OPSaid – Kubernetes 安全

Docs: 审计日志

Fri, 29 Dec 2023 17:33:58 +0800

简要概述

TODO;

配置示例

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
 - level: Metadata

数据结构

基于 “kubernetes-1.26.11/staging/src/k8s.io/apiserver/pkg/apis/audit/v1/types.go” 源文件。

Policy

// Policy defines the configuration of audit logging, and the rules for how different request
// categories are logged.
type Policy struct {
 metav1.TypeMeta `json:",inline"`
 // ObjectMeta is included for interoperability with API infrastructure.
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Rules specify the audit Level a request should be recorded at.
 // A request may match multiple rules, in which case the FIRST matching rule is used.
 // The default audit level is None, but can be overridden by a catch-all rule at the end of the list.
 // PolicyRules are strictly ordered.
 Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`

 // OmitStages is a list of stages for which no events are created. Note that this can also
 // be specified per rule in which case the union of both are omitted.
 // +optional
 OmitStages []Stage `json:"omitStages,omitempty" protobuf:"bytes,3,rep,name=omitStages"`

 // OmitManagedFields indicates whether to omit the managed fields of the request
 // and response bodies from being written to the API audit log.
 // This is used as a global default - a value of 'true' will omit the managed fileds,
 // otherwise the managed fields will be included in the API audit log.
 // Note that this can also be specified per rule in which case the value specified
 // in a rule will override the global default.
 // +optional
 OmitManagedFields bool `json:"omitManagedFields,omitempty" protobuf:"varint,4,opt,name=omitManagedFields"`
}

PolicyRule

// PolicyRule maps requests based off metadata to an audit Level.
// Requests must match the rules of every field (an intersection of rules).
type PolicyRule struct {
 // The Level that requests matching this rule are recorded at.
 Level Level `json:"level" protobuf:"bytes,1,opt,name=level,casttype=Level"`

 // The users (by authenticated user name) this rule applies to.
 // An empty list implies every user.
 // +optional
 Users []string `json:"users,omitempty" protobuf:"bytes,2,rep,name=users"`
 // The user groups this rule applies to. A user is considered matching
 // if it is a member of any of the UserGroups.
 // An empty list implies every user group.
 // +optional
 UserGroups []string `json:"userGroups,omitempty" protobuf:"bytes,3,rep,name=userGroups"`

 // The verbs that match this rule.
 // An empty list implies every verb.
 // +optional
 Verbs []string `json:"verbs,omitempty" protobuf:"bytes,4,rep,name=verbs"`

 // Rules can apply to API resources (such as "pods" or "secrets"),
 // non-resource URL paths (such as "/api"), or neither, but not both.
 // If neither is specified, the rule is treated as a default for all URLs.

 // Resources that this rule matches. An empty list implies all kinds in all API groups.
 // +optional
 Resources []GroupResources `json:"resources,omitempty" protobuf:"bytes,5,rep,name=resources"`
 // Namespaces that this rule matches.
 // The empty string "" matches non-namespaced resources.
 // An empty list implies every namespace.
 // +optional
 Namespaces []string `json:"namespaces,omitempty" protobuf:"bytes,6,rep,name=namespaces"`

 // NonResourceURLs is a set of URL paths that should be audited.
 // *s are allowed, but only as the full, final step in the path.
 // Examples:
 // "/metrics" - Log requests for apiserver metrics
 // "/healthz*" - Log all health checks
 // +optional
 NonResourceURLs []string `json:"nonResourceURLs,omitempty" protobuf:"bytes,7,rep,name=nonResourceURLs"`

 // OmitStages is a list of stages for which no events are created. Note that this can also
 // be specified policy wide in which case the union of both are omitted.
 // An empty list means no restrictions will apply.
 // +optional
 OmitStages []Stage `json:"omitStages,omitempty" protobuf:"bytes,8,rep,name=omitStages"`

 // OmitManagedFields indicates whether to omit the managed fields of the request
 // and response bodies from being written to the API audit log.
 // - a value of 'true' will drop the managed fields from the API audit log
 // - a value of 'false' indicates that the managed fileds should be included
 // in the API audit log
 // Note that the value, if specified, in this rule will override the global default
 // If a value is not specified then the global default specified in
 // Policy.OmitManagedFields will stand.
 // +optional
 OmitManagedFields *bool `json:"omitManagedFields,omitempty" protobuf:"varint,9,opt,name=omitManagedFields"`
}

Stage

// Stage defines the stages in request handling that audit events may be generated.
type Stage string

// Valid audit stages.
const (
 // The stage for events generated as soon as the audit handler receives the request, and before it
 // is delegated down the handler chain.
 StageRequestReceived Stage = "RequestReceived"
 // The stage for events generated once the response headers are sent, but before the response body
 // is sent. This stage is only generated for long-running requests (e.g. watch).
 StageResponseStarted Stage = "ResponseStarted"
 // The stage for events generated once the response body has been completed, and no more bytes
 // will be sent.
 StageResponseComplete Stage = "ResponseComplete"
 // The stage for events generated when a panic occurred.
 StagePanic Stage = "Panic"
)

Level

// Level defines the amount of information logged during auditing
type Level string

// Valid audit levels
const (
 // LevelNone disables auditing
 LevelNone Level = "None"
 // LevelMetadata provides the basic level of auditing.
 LevelMetadata Level = "Metadata"
 // LevelRequest provides Metadata level of auditing, and additionally
 // logs the request object (does not apply for non-resource requests).
 LevelRequest Level = "Request"
 // LevelRequestResponse provides Request level of auditing, and additionally
 // logs the response object (does not apply for non-resource requests).
 LevelRequestResponse Level = "RequestResponse"
)

GroupResources

// GroupResources represents resource kinds in an API group.
type GroupResources struct {
 // Group is the name of the API group that contains the resources.
 // The empty string represents the core API group.
 // +optional
 Group string `json:"group,omitempty" protobuf:"bytes,1,opt,name=group"`
 // Resources is a list of resources this rule applies to.
 //
 // For example:
 // 'pods' matches pods.
 // 'pods/log' matches the log subresource of pods.
 // '*' matches all resources and their subresources.
 // 'pods/*' matches all subresources of pods.
 // '*/scale' matches all scale subresources.
 //
 // If wildcard is present, the validation rule will ensure resources do not
 // overlap with each other.
 //
 // An empty list implies all resources and subresources in this API groups apply.
 // +optional
 Resources []string `json:"resources,omitempty" protobuf:"bytes,2,rep,name=resources"`
 // ResourceNames is a list of resource instance names that the policy matches.
 // Using this field requires Resources to be specified.
 // An empty list implies that every instance of the resource is matched.
 // +optional
 ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,3,rep,name=resourceNames"`
}

