Aller au contenu

Feuille de caillebotis

- :material-content-copy:_ **Copier les commandes** --- Copier toutes les commandes - :material-file-pdf-box: **Générer PDF** --- Télécharger le PDF
# Installation du gardien de porte kubectl appliquer -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.14/deploy/gatekeeper.yaml # Vérifier le gardien de porte État kubectl obtenir des gousses -n gatekeeper-système kubectl obtenir crd. # Créer un modèle de contrainte kubectl applique -f contrainte-template. l'association # Créer une contrainte kubectl applique -f contrainte. l'association # Liste des modèles de contraintes kubectl obtenir des templates de contrainte # Liste des contraintes kubectl obtenir des contraintes # Afficher les détails des contraintes kubectl décrire la contrainte # Vérifier les violations kubectl obtenir -o yaml # Config portier kubectl obtenir config -n gatekeeper-system # Synchronisation des ressources kubectl appliquer -f sync-config.yaml # Politiques de mutation kubectl applique -f attribution-mutation. l'association kubectl applique -f assignmetadata-mutation. l'association # Réplication des données kubectl obtenir des fournisseurs kubectl appliquer -f fournisseur-config.yaml # Résultats de la vérification b) Registres kubectl -n gatekeeper-system -l control-plan=audit-controller # Journaux Webhook b) Registres de kubectl -n gatekeeper-system -l control-plan=controller-manager # Procédures d'urgence kubectl supprimer validationadmissionconfiguration gatekeeper-validation-admission-configuration kubectl patch validantadmissionconfiguration gatekeeper-validation-admission-configuration --type='merge' -p='{"webhooks":[{"name":"validation.gatekeeper.sh","failure Policy":"Ignorer"}]} '

Installation et configuration

Installer le gardien de porte

# Install latest Gatekeeper
kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.14/deploy/gatekeeper.yaml

# Verify installation
kubectl get pods -n gatekeeper-system
kubectl get crd | grep gatekeeper

Vérifier l'état du système

# Check all Gatekeeper components
kubectl get all -n gatekeeper-system

# View Gatekeeper configuration
kubectl get config -n gatekeeper-system -o yaml

# Check webhook configuration
kubectl get validatingadmissionconfiguration gatekeeper-validating-admission-configuration
```_

## Modèles de contraintes

### Créer un modèle de contrainte
```yaml
# constraint-template.yaml
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        type: object
        properties:
          labels:
            type: array
            items:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels

        violation[{"msg": msg}] {
          required := input.parameters.labels
          provided := input.review.object.metadata.labels
          missing := required[_]
          not provided[missing]
          msg := sprintf("Missing required label: %v", [missing])
        }
```_

### Appliquer le modèle
```bash
# Apply constraint template
kubectl apply -f constraint-template.yaml

# List all constraint templates
kubectl get constrainttemplates

# View template details
kubectl describe constrainttemplate k8srequiredlabels

Contraintes

Créer une contrainte

# constraint.yaml
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: must-have-environment
spec:
  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]
    namespaces: ["production"]
  parameters:
    labels: ["environment", "team", "version"]

Gérer les contraintes

# Apply constraint
kubectl apply -f constraint.yaml

# List all constraints
kubectl get constraints

# View constraint status
kubectl get k8srequiredlabels must-have-environment -o yaml

# Check violations
kubectl describe k8srequiredlabels must-have-environment

Exemples de politiques

Politique sur les étiquettes obligatoires

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        properties:
          labels:
            type: array
            items:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels

        violation[{"msg": msg}] {
          required := input.parameters.labels
          provided := input.review.object.metadata.labels
          missing := required[_]
          not provided[missing]
          msg := sprintf("Missing required label: %v", [missing])
        }

Politique sur les limites des ressources

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8scontainerlimits
spec:
  crd:
    spec:
      names:
        kind: K8sContainerLimits
      validation:
        properties:
          cpu:
            type: string
          memory:
            type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8scontainerlimits

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.cpu
          msg := "Container must have CPU limits"
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.memory
          msg := "Container must have memory limits"
        }

Politique relative au contexte de sécurité

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8ssecuritycontext
spec:
  crd:
    spec:
      names:
        kind: K8sSecurityContext
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8ssecuritycontext

        violation[{"msg": msg}] {
          input.review.object.spec.securityContext.runAsRoot == true
          msg := "Containers must not run as root"
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          container.securityContext.privileged == true
          msg := "Privileged containers are not allowed"
        }

