Kubernetes与安全扫描最佳实践

1. 安全扫描概述

在Kubernetes环境中，安全扫描是确保集群和应用安全的重要手段。本文将详细介绍Kubernetes环境中的安全扫描工具和最佳实践，包括镜像扫描、漏洞检测、配置审计等内容。

2. 镜像扫描工具

2.1 Trivy

Trivy是一个全面的容器安全扫描工具，它可以检测容器镜像中的漏洞、配置错误和密码泄露。

2.1.1 安装Trivy

# 安装Trivy
brew install trivy

# 或使用curl安装
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

2.1.2 使用Trivy扫描镜像

# 扫描镜像
 trivy image nginx:1.20.0

# 扫描特定标签的镜像
 trivy image --tag 1.20.0 nginx

# 扫描本地构建的镜像
 trivy image my-app:latest

# 输出JSON格式
 trivy image --format json --output results.json nginx:1.20.0

2.2 Clair

Clair是一个开源的容器漏洞扫描器，它可以分析容器镜像并报告已知的漏洞。

2.2.1 安装Clair

# 使用Docker运行Clair
 docker run -d -p 6060:6060 -p 6061:6061 --name clair \
   -e POSTGRES_PASSWORD=password \
   -e POSTGRES_USER=clair \
   -e POSTGRES_DB=clair \
   arminc/clair-local-scan:v2.0.1

# 等待Clair启动
 sleep 10

2.2.2 使用Clair扫描镜像

# 安装clair-scanner
 curl -L https://github.com/arminc/clair-scanner/releases/download/v8/clair-scanner_linux_amd64 > clair-scanner
 chmod +x clair-scanner

# 扫描镜像
 ./clair-scanner --clair=http://localhost:6060 --ip=127.0.0.1 nginx:1.20.0

2.3 工具比较

工具	优点	缺点	适用场景
Trivy	易于使用，支持多种扫描类型	扫描速度较慢	开发环境，CI/CD集成
Clair	专注于漏洞扫描，扫描速度快	配置复杂	生产环境，大规模扫描

3. 集群安全扫描

3.1 kube-bench

kube-bench是一个针对Kubernetes集群的安全基准测试工具，它可以检查集群是否符合CIS Kubernetes Benchmark的安全标准。

3.1.1 安装kube-bench

# 使用Docker运行kube-bench
 docker run --rm -v /etc/kubernetes:/etc/kubernetes:ro \
   -v /var/lib/kubelet:/var/lib/kubelet:ro \
   aquasec/kube-bench:latest

# 针对特定版本的Kubernetes
 docker run --rm -v /etc/kubernetes:/etc/kubernetes:ro \
   -v /var/lib/kubelet:/var/lib/kubelet:ro \
   aquasec/kube-bench:latest --version 1.21

3.1.2 生成报告

# 生成JSON格式报告
 docker run --rm -v /etc/kubernetes:/etc/kubernetes:ro \
   -v /var/lib/kubelet:/var/lib/kubelet:ro \
   aquasec/kube-bench:latest --output json > kube-bench-report.json

# 生成HTML格式报告
 docker run --rm -v /etc/kubernetes:/etc/kubernetes:ro \
   -v /var/lib/kubelet:/var/lib/kubelet:ro \
   aquasec/kube-bench:latest --output html > kube-bench-report.html

3.2 kube-hunter

kube-hunter是一个用于测试Kubernetes集群安全性的工具，它可以模拟攻击者的视角来发现集群中的安全漏洞。

3.2.1 安装kube-hunter

# 使用Docker运行kube-hunter
 docker run --rm aquasec/kube-hunter

# 针对特定IP范围扫描
 docker run --rm aquasec/kube-hunter --target 192.168.1.0/24

4. 配置审计工具

4.1 Conftest

Conftest是一个基于Open Policy Agent (OPA)的配置审计工具，它可以检查Kubernetes配置文件是否符合安全最佳实践。

4.1.1 安装Conftest

# 安装Conftest
 brew install conftest

# 或使用curl安装
 curl -L https://github.com/open-policy-agent/conftest/releases/download/v0.32.0/conftest_0.32.0_Darwin_x86_64.tar.gz | tar xz
 sudo mv conftest /usr/local/bin/