Event

// Event captures all the information that can be included in an API audit log.
type Event struct {
 metav1.TypeMeta `json:",inline"`

 // AuditLevel at which event was generated
 Level Level `json:"level" protobuf:"bytes,1,opt,name=level,casttype=Level"`

 // Unique audit ID, generated for each request.
 AuditID types.UID `json:"auditID" protobuf:"bytes,2,opt,name=auditID,casttype=k8s.io/apimachinery/pkg/types.UID"`
 // Stage of the request handling when this event instance was generated.
 Stage Stage `json:"stage" protobuf:"bytes,3,opt,name=stage,casttype=Stage"`

 // RequestURI is the request URI as sent by the client to a server.
 RequestURI string `json:"requestURI" protobuf:"bytes,4,opt,name=requestURI"`
 // Verb is the kubernetes verb associated with the request.
 // For non-resource requests, this is the lower-cased HTTP method.
 Verb string `json:"verb" protobuf:"bytes,5,opt,name=verb"`
 // Authenticated user information.
 User authnv1.UserInfo `json:"user" protobuf:"bytes,6,opt,name=user"`
 // Impersonated user information.
 // +optional
 ImpersonatedUser *authnv1.UserInfo `json:"impersonatedUser,omitempty" protobuf:"bytes,7,opt,name=impersonatedUser"`
 // Source IPs, from where the request originated and intermediate proxies.
 // The source IPs are listed from (in order):
 // 1. X-Forwarded-For request header IPs
 // 2. X-Real-Ip header, if not present in the X-Forwarded-For list
 // 3. The remote address for the connection, if it doesn't match the last
 // IP in the list up to here (X-Forwarded-For or X-Real-Ip).
 // Note: All but the last IP can be arbitrarily set by the client.
 // +optional
 SourceIPs []string `json:"sourceIPs,omitempty" protobuf:"bytes,8,rep,name=sourceIPs"`
 // UserAgent records the user agent string reported by the client.
 // Note that the UserAgent is provided by the client, and must not be trusted.
 // +optional
 UserAgent string `json:"userAgent,omitempty" protobuf:"bytes,16,opt,name=userAgent"`
 // Object reference this request is targeted at.
 // Does not apply for List-type requests, or non-resource requests.
 // +optional
 ObjectRef *ObjectReference `json:"objectRef,omitempty" protobuf:"bytes,9,opt,name=objectRef"`
 // The response status, populated even when the ResponseObject is not a Status type.
 // For successful responses, this will only include the Code and StatusSuccess.
 // For non-status type error responses, this will be auto-populated with the error Message.
 // +optional
 ResponseStatus *metav1.Status `json:"responseStatus,omitempty" protobuf:"bytes,10,opt,name=responseStatus"`

 // API object from the request, in JSON format. The RequestObject is recorded as-is in the request
 // (possibly re-encoded as JSON), prior to version conversion, defaulting, admission or
 // merging. It is an external versioned object type, and may not be a valid object on its own.
 // Omitted for non-resource requests. Only logged at Request Level and higher.
 // +optional
 RequestObject *runtime.Unknown `json:"requestObject,omitempty" protobuf:"bytes,11,opt,name=requestObject"`
 // API object returned in the response, in JSON. The ResponseObject is recorded after conversion
 // to the external type, and serialized as JSON. Omitted for non-resource requests. Only logged
 // at Response Level.
 // +optional
 ResponseObject *runtime.Unknown `json:"responseObject,omitempty" protobuf:"bytes,12,opt,name=responseObject"`
 // Time the request reached the apiserver.
 // +optional
 RequestReceivedTimestamp metav1.MicroTime `json:"requestReceivedTimestamp" protobuf:"bytes,13,opt,name=requestReceivedTimestamp"`
 // Time the request reached current audit stage.
 // +optional
 StageTimestamp metav1.MicroTime `json:"stageTimestamp" protobuf:"bytes,14,opt,name=stageTimestamp"`

 // Annotations is an unstructured key value map stored with an audit event that may be set by
 // plugins invoked in the request serving chain, including authentication, authorization and
 // admission plugins. Note that these annotations are for the audit event, and do not correspond
 // to the metadata.annotations of the submitted object. Keys should uniquely identify the informing
 // component to avoid name collisions (e.g. podsecuritypolicy.admission.k8s.io/policy). Values
 // should be short. Annotations are included in the Metadata level.
 // +optional
 Annotations map[string]string `json:"annotations,omitempty" protobuf:"bytes,15,rep,name=annotations"`
}

authnv1.UserInfo

k8s.io/api/authentication/v1/types.go

// UserInfo holds the information about the user needed to implement the
// user.Info interface.
type UserInfo struct {
 // The name that uniquely identifies this user among all active users.
 // +optional
 Username string `json:"username,omitempty" protobuf:"bytes,1,opt,name=username"`
 // A unique value that identifies this user across time. If this user is
 // deleted and another user by the same name is added, they will have
 // different UIDs.
 // +optional
 UID string `json:"uid,omitempty" protobuf:"bytes,2,opt,name=uid"`
 // The names of groups this user is a part of.
 // +optional
 Groups []string `json:"groups,omitempty" protobuf:"bytes,3,rep,name=groups"`
 // Any additional information provided by the authenticator.
 // +optional
 Extra map[string]ExtraValue `json:"extra,omitempty" protobuf:"bytes,4,rep,name=extra"`
}

// ExtraValue masks the value so protobuf can generate
// +protobuf.nullable=true
// +protobuf.options.(gogoproto.goproto_stringer)=false
type ExtraValue []string

Docs: 网络策略

Wed, 13 Dec 2023 10:26:01 +0800

简要概述

使用 K8S 原生网络策略，既接口组 “networking.k8s.io/v1” 下服务，数据结构可参考 NetworkPolicy，以下提供一些有用地址：

实现原理

根据不通的 CNI 底层分别基于 iptables 或 ebpf 实现，如果 CNI 不支持网络策略，即使在 k8s 上声明了规则，也不会有任何影响。

两种 POD 网络隔离

隔离顺序

网络策略是相加的，不会产生冲突，评估的顺序不影响策略的结果，要允许从源 Pod 到目的 Pod 的连接，源 Pod 的出口策略和目的 Pod 的入口策略都需要允许连接。如果任何一方不允许连接，建立连接将会失败。

入口隔离（Ingress）

默认情况下，一个 Pod 对入口是非隔离的，即所有入站连接都是被允许的。

出口隔离（Egress）

默认情况下，一个 Pod 的出口是非隔离的，即所有外向连接都是被允许的。

定位目标的四种组合

podSelector

 ...
 ingress:
 - from:
 - podSelector:
 matchLabels:
 app.kubernetes.io/name: nginx
 ...

