Харденинг безопасности Kubernetes: практическое руководство для production-кластеров

# kube-apiserver flags (kubeadm configuration snippet)
apiServer:
  extraArgs:
    anonymous-auth: "false"
    enable-admission-plugins: "NodeRestriction,PodSecurity,ServiceAccount"
    profiling: "false"
    audit-log-maxage: "30"
    audit-log-maxbackup: "10"
    audit-log-maxsize: "100"
    audit-log-path: "/var/log/kubernetes/audit.log"
    audit-policy-file: "/etc/kubernetes/audit-policy.yaml"
    encryption-provider-config: "/etc/kubernetes/encryption-config.yaml"
    tls-min-version: "VersionTLS12"
    tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
    client-ca-file: "/etc/kubernetes/pki/ca.crt"
    request-timeout: "10s"

# /etc/kubernetes/encryption-config.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
      - configmaps
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64-encoded-32-byte-key>
      - identity: {}

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-reader
  labels:
    rbac.example.com/aggregation-role: "true"
rules:
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dev-team-namespace-reader
subjects:
  - kind: Group
    name: "engineering-dev"
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: namespace-reader
  apiGroup: rbac.authorization.k8s.io

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: "restricted"
    pod-security.kubernetes.io/enforce-version: "v1.29"
    pod-security.kubernetes.io/warn: "restricted"
    pod-security.kubernetes.io/warn-version: "v1.29"

# Default deny all ingress and egress in the namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
---
# Explicitly allow DNS resolution (required for all pods)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - port: 53
          protocol: UDP
---
# Allow frontend to backend communication
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - port: 8080

# Disable swap (Kubernetes requires swap to be off or accounted for)
swapoff -a
# Edit /etc/fstab to make swap permanent
sed -i '/swap/d' /etc/fstab

# Disable unused kernel modules
cat > /etc/modprobe.d/k8s.conf << 'EOF'
install br_netfilter /bin/true
install ceph /bin/true
install rbd /bin/true
EOF

# Kernel hardening parameters
cat > /etc/sysctl.d/99-kubernetes-hardening.conf << 'EOF'
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
kernel.yama.ptrace_scope = 2
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 1
EOF

sysctl --system

# Vault Agent Injector annotation pattern on a pod
apiVersion: v1
kind: Pod
metadata:
  name: myapp
  namespace: production
  annotations:
    vault.hashicorp.com/agent-inject: "true"
    vault.hashicorp.com/role: "myapp-readonly"
    vault.hashicorp.com/agent-inject-secret-db: "secret/data/production/database"
    vault.hashicorp.com/agent-inject-template-db: |
      {{- with secret "secret/data/production/database" -}}
      DATABASE_HOST={{ .Data.data.host }}
      DATABASE_PORT={{ .Data.data.port }}
      DATABASE_USER={{ .Data.data.username }}
      DATABASE_PASSWORD={{ .Data.data.password }}
      {{- end }}
spec:
  containers:
    - name: myapp
      image: myapp:latest
      volumeMounts:
        - name: vault-secret
          mountPath: /vault/secrets
          readOnly: true
  volumes:
    - name: vault-secret
      emptyDir:
        medium: Memory