4.1.2 使用Conftest检查配置

# 创建策略文件
 mkdir -p policies
 cat > policies/kubernetes.rego << EOF
package main

# 检查容器是否以非root用户运行
denylist[msg] {
  input.kind == "Pod"
  not input.spec.securityContext
  msg = "Pod should have securityContext"
}

denylist[msg] {
  input.kind == "Pod"
  input.spec.securityContext.runAsNonRoot != true
  msg = "Pod should run as non-root user"
}

# 检查容器是否设置了资源限制
denylist[msg] {
  input.kind == "Pod"
  container := input.spec.containers[_]
  not container.resources
  msg = sprintf("Container %s should have resources defined", [container.name])
}
EOF

# 检查配置文件
 conftest test deployment.yaml

4.2 OPA Gatekeeper

OPA Gatekeeper是一个基于OPA的Kubernetes准入控制器，它可以在资源创建时强制执行安全策略。

4.2.1 安装OPA Gatekeeper

# 安装OPA Gatekeeper
 kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.8/deploy/gatekeeper.yaml

# 查看部署状态
 kubectl get pods -n gatekeeper-system

4.2.2 创建约束模板

# 创建约束模板
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
  annotations:
    description: Requires all resources to have specified labels.
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        openAPIV3Schema:
          type: object
          properties:
            labels:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego:
        from: string
        string: |
          package k8srequiredlabels

          violation[{"msg": msg, "details": {"missing_labels": missing}}] {
            provided := {label | input.review.object.metadata.labels[label]}
            required := {label | label := input.parameters.labels[_]}
            missing := required - provided
            count(missing) > 0
            msg := sprintf("missing required labels: %v", [missing])
          }

4.2.3 创建约束

# 创建约束
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: all-must-have-owner
  annotations:
    description: Requires all resources to have an `owner` label.
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    labels:
      - owner

5. 安全扫描集成

5.1 与CI/CD集成

5.1.1 与GitHub Actions集成

# .github/workflows/security-scan.yaml
name: Security Scan

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  trivy-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Build image
        run: docker build -t my-app:${{ github.sha }} .
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'my-app:${{ github.sha }}'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'

5.1.2 与GitLab CI集成

# .gitlab-ci.yml
stages:
  - build
  - security-scan

build:
  stage: build
  script:
    - docker build -t my-app:$CI_COMMIT_SHA .
  only:
    - main

security-scan:
  stage: security-scan
  script:
    - docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image my-app:$CI_COMMIT_SHA
  only:
    - main

5.2 与Kubernetes集成

5.2.1 使用Pod Security Policy

# 创建Pod Security Policy
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
    seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
    apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535

5.2.2 使用SecurityContext

# 部署配置示例
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
      - name: nginx
        image: nginx:1.20.0
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
          readOnlyRootFilesystem: true
        ports:
        - containerPort: 80
        resources:
          requests:
            cpu: "100m"
            memory: "128Mi"
          limits:
            cpu: "200m"
            memory: "256Mi"

6. 安全扫描最佳实践

6.1 镜像扫描最佳实践

扫描时机：在构建时、部署前和定期扫描
扫描范围：包括基础镜像和应用依赖
漏洞管理：建立漏洞管理流程，及时修复高危漏洞
镜像签名：使用Docker Content Trust或Notary对镜像进行签名
镜像仓库安全：配置镜像仓库的访问控制和镜像扫描

6.2 集群安全最佳实践

定期扫描：定期使用kube-bench和kube-hunter扫描集群
安全配置：按照CIS Kubernetes Benchmark配置集群
网络安全：配置NetworkPolicy限制Pod间通信
访问控制：使用RBAC和Pod Security Policy限制权限
监控告警：配置安全事件监控和告警

