mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-07-28 14:47:17 -07:00
Translated ['src/pentesting-cloud/kubernetes-security/kubernetes-basics.
This commit is contained in:
Translator
@@ -2,11 +2,11 @@
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
|
||||
Kuna **njia tofauti za kufichua services** ndani ya Kubernetes ili **internal** endpoints na **external** endpoints zote ziweze kuzifikia. Configuration hii ya Kubernetes ni muhimu sana kwa sababu administrator anaweza kutoa access kwa **attackers kwa services ambazo hawapaswi kuweza kuzifikia**.
|
||||
Kuna **njia tofauti za kufichua services** katika Kubernetes ili **internal** endpoints na **external** endpoints ziweze kuzifikia. Configuration hii ya Kubernetes ni muhimu sana kwa sababu administrator anaweza kuwapa **attackers ufikiaji wa services ambazo hawapaswi kuweza kuzifikia**.
|
||||
|
||||
### Automatic Enumeration
|
||||
|
||||
Kabla ya kuanza kuenumerate njia ambazo K8s inatoa za kufichua services kwa public, fahamu kwamba ikiwa unaweza kuorodhesha namespaces, services na ingresses, unaweza kupata kila kitu kilichofichuliwa kwa public kwa:
|
||||
Kabla ya kuanza ku-enumerate njia ambazo K8s inatoa za kufichua services kwa public, jua kwamba ikiwa unaweza ku-list namespaces, services na ingresses, unaweza kupata kila kitu kilichofichuliwa kwa public kwa:
|
||||
```bash
|
||||
kubectl get namespace -o custom-columns='NAME:.metadata.name' | grep -v NAME | while IFS='' read -r ns; do
|
||||
echo "Namespace: $ns"
|
||||
@@ -20,13 +20,13 @@ done | grep -v "ClusterIP"
|
||||
```
|
||||
### ClusterIP
|
||||
|
||||
Huduma ya **ClusterIP** ni huduma ya **default** ya Kubernetes. Inakupa **service ndani ya** cluster yako ambayo apps nyingine zilizo ndani ya cluster yako zinaweza kufikia. **Hakuna external access**.
|
||||
Huduma ya **ClusterIP** ni **default** ya Kubernetes **service**. Inakupa **service ndani** ya cluster yako ambayo apps nyingine ndani ya cluster yako zinaweza kufikia. Hakuna **external access**.
|
||||
|
||||
Hata hivyo, hii inaweza kufikiwa kwa kutumia Kubernetes Proxy:
|
||||
```bash
|
||||
kubectl proxy --port=8080
|
||||
```
|
||||
Sasa, unaweza kuvinjari kupitia Kubernetes API ili kufikia services ukitumia mpangilio huu:
|
||||
Sasa, unaweza kupitia Kubernetes API kufikia services ukitumia mpangilio huu:
|
||||
|
||||
`http://localhost:8080/api/v1/proxy/namespaces/<NAMESPACE>/services/<SERVICE-NAME>:<PORT-NAME>/`
|
||||
|
||||
@@ -34,7 +34,7 @@ Kwa mfano unaweza kutumia URL ifuatayo:
|
||||
|
||||
`http://localhost:8080/api/v1/proxy/namespaces/default/services/my-internal-service:http/`
|
||||
|
||||
ili kufikia service hii:
|
||||
kufikia service hii:
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -50,15 +50,15 @@ port: 80
|
||||
targetPort: 80
|
||||
protocol: TCP
|
||||
```
|
||||
_Hii mbinu inakuhitaji uendeshe `kubectl` kama **authenticated user**._
|
||||
_Mbinu hii inahitaji uendeshe `kubectl` kama **mtumiaji aliyethibitishwa**._
|
||||
|
||||
Orodhesha ClusterIPs zote:
|
||||
Orodhesha zote ClusterIPs:
|
||||
```bash
|
||||
kubectl get services --all-namespaces -o=custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,TYPE:.spec.type,CLUSTER-IP:.spec.clusterIP,PORT(S):.spec.ports[*].port,TARGETPORT(S):.spec.ports[*].targetPort,SELECTOR:.spec.selector' | grep ClusterIP
|
||||
```
|
||||
### NodePort
|
||||
|
||||
Wakati **NodePort** inapotumika, porti iliyoteuliwa hupatikana kwenye Node zote (zinazoakilisha Virtual Machines). **Traffic** inayoelekezwa kwenye porti hii mahususi basi **huelekezwa kwa service** kwa utaratibu. Kwa kawaida, njia hii haipendekezwi kutokana na mapungufu yake.
