通过安全策略管理配置Pod的安全策略

安装和配置ack-policy-external-provider

1. 在ACK集群列表页面，单击目标集群名称，在集群详情页左侧导航栏，单击组件管理。

2. 搜索并定位ack-policy-external-provider，配置ack-policy-external-provider的实例个数（ProviderPodNumber）和是否开启CRD删除保护需要的RBAC权限。

   CRD删除保护需要集群内全部资源的只读权限。依据最小化权限原则，ack-policy-external-provider默认不开放此权限，需手动勾选开启。

接口定义及参数说明

ack-policy-external-provider 实现了一个标准的 Gatekeeper 外部数据 Provider。可在 Rego 策略模板中，通过调用 external_data 函数并指定 provider: ack-policy-external-data-provider，来向该组件发起资源查询请求。

请求参数以 JSON 格式定义，示例如下。

// 示例 1
{
  "action": "ListK8sResource",
  "namespaced": false,
  "group": "",
  "version": "v1",
  "resource": "persistentvolumeclaims"
  "requestID": review.uid,
  "userInfo": review.userInfo,
  "requestFrom": "PVCProtector",
  "labelSelector": "protected",
  "limit": 1
}
// 示例 2
{
  "action": "GetK8sResource",
  "namespaced": true,
  "namespace": "default",
  "group": "apps",
  "version": "v1",
  "resource": "deployments",
  "requestID": review.uid,
  "userInfo": review.userInfo,
  "requestFrom": "FinOpsPolicy",
  "labelSelector": "protected",
  "limit": 1
}

核心参数说明：

场景示例：防止CRD被删除

本示例展示利用 ack-policy-external-provider 实现一个常见的高级策略：当 CRD 仍然存在关联的 CR 实例时，禁止删除该 CRD。

此策略已作为内置规则集成到策略库中，无需手动部署。仅作为原理说明。

• 策略逻辑

  • 触发：Gatekeeper 监听到 DELETE CRD 操作。

  • 查询：Rego 策略通过 external_data 调用 ack-policy-external-provider。

  • 判断：ack-policy-external-provider 根据请求参数查询集群中是否存在对应的 CR 实例。

  • 决策：如果查询结果返回了至少一个 CR 实例，ack-policy-external-provider 会将结果返回给 Rego 策略，策略最终会 deny (拒绝) 本次删除操作。

• 策略模板（ConstraintTemplate）

  定义策略的逻辑。

  apiVersion: templates.gatekeeper.sh/v1beta1
  kind: ConstraintTemplate
  metadata:
    name: blockcrddeletion
    annotations:
      meta.helm.sh/release-name: gatekeeper
      meta.helm.sh/release-namespace: kube-system
      metadata.gatekeeper.sh/version: 1.0.0
    labels:
      app.kubernetes.io/managed-by: Helm
  spec:
    crd:
      spec:
        names:
          kind: BlockCrdDeletion
        validation:
          legacySchema: true
    targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package block_crd_deletion
        violation[{"msg": msg}] {
          before(input.review.operation)
          response := handle(input.review)
          msg := after(response)
        }
  
        before(operation) {
          operation == "DELETE"
        }
  
        handle(review) = response {
          customrequest := {
            "action": "ListK8sResource",
            "namespaced": false,
            "group": review.object.spec.group,
            "version": "",
            "resource": review.object.spec.names.plural,
            "requestID": review.uid,
            "userInfo": review.userInfo,
            "requestFrom": "BlockCrdDeletion",
            "labelSelector": "protected",
            "limit": 1
          }
          request_keys := [json.marshal(customrequest)]
          response := external_data({
            "provider": "ack-policy-external-data-provider",
            "keys": request_keys
          })
        }
  
        after(response) = msg {
          count(response.responses[0]) > 0
          msg := sprintf(
            "The CRD %v is not allowed to be deleted. Reason: It is not allowed to delete a CRD object when it contains a collection of custom resources. Current existing custom resources: %v, etc.",
            [input.review.name, response.responses[0][0]]
          )
        }

• 策略实例（Constraint）

  将模板应用到具体资源。本示例应用到所有CRD。

  apiVersion: constraints.gatekeeper.sh/v1beta1
  kind: BlockCrdDeletion
  metadata:
    name: block-crd-deletion-rule
  spec:
    enforcementAction: deny
    match:
      kinds:
      - apiGroups:
        - '*'
        kinds:
        - CustomResourceDefinition

• 效果验证

  1. 创建一个测试 CRD 和对应的 CR 实例：

     # 创建 CRD
     apiVersion: apiextensions.k8s.io/v1
     kind: CustomResourceDefinition
     metadata:
       name: simplestthings.example.com
     spec:
       group: example.com
       scope: Namespaced
       names:
         plural: simplestthings
         singular: simplestthing
         kind: SimplestThing
       versions:
         - name: v1
           served: true
           storage: true
           schema:
             openAPIV3Schema:
               type: object
               properties:
                 spec:
                   type: object
                   properties:
                     message:
                       type: string
     ---
     # 创建 CR 实例
     apiVersion: example.com/v1
     kind: SimplestThing
     metadata:
       name: my-simple-thing
       namespace: default
       labels:
         protected: "false"
     spec:
       message: "Hello"

  2. 尝试删除该 CRD。

     kubectl delete crd simplestthings.example.com

  3. 查看删除操作是否被策略拦截，并返回明确的错误信息。

     预期输出：

     % kubectl delete crd simplestthings.example.com
     Error from server (Forbidden): admission webhook "delete.validation.gatekeeper.sh" denied the request: [block-crd-deletion-rule] The CRD simplestthings.example.com is not allowed to be deleted. Reason: It is not allowed to delete a CRD object when it contains a collection of custom resources. Current existing custom resources: my-simple-thing, etc.