6.3 配置审计最佳实践

策略定义：定义明确的安全策略，包括资源限制、权限控制等
自动化审计：在CI/CD流程中集成配置审计
准入控制：使用OPA Gatekeeper强制执行安全策略
定期检查：定期检查集群配置，确保符合安全标准
持续改进：根据安全事件和新威胁不断更新安全策略

7. 安全扫描工具配置示例

7.1 Trivy配置

# .trivy.yaml
severity:
  - UNKNOWN
  - LOW
  - MEDIUM
  - HIGH
  - CRITICAL

# 忽略特定漏洞
ignoreFile: .trivyignore

# 缓存配置
cache:
  backend: filesystem
  dir: ~/.cache/trivy

# 镜像配置
image:
  skipPull: false
  insecure: false
  registry:
    credentials:
      - registry: docker.io
        username: username
        password: password

7.2 OPA Gatekeeper配置

# 约束模板：限制容器资源
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sresourcelimits
  annotations:
    description: Requires containers to have resource limits defined.
spec:
  crd:
    spec:
      names:
        kind: K8sResourceLimits
      validation:
        openAPIV3Schema:
          type: object
          properties:
            cpuLimit:
              type: string
            memoryLimit:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego:
        from: string
        string: |
          package k8sresourcelimits

          violation[{"msg": msg, "details": {"container": container.name}}] {
            container := input.review.object.spec.containers[_]
            not container.resources.limits.cpu
            msg := sprintf("Container %s must have cpu limit", [container.name])
          }

          violation[{"msg": msg, "details": {"container": container.name}}] {
            container := input.review.object.spec.containers[_]
            not container.resources.limits.memory
            msg := sprintf("Container %s must have memory limit", [container.name])
          }

8. 代码优化建议

8.1 安全配置优化

# 优化前
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  template:
    spec:
      containers:
      - name: nginx
        image: nginx:1.20.0
        ports:
        - containerPort: 80

# 优化后
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
      - name: nginx
        image: nginx:1.20.0
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
          readOnlyRootFilesystem: true
        ports:
        - containerPort: 80
        resources:
          requests:
            cpu: "100m"
            memory: "128Mi"
          limits:
            cpu: "200m"
            memory: "256Mi"
        livenessProbe:
          httpGet:
            path: /health
            port: 80
          initialDelaySeconds: 15
          periodSeconds: 20
        readinessProbe:
          httpGet:
            path: /health
            port: 80
          initialDelaySeconds: 5
          periodSeconds: 10

8.2 CI/CD安全集成优化

# .github/workflows/security-scan.yaml
name: Security Scan

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  trivy-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Build image
        run: docker build -t my-app:${{ github.sha }} .
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'my-app:${{ github.sha }}'
          format: 'json'
          output: 'trivy-results.json'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
      - name: Upload Trivy results
        uses: actions/upload-artifact@v2
        with:
          name: trivy-results
          path: trivy-results.json

  conftest-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Install Conftest
        run: |
          curl -L https://github.com/open-policy-agent/conftest/releases/download/v0.32.0/conftest_0.32.0_Linux_x86_64.tar.gz | tar xz
          sudo mv conftest /usr/local/bin/
      - name: Run Conftest
        run: conftest test kubernetes/

9. 总结

安全扫描是Kubernetes环境中确保应用和集群安全的重要手段。本文介绍了多种安全扫描工具，包括镜像扫描工具（Trivy、Clair）、集群安全扫描工具（kube-bench、kube-hunter）和配置审计工具（Conftest、OPA Gatekeeper），并提供了详细的配置示例和最佳实践。

通过集成这些安全扫描工具到CI/CD流程和Kubernetes集群中，可以：

及时发现并修复容器镜像中的漏洞
确保集群配置符合安全最佳实践
强制执行安全策略，防止不安全的配置部署
提高系统的整体安全性和可靠性

在实际应用中，应根据组织的安全需求和资源情况，选择合适的安全扫描工具和策略，建立完善的安全扫描流程，确保Kubernetes环境的安全。

转载自CSDN-专业IT技术社区

原文链接：https://blog.csdn.net/2609_95049439/article/details/159760242

Kubernetes与安全扫描最佳实践