Kubernetes 安全性評估與滲透測試

#!/bin/bash
# kubernetes-test-env-setup.sh
# 此腳本用於建立 Kubernetes 安全測試環境
# 包含 kind、kubectl 和相關安全評估工具的安裝

# 設定顏色輸出
RED='\033[0;31m'
GREEN='\033[0;32m'
NC='\033[0m'  # 無顏色

echo -e "${GREEN}開始安裝 Kubernetes 安全測試環境${NC}"

# 檢查 Docker 是否已安裝
if ! command -v docker &> /dev/null; then
    echo -e "${RED}錯誤：Docker 未安裝，請先安裝 Docker${NC}"
    exit 1
fi

# 安裝 kubectl
echo "正在安裝 kubectl..."
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x kubectl
sudo mv kubectl /usr/local/bin/
echo -e "${GREEN}kubectl 安裝完成${NC}"

# 安裝 kind
echo "正在安裝 kind..."
curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-amd64
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind
echo -e "${GREEN}kind 安裝完成${NC}"

# 驗證安裝
echo "驗證安裝..."
kubectl version --client
kind version

echo -e "${GREEN}測試環境基礎工具安裝完成${NC}"

# kind-security-test-cluster.yaml
# 用於安全評估測試的 kind 叢集配置
# 此配置建立一個三節點叢集，並暴露相關端口供測試使用

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
name: security-test  # 叢集名稱
networking:
  apiServerAddress: "127.0.0.1"  # API Server 綁定地址
  apiServerPort: 6443  # API Server 端口
nodes:
# 控制平面節點配置
- role: control-plane
  kubeadmConfigPatches:
  - |
    kind: InitConfiguration
    nodeRegistration:
      kubeletExtraArgs:
        # 啟用匿名存取以便測試（生產環境不應啟用）
        anonymous-auth: "true"
  extraPortMappings:
  # 映射 API Server 端口到主機
  - containerPort: 6443
    hostPort: 6443
    protocol: TCP
  # 映射 NodePort 範圍供服務測試
  - containerPort: 30000
    hostPort: 30000
    protocol: TCP
  - containerPort: 30001
    hostPort: 30001
    protocol: TCP

# 工作節點配置
- role: worker
  kubeadmConfigPatches:
  - |
    kind: JoinConfiguration
    nodeRegistration:
      kubeletExtraArgs:
        anonymous-auth: "true"

- role: worker
  kubeadmConfigPatches:
  - |
    kind: JoinConfiguration
    nodeRegistration:
      kubeletExtraArgs:
        anonymous-auth: "true"

# 建立測試叢集
kind create cluster --config kind-security-test-cluster.yaml

# 設定 kubectl 使用新建立的叢集
kubectl cluster-info --context kind-security-test

# 驗證叢集狀態
kubectl get nodes
kubectl get pods --all-namespaces

# 進入控制平面節點
docker exec -it security-test-control-plane /bin/bash

# 在節點內部查看運行的 Kubernetes 元件
ps aux | grep kube

# 查看 kubelet 配置
cat /var/lib/kubelet/config.yaml

# 查看 API Server 的 TLS 憑證
ls -la /etc/kubernetes/pki/

# 退出節點
exit

# 在測試節點上安裝額外工具
docker exec -it security-test-control-plane bash -c "
apt-get update && apt-get install -y \
  tcpdump \
  net-tools \
  curl \
  jq \
  vim
"

# 下載 etcdctl 工具
ETCD_VER=v3.5.9
docker exec -it security-test-control-plane bash -c "
curl -L https://github.com/etcd-io/etcd/releases/download/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd.tar.gz
tar xzf /tmp/etcd.tar.gz -C /tmp
mv /tmp/etcd-${ETCD_VER}-linux-amd64/etcdctl /usr/local/bin/
"

# certificate-signing-request.yaml
# 示範如何建立憑證簽署請求（CSR）
# 此請求用於取得新的使用者憑證

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: security-tester  # CSR 名稱
spec:
  request: |  # Base64 編碼的 CSR 內容
    LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0K...
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 86400  # 憑證有效期（秒）
  usages:
  - client auth  # 用於客戶端認證

#!/bin/bash
# extract-serviceaccount-token.sh
# 示範如何從 Pod 中提取 ServiceAccount Token
# 此腳本用於安全評估，展示 Token 洩露的風險

# Token 預設掛載位置
TOKEN_PATH="/var/run/secrets/kubernetes.io/serviceaccount/token"
CA_CERT_PATH="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
NAMESPACE_PATH="/var/run/secrets/kubernetes.io/serviceaccount/namespace"

