Container Service for Kubernetes：通過安全性原則管理配置Pod的安全性原則

安裝和配置ack-policy-external-provider

1. 在ACK叢集列表頁面，單擊目的地組群名稱，在叢集詳情頁左側導覽列，單擊组件管理。

2. 搜尋並定位ack-policy-external-provider，按照頁面提示完成配置。

   • ProviderPodNumber：組件的執行個體個數。

   • ProtectedKinds：添加需要保護 CRD 對應的資源類型。

     CRD 刪除保護需要檢查叢集中是否存在該資源類型的執行個體。遵循最小化許可權原則，ack-policy-external-provider預設不具備該檢查所需的查詢許可權，需手動設定。

     

介面定義及參數說明

ack-policy-external-provider 實現了一個標準的 Gatekeeper 外部資料 Provider。可在 Rego 原則範本中，通過調用 external_data 函數並指定 provider: ack-policy-external-data-provider，來向該組件發起資源查詢請求。

請求參數以 JSON 格式定義，樣本如下。

// 樣本 1
{
  "action": "ListK8sResource",
  "namespaced": false,
  "group": "",
  "version": "v1",
  "resource": "persistentvolumeclaims"
  "requestID": review.uid,
  "userInfo": review.userInfo,
  "requestFrom": "PVCProtector",
  "labelSelector": "protected",
  "limit": 1
}
// 樣本 2
{
  "action": "GetK8sResource",
  "namespaced": true,
  "namespace": "default",
  "group": "apps",
  "version": "v1",
  "resource": "deployments",
  "requestID": review.uid,
  "userInfo": review.userInfo,
  "requestFrom": "FinOpsPolicy",
  "labelSelector": "protected",
  "limit": 1
}

核心參數說明：

情境樣本：防止CRD被刪除

本樣本展示利用 ack-policy-external-provider 實現一個常見的進階策略：當 CRD 仍然存在關聯的 CR 執行個體時，禁止刪除該 CRD。

此策略已作為內建規則集成到策略庫中，無需手動部署。僅作為原理說明。

• 策略邏輯

  • 觸發：Gatekeeper 監聽到 DELETE CRD 操作。

  • 查詢：Rego 策略通過 external_data 調用 ack-policy-external-provider。

  • 判斷：ack-policy-external-provider 根據請求參數查詢叢集中是否存在對應的 CR 執行個體。

  • 決策：如果查詢結果返回了至少一個 CR 執行個體，ack-policy-external-provider 會將結果返回給 Rego 策略，策略最終會 deny (拒絕) 本次刪除操作。

• 原則範本（ConstraintTemplate）

  定義策略的邏輯。

  apiVersion: templates.gatekeeper.sh/v1beta1
  kind: ConstraintTemplate
  metadata:
    name: blockcrddeletion
    annotations:
      meta.helm.sh/release-name: gatekeeper
      meta.helm.sh/release-namespace: kube-system
      metadata.gatekeeper.sh/version: 1.0.0
    labels:
      app.kubernetes.io/managed-by: Helm
  spec:
    crd:
      spec:
        names:
          kind: BlockCrdDeletion
        validation:
          legacySchema: true
    targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package block_crd_deletion
        violation[{"msg": msg}] {
          before(input.review.operation)
          response := handle(input.review)
          msg := after(response)
        }
  
        before(operation) {
          operation == "DELETE"
        }
  
        handle(review) = response {
          customrequest := {
            "action": "ListK8sResource",
            "namespaced": false,
            "group": review.object.spec.group,
            "version": "",
            "resource": review.object.spec.names.plural,
            "requestID": review.uid,
            "userInfo": review.userInfo,
            "requestFrom": "BlockCrdDeletion",
            "labelSelector": "protected",
            "limit": 1
          }
          request_keys := [json.marshal(customrequest)]
          response := external_data({
            "provider": "ack-policy-external-data-provider",
            "keys": request_keys
          })
        }
  
        after(response) = msg {
          count(response.responses[0]) > 0
          msg := sprintf(
            "The CRD %v is not allowed to be deleted. Reason: It is not allowed to delete a CRD object when it contains a collection of custom resources. Current existing custom resources: %v, etc.",
            [input.review.name, response.responses[0][0]]
          )
        }

• 策略執行個體（Constraint）

  將模板應用到具體資源。本樣本應用到所有CRD。

  apiVersion: constraints.gatekeeper.sh/v1beta1
  kind: BlockCrdDeletion
  metadata:
    name: block-crd-deletion-rule
  spec:
    enforcementAction: deny
    match:
      kinds:
      - apiGroups:
        - '*'
        kinds:
        - CustomResourceDefinition

• 效果驗證

  1. 建立一個測試 CRD 和對應的 CR 執行個體：

     # 建立 CRD
     apiVersion: apiextensions.k8s.io/v1
     kind: CustomResourceDefinition
     metadata:
       name: simplestthings.example.com
     spec:
       group: example.com
       scope: Namespaced
       names:
         plural: simplestthings
         singular: simplestthing
         kind: SimplestThing
       versions:
         - name: v1
           served: true
           storage: true
           schema:
             openAPIV3Schema:
               type: object
               properties:
                 spec:
                   type: object
                   properties:
                     message:
                       type: string
     ---
     # 建立 CR 執行個體
     apiVersion: example.com/v1
     kind: SimplestThing
     metadata:
       name: my-simple-thing
       namespace: default
       labels:
         protected: "false"
     spec:
       message: "Hello"

  2. 嘗試刪除該 CRD。

     kubectl delete crd simplestthings.example.com

  3. 查看刪除操作是否被策略攔截，並返回明確的錯誤資訊。

     預期輸出：

     % kubectl delete crd simplestthings.example.com
     Error from server (Forbidden): admission webhook "delete.validation.gatekeeper.sh" denied the request: [block-crd-deletion-rule] The CRD simplestthings.example.com is not allowed to be deleted. Reason: It is not allowed to delete a CRD object when it contains a collection of custom resources. Current existing custom resources: my-simple-thing, etc.