Security

# API 호출 시 인증서 사용
curl https://kube-apiserver:6443/api/v1/pods \
  --key admin.key \
  --cert admin.crt \
  --cacert ca.crt

# 1. CA 개인키 생성
openssl genrsa -out ca.key 2048

# 2. CA CSR 생성
openssl req -new -key ca.key -subj "/CN=KUBERNETES-CA" -out ca.csr

# 3. 자체 서명 인증서 생성
openssl x509 -req -in ca.csr -signkey ca.key -out ca.crt -days 1000

# 1. 개인키 생성
openssl genrsa -out admin.key 2048

# 2. CSR 생성 (그룹 포함)
openssl req -new -key admin.key \
  -subj "/CN=kube-admin/O=system:masters" -out admin.csr

# 3. CA로 서명
openssl x509 -req -in admin.csr -CA ca.crt -CAkey ca.key \
  -out admin.crt -days 1000

# openssl.cnf
[req]
req_extensions = v3_req
[v3_req]
subjectAltName = @alt_names
[alt_names]
DNS.1 = kubernetes
DNS.2 = kubernetes.default
DNS.3 = kubernetes.default.svc
DNS.4 = kubernetes.default.svc.cluster.local
IP.1 = 10.96.0.1
IP.2 = 172.17.0.87

openssl req -new -key apiserver.key -subj "/CN=kube-apiserver" \
  -out apiserver.csr -config openssl.cnf

# 인증서 상세 정보
openssl x509 -in /path/to/cert.crt -text -noout

# 확인할 항목:
# - Subject (주체)
# - Subject Alternative Names (SAN)
# - Issuer (발급자)
# - Validity (유효기간)

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: jane
spec:
  request: <Base64-encoded-CSR>
  signerName: kubernetes.io/kube-apiserver-client
  usages:
  - client auth

# CSR Base64 인코딩
cat jane.csr | base64 | tr -d "\n"

# CSR 승인
kubectl certificate approve jane

# 인증서 추출
kubectl get csr jane -o jsonpath='{.status.certificate}' | base64 -d > jane.crt

apiVersion: v1
kind: Config
current-context: dev-user@development

clusters:           # 접근할 클러스터 목록
- name: development
  cluster:
    server: https://dev-cluster:6443
    certificate-authority: /path/to/ca.crt

users:              # 사용자 인증 정보
- name: dev-user
  user:
    client-certificate: /path/to/dev.crt
    client-key: /path/to/dev.key

contexts:           # 클러스터 + 사용자 조합
- name: dev-user@development
  context:
    cluster: development
    user: dev-user
    namespace: default

# 현재 설정 확인
kubectl config view

# 컨텍스트 전환
kubectl config use-context prod-user@production

# 컨텍스트 목록
kubectl config get-contexts

# 현재 컨텍스트 확인
kubectl config current-context

# 프록시 시작 (인증 자동 처리)
kubectl proxy --port=8001

# 프록시를 통한 API 접근
curl http://localhost:8001/api/v1/pods

# API 서버 설정
kube-apiserver --authorization-mode=Node,RBAC,Webhook

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: developer
  namespace: default
rules:
- apiGroups: [""]           # Core API (빈 문자열)
  resources: ["pods"]
  verbs: ["get", "list", "create", "delete"]
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list"]

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: dev-user-binding
  namespace: default
subjects:
- kind: User
  name: dev-user
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: developer
  apiGroup: rbac.authorization.k8s.io

# 자신의 권한 확인
kubectl auth can-i create pods
kubectl auth can-i delete nodes

# 다른 사용자 권한 확인 (관리자)
kubectl auth can-i create pods --as dev-user
kubectl auth can-i create pods --as dev-user --namespace test

rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list"]
  resourceNames: ["blue-pod", "green-pod"]  # 특정 Pod만

# 네임스페이스 범위 리소스
kubectl api-resources --namespaced=true

# 클러스터 범위 리소스
kubectl api-resources --namespaced=false

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-admin-role
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "create", "delete"]
- apiGroups: [""]
  resources: ["persistentvolumes"]
  verbs: ["get", "list", "create", "delete"]

# ClusterRole로 모든 네임스페이스의 Pod 접근
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-reader-all
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-pods-global
subjects:
- kind: User
  name: monitor-user
roleRef:
  kind: ClusterRole
  name: pod-reader-all

