:
  name: restricted
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'runtime/default'
    apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
  - ALL
  runAsUser:
    rule: MustRunAsNonRoot
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: MustRunAs
    ranges:
    - min: 1
      max: 65535
  fsGroup:
    rule: MustRunAs
    ranges:
    - min: 1
      max: 65535
  readOnlyRootFilesystem: true

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: app1-network-policy
spec:
  podSelector:
    matchLabels:
      app: app1
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: app2
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: app3
    ports:
    - protocol: TCP
      port: 9090

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: default
spec:
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: app1-authz
  namespace: default
spec:
  selector:
    matchLabels:
      app: app1
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/sa/app2"]
    to:
    - operation:
        methods: ["GET", "POST"]
        paths: ["/api/*"]

apiVersion: v1
kind: Secret
metadata:
  name: app-secret
type: Opaque
data:
  DB_PASSWORD: c29tZXBhc3N3b3Jk
  API_KEY: c29tZWFwa2V5
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app1
spec:
  replicas: 3
  selector:
    matchLabels:
      app: app1
  template:
    metadata:
      labels:
        app: app1
    spec:
      containers:
      - name: app1
        image: app1:latest
        env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: app-secret
              key: DB_PASSWORD
        - name: API_KEY
          valueFrom:
            secretKeyRef:
              name: app-secret
              key: API_KEY

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: encrypted
provisioner: kubernetes.io/aws-ebs
parameters:
  type: gp2
  encrypted: "true"
reclaimPolicy: Delete
allowVolumeExpansion: true
volumeBindingMode: Immediate

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: app1-role
  namespace: default
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app1-rolebinding
  namespace: default
subjects:
- kind: ServiceAccount
  name: app1-sa
  namespace: default
roleRef:
  kind: Role
  name: app1-role
  apiGroup: rbac.authorization.k8s.io

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app1-sa
  namespace: default
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app1
spec:
  replicas: 3
  selector:
    matchLabels:
      app: app1
  template:
    metadata:
      labels:
        app: app1
    spec:
      serviceAccountName: app1-sa
      containers:
      - name: app1
        image: app1:latest

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: security-monitor
  namespace: monitoring
spec:
  selector:
    matchLabels:
      app: security-agent
  endpoints:
  - port: metrics
    interval: 15s

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets", "configmaps"]
- level: Metadata
  resources:
  - group: ""
    resources: ["pods", "services"]