|
||||
Wakati **NodePort** inapotumika, porti maalum inapatikana kwenye Nodes zote (zinazoonyesha Virtual Machines). **Traffic** inayoelekezwa kwenye porti hii mahususi basi **huelekezwa kwa service** kwa utaratibu. Kwa kawaida, njia hii haipendekezwi kwa sababu ya mapungufu yake.
|
||||
|
||||
Orodhesha NodePorts zote:
|
||||
```bash
|
||||
@@ -81,13 +81,24 @@ targetPort: 80
|
||||
nodePort: 30036
|
||||
protocol: TCP
|
||||
```
|
||||
Ukiwa **hutaspecify** **nodePort** kwenye yaml (ni port ambayo itafunguliwa) port katika **range 30000–32767 itatumika**.
|
||||
Usipoweka **nodePort** katika yaml (ndiyo bandari itakayofunguliwa), bandari katika **masafa 30000–32767 itatumika**.
|
||||
|
||||
Unapokagua NodePort au LoadBalancer Services, pia kagua fields za traffic-policy kwa sababu hubadilisha ni nodes na backends zipi zinafaa kutoka kwenye chanzo fulani:
|
||||
```bash
|
||||
kubectl get services --all-namespaces \
|
||||
-o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,TYPE:.spec.type,ETP:.spec.externalTrafficPolicy,ITP:.spec.internalTrafficPolicy,AFFINITY:.spec.sessionAffinity,DIST:.spec.trafficDistribution,NODEPORTS:.spec.ports[*].nodePort'
|
||||
```
|
||||
- `externalTrafficPolicy: Local` huhifadhi IP asili ya mteja kwa traffic ya NodePort/LoadBalancer na huepuka forwarding kwenda endpoints kwenye nodes nyingine. Node bila local ready endpoint inaweza ku-drop traffic hata kama Service ina endpoints mahali pengine.
|
||||
- `externalTrafficPolicy: Cluster` ndiyo default na inaweza forward kupitia node yoyote, lakini backend logs zinaweza kuona node IPs badala ya real external client IP.
|
||||
- `internalTrafficPolicy: Local` huweka limits kwa in-cluster Service traffic kwenda endpoints zilizo local kwa source node. Hii ni locality routing, si authorization boundary.
|
||||
- `sessionAffinity: ClientIP` inaweza kufanya majaribio ya kurudiwa kutoka client mmoja yapige backend ile ile, ikificha endpoints nyingine ready wakati wa manual checks.
|
||||
- `trafficDistribution` na EndpointSlice topology hints vinaweza kupendelea same-zone au same-node endpoints kwenye clusters mpya; vitazame kama routing preferences badala ya hard security policy.
|
||||
|
||||
### LoadBalancer
|
||||
|
||||
Huonyesha Service kwa nje **kwa kutumia load balancer ya cloud provider**. Kwenye GKE, hii itazindua [Network Load Balancer](https://cloud.google.com/compute/docs/load-balancing/network/) ambayo itakupa anwani moja ya IP ambayo itapeleka trafiki yote kwa service yako. Kwenye AWS itazindua Load Balancer.