Gestion de la configuration

Synchroniser la configuration

# sync-config.yaml
apiVersion: config.gatekeeper.sh/v1alpha1
kind: Config
metadata:
  name: config
  namespace: gatekeeper-system
spec:
  sync:
    syncOnly:
      - group: ""
        version: "v1"
        kind: "Namespace"
      - group: "apps"
        version: "v1"
        kind: "Deployment"
  validation:
    traces:
      - user:
          kind:
            group: "*"
            version: "*"
            kind: "*"

Exclure les espaces de noms

apiVersion: config.gatekeeper.sh/v1alpha1
kind: Config
metadata:
  name: config
  namespace: gatekeeper-system
spec:
  match:
    - excludedNamespaces: ["kube-system", "gatekeeper-system"]
      processes: ["*"]

Politiques de mutation

Attribuer la mutation

# assign-mutation.yaml
apiVersion: mutations.gatekeeper.sh/v1alpha1
kind: Assign
metadata:
  name: add-security-label
spec:
  applyTo:
    - groups: ["apps"]
      kinds: ["Deployment"]
      versions: ["v1"]
  match:
    scope: Namespaced
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]
  location: "metadata.labels.security-scan"
  parameters:
    assign:
      value: "required"

AttributionMetadata Mutation

# assignmetadata-mutation.yaml
apiVersion: mutations.gatekeeper.sh/v1alpha1
kind: AssignMetadata
metadata:
  name: add-annotation
spec:
  match:
    scope: Namespaced
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  location: "metadata.annotations.gatekeeper"
  parameters:
    assign:
      value: "mutated"

Réplication des données

Configuration du fournisseur

# provider-config.yaml
apiVersion: externaldata.gatekeeper.sh/v1alpha1
kind: Provider
metadata:
  name: image-scanner
spec:
  url: https://image-scanner.example.com/scan
  timeout: 30

Modèle de données externe

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8simagescan
spec:
  crd:
    spec:
      names:
        kind: K8sImageScan
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8simagescan

        violation[{"msg": msg}] {
          image := input.review.object.spec.containers[_].image
          response := external_data({"provider": "image-scanner", "keys": [image]})
          response[image].vulnerabilities > 0
          msg := sprintf("Image %v has vulnerabilities", [image])
        }

Surveillance et dépannage

Vérifier les violations

# View constraint violations
kubectl get <constraint-kind> <constraint-name> -o yaml

# Check audit logs
kubectl logs -n gatekeeper-system -l control-plane=audit-controller

# View webhook logs
kubectl logs -n gatekeeper-system -l control-plane=controller-manager

# Check metrics
kubectl port-forward -n gatekeeper-system svc/gatekeeper-controller-manager-metrics-service 8080:8080
curl localhost:8080/metrics

Politiques de débogage

# Test constraint template
kubectl apply --dry-run=server -f test-resource.yaml

# View constraint status
kubectl describe constraint <constraint-name>

# Check template compilation
kubectl get constrainttemplate <template-name> -o yaml

Procédures d'urgence

Désactiver Gatekeeper

# Disable admission webhook
kubectl delete validatingadmissionconfiguration gatekeeper-validating-admission-configuration

# Set webhook to ignore failures
kubectl patch validatingadmissionconfiguration gatekeeper-validating-admission-configuration \
  --type='merge' \
  -p='{"webhooks":[{"name":"validation.gatekeeper.sh","failurePolicy":"Ignore"}]}'

Opérations de redressement

# Remove all constraints
kubectl delete constraints --all

# Remove constraint templates
kubectl delete constrainttemplates --all

# Restart Gatekeeper
kubectl rollout restart deployment/gatekeeper-controller-manager -n gatekeeper-system
kubectl rollout restart deployment/gatekeeper-audit -n gatekeeper-system

Meilleures pratiques

Élaboration des politiques

  • Démarrer avec le mode d'application d'avertissement
  • Politiques d ' essai dans les environnements de développement
  • Utiliser des messages de violation descriptifs
  • Mettre en œuvre des stratégies de déploiement progressif

Optimisation des performances

  • Limiter la portée de la contrainte avec les critères d'adéquation
  • Utiliser des politiques Rego efficaces
  • Surveiller l'utilisation des ressources
  • Mettre en œuvre des stratégies de mise en cache appropriées

Considérations en matière de sécurité

  • Mettre à jour régulièrement Gatekeeper
  • Surveillance des contournements politiques
  • Mettre en œuvre le RBAC approprié
  • Changements dans la politique de vérification