Security Center：接入K8s自建叢集

一、安裝Logtail組件

具體操作，請參見安裝Logtail組件（自建Kubernetes叢集）的安裝Logtail章節。

二、開啟叢集審計功能

以下步驟供您參考。更多資訊，請參見啟用叢集API Server審計功能。

1. 已建立註冊叢集，並將自建Kubernetes叢集接入註冊叢集。具體操作，請參見建立ACK One註冊叢集。

2. 在Master節點上配置審計配置策略檔案。

   依次登入所有Master節點，在審計配置策略檔案的路徑/etc/kubernetes/audit-policy.yaml，請根據以下內容修改審計配置策略：

   說明

   若您的叢集版本低於1.24，apiVersion請使用audit.k8s.io/v1beta1，若叢集版本大於等於1.24，則使用audit.k8s.io/v1。更多詳細資料，請參見Kubernetes 1.24版本說明。

   apiVersion: audit.k8s.io/v1beta1 
   kind: Policy
   # Don't generate audit events for all requests in RequestReceived stage.
   omitStages:
     - "RequestReceived"
   rules:
     # The following requests were manually identified as high-volume and low-risk,
     # so drop them.
     - level: None
       users: ["system:kube-proxy"]
       verbs: ["watch"]
       resources:
         - group: "" # core
           resources: ["endpoints", "services"]
     - level: None
       users: ["system:unsecured"]
       namespaces: ["kube-system"]
       verbs: ["get"]
       resources:
         - group: "" # core
           resources: ["configmaps"]
     - level: None
       users: ["kubelet"] # legacy kubelet identity
       verbs: ["get"]
       resources:
         - group: "" # core
           resources: ["nodes"]
     - level: None
       userGroups: ["system:nodes"]
       verbs: ["get"]
       resources:
         - group: "" # core
           resources: ["nodes"]
     - level: None
       users:
         - system:kube-controller-manager
         - system:kube-scheduler
         - system:serviceaccount:kube-system:endpoint-controller
       verbs: ["get", "update"]
       namespaces: ["kube-system"]
       resources:
         - group: "" # core
           resources: ["endpoints"]
     - level: None
       users: ["system:apiserver"]
       verbs: ["get"]
       resources:
         - group: "" # core
           resources: ["namespaces"]
     # Don't log these read-only URLs.
     - level: None
       nonResourceURLs:
         - /healthz*
         - /version
         - /swagger*
     # Don't log events requests.
     - level: None
       resources:
         - group: "" # core
           resources: ["events"]
     # Secrets, ConfigMaps, and TokenReviews can contain sensitive & binary data,
     # so only log at the Metadata level.
     - level: Metadata
       resources:
         - group: "" # core
           resources: ["secrets", "configmaps"]
         - group: authentication.k8s.io
           resources: ["tokenreviews"]
     # Get repsonses can be large; skip them.
     - level: Request
       verbs: ["get", "list", "watch"]
       resources:
         - group: "" # core
         - group: "admissionregistration.k8s.io"
         - group: "apps"
         - group: "authentication.k8s.io"
         - group: "authorization.k8s.io"
         - group: "autoscaling"
         - group: "batch"
         - group: "certificates.k8s.io"
         - group: "extensions"
         - group: "networking.k8s.io"
         - group: "policy"
         - group: "rbac.authorization.k8s.io"
         - group: "settings.k8s.io"
         - group: "storage.k8s.io"
     # Default level for known APIs
     - level: RequestResponse
       resources:
         - group: "" # core
         - group: "admissionregistration.k8s.io"
         - group: "apps"
         - group: "authentication.k8s.io"
         - group: "authorization.k8s.io"
         - group: "autoscaling"
         - group: "batch"
         - group: "certificates.k8s.io"
         - group: "extensions"
         - group: "networking.k8s.io"
         - group: "policy"
         - group: "rbac.authorization.k8s.io"
         - group: "settings.k8s.io"
         - group: "storage.k8s.io"
     # Default level for all other requests.
     - level: Metadata

3. 在Master節點上配置Kube API Server檔案。

   依次登入所有Master節點機器，在Kube API Server檔案的路徑/etc/kubernetes/manifests/kube-apiserver.yaml，完成以下相關配置：

   • 根據以下樣本添加command參數--audit-log-*：

     ...
     spec:
       containers:
       - command:
         - kube-apiserver
         - --audit-log-maxbackup=10
         - --audit-log-maxsize=100
         - --audit-log-path=/var/log/kubernetes/kubernetes.audit
         - --audit-log-maxage=30
         - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
         ...

