f0572ae906
K4.3 Pod Security Standards: - awoooi-prod: baseline - kube-state-metrics: baseline - kured: privileged (hostPID required) - descheduler: restricted - velero: baseline - argocd: baseline Grafana Dashboard: - K3s Cluster Overview (9 panels) - Nodes, Pods, HPA, Velero, Alerts Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
76 lines
2.7 KiB
Markdown
76 lines
2.7 KiB
Markdown
# Pod Security Standards 部署指南
|
|
|
|
> **版本**: K4.3
|
|
> **用途**: Kubernetes 內建安全機制
|
|
> **建立日期**: 2026-03-29 (台北時間)
|
|
|
|
---
|
|
|
|
## 1. 部署 Namespace Labels
|
|
|
|
```bash
|
|
# 在 K3s Master (192.168.0.120) 執行
|
|
kubectl apply -f k8s/pod-security/namespace-labels.yaml
|
|
|
|
# 或從本機透過 kubeconfig
|
|
kubectl --kubeconfig=/path/to/k3s.yaml apply -f k8s/pod-security/namespace-labels.yaml
|
|
```
|
|
|
|
## 2. 驗證
|
|
|
|
```bash
|
|
# 檢查 namespace labels
|
|
kubectl get ns -o custom-columns='NAME:.metadata.name,ENFORCE:.metadata.labels.pod-security\.kubernetes\.io/enforce'
|
|
|
|
# 預期結果:
|
|
# awoooi-prod baseline
|
|
# kube-state-metrics baseline
|
|
# kured privileged
|
|
# descheduler restricted
|
|
# velero baseline
|
|
# argocd baseline
|
|
```
|
|
|
|
## 3. PSS 級別說明
|
|
|
|
| 級別 | 說明 | 適用場景 |
|
|
|------|------|---------|
|
|
| `privileged` | 無限制 | Kured (hostPID + 重啟) |
|
|
| `baseline` | 基本限制 | 大多數應用 |
|
|
| `restricted` | 最嚴格 | 無特權需求的工具 |
|
|
|
|
## 4. 標籤說明
|
|
|
|
| 標籤 | 作用 |
|
|
|------|------|
|
|
| `enforce` | 違反時拒絕 Pod |
|
|
| `warn` | 違反時發出警告 |
|
|
| `audit` | 記錄到審計日誌 |
|
|
|
|
## 5. 驗證 Pod 合規
|
|
|
|
```bash
|
|
# 測試 Pod 是否合規
|
|
kubectl auth can-i create pod --namespace=awoooi-prod --as=system:serviceaccount:default:default
|
|
|
|
# 檢查是否有警告
|
|
kubectl get events -n awoooi-prod --field-selector reason=FailedCreate
|
|
```
|
|
|
|
---
|
|
|
|
## 架構圖
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────────────────┐
|
|
│ K3s Cluster PSS │
|
|
├─────────────────────────────────────────────────────────────┤
|
|
│ privileged │ kured (hostPID + node reboot required) │
|
|
├─────────────────┼───────────────────────────────────────────┤
|
|
│ baseline │ awoooi-prod, kube-state-metrics, │
|
|
│ │ velero, argocd │
|
|
├─────────────────┼───────────────────────────────────────────┤
|
|
│ restricted │ descheduler (純 API 存取) │
|
|
└─────────────────┴───────────────────────────────────────────┘
|
|
```
|