# Implementing Rbac Hardening For Kubernetes > 通过实施最小权限策略、审计角色绑定、消除 cluster-admin 权限蔓延并集成外部身份提供商，加固 Kubernetes 基于角色的访问控制（RBAC）。 - Skill: `killvxk/implementing-rbac-hardening-for-kubernetes` (Agent Skill, multi-file: 8 files) - Install (CLI): `npx skillmds@latest add killvxk/implementing-rbac-hardening-for-kubernetes` - Raw SKILL.md: https://api.skillmd.com/api/skills/killvxk/implementing-rbac-hardening-for-kubernetes/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - License: Apache-2.0 - Author: killvxk (https://skillmd.com/u/killvxk) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/killvxk/implementing-rbac-hardening-for-kubernetes --- # 实施 Kubernetes RBAC 加固 ## 概述 Kubernetes 基于角色的访问控制（RBAC，Role-Based Access Control）根据分配给用户、组和服务账户的角色来管理对集群资源的访问。默认配置通常会授予过多权限，若不主动加固，RBAC 会成为权限提升（Privilege Escalation）、横向移动（Lateral Movement）和数据外泄（Exfiltration）的主要攻击入口。加固工作需要实施最小权限原则（Least Privilege）、消除不必要的 ClusterRole 绑定、隔离服务账户、集成外部身份提供商，并持续进行审计。 ## 前置条件 - Kubernetes 集群 v1.24+，已启用 RBAC（v1.6 起默认开启） - 具有 cluster-admin 权限的 kubectl 访问（用于初始审计） - 用于用户认证的外部身份提供商（OIDC） - API server 已启用审计日志 ## 核心加固原则 ### 1. 消除 cluster-admin 权限蔓延 审计并移除不必要的 cluster-admin 绑定： ```bash # 列出所有 cluster-admin 绑定 kubectl get clusterrolebindings -o json | jq -r ' .items[] | select(.roleRef.name == "cluster-admin") | "\(.metadata.name) -> \(.subjects[]? | "\(.kind)/\(.name) (\(.namespace // "cluster"))")" ' ``` ### 2. 优先使用命名空间范围的 Role 而非 ClusterRole 使用 Role 和 RoleBinding 替代 ClusterRole 和 ClusterRoleBinding： ```yaml # 推荐：命名空间范围的角色 apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: application name: app-developer rules: - apiGroups: ["apps"] resources: ["deployments"] verbs: ["get", "list", "watch", "create", "update", "patch"] - apiGroups: [""] resources: ["pods", "pods/log"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["configmaps"] verbs: ["get", "list"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: namespace: application name: app-developer-binding subjects: - kind: Group name: dev-team apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: app-developer apiGroup: rbac.authorization.k8s.io ``` ### 3. 为每个工作负载使用专用服务账户 ```yaml apiVersion: v1 kind: ServiceAccount metadata: name: payment-processor namespace: payments automountServiceAccountToken: false # 禁用自动挂载 --- apiVersion: apps/v1 kind: Deployment metadata: name: payment-processor namespace: payments spec: template: spec: serviceAccountName: payment-processor automountServiceAccountToken: true # 仅在明确需要时挂载 containers: - name: processor image: payments/processor:v2.1@sha256:abc... ``` ### 4. 限制危险权限 阻止可导致权限提升的权限： ```yaml # 需要限制的危险动词/资源： # - secrets: get, list, watch（暴露命名空间内所有密钥） # - pods/exec: create（允许在 Pod 内执行命令） # - pods: create（带特权 securityContext） # - serviceaccounts/token: create（生成新令牌） # - clusterroles/clusterrolebindings: create, update（自我提权） # - nodes/proxy: create（绕过 API server 授权） # 安全的只读角色示例 apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: security-viewer rules: - apiGroups: [""] resources: ["pods", "services", "namespaces", "nodes"] verbs: ["get", "list", "watch"] - apiGroups: ["apps"] resources: ["deployments", "daemonsets", "statefulsets"] verbs: ["get", "list", "watch"] - apiGroups: ["networking.k8s.io"] resources: ["networkpolicies"] verbs: ["get", "list", "watch"] ``` ### 5. 集成 OIDC 实现用户认证 ```yaml # OIDC 集成的 API server 参数 apiVersion: v1 kind: Pod metadata: name: kube-apiserver spec: containers: - name: kube-apiserver command: - kube-apiserver - --oidc-issuer-url=https://idp.company.com - --oidc-client-id=kubernetes - --oidc-username-claim=email - --oidc-groups-claim=groups - --oidc-ca-file=/etc/kubernetes/pki/oidc-ca.crt ``` ## RBAC 审计流程 ### 步骤 1：枚举所有绑定 ```bash # 列出所有带主体的 ClusterRoleBinding kubectl get clusterrolebindings -o json | jq -r ' .items[] | select(.subjects != null) | .subjects[] as $s | "\(.metadata.name) | \(.roleRef.name) | \($s.kind)/\($s.name)" ' | sort | column -t -s '|' # 列出所有命名空间的 RoleBinding kubectl get rolebindings --all-namespaces -o json | jq -r ' .items[] | select(.subjects != null) | .subjects[] as $s | "\(.metadata.namespace) | \(.metadata.name) | \(.roleRef.name) | \($s.kind)/\($s.name)" ' | sort | column -t -s '|' ``` ### 步骤 2：识别过度授权的服务账户 ```bash # 查找具有 cluster-admin 或 admin 角色的服务账户 kubectl get clusterrolebindings -o json | jq -r ' .items[] | select(.roleRef.name == "cluster-admin" or .roleRef.name == "admin") | select(.subjects[]?.kind == "ServiceAccount") | "\(.subjects[] | select(.kind == "ServiceAccount") | "\(.namespace)/\(.name)")" ' ``` ### 步骤 3：检查默认服务账户使用情况 ```bash # 查找使用默认服务账户的 Pod kubectl get pods --all-namespaces -o json | jq -r ' .items[] | select(.spec.serviceAccountName == "default" or .spec.serviceAccountName == null) | "\(.metadata.namespace)/\(.metadata.name)" ' ``` ### 步骤 4：验证令牌自动挂载 ```bash # 查找自动挂载服务账户令牌的 Pod kubectl get pods --all-namespaces -o json | jq -r ' .items[] | select(.spec.automountServiceAccountToken != false) | "\(.metadata.namespace)/\(.metadata.name) sa=\(.spec.serviceAccountName // "default")" ' ``` ## 工具 ### rbac-lookup ```bash # 安装 rbac-lookup kubectl krew install rbac-lookup # 查看特定用户的 RBAC 配置 kubectl rbac-lookup developer@company.com # 以宽格式查看所有 RBAC 绑定 kubectl rbac-lookup --kind user -o wide ``` ### rakkess（访问审查） ```bash # 安装 rakkess kubectl krew install access-matrix # 显示当前用户的访问矩阵 kubectl access-matrix # 显示特定服务账户的访问权限 kubectl access-matrix --sa payments:payment-processor ``` ## 参考资料 - [Kubernetes RBAC 文档](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) - [CIS Kubernetes 基准 - RBAC 控制项](https://www.cisecurity.org/benchmark/kubernetes) - [Kubernetes 安全加固指南 2025](https://sealos.io/blog/a-practical-guide-to-kubernetes-security-hardening-your-cluster-in-2025/) - [OWASP Kubernetes 安全速查表](https://cheatsheetseries.owasp.org/cheatsheets/Kubernetes_Security_Cheat_Sheet.html)