选择 Pod 标签为 “app.kubernetes.io/name=nginx” 且命名空间同该 NetworkPolicy 声明相同。

namespaceSelector

 ...
 ingress:
 - from:
 - namespaceSelector:
 matchLabels:
 kubernetes.io/metadata.name: default
 ...

选择 Pod 所在的命名空间包含 “kubernetes.io/metadata.name=default” 标签（也就是 “default” 空间）。

namespaceSelector 和 podSelector

 ...
 ingress:
 - from:
 - namespaceSelector:
 matchLabels:
 kubernetes.io/metadata.name: default
 podSelector:
 matchLabels:
 app.kubernetes.io/name: nginx
 ...

选择 Pod 标签为 “app.kubernetes.io/name=nginx” 且命名空间包含 “kubernetes.io/metadata.name=default” 标签（也就是 “default” 空间），注意下面另外一种形式：

 ...
 ingress:
 - from:
 - namespaceSelector:
 matchLabels:
 kubernetes.io/metadata.name: default
 - podSelector:
 matchLabels:
 app.kubernetes.io/name: nginx
 ...

选择 Pod 标签为 “app.kubernetes.io/name=nginx” 或命名空间包含 “kubernetes.io/metadata.name=default” 标签（也就是 “default” 空间）。

ipBlock

 ...
 ingress:
 - from:
 - ipBlock:
 cidr: 192.168.31.0/24
 except:
 - 192.168.31.203/32
 ...

选择源 IP 来自 “192.168.31.0/24” 且排除 “192.168.31.203/32” 的网段，这些应该是集群外部 IP，因为 Pod IP 存在时间短暂的且随机产生。

配置示例

仅允许特定命名空间内访问

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: default-deny-ingress
 namespace: biz-dev-opsaid
spec:
 podSelector:
 matchLabels:
 api.grpc-kit.com/appname: mingqing-apilogin-v1
 policyTypes:
 - Ingress
 ingress:
 - from:
 - namespaceSelector:
 matchLabels:
 kubernetes.io/metadata.name: default
 ports:
 - protocol: TCP
 port: 10080

业务应用部署在 “biz-dev-opsaid” 空间内且包含名称 “mingqing-apilogin-v1”，对外提供 10080 服务端口，此时仅允许命名空间标签选择 “kubernetes.io/metadata.name” 匹配名称为 “default” 的 Pod 连接至该 10080 端口。

指定命名空间内 Pod 访问

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: default-deny-ingress
 namespace: biz-dev-opsaid
spec:
 podSelector:
 matchLabels:
 api.grpc-kit.com/appname: mingqing-apilogin-v1
 policyTypes:
 - Ingress
 ingress:
 - from:
 - namespaceSelector:
 matchLabels:
 kubernetes.io/metadata.name: default
 podSelector:
 matchLabels:
 run: nginx
 ports:
 - protocol: TCP
 port: 10080

业务应用同上，当仅允许来自 “default” 命名空间下标签为 “run=nginx” 的 Pod 连接。

拒绝所有入站流量

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: default-deny-ingress
 namespace: default
spec:
 podSelector: {}
 policyTypes:
 - Ingress

拒绝 “default” 命名空间下的所以 Pod 流量接入。

允许所有入站流量

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: allow-all-ingress
 namespace: default
spec:
 podSelector: {}
 ingress:
 - {}
 policyTypes:
 - Ingress

允许 “default” 命名空间下的所以 Pod 流量接入，默认空间均没有限制，所以该规则无需特意编写。

拒绝所有出站流量

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: default-deny-egress
 namespace: default
spec:
 podSelector: {}
 policyTypes:
 - Egress

拒绝 “default” 命名空间下的所以 Pod 流量出去。

允许所有出站流量

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: default-deny-egress
 namespace: default
spec:
 podSelector: {}
 egress:
 - {}
 policyTypes:
 - Egress

允许 “default” 命名空间下的所以 Pod 流量出去。

拒绝所有入与出站流量

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: default-deny-egress
 namespace: default
spec:
 podSelector: {}
 policyTypes:
 - Ingress
 - Egress

拒绝 “default” 命名空间下的所以 Pod 流量进出。

Docs: 网络策略

Tue, 12 Dec 2023 11:14:45 +0800

简要概述

TODO;

配置示例

见 K8S 原生安全网络策略。

数据结构

基于 “kubernetes-1.26.11/staging/src/k8s.io/api/networking/v1/types.go” 源文件。

NetworkPolicy

// NetworkPolicy describes what network traffic is allowed for a set of Pods
type NetworkPolicy struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object's metadata.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

 // Specification of the desired behavior for this NetworkPolicy.
 // +optional
 Spec NetworkPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

 // Status is the current state of the NetworkPolicy.
 // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 // +optional
 Status NetworkPolicyStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

NetworkPolicySpec

// NetworkPolicySpec provides the specification of a NetworkPolicy
type NetworkPolicySpec struct {
 // Selects the pods to which this NetworkPolicy object applies. The array of
 // ingress rules is applied to any pods selected by this field. Multiple network
 // policies can select the same set of pods. In this case, the ingress rules for
 // each are combined additively. This field is NOT optional and follows standard
 // label selector semantics. An empty podSelector matches all pods in this
 // namespace.
 // 选择这个网络策略应用到哪些 Pod 上
 // 空的 podSelector 选择名字空间下的所有 Pod
 PodSelector metav1.LabelSelector `json:"podSelector" protobuf:"bytes,1,opt,name=podSelector"`

