Set up a cluster securely

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

المهارات في هذا الفصل

سياسات الشبكة ومعيار CIS و TLS للـ Ingress وبيانات العقد والتحقق من الملفات التنفيذية

Restrict traffic with default-deny policies

Every namespace with apps gets a default-deny policy; then only the needed flows are allowed (see CKA network policies).

default-deny.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: default-deny, namespace: shop }
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]

$for ns in shop payments; do kubectl apply -n $ns -f default-deny.yaml; done
$kubectl get networkpolicy -A

1.2

Check the cluster with kube-bench

kube-bench checks the control plane and the nodes against the CIS Kubernetes Benchmark and tells you how to fix every FAIL.

#kube-bench run --targets master
#kube-bench run --targets node
#kube-bench run --targets master --check 1.2.16
$kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
$kubectl logs job/kube-bench

Typical fixes in /etc/kubernetes/manifests/kube-apiserver.yaml and /var/lib/kubelet/config.yaml:

Check	Fix
API server profiling on	`--profiling=false`
Anonymous kubelet access	kubelet `authentication.anonymous.enabled: false`
Kubelet authorisation	`authorization.mode: Webhook`
Read-only kubelet port	`readOnlyPort: 0`
Authorisation mode	`--authorization-mode=Node,RBAC`

#systemctl restart kubelet

تذكّر

After editing a static pod manifest, wait until the pod is back (crictl ps); after editing the kubelet config, restart the kubelet.

1.3

Protect the ingress with TLS

Public traffic must be HTTPS. Put the certificate in a TLS secret and refer to it in the Ingress (see Ingress TLS).

$openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=shop.example.com"
$kubectl create secret tls shop-tls --cert=tls.crt --key=tls.key -n shop
$curl -kv https://shop.example.com/ --resolve shop.example.com:443:INGRESS_IP 2>&1 | grep -E "subject|HTTP/"

1.4

Block the cloud metadata service

On cloud VMs, 169.254.169.254 hands out tokens and node identity. A hacked pod must not reach it.

block-metadata.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: deny-metadata, namespace: shop }
spec:
  podSelector: {}
  policyTypes: [Egress]
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except: [169.254.169.254/32]

1.5

Verify the platform binaries

Compare the checksum of kubelet, kubeadm, kubectl with the official release values — a changed binary is a backdoor.

$kubectl version --client
$curl -LO "https://dl.k8s.io/release/v1.33.1/bin/linux/amd64/kubelet.sha256"
$echo "$(cat kubelet.sha256)  /usr/bin/kubelet" | sha256sum --check
/usr/bin/kubelet: OK
$sha512sum /usr/bin/kubectl

انتبه

The version must match exactly. Compare against the checksum of the same version and architecture.

كل الأوامر في هذا الفصل