# Service Account 생성
kubectl create serviceaccount dashboard-sa

# 토큰 생성 (v1.24+)
kubectl create token dashboard-sa

# 만료 시간 지정
kubectl create token dashboard-sa --duration=24h

apiVersion: v1
kind: Pod
metadata:
  name: my-app
spec:
  serviceAccountName: dashboard-sa  # Service Account 지정
  containers:
  - name: app
    image: my-app

spec:
  automountServiceAccountToken: false

# Docker Registry Secret 생성
kubectl create secret docker-registry regcred \
  --docker-server=myregistry.com \
  --docker-username=myuser \
  --docker-password=mypassword \
  --docker-email=user@example.com

apiVersion: v1
kind: Pod
metadata:
  name: private-app
spec:
  imagePullSecrets:
  - name: regcred
  containers:
  - name: app
    image: myregistry.com/mycompany/app:v1.0

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  containers:
  - name: app
    image: nginx

spec:
  containers:
  - name: app
    image: nginx
    securityContext:
      runAsUser: 2000
      runAsNonRoot: true
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
        add: ["NET_BIND_SERVICE"]

securityContext:
  capabilities:
    add:
    - NET_BIND_SERVICE   # 1024 미만 포트 바인딩
    - SYS_TIME           # 시스템 시간 변경
    drop:
    - ALL                # 모든 권한 제거

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-policy
spec:
  podSelector:           # 정책 적용 대상 Pod
    matchLabels:
      role: db
  policyTypes:
  - Ingress              # Ingress 규칙 적용
  - Egress               # Egress 규칙 적용
  ingress:
  - from:
    - podSelector:       # 허용할 소스 Pod
        matchLabels:
          role: api
    ports:
    - protocol: TCP
      port: 3306

- podSelector:
    matchLabels:
      app: api-server

- namespaceSelector:
    matchLabels:
      environment: production

- ipBlock:
    cidr: 10.0.0.0/8
    except:
    - 10.0.1.0/24

# AND 조합 (같은 항목 내)
ingress:
- from:
  - podSelector:
      matchLabels:
        app: api
    namespaceSelector:      # AND: api Pod AND prod 네임스페이스
      matchLabels:
        name: prod

# OR 조합 (별도 항목)
ingress:
- from:
  - podSelector:            # 규칙 1
      matchLabels:
        app: api
  - ipBlock:                # OR: 규칙 2
      cidr: 192.168.5.10/32

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}     # 모든 Pod
  policyTypes:
  - Ingress
  - Egress
  # 규칙 없음 = 모든 트래픽 차단

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: flighttickets.flights.com
spec:
  scope: Namespaced
  group: flights.com
  names:
    kind: FlightTicket
    singular: flightticket
    plural: flighttickets
    shortNames:
    - ft
  versions:
  - name: v1
    served: true
    storage: true
    schema:
      openAPIV3Schema:
        type: object
        properties:
          spec:
            type: object
            properties:
              from:
                type: string
              to:
                type: string
              number:
                type: integer
                minimum: 1
                maximum: 10

apiVersion: flights.com/v1
kind: FlightTicket
metadata:
  name: my-ticket
spec:
  from: Seoul
  to: Tokyo
  number: 2

kubectl get flighttickets
kubectl get ft  # 축약형

# OLM 설치
curl -sL https://github.com/operator-framework/operator-lifecycle-manager/releases/download/v0.22.0/install.sh | bash -s v0.22.0

# Operator 설치
kubectl apply -f https://operatorhub.io/install/prometheus.yaml

# Custom Resource로 배포
kubectl apply -f prometheus-instance.yaml

# 인증서
openssl genrsa -out key.pem 2048
openssl req -new -key key.pem -out cert.csr
openssl x509 -req -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt
openssl x509 -in cert.crt -text -noout

# CSR
kubectl certificate approve <csr-name>
kubectl certificate deny <csr-name>
kubectl get csr

# KubeConfig
kubectl config view
kubectl config use-context <context>
kubectl config get-contexts
kubectl config current-context

# RBAC
kubectl create role <name> --verb=get,list --resource=pods
kubectl create rolebinding <name> --role=<role> --user=<user>
kubectl create clusterrole <name> --verb=get,list --resource=nodes
kubectl create clusterrolebinding <name> --clusterrole=<role> --user=<user>
kubectl auth can-i <verb> <resource>
kubectl auth can-i <verb> <resource> --as <user>

# Service Account
kubectl create serviceaccount <name>
kubectl create token <sa-name>

# Network Policy
kubectl get networkpolicy
kubectl describe networkpolicy <name>

# CRD
kubectl get crd
kubectl describe crd <name>
kubectl api-resources