# 讀取 Token 和相關資訊
if [ -f "$TOKEN_PATH" ]; then
    echo "發現 ServiceAccount Token"
    TOKEN=$(cat $TOKEN_PATH)
    NAMESPACE=$(cat $NAMESPACE_PATH)

    # 解碼 JWT Token 以檢視其內容
    echo "Token 內容（Payload 部分）:"
    echo $TOKEN | cut -d '.' -f 2 | base64 -d 2>/dev/null | jq .

    echo ""
    echo "Namespace: $NAMESPACE"

    # 嘗試使用此 Token 呼叫 API Server
    echo ""
    echo "測試 Token 權限..."
    curl -s --cacert $CA_CERT_PATH \
         -H "Authorization: Bearer $TOKEN" \
         https://kubernetes.default.svc/api/v1/namespaces/$NAMESPACE/pods
else
    echo "未找到 ServiceAccount Token"
fi

# 檢查匿名存取權限
# 此命令列出所有綁定到匿名使用者或未認證群組的角色

kubectl get clusterrolebindings -o json | jq -r '
  .items[] |
  select(
    .subjects[]? |
    select(
      (.kind == "User" and .name == "system:anonymous") or
      (.kind == "Group" and .name == "system:unauthenticated")
    )
  ) |
  .metadata.name
'

# 檢查特定角色的權限
kubectl describe clusterrolebinding system:public-info-viewer

# dangerous-rbac-examples.yaml
# 示範幾種危險的 RBAC 配置
# 這些配置在安全評估中應特別注意

---
# 危險配置 1：過度寬鬆的叢集管理員權限
# 此配置授予所有資源的完全控制權
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dangerous-admin-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin  # 授予完全控制權
subjects:
- kind: ServiceAccount
  name: monitoring-sa
  namespace: monitoring

---
# 危險配置 2：可存取 Secrets 的權限
# Secrets 可能包含敏感資訊如密碼、憑證
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch"]  # 可讀取所有 Secrets

---
# 危險配置 3：可建立 Pod 的權限
# 可能被利用來執行任意程式碼
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: development
  name: pod-creator
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create", "delete"]  # 可建立和刪除 Pod
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create"]  # 可在 Pod 中執行命令

#!/bin/bash
# rbac-audit.sh
# RBAC 權限審計腳本
# 識別危險的權限配置

echo "===== RBAC 安全審計 ====="
echo ""

# 檢查具有 cluster-admin 權限的綁定
echo "[!] 具有 cluster-admin 權限的主體："
kubectl get clusterrolebindings -o json | jq -r '
  .items[] |
  select(.roleRef.name == "cluster-admin") |
  "  - " + .metadata.name + ": " +
  (.subjects[]? | .kind + "/" + .name + " (" + (.namespace // "cluster-wide") + ")")
'

echo ""

# 檢查可存取 Secrets 的角色
echo "[!] 可存取 Secrets 的角色："
kubectl get roles,clusterroles -A -o json | jq -r '
  .items[] |
  select(.rules[]?.resources[]? == "secrets") |
  "  - " + .kind + "/" + .metadata.name +
  " (namespace: " + (.metadata.namespace // "cluster-wide") + ")"
'

echo ""

# 檢查可建立 Pod 的角色
echo "[!] 可建立 Pod 的角色："
kubectl get roles,clusterroles -A -o json | jq -r '
  .items[] |
  select(
    .rules[]? |
    select(.resources[]? == "pods") |
    select(.verbs[]? == "create" or .verbs[]? == "*")
  ) |
  "  - " + .kind + "/" + .metadata.name
'

echo ""

# 檢查可修改 RBAC 的角色
echo "[!] 可修改 RBAC 配置的角色："
kubectl get clusterroles -o json | jq -r '
  .items[] |
  select(
    .rules[]? |
    select(.apiGroups[]? == "rbac.authorization.k8s.io") |
    select(.verbs[]? == "create" or .verbs[]? == "update" or .verbs[]? == "*")
  ) |
  "  - " + .metadata.name
'

#!/bin/bash
# kubelet-security-check.sh
# kubelet 安全配置檢查腳本
# 評估 kubelet 的身份驗證和授權設定

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"

echo "===== Kubelet 安全配置檢查 ====="
echo ""