 // List of ingress rules to be applied to the selected pods. Traffic is allowed to
 // a pod if there are no NetworkPolicies selecting the pod
 // (and cluster policy otherwise allows the traffic), OR if the traffic source is
 // the pod's local node, OR if the traffic matches at least one ingress rule
 // across all of the NetworkPolicy objects whose podSelector matches the pod. If
 // this field is empty then this NetworkPolicy does not allow any traffic (and serves
 // solely to ensure that the pods it selects are isolated by default)
 // +optional
 // 白名单模式，入口网络流量隔离规则
 Ingress []NetworkPolicyIngressRule `json:"ingress,omitempty" protobuf:"bytes,2,rep,name=ingress"`

 // List of egress rules to be applied to the selected pods. Outgoing traffic is
 // allowed if there are no NetworkPolicies selecting the pod (and cluster policy
 // otherwise allows the traffic), OR if the traffic matches at least one egress rule
 // across all of the NetworkPolicy objects whose podSelector matches the pod. If
 // this field is empty then this NetworkPolicy limits all outgoing traffic (and serves
 // solely to ensure that the pods it selects are isolated by default).
 // This field is beta-level in 1.8
 // +optional
 // 白名单模式，出口网络流量隔离规则
 Egress []NetworkPolicyEgressRule `json:"egress,omitempty" protobuf:"bytes,3,rep,name=egress"`

 // List of rule types that the NetworkPolicy relates to.
 // Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"].
 // If this field is not specified, it will default based on the existence of Ingress or Egress rules;
 // policies that contain an Egress section are assumed to affect Egress, and all policies
 // (whether or not they contain an Ingress section) are assumed to affect Ingress.
 // If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ].
 // Likewise, if you want to write a policy that specifies that no egress is allowed,
 // you must specify a policyTypes value that include "Egress" (since such a policy would not include
 // an Egress section and would otherwise default to just [ "Ingress" ]).
 // This field is beta-level in 1.8
 // +optional
 // 哪种隔离规则生效，仅可组合为以下三种模式：
 // ["Ingress"] 应用于进入所选 Pod 的入站流量
 // ["Egress"] 应用与所选 Pod 的出站流量
 // ["Ingress", "Egress"] 同时应用与 Pod 的进出流量
 PolicyTypes []PolicyType `json:"policyTypes,omitempty" protobuf:"bytes,4,rep,name=policyTypes,casttype=PolicyType"`
}

metav1.LabelSelector

见基础数据。

NetworkPolicyIngressRule

// NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods
// matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
// 规则中 "ports" 与 "from" 必须同时匹配
type NetworkPolicyIngressRule struct {
 // List of ports which should be made accessible on the pods selected for this
 // rule. Each item in this list is combined using a logical OR. If this field is
 // empty or missing, this rule matches all ports (traffic not restricted by port).
 // If this field is present and contains at least one item, then this rule allows
 // traffic only if the traffic matches at least one port in the list.
 // +optional
 Ports []NetworkPolicyPort `json:"ports,omitempty" protobuf:"bytes,1,rep,name=ports"`

 // List of sources which should be able to access the pods selected for this rule.
 // Items in this list are combined using a logical OR operation. If this field is
 // empty or missing, this rule matches all sources (traffic not restricted by
 // source). If this field is present and contains at least one item, this rule
 // allows traffic only if the traffic matches at least one item in the from list.
 // +optional
 From []NetworkPolicyPeer `json:"from,omitempty" protobuf:"bytes,2,rep,name=from"`
}

NetworkPolicyEgressRule

// NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods
// matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to.
// This type is beta-level in 1.8
// 规则中 "ports" 与 "to" 必须同时匹配
type NetworkPolicyEgressRule struct {
 // List of destination ports for outgoing traffic.
 // Each item in this list is combined using a logical OR. If this field is
 // empty or missing, this rule matches all ports (traffic not restricted by port).
 // If this field is present and contains at least one item, then this rule allows
 // traffic only if the traffic matches at least one port in the list.
 // +optional
 Ports []NetworkPolicyPort `json:"ports,omitempty" protobuf:"bytes,1,rep,name=ports"`

 // List of destinations for outgoing traffic of pods selected for this rule.
 // Items in this list are combined using a logical OR operation. If this field is
 // empty or missing, this rule matches all destinations (traffic not restricted by
 // destination). If this field is present and contains at least one item, this rule
 // allows traffic only if the traffic matches at least one item in the to list.
 // +optional
 To []NetworkPolicyPeer `json:"to,omitempty" protobuf:"bytes,2,rep,name=to"`
}

PolicyType

// PolicyType string describes the NetworkPolicy type
// This type is beta-level in 1.8
// +enum
type PolicyType string

const (
 // PolicyTypeIngress is a NetworkPolicy that affects ingress traffic on selected pods
 PolicyTypeIngress PolicyType = "Ingress"
 // PolicyTypeEgress is a NetworkPolicy that affects egress traffic on selected pods
 PolicyTypeEgress PolicyType = "Egress"
)

NetworkPolicyPort

// NetworkPolicyPort describes a port to allow traffic on
type NetworkPolicyPort struct {
 // The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this
 // field defaults to TCP.
 // +optional
 Protocol *v1.Protocol `json:"protocol,omitempty" protobuf:"bytes,1,opt,name=protocol,casttype=k8s.io/api/core/v1.Protocol"`

 // The port on the given protocol. This can either be a numerical or named
 // port on a pod. If this field is not provided, this matches all port names and
 // numbers.
 // If present, only traffic on the specified protocol AND port will be matched.
 // +optional
 Port *intstr.IntOrString `json:"port,omitempty" protobuf:"bytes,2,opt,name=port"`

 // If set, indicates that the range of ports from port to endPort, inclusive,
 // should be allowed by the policy. This field cannot be defined if the port field
 // is not defined or if the port field is defined as a named (string) port.
 // The endPort must be equal or greater than port.
 // +optional
 EndPort *int32 `json:"endPort,omitempty" protobuf:"bytes,3,opt,name=endPort"`
}

