Настройка для защиты пользовательских пространств имен Kubernetes

Настройка для защиты пользовательских пространств имен Kubernetes#

Создание учетной записи для агента Kubernetes

  1. Создайте файл prepare-cluster.yaml с содержимым, приведенным ниже.

    apiVersion: v1
kind: Namespace
metadata:
  name: cyberprotect
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cyberprotect
  namespace: cyberprotect
---
apiVersion: v1
kind: Secret
metadata:
  name: cyberprotect
  namespace: cyberprotect
  annotations:
   kubernetes.io/service-account.name: cyberprotect
type: kubernetes.io/service-account-token
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cyberprotect-discovery-generic
rules:
# Get cluster id
- apiGroups: [""]
  resources: ["namespaces"]
  resourceNames: ["kube-system"]
  verbs: ["get"]
# List nodes
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["list"]
# List namespaces
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["list"]
# List storage classes
- apiGroups: ["storage.k8s.io"]
  resources: ["storageclasses"]
  verbs: ["list"]
# List cluster resources
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["list"]
# Create cyberprotect namespace
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cyberprotect-discovery-generic
subjects:
- kind: ServiceAccount
  name: cyberprotect
  namespace: cyberprotect
roleRef:
  kind: ClusterRole
  name: cyberprotect-discovery-generic
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cyberprotect-discovery-volume-backup
  namespace: cyberprotect
rules:
# Manage pods
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["*"]
# Manage jobs
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cyberprotect-discovery-volume-backup
  namespace: cyberprotect
subjects:
- kind: ServiceAccount
  name: cyberprotect
  namespace: cyberprotect
roleRef:
  kind: Role
  name: cyberprotect-discovery-volume-backup
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cyberprotect-backup-generic
rules:
# List cluster resources
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["list"]
# Get persistent volume claims
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cyberprotect-backup-generic
subjects:
- kind: ServiceAccount
  name: cyberprotect
  namespace: cyberprotect
roleRef:
  kind: ClusterRole
  name: cyberprotect-backup-generic
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cyberprotect-backup-snapshotter
rules:
# Manage volume snapshots
- apiGroups: ["snapshot.storage.k8s.io"]
  resources: ["*"]
  verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cyberprotect-backup-snapshotter
subjects:
- kind: ServiceAccount
  name: cyberprotect
  namespace: cyberprotect
roleRef:
  kind: ClusterRole
  name: cyberprotect-backup-snapshotter
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cyberprotect-backup-data-mover
rules:
# Create/delete pods, services and persistent volume claims. Execute commands in pods.
- apiGroups: [""]
  resources: ["pods", "pods/exec", "services", "persistentvolumeclaims"]
  verbs: ["create", "get", "delete"]
# Watch events
- apiGroups: [""]
  resources: ["events"]
  verbs: ["watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cyberprotect-backup-data-mover
subjects:
- kind: ServiceAccount
  name: cyberprotect
  namespace: cyberprotect
roleRef:
  kind: ClusterRole
  name: cyberprotect-backup-data-mover
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cyberprotect-restore
rules:
# Manage namespaces
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["create", "get", "update", "delete"]
# Manage core resources
- apiGroups: [""]
  resources: ["*"]
  verbs: ["*"]
# Manage workloads
- apiGroups: ["apps"]
  resources: ["*"]
  verbs: ["*"]
# Manage other cluster resources
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["create", "get", "update", "delete", "deletecollection"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
 name: cyberprotect-restore
subjects:
- kind: ServiceAccount
  name: cyberprotect
  namespace: cyberprotect
roleRef:
  kind: ClusterRole
  name: cyberprotect-restore
  apiGroup: rbac.authorization.k8s.io

  2. Создайте в кластере ресурсы, перечисленные в файле prepare-cluster.yaml:

    kubectl create -f prepare-cluster.yaml

  3. Получите и сохраните токен служебной учетной записи cyberprotect:

    kubectl -n cyberprotect describe secret cyberprotect

Подготовка конфигурационного файла kubeconfig

  1. Загрузите на рабочую машину конфигурационный файл kubeconfig по умолчанию. Путь к конфигурационному файлу по умолчанию — /etc/kubernetes/admin.conf.

  2. Внесите в файл следующие изменения:

    • замените имя исходной служебной учетной записи (например, admin) на cyberprotect;

    • замените сертификат для аутентификации пользователя (client-certificate-data: <...>) на токен (token: <...>), который был подготовлен при создании учетной записи для агента Kubernetes.

  3. Сохраните внесенные изменения.

Пример файла, который должен получиться в итоге:

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: <...>
    server: https://192.168.1.100:6443
  name: myk8scluster
contexts:
- context:
    cluster: myk8scluster
    user: cyberprotect
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: cyberprotect
  user:
    token: <...>