# 檢查配置檔案是否存在
if [ ! -f "$KUBELET_CONFIG" ]; then
    echo "錯誤：找不到 kubelet 配置檔案"
    exit 1
fi

# 檢查匿名存取設定
ANON_AUTH=$(grep -A 2 "authentication:" $KUBELET_CONFIG | grep "anonymous:" -A 1 | grep "enabled:" | awk '{print $2}')
if [ "$ANON_AUTH" == "true" ]; then
    echo "[警告] 匿名存取已啟用"
else
    echo "[良好] 匿名存取已停用"
fi

# 檢查 Webhook 認證
WEBHOOK_AUTH=$(grep -A 5 "authentication:" $KUBELET_CONFIG | grep "webhook:" -A 1 | grep "enabled:" | awk '{print $2}')
if [ "$WEBHOOK_AUTH" == "true" ]; then
    echo "[良好] Webhook 認證已啟用"
else
    echo "[警告] Webhook 認證未啟用"
fi

# 檢查授權模式
AUTH_MODE=$(grep "authorization:" -A 2 $KUBELET_CONFIG | grep "mode:" | awk '{print $2}')
echo "[資訊] 授權模式: $AUTH_MODE"
if [ "$AUTH_MODE" == "Webhook" ]; then
    echo "  - Webhook 模式：由 API Server 進行授權檢查"
elif [ "$AUTH_MODE" == "AlwaysAllow" ]; then
    echo "  [警告] AlwaysAllow 模式：所有請求都被允許"
fi

# 檢查 TLS 配置
TLS_CERT=$(grep "tlsCertFile:" $KUBELET_CONFIG | awk '{print $2}')
TLS_KEY=$(grep "tlsPrivateKeyFile:" $KUBELET_CONFIG | awk '{print $2}')
if [ -n "$TLS_CERT" ] && [ -n "$TLS_KEY" ]; then
    echo "[良好] TLS 已配置"
    echo "  - 憑證: $TLS_CERT"
    echo "  - 私鑰: $TLS_KEY"
else
    echo "[警告] TLS 未配置"
fi

# 檢查唯讀端口
READONLY_PORT=$(grep "readOnlyPort:" $KUBELET_CONFIG | awk '{print $2}')
if [ "$READONLY_PORT" == "0" ]; then
    echo "[良好] 唯讀端口已停用"
else
    echo "[警告] 唯讀端口已啟用: $READONLY_PORT"
fi

# 從 kube-apiserver Pod 的配置中取得 etcd 連接資訊
kubectl get pod kube-apiserver-<node-name> -n kube-system -o yaml | \
  grep -A 5 "etcd"

# 或者直接查看 kube-apiserver 的 manifest
cat /etc/kubernetes/manifests/kube-apiserver.yaml | grep etcd

#!/bin/bash
# etcd-enumeration.sh
# etcd 資料列舉腳本
# 用於安全評估，展示可從 etcd 取得的敏感資訊

# 設定 etcd 連接參數
export ETCDCTL_API=3
ETCD_ENDPOINTS="https://127.0.0.1:2379"
ETCD_CACERT="/etc/kubernetes/pki/etcd/ca.crt"
ETCD_CERT="/etc/kubernetes/pki/apiserver-etcd-client.crt"
ETCD_KEY="/etc/kubernetes/pki/apiserver-etcd-client.key"

# 定義便利函數
etcd_cmd() {
    etcdctl --endpoints=$ETCD_ENDPOINTS \
            --cacert=$ETCD_CACERT \
            --cert=$ETCD_CERT \
            --key=$ETCD_KEY \
            "$@"
}

echo "===== etcd 資料列舉 ====="
echo ""

# 檢查 etcd 健康狀態
echo "[*] etcd 健康狀態："
etcd_cmd endpoint health
echo ""

# 列出所有 key 的前綴
echo "[*] 主要資料類別："
etcd_cmd get /registry --prefix --keys-only | \
  cut -d '/' -f 1-3 | sort | uniq -c | sort -rn | head -20
echo ""

# 列舉所有 Secrets
echo "[*] 所有 Secrets："
etcd_cmd get /registry/secrets --prefix --keys-only | \
  sed 's|/registry/secrets/||'
echo ""

# 讀取特定 Secret（示例）
echo "[*] 讀取 default namespace 的 Secrets："
etcd_cmd get /registry/secrets/default --prefix --keys-only
echo ""

# 列舉 ServiceAccount Tokens
echo "[*] ServiceAccount Tokens："
etcd_cmd get /registry/secrets --prefix --keys-only | \
  grep "token"
echo ""