NetworkPolicyPeer

// NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of
// fields are allowed
// 描述匹配的对端目标，应用在 "to" 或 "from" 方向，仅支持四种组合，见以下说明
type NetworkPolicyPeer struct {
 // This is a label selector which selects Pods. This field follows standard label
 // selector semantics; if present but empty, it selects all pods.
 //
 // If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects
 // the Pods matching PodSelector in the Namespaces selected by NamespaceSelector.
 // Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.
 // +optional
 PodSelector *metav1.LabelSelector `json:"podSelector,omitempty" protobuf:"bytes,1,opt,name=podSelector"`

 // Selects Namespaces using cluster-scoped labels. This field follows standard label
 // selector semantics; if present but empty, it selects all namespaces.
 //
 // If PodSelector is also set, then the NetworkPolicyPeer as a whole selects
 // the Pods matching PodSelector in the Namespaces selected by NamespaceSelector.
 // Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.
 // +optional
 NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,2,opt,name=namespaceSelector"`

 // IPBlock defines policy on a particular IPBlock. If this field is set then
 // neither of the other fields can be.
 // +optional
 IPBlock *IPBlock `json:"ipBlock,omitempty" protobuf:"bytes,3,rep,name=ipBlock"`
}

示例配置见定位目标的四种组合。

IPBlock

// IPBlock describes a particular CIDR (Ex. "192.168.1.0/24","2001:db8::/64") that is allowed
// to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs
// that should not be included within this rule.
type IPBlock struct {
 // CIDR is a string representing the IP Block
 // Valid examples are "192.168.1.0/24" or "2001:db8::/64"
 CIDR string `json:"cidr" protobuf:"bytes,1,name=cidr"`
 // Except is a slice of CIDRs that should not be included within an IP Block
 // Valid examples are "192.168.1.0/24" or "2001:db8::/64"
 // Except values will be rejected if they are outside the CIDR range
 // +optional
 Except []string `json:"except,omitempty" protobuf:"bytes,2,rep,name=except"`
}

NetworkPolicyStatus

// NetworkPolicyStatus describe the current state of the NetworkPolicy.
type NetworkPolicyStatus struct {
 // Conditions holds an array of metav1.Condition that describe the state of the NetworkPolicy.
 // Current service state
 // +optional
 // +patchMergeKey=type
 // +patchStrategy=merge
 // +listType=map
 // +listMapKey=type
 Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

Docs: CIS 基准

Mon, 01 Jan 0001 00:00:00 +0000

Kubernetes CIS 安全基线与检查。

Docs: 准入控制器

Mon, 11 Dec 2023 13:41:43 +0800

简要概述

准入控制器的在 kube-apiserver 中的配置。

配置示例

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
 configuration:
 apiVersion: pod-security.admission.config.k8s.io/v1
 kind: PodSecurityConfiguration
 defaults:
 enforce: "baseline"
 enforce-version: "latest"
 audit: "restricted"
 audit-version: "latest"
 warn: "restricted"
 warn-version: "latest"
 exemptions:
 usernames: []
 runtimeClasses: []
 namespaces: [kube-system]

内置准入控制器

k8s.io/apiserver/pkg/apis/apiserver/v1/types.go

AdmissionConfiguration

// AdmissionConfiguration provides versioned configuration for admission controllers.
type AdmissionConfiguration struct {
 metav1.TypeMeta `json:",inline"`

 // Plugins allows specifying a configuration per admission control plugin.
 // +optional
 Plugins []AdmissionPluginConfiguration `json:"plugins"`
}

AdmissionPluginConfiguration

// AdmissionPluginConfiguration provides the configuration for a single plug-in.
type AdmissionPluginConfiguration struct {
 // Name is the name of the admission controller.
 // It must match the registered admission plugin name.
 Name string `json:"name"`

 // Path is the path to a configuration file that contains the plugin's
 // configuration
 // +optional
 Path string `json:"path"`

 // Configuration is an embedded configuration object to be used as the plugin's
 // configuration. If present, it will be used instead of the path to the configuration file.
 // +optional
 Configuration *runtime.Unknown `json:"configuration"`
}

动态准入控制器

k8s.io/api/admission/v1/types.go

AdmissionReview

// AdmissionReview describes an admission review request/response.
type AdmissionReview struct {
 metav1.TypeMeta `json:",inline"`
 // Request describes the attributes for the admission request.
 // +optional
 Request *AdmissionRequest `json:"request,omitempty" protobuf:"bytes,1,opt,name=request"`
 // Response describes the attributes for the admission response.
 // +optional
 Response *AdmissionResponse `json:"response,omitempty" protobuf:"bytes,2,opt,name=response"`
}

AdmissionRequest

// AdmissionRequest describes the admission.Attributes for the admission request.
type AdmissionRequest struct {
 // UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
 // otherwise identical (parallel requests, requests when earlier requests did not modify etc)
 // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
 // It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
 UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"`
 // Kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)
 Kind metav1.GroupVersionKind `json:"kind" protobuf:"bytes,2,opt,name=kind"`
 // Resource is the fully-qualified resource being requested (for example, v1.pods)
 Resource metav1.GroupVersionResource `json:"resource" protobuf:"bytes,3,opt,name=resource"`
 // SubResource is the subresource being requested, if any (for example, "status" or "scale")
 // +optional
 SubResource string `json:"subResource,omitempty" protobuf:"bytes,4,opt,name=subResource"`

 // RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
 // If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
 //
 // For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
 // `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
 // an API request to apps/v1beta1 deployments would be converted and sent to the webhook
 // with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
 // and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
 //
 // See documentation for the "matchPolicy" field in the webhook configuration type for more details.
 // +optional
 RequestKind *metav1.GroupVersionKind `json:"requestKind,omitempty" protobuf:"bytes,13,opt,name=requestKind"`
 // RequestResource is the fully-qualified resource of the original API request (for example, v1.pods).
 // If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
 //
 // For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
 // `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
 // an API request to apps/v1beta1 deployments would be converted and sent to the webhook
 // with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
 // and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
 //
 // See documentation for the "matchPolicy" field in the webhook configuration type.
 // +optional
 RequestResource *metav1.GroupVersionResource `json:"requestResource,omitempty" protobuf:"bytes,14,opt,name=requestResource"`
 // RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
 // If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
 // See documentation for the "matchPolicy" field in the webhook configuration type.
 // +optional
 RequestSubResource string `json:"requestSubResource,omitempty" protobuf:"bytes,15,opt,name=requestSubResource"`

 // Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
 // rely on the server to generate the name. If that is the case, this field will contain an empty string.
 // +optional
 Name string `json:"name,omitempty" protobuf:"bytes,5,opt,name=name"`
 // Namespace is the namespace associated with the request (if any).
 // +optional
 Namespace string `json:"namespace,omitempty" protobuf:"bytes,6,opt,name=namespace"`
 // Operation is the operation being performed. This may be different than the operation
 // requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
 Operation Operation `json:"operation" protobuf:"bytes,7,opt,name=operation"`
 // UserInfo is information about the requesting user
 UserInfo authenticationv1.UserInfo `json:"userInfo" protobuf:"bytes,8,opt,name=userInfo"`
 // Object is the object from the incoming request.
 // +optional
 Object runtime.RawExtension `json:"object,omitempty" protobuf:"bytes,9,opt,name=object"`
 // OldObject is the existing object. Only populated for DELETE and UPDATE requests.
 // +optional
 OldObject runtime.RawExtension `json:"oldObject,omitempty" protobuf:"bytes,10,opt,name=oldObject"`
 // DryRun indicates that modifications will definitely not be persisted for this request.
 // Defaults to false.
 // +optional
 DryRun *bool `json:"dryRun,omitempty" protobuf:"varint,11,opt,name=dryRun"`
 // Options is the operation option structure of the operation being performed.
 // e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
 // different than the options the caller provided. e.g. for a patch request the performed
 // Operation might be a CREATE, in which case the Options will a
 // `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
 // +optional
 Options runtime.RawExtension `json:"options,omitempty" protobuf:"bytes,12,opt,name=options"`
}

AdmissionResponse

// AdmissionResponse describes an admission response.
type AdmissionResponse struct {
 // UID is an identifier for the individual request/response.
 // This must be copied over from the corresponding AdmissionRequest.
 UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"`

 // Allowed indicates whether or not the admission request was permitted.
 Allowed bool `json:"allowed" protobuf:"varint,2,opt,name=allowed"`

 // Result contains extra details into why an admission request was denied.
 // This field IS NOT consulted in any way if "Allowed" is "true".
 // +optional
 Result *metav1.Status `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`

 // The patch body. Currently we only support "JSONPatch" which implements RFC 6902.
 // +optional
 Patch []byte `json:"patch,omitempty" protobuf:"bytes,4,opt,name=patch"`

 // The type of Patch. Currently we only allow "JSONPatch".
 // +optional
 PatchType *PatchType `json:"patchType,omitempty" protobuf:"bytes,5,opt,name=patchType"`

 // AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
 // MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
 // admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
 // the admission webhook to add additional context to the audit log for this request.
 // +optional
 AuditAnnotations map[string]string `json:"auditAnnotations,omitempty" protobuf:"bytes,6,opt,name=auditAnnotations"`

 // warnings is a list of warning messages to return to the requesting API client.
 // Warning messages describe a problem the client making the API request should correct or be aware of.
 // Limit warnings to 120 characters if possible.
 // Warnings over 256 characters and large numbers of warnings may be truncated.
 // +optional
 Warnings []string `json:"warnings,omitempty" protobuf:"bytes,7,rep,name=warnings"`
}

types.UID

k8s.io/apimachinery/pkg/types/uid.go

// UID is a type that holds unique ID values, including UUIDs. Because we
// don't ONLY use UUIDs, this is an alias to string. Being a type captures
// intent and helps make sure that UIDs and names do not get conflated.
type UID string

Operation

// Operation is the type of resource operation being checked for admission control
type Operation string

// Operation constants
const (
 Create Operation = "CREATE"
 Update Operation = "UPDATE"
 Delete Operation = "DELETE"
 Connect Operation = "CONNECT"
)

authenticationv1.UserInfo

k8s.io/api/authentication/v1/types.go

TODO;

runtime.RawExtension

k8s.io/apimachinery/pkg/runtime/types.go

TODO;

PatchType

// PatchType is the type of patch being used to represent the mutated object
type PatchType string

// PatchType constants.
const (
 PatchTypeJSONPatch PatchType = "JSONPatch"
)

即时配置 Webhook

ValidatingWebhookConfiguration

// ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
type ValidatingWebhookConfiguration struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 // Webhooks is a list of webhooks and the affected resources and operations.
 // +optional
 // +patchMergeKey=name
 // +patchStrategy=merge
 Webhooks []ValidatingWebhook `json:"webhooks,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=Webhooks"`
}

ValidatingWebhook

// ValidatingWebhook describes an admission webhook and the resources and operations it applies to.
type ValidatingWebhook struct {
 // The name of the admission webhook.
 // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
 // "imagepolicy" is the name of the webhook, and kubernetes.io is the name
 // of the organization.
 // Required.
 Name string `json:"name" protobuf:"bytes,1,opt,name=name"`

 // ClientConfig defines how to communicate with the hook.
 // Required
 ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"`

 // Rules describes what operations on what resources/subresources the webhook cares about.
 // The webhook cares about an operation if it matches _any_ Rule.
 // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
 // from putting the cluster in a state which cannot be recovered from without completely
 // disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called
 // on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
 Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`

 // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
 // allowed values are Ignore or Fail. Defaults to Fail.
 // +optional
 FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"`

 // matchPolicy defines how the "rules" list is used to match incoming requests.
 // Allowed values are "Exact" or "Equivalent".
 //
 // - Exact: match a request only if it exactly matches a specified rule.
 // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
 // but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
 // a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.
 //
 // - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
 // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
 // and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
 // a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.
 //
 // Defaults to "Equivalent"
 // +optional
 MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,9,opt,name=matchPolicy,casttype=MatchPolicyType"`

 //......
 NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"`

 //......
 ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,10,opt,name=objectSelector"`

 // SideEffects states whether this webhook has side effects.
 // Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
 // Webhooks with side effects MUST implement a reconciliation system, since a request may be
 // rejected by a future step in the admission chain and the side effects therefore need to be undone.
 // Requests with the dryRun attribute will be auto-rejected if they match a webhook with
 // sideEffects == Unknown or Some.
 SideEffects *SideEffectClass `json:"sideEffects" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"`

 // TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
 // the webhook call will be ignored or the API call will fail based on the
 // failure policy.
 // The timeout value must be between 1 and 30 seconds.
 // Default to 10 seconds.
 // +optional
 TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,7,opt,name=timeoutSeconds"`

 // AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
 // versions the Webhook expects. API server will try to use first version in
 // the list which it supports. If none of the versions specified in this list
 // supported by API server, validation will fail for this object.
 // If a persisted webhook configuration specifies allowed versions and does not
 // include any versions known to the API Server, calls to the webhook will fail
 // and be subject to the failure policy.
 AdmissionReviewVersions []string `json:"admissionReviewVersions" protobuf:"bytes,8,rep,name=admissionReviewVersions"`
}

MutatingWebhookConfiguration

// MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
type MutatingWebhookConfiguration struct {
 metav1.TypeMeta `json:",inline"`
 // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 // +optional
 metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 // Webhooks is a list of webhooks and the affected resources and operations.
 // +optional
 // +patchMergeKey=name
 // +patchStrategy=merge
 Webhooks []MutatingWebhook `json:"webhooks,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=Webhooks"`
}

MutatingWebhook

// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
type MutatingWebhook struct {
 // The name of the admission webhook.
 // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
 // "imagepolicy" is the name of the webhook, and kubernetes.io is the name
 // of the organization.
 // Required.
 Name string `json:"name" protobuf:"bytes,1,opt,name=name"`

 // ClientConfig defines how to communicate with the hook.
 // Required
 ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"`

 // Rules describes what operations on what resources/subresources the webhook cares about.
 // The webhook cares about an operation if it matches _any_ Rule.
 // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
 // from putting the cluster in a state which cannot be recovered from without completely
 // disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called
 // on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
 Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`

 // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
 // allowed values are Ignore or Fail. Defaults to Fail.
 // +optional
 FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"`

 // matchPolicy defines how the "rules" list is used to match incoming requests.
 // Allowed values are "Exact" or "Equivalent".
 //
 // - Exact: match a request only if it exactly matches a specified rule.
 // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
 // but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
 // a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.
 //
 // - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
 // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
 // and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
 // a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.
 //
 // Defaults to "Equivalent"
 // +optional
 MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,9,opt,name=matchPolicy,casttype=MatchPolicyType"`

 // ......
 NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"`

 // ......
 ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,11,opt,name=objectSelector"`

 // SideEffects states whether this webhook has side effects.
 // Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
 // Webhooks with side effects MUST implement a reconciliation system, since a request may be
 // rejected by a future step in the admission chain and the side effects therefore need to be undone.
 // Requests with the dryRun attribute will be auto-rejected if they match a webhook with
 // sideEffects == Unknown or Some.
 SideEffects *SideEffectClass `json:"sideEffects" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"`

 // TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
 // the webhook call will be ignored or the API call will fail based on the
 // failure policy.
 // The timeout value must be between 1 and 30 seconds.
 // Default to 10 seconds.
 // +optional
 TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,7,opt,name=timeoutSeconds"`

 // AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
 // versions the Webhook expects. API server will try to use first version in
 // the list which it supports. If none of the versions specified in this list
 // supported by API server, validation will fail for this object.
 // If a persisted webhook configuration specifies allowed versions and does not
 // include any versions known to the API Server, calls to the webhook will fail
 // and be subject to the failure policy.
 AdmissionReviewVersions []string `json:"admissionReviewVersions" protobuf:"bytes,8,rep,name=admissionReviewVersions"`

 // reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation.
 // Allowed values are "Never" and "IfNeeded".
 //
 // Never: the webhook will not be called more than once in a single admission evaluation.
 //
 // IfNeeded: the webhook will be called at least one additional time as part of the admission evaluation
 // if the object being admitted is modified by other admission plugins after the initial webhook call.
 // Webhooks that specify this option *must* be idempotent, able to process objects they previously admitted.
 // Note:
 // * the number of additional invocations is not guaranteed to be exactly one.
 // * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again.
 // * webhooks that use this option may be reordered to minimize the number of additional invocations.
 // * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead.
 //
 // Defaults to "Never".
 // +optional
 ReinvocationPolicy *ReinvocationPolicyType `json:"reinvocationPolicy,omitempty" protobuf:"bytes,10,opt,name=reinvocationPolicy,casttype=ReinvocationPolicyType"`
}

WebhookClientConfig

// WebhookClientConfig contains the information to make a TLS
// connection with the webhook
type WebhookClientConfig struct {
 // `url` gives the location of the webhook, in standard URL form
 // (`scheme://host:port/path`). Exactly one of `url` or `service`
 // must be specified.
 //
 // The `host` should not refer to a service running in the cluster; use
 // the `service` field instead. The host might be resolved via external
 // DNS in some apiservers (e.g., `kube-apiserver` cannot resolve
 // in-cluster DNS as that would be a layering violation). `host` may
 // also be an IP address.
 //
 // Please note that using `localhost` or `127.0.0.1` as a `host` is
 // risky unless you take great care to run this webhook on all hosts
 // which run an apiserver which might need to make calls to this
 // webhook. Such installs are likely to be non-portable, i.e., not easy
 // to turn up in a new cluster.
 //
 // The scheme must be "https"; the URL must begin with "https://".
 //
 // A path is optional, and if present may be any string permissible in
 // a URL. You may use the path to pass an arbitrary string to the
 // webhook, for example, a cluster identifier.
 //
 // Attempting to use a user or basic auth e.g. "user:password@" is not
 // allowed. Fragments ("#...") and query parameters ("?...") are not
 // allowed, either.
 //
 // +optional
 URL *string `json:"url,omitempty" protobuf:"bytes,3,opt,name=url"`

 // `service` is a reference to the service for this webhook. Either
 // `service` or `url` must be specified.
 //
 // If the webhook is running within the cluster, then you should use `service`.
 //
 // +optional
 Service *ServiceReference `json:"service,omitempty" protobuf:"bytes,1,opt,name=service"`

 // `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
 // If unspecified, system trust roots on the apiserver are used.
 // +optional
 CABundle []byte `json:"caBundle,omitempty" protobuf:"bytes,2,opt,name=caBundle"`
}

