kubernetes-security-audit

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Kubernetes Security Audit

Kubernetes 安全审计

Audit a cluster across four layers: workload, identity, network, supply chain.

从工作负载、身份、网络和供应链四个层面对集群进行审计。

Workload Security

工作负载安全

Pod Security Standards: check namespace labels (
```
pod-security.kubernetes.io/enforce
```
)
Privileged pods,
```
hostPID
```
/
```
hostNetwork
```
/
```
hostPath
```
usage — each needs justification

Containers running as root;

allowPrivilegeEscalation: true

; missing

readOnlyRootFilesystem

```
securityContext
```
set at pod and container level; capabilities dropped to minimum set

Pod Security Standards：检查 namespace 标签（
```
pod-security.kubernetes.io/enforce
```
）
特权 Pod，使用
```
hostPID
```
/
```
hostNetwork
```
/
```
hostPath
```
——每项用法都需要合理说明

容器以 root 运行；设置

allowPrivilegeEscalation: true

；缺少

readOnlyRootFilesystem

在 Pod 和容器级别设置
```
securityContext
```
；将 capabilities 缩减至最小集合

RBAC

Enumerate bindings; find
```
cluster-admin
```
subjects — minimize to a named list

Escalation paths:

bind

escalate

impersonate

verbs;

create pods

+ node privileged,

create pods/exec

Service accounts: default SA used by workloads? token automount disabled where unneeded?
Check for wildcard (
```
*
```
) verbs/resources in custom roles

枚举 bindings；找出
```
cluster-admin
```
subjects——将权限最小化并限制给明确列出的对象

提权路径：

bind

escalate

impersonate

verbs；

create pods

+ node privileged，

create pods/exec

Service accounts：工作负载是否使用 default SA？不需要时是否禁用了 token automount？
检查自定义角色中基于通配符（
```
*
```
）的 verbs/resources

Network

网络

NetworkPolicy: default-deny ingress/egress per namespace as the baseline
Cross-namespace exposure: which namespaces can reach
```
kube-system
```
, ingress controllers, databases
Control plane exposure: API server on public IP? etcd reachable/authenticated?

NetworkPolicy：以每个 namespace 的 default-deny ingress/egress 作为基线
跨 namespace 暴露：哪些 namespace 可以访问
```
kube-system
```
、ingress controllers 和 databases
控制平面暴露：API server 是否位于公共 IP？etcd 是否可访问并已启用身份验证？

Supply Chain

供应链

Image provenance: registry digests pinned (not
```
:latest
```
), signature verification (cosign)
Admission control: image policy, no privileged images from untrusted registries
Secrets: Kubernetes Secrets at rest (KMS encryption configured), not baked into images or env in manifests committed to git

镜像来源：固定 registry digest（而非
```
:latest
```
），验证签名（cosign）
准入控制：镜像策略；禁止使用来自不可信 registry 的特权镜像
Secrets：Kubernetes Secrets 的静态加密（已配置 KMS encryption）；不得将 Secrets 写入镜像，也不得作为 env 写入提交到 Git 的 manifests 中

Quick Checks

快速检查

bash

kubectl get pods -A -o json | jq '[.items[] | select(.spec.containers[].securityContext.privileged==true)]'
kubectl get ns -l pod-security.kubernetes.io/enforce
kubectl auth can-i --list --as=system:serviceaccount:default:default
kubectl get networkpolicy -A

bash

kubectl get pods -A -o json | jq '[.items[] | select(.spec.containers[].securityContext.privileged==true)]'
kubectl get ns -l pod-security.kubernetes.io/enforce
kubectl auth can-i --list --as=system:serviceaccount:default:default
kubectl get networkpolicy -A

Output

输出

Findings per layer with YAML evidence, risk, and hardening manifests for remediation.

按层提供审计发现，包括 YAML 证据、风险以及用于修复的加固 manifests。