# 列舉 RBAC 配置
echo "[*] ClusterRoleBindings："
etcd_cmd get /registry/clusterrolebindings --prefix --keys-only

# 使用 auger 解碼 etcd 資料
# 首先從 etcd 讀取原始資料
etcd_cmd get /registry/secrets/kube-system/default-token-xxxxx --print-value-only > /tmp/secret.bin

# 使用 auger 解碼
auger decode -f /tmp/secret.bin

# encryption-config.yaml
# etcd Secrets 加密配置
# 此配置啟用 AES-CBC 加密保護 Secrets

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
    - secrets  # 對 Secrets 進行加密
    providers:
    # 使用 AES-CBC 加密
    - aescbc:
        keys:
        - name: key1
          # 32 bytes 的加密金鑰（base64 編碼）
          secret: <base64-encoded-32-byte-key>
    # 允許讀取未加密的 Secrets（用於遷移）
    - identity: {}

# deny-all-network-policy.yaml
# 預設拒絕所有流量的 Network Policy
# 這是建立零信任網路的基礎

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}  # 選擇所有 Pod
  policyTypes:
  - Ingress
  - Egress
  # 未定義任何規則，表示拒絕所有流量

---
# allow-specific-traffic.yaml
# 只允許特定流量的 Network Policy 範例

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-web-traffic
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: web-server
  policyTypes:
  - Ingress
  - Egress
  ingress:
  # 允許來自 Ingress Controller 的流量
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    ports:
    - protocol: TCP
      port: 8080
  egress:
  # 允許存取資料庫
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432
  # 允許 DNS 查詢
  - to:
    - namespaceSelector: {}
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53

# minimal-rbac.yaml
# 最小權限原則的 RBAC 配置範例

---
# 自定義角色：只允許讀取 Deployment 狀態
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: deployment-viewer
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch"]  # 只有讀取權限
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list"]
  # 注意：不包含 pods/exec 和 pods/log

---
# 為特定 ServiceAccount 綁定角色
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: deployment-viewer-binding
  namespace: production
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: deployment-viewer
subjects:
- kind: ServiceAccount
  name: monitoring-app
  namespace: production

# secure-pod.yaml
# 安全加固的 Pod 配置範例

apiVersion: v1
kind: Pod
metadata:
  name: secure-app
  namespace: production
spec:
  # 停用 ServiceAccount Token 自動掛載
  automountServiceAccountToken: false

  # 使用專用的 ServiceAccount
  serviceAccountName: secure-app-sa

  # 設定 Pod 層級的安全上下文
  securityContext:
    runAsNonRoot: true  # 強制以非 root 運行
    runAsUser: 10000  # 指定 UID
    runAsGroup: 10000  # 指定 GID
    fsGroup: 10000  # 檔案系統群組
    seccompProfile:
      type: RuntimeDefault  # 使用預設的 seccomp 設定檔

  containers:
  - name: app
    image: secure-app:latest

    # 容器層級的安全上下文
    securityContext:
      allowPrivilegeEscalation: false  # 禁止權限提升
      readOnlyRootFilesystem: true  # 唯讀根檔案系統
      capabilities:
        drop:
        - ALL  # 移除所有 Linux capabilities

    # 資源限制
    resources:
      limits:
        cpu: "500m"
        memory: "256Mi"
      requests:
        cpu: "100m"
        memory: "128Mi"

    # 使用 tmpfs 作為可寫入目錄
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: cache
      mountPath: /var/cache

  volumes:
  - name: tmp
    emptyDir: {}
  - name: cache
    emptyDir: {}

# audit-policy.yaml
# Kubernetes API Server 審計策略
# 記錄敏感操作以便安全監控

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
# 不記錄對健康檢查端點的請求
- level: None
  nonResourceURLs:
  - /healthz*
  - /livez*
  - /readyz*

# 不記錄對 kube-system 的 configmaps 的 watch 請求
- level: None
  resources:
  - group: ""
    resources: ["configmaps"]
  namespaces: ["kube-system"]
  verbs: ["watch"]

# 記錄對 Secrets 的所有操作，包含完整請求和回應
- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]

# 記錄對 RBAC 資源的修改操作
- level: RequestResponse
  resources:
  - group: "rbac.authorization.k8s.io"
    resources: ["*"]
  verbs: ["create", "update", "patch", "delete"]

# 記錄對 pods/exec 的請求
- level: RequestResponse
  resources:
  - group: ""
    resources: ["pods/exec", "pods/attach"]

# 記錄認證失敗
- level: Metadata
  omitStages:
  - RequestReceived

# 預設記錄所有其他請求的元資料
- level: Metadata