RuleWithOperations

// RuleWithOperations is a tuple of Operations and Resources. It is recommended to make
// sure that all the tuple expansions are valid.
type RuleWithOperations struct {
 // Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *
 // for all of those operations and any future admission operations that are added.
 // If '*' is present, the length of the slice must be one.
 // Required.
 // +listType=atomic
 Operations []OperationType `json:"operations,omitempty" protobuf:"bytes,1,rep,name=operations,casttype=OperationType"`
 // Rule is embedded, it describes other criteria of the rule, like
 // APIGroups, APIVersions, Resources, etc.
 Rule `json:",inline" protobuf:"bytes,2,opt,name=rule"`
}

// OperationType specifies an operation for a request.
// +enum
type OperationType string

// The constants should be kept in sync with those defined in k8s.io/kubernetes/pkg/admission/interface.go.
const (
 OperationAll OperationType = "*"
 Create OperationType = "CREATE"
 Update OperationType = "UPDATE"
 Delete OperationType = "DELETE"
 Connect OperationType = "CONNECT"
)

FailurePolicyType

// FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled.
// +enum
type FailurePolicyType string

const (
 // Ignore means that an error calling the webhook is ignored.
 Ignore FailurePolicyType = "Ignore"
 // Fail means that an error calling the webhook causes the admission to fail.
 Fail FailurePolicyType = "Fail"
)

MatchPolicyType

// MatchPolicyType specifies the type of match policy.
// +enum
type MatchPolicyType string

const (
 // Exact means requests should only be sent to the webhook if they exactly match a given rule.
 Exact MatchPolicyType = "Exact"
 // Equivalent means requests should be sent to the webhook if they modify a resource listed in rules via another API group or version.
 Equivalent MatchPolicyType = "Equivalent"
)

SideEffectClass

// SideEffectClass specifies the types of side effects a webhook may have.
// +enum
type SideEffectClass string

const (
 // SideEffectClassUnknown means that no information is known about the side effects of calling the webhook.
 // If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail.
 SideEffectClassUnknown SideEffectClass = "Unknown"
 // SideEffectClassNone means that calling the webhook will have no side effects.
 SideEffectClassNone SideEffectClass = "None"
 // SideEffectClassSome means that calling the webhook will possibly have side effects.
 // If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail.
 SideEffectClassSome SideEffectClass = "Some"
 // SideEffectClassNoneOnDryRun means that calling the webhook will possibly have side effects, but if the
 // request being reviewed has the dry-run attribute, the side effects will be suppressed.
 SideEffectClassNoneOnDryRun SideEffectClass = "NoneOnDryRun"
)

ReinvocationPolicyType

// ReinvocationPolicyType specifies what type of policy the admission hook uses.
// +enum
type ReinvocationPolicyType string

const (
 // NeverReinvocationPolicy indicates that the webhook must not be called more than once in a
 // single admission evaluation.
 NeverReinvocationPolicy ReinvocationPolicyType = "Never"
 // IfNeededReinvocationPolicy indicates that the webhook may be called at least one
 // additional time as part of the admission evaluation if the object being admitted is
 // modified by other admission plugins after the initial webhook call.
 IfNeededReinvocationPolicy ReinvocationPolicyType = "IfNeeded"
)

Plugins: PodSecurity

PodSecurityConfiguration

k8s.io/pod-security-admission/admission/api/v1/types.go

type PodSecurityConfiguration struct {
 metav1.TypeMeta
 Defaults PodSecurityDefaults `json:"defaults"`
 Exemptions PodSecurityExemptions `json:"exemptions"`
}

PodSecurityDefaults

type PodSecurityDefaults struct {
 Enforce string `json:"enforce,omitempty"`
 EnforceVersion string `json:"enforce-version,omitempty"`
 Audit string `json:"audit,omitempty"`
 AuditVersion string `json:"audit-version,omitempty"`
 Warn string `json:"warn,omitempty"`
 WarnVersion string `json:"warn-version,omitempty"`
}

模式	描述
enforce	策略违例会导致 Pod 被拒绝
audit	策略违例会触发审计日志中记录新事件时添加审计注解；但是 Pod 仍是被接受的
warn	策略违例会触发用户可见的警告信息，但是 Pod 仍是被接受的

Pod 通常是通过 Deployment、Job 等工作负载间接创建，为了尽早地捕获违例状况，audit 和 warn 模式都直接应用到负载资源，而 enforce 模式仅应用到所生成的 Pod 对象上，所以在命名空间更改策略模式后，不会影响当前运行应用。

策略	用途	描述
privileged	提供给集群管理服务	不受限制的策略，提供最大可能范围的权限许可
baseline	提供给普通运维服务	限制性最弱的策略，禁止已知的特权提升
restricted	提供给业务运行环境	限制性非常强的策略，遵循当前的保护 Pod 的最佳实践

各模式可取值为：privileged、baseline、restricted，它们之间差异详见 Pod 安全性标准。

PodSecurityExemptions

type PodSecurityExemptions struct {
 Usernames []string `json:"usernames,omitempty"`
 Namespaces []string `json:"namespaces,omitempty"`
 RuntimeClasses []string `json:"runtimeClasses,omitempty"`
}

属性	描述
usernames	来自用户名已被豁免的、已认证的（或伪装的）的用户的请求会被忽略
runtimeClasses	指定了已豁免的运行时类名称的 Pod 和负载资源会被忽略
namespaces	位于被豁免的名字空间中的 Pod 和负载资源会被忽略

这里配置的是为 Pod 安全性的实施设置豁免（Exemptions）规则，从而允许创建一些本来会被与给定名字空间相关的策略所禁止的 Pod。

Plugins: WebhookAdmissionConfiguration

WebhookAdmission

k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1/types.go k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1/register.go

// WebhookAdmission provides configuration for the webhook admission controller.
type WebhookAdmission struct {
 metav1.TypeMeta

 // KubeConfigFile is the path to the kubeconfig file.
 KubeConfigFile string
}

// GroupName is the group name use in this package
const GroupName = "apiserver.config.k8s.io"

// SchemeGroupVersion is group version used to register these objects
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}

func addKnownTypes(scheme *runtime.Scheme) error {
 scheme.AddKnownTypeWithName(SchemeGroupVersion.WithKind("WebhookAdmissionConfiguration"),
 &WebhookAdmission{},
 )
 return nil
}