   • 根據以下樣本添加env參數aliyun_logs_audit-*：

     您需要將以下樣本中的{cluster_id}替換為您叢集的Cluster ID。您可以登入Security Center控制台，在容器資產頁面擷取叢集的Cluster ID，具體位置請參見下圖。

     ...
     spec:
       containers:
       - command:
         - kube-apiserver
         - --audit-log-maxbackup=10
         - --audit-log-maxsize=100
         - --audit-log-path=/var/log/kubernetes/kubernetes.audit
         - --audit-log-maxage=30
         - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
         ...
         ...
         env:
         - name: aliyun_logs_audit-${cluster_id}
           value: /var/log/kubernetes/kubernetes.audit
         - name: aliyun_logs_audit-${cluster_id}_tags
           value: audit=apiserver
         - name: aliyun_logs_audit-${cluster_id}_product
           value: k8s-audit
         - name: aliyun_logs_audit-${cluster_id}_jsonfile
           value: "true"
         image: registry-vpc.cn-shenzhen.aliyuncs.com/acs/kube-apiserver:v1.20.4-aliyun.1

   • 根據以下樣本掛載/etc/kubernetes/audit-policy.yaml到API Server Pod。

     ...
     spec:
       containers:
       - command:
         - kube-apiserver
         - --audit-log-maxbackup=10
         - --audit-log-maxsize=100
         - --audit-log-path=/var/log/kubernetes/kubernetes.audit
         - --audit-log-maxage=30
         - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
         ...
         ...
         env:
         - name: aliyun_logs_audit-${cluster_id}
           value: /var/log/kubernetes/kubernetes.audit
         - name: aliyun_logs_audit-${cluster_id}_tags
           value: audit=apiserver
         - name: aliyun_logs_audit-${cluster_id}_product
           value: k8s-audit
         - name: aliyun_logs_audit-${cluster_id}_jsonfile
           value: "true"
         image: registry-vpc.cn-shenzhen.aliyuncs.com/acs/kube-apiserver:v1.20.4-aliyun.1
         ...
         ...
         volumeMounts:
         - mountPath: /var/log/kubernetes
           name: k8s-audit
         - mountPath: /etc/kubernetes/audit-policy.yaml
           name: audit-policy
           readOnly: true
         ...
         ...
       volumes:
       - hostPath:
           path: /var/log/kubernetes
           type: DirectoryOrCreate
         name: k8s-audit
       - hostPath:
           path: /etc/kubernetes/audit-policy.yaml
           type: FileOrCreate
         name: audit-policy
       ...

三、驗證日誌採集結果

1. 登入Log Service控制台。

2. 單擊目標Project名稱。

3. 查看相關日誌是否已採集到目標Project下的日誌庫（Logstore）。

四、開啟威脅檢測

1. 登入Security Center控制台。

2. 在左側導覽列，選擇資產 > 容器資產。在控制台左上方，選擇需防護資產所在的地區：中國內地或非中國內地。

3. 在叢集頁簽，單擊自建集群接入。

4. 找到需要開啟K8s日誌威脅檢測的自建叢集，在操作列單擊編輯。

5. 在開啟日誌頁簽，選中開啟K8S日誌上報進行威脅檢測，配置審計日誌資訊，然後單擊儲存。

   • 審計日誌Region：選擇審計日誌的儲存地區。

   • 審計日誌Project：輸入一、安裝Logtail組件中建立的Project名稱。例如：如k8s-log-custom-sd89ehdq。

   • 審計日誌LogStore：輸入一、安裝Logtail組件中自動建立的LogStore名稱。例如：audit-027b007a7dd11967a9f7e2449d8dc497。