|
||||
Hufichua Service kwa nje **kwa kutumia cloud provider's load balancer**. Kwenye GKE, hii itazindua [Network Load Balancer](https://cloud.google.com/compute/docs/load-balancing/network/) ambayo itakupa single IP address ambayo ita-forward traffic yote kwenda service yako. Kwenye AWS itazindua Load Balancer.
|
||||
|
||||
Lazima ulipe kwa LoadBalancer kwa kila service iliyofichuliwa, jambo ambalo linaweza kuwa ghali.
|
||||
Lazima ulipe LoadBalancer kwa kila exposed service, jambo ambalo linaweza kuwa ghali.
|
||||
|
||||
Orodhesha LoadBalancers zote:
|
||||
```bash
|
||||
@@ -96,15 +107,15 @@ kubectl get services --all-namespaces -o=custom-columns='NAMESPACE:.metadata.nam
|
||||
### External IPs
|
||||
|
||||
> [!TIP]
|
||||
> External IPs huonekana kupitia services za aina Load Balancers na kwa kawaida hutumika wakati external Cloud Provider Load Balancer inatumika.
|
||||
> External IPs ziko wazi kupitia services za aina ya Load Balancers na kwa kawaida hutumika wakati external Cloud Provider Load Balancer inatumika.
|
||||
>
|
||||
> Ili kuzipata, angalia load balancers zenye thamani kwenye field ya `EXTERNAL-IP`.
|
||||
> Ili kuzitafuta, angalia load balancers zenye thamani katika field ya `EXTERNAL-IP`.
|
||||
|
||||
Traffic inayoingia kwenye cluster kupitia **external IP** (kama **destination IP**), kwenye port ya Service, itakuwa **routed to one of the Service endpoints**. `externalIPs` hazisimamiwi na Kubernetes na ni jukumu la cluster administrator.
|
||||
|
||||
`externalIPs` ni sensitive route-control field kwa sababu user anayeweza kuiweka anaweza kudai traffic ya IP address ambayo owner wa Service hapaswi ku-control ikiwa surrounding network ina-route IP hiyo kwenda kwenye cluster. Kubernetes ilitangaza deprecation na planned removal ya Service `externalIPs` katika v1.36, kwa hiyo pendelea controller-owned exposure mechanisms kama LoadBalancer integrations au Gateway API pale inapowezekana, na restrict/admit field hii kwa uangalifu wakati bado ipo.
|
||||
`externalIPs` ni field nyeti ya route-control kwa sababu user anayeweza kuiweka anaweza kudai traffic ya IP address ambayo owner wa Service hapaswi kuidhibiti ikiwa network inayozunguka ina-route IP hiyo kwenda kwenye cluster. Kubernetes ilitangaza deprecation na removal iliyopangwa ya Service `externalIPs` katika v1.36, hivyo tumia mechanisms za exposure zinazoendeshwa na controller kama LoadBalancer integrations au Gateway API inapowezekana, na restrict/admit field hii kwa uangalifu wakati bado ipo.
|
||||
|
||||
Katika Service spec, `externalIPs` zinaweza kusemwa pamoja na yoyote kati ya `ServiceTypes`. Katika mfano hapa chini, "`my-service`" inaweza kupatikana na clients kwenye "`80.11.12.10:80`" (`externalIP:port`)
|
||||
Katika Service spec, `externalIPs` zinaweza kubainishwa pamoja na yoyote ya `ServiceTypes`. Katika mfano hapa chini, "`my-service`" inaweza kufikiwa na clients kwenye "`80.11.12.10:80`" (`externalIP:port`)
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -123,9 +134,9 @@ externalIPs:
|
||||
```
|
||||
### ExternalName
|
||||
|
||||
[**Kutoka kwenye docs:**](https://kubernetes.io/docs/concepts/services-networking/service/#externalname) Services za aina ExternalName **huweka Service kwa jina la DNS**, si kwa selector ya kawaida kama `my-service` au `cassandra`. Unabainisha Services hizi kwa kutumia kigezo cha `spec.externalName`.
