Ubuntu 上 Kubernetes 安全设置清单
一 基础系统与网络加固
swapoff -a);按需安装并配置 Containerd/Docker 作为容器运行时。sysctl -p 使配置生效。ufw allow from 192.168.1.0/24 to any port 22 proto tcp(SSH 管理)ufw allow from 10.0.0.0/24 to any port 6443 proto tcp(API Server)ufw allow from 10.0.0.0/24 to any port 10250 proto tcp(Kubelet API)ufw allow from 10.0.0.0/24 to any port 53 proto tcp,udp(DNS)ufw allow from <master1>,<master2> to any port 2379,2380 proto tcp(etcd)ufw status numbered、ufw reload、nc -zv <IP> <端口>。二 集群通信与证书管理
kubeadm init --apiserver-advertise-address=<内网IP> --apiserver-cert-extra-sans=<外网IP/域名> --pod-network-cidr=10.244.0.0/16kubeadm token create --validity 24h --print-join-commandkubeadm certs check-expirationkubeadm certs renew allsystemctl restart kubeletkubectl delete pod -n kube-system -l k8s-app=kube-apiserverkubectl delete pod -n kube-system -l k8s-app=kube-controller-managerkubectl delete pod -n kube-system -l k8s-app=kube-scheduler三 身份与访问控制 RBAC
kubectl create role pod-reader --namespace=dev --verb=get,list,watch --resource=podskubectl create rolebinding pod-reader-binding --namespace=dev --role=pod-reader --serviceaccount=dev:defaultkubectl create clusterrole pod-reader-all --verb=get,list,watch --resource=podskubectl create clusterrolebinding pod-reader-all-binding --clusterrole=pod-reader-all --user=ops-teamkubectl auth can-i <verb> <resource> [--namespace=<ns>]四 网络与 Pod 安全
kubectl apply -f https://docs.projectcalico.org/manifests/calico.yamlGlobalNetworkPolicy,selector: all(),types: [Ingress, Egress]apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata: name: allow-dns namespace: defaultspec: podSelector: {} policyTypes: [Ingress] ingress: from: - namespaceSelector: matchLabels: name: kube-system - podSelector: matchLabels: k8s-app: kube-dns ports: - protocol: TCP port: 53 - protocol: UDP port: 53pod-security.kubernetes.io/enforce: restricted、pod-security.kubernetes.io/warn: restricted,或在 kube-apiserver 启用 PSA 准入插件。五 镜像 数据与审计监控