Kubernetes安全是多层次的。本文介绍RBAC和Pod安全策略。 ## RBAC配置 ```yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: production name: developer rules: - apiGroups: [""] resources: ["pods", "services"] verbs: ["get", "list", "watch"] - apiGroups: ["apps"] resources: ["deployments"] verbs: ["get", "list", "watch", "update"] ``` ## Pod安全标准 ```yaml apiVersion: v1 kind: Namespace metadata: name: production labels: pod-security.kubernetes.io/enforce: restricted ``` ## 安全上下文 ```yaml spec: securityContext: runAsNonRoot: true runAsUser: 1000 containers: - name: app securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL ``` 安全是持续的过程，不是一次性的配置。