|
||||
[**Kutoka kwenye docs:**](https://kubernetes.io/docs/concepts/services-networking/service/#externalname) Services za type ExternalName **hulinganisha Service na jina la DNS**, si kwa selector ya kawaida kama `my-service` au `cassandra`. Unaweka Services hizi kwa parameter ya `spec.externalName`.
|
||||
|
||||
Ufafanuzi huu wa Service, kwa mfano, huweka `my-service` Service katika namespace `prod` kuwa `my.database.example.com`:
|
||||
Ufafanuzi huu wa Service, kwa mfano, hulinganisha Service ya `my-service` katika namespace ya `prod` na `my.database.example.com`:
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -136,34 +147,34 @@ spec:
|
||||
type: ExternalName
|
||||
externalName: my.database.example.com
|
||||
```
|
||||
Wakati wa kutafuta host `my-service.prod.svc.cluster.local`, cluster DNS Service hurejesha rekodi ya `CNAME` yenye thamani `my.database.example.com`. Kufikia `my-service` hufanya kazi kwa njia ile ile kama nyingine Services lakini kwa tofauti muhimu kwamba **redirection hutokea katika kiwango cha DNS** badala ya kupitia proxying au forwarding.
|
||||
Wakati wa kutafuta host `my-service.prod.svc.cluster.local`, huduma ya DNS ya cluster inarudisha rekodi ya `CNAME` yenye thamani `my.database.example.com`. Kufikia `my-service` hufanya kazi kwa njia ileile kama Services nyingine lakini kwa tofauti muhimu kwamba **redirection hutokea katika kiwango cha DNS** badala ya kupitia proxying au forwarding.
|
||||
|
||||
Orodhesha all ExternalNames:
|
||||
Orodhesha ExternalNames zote:
|
||||
```bash
|
||||
kubectl get services --all-namespaces | grep ExternalName
|
||||
```
|
||||
### EndpointSlices
|
||||
|
||||
EndpointSlices huonyesha anwani halisi za backend na ports ambazo Service kwa sasa inaelekeza trafiki kwake. Ni muhimu sana wakati Service haina selector, wakati labels hazielezi njia ya trafiki, au wakati ni baadhi tu ya backends zilizo tayari.
|
||||
EndpointSlices zinaonyesha anwani za backend halisi na ports ambazo Service kwa sasa inaelekeza trafiki kwenda. Ni muhimu sana hasa wakati Service haina selector, wakati labels hazielezi njia ya trafiki, au wakati ni baadhi tu ya backends zilizo tayari.
|
||||
|
||||
Orodhesha EndpointSlices zinazohusishwa na Services:
|
||||
Orodhesha EndpointSlices zinazohusiana na Services:
|
||||
```bash
|
||||
kubectl get endpointslices --all-namespaces
|
||||
kubectl get endpointslice -n <namespace> -l kubernetes.io/service-name=<service-name> -o yaml
|
||||
kubectl get endpointslice -n <namespace> -l kubernetes.io/service-name=<service-name> \
|
||||
-o custom-columns='NAME:.metadata.name,ADDR:.endpoints[*].addresses,READY:.endpoints[*].conditions.ready,PORTS:.ports[*].port'
|
||||
```
|
||||
Saat unakagua exposure, linganisha Service selector na EndpointSlice `targetRef`, endpoint addresses, readiness conditions, na ports. Selectorless Service inaweza kuunganishwa na EndpointSlices zinazosimamiwa kwa mikono na kuelekeza traffic kwenda destinations zisizo za Pod au zisizotarajiwa.
|
||||
Unapokuwa ukikagua exposure, linganisha Service selector na EndpointSlice `targetRef`, endpoint addresses, readiness conditions, na ports. Service isiyo na selector inaweza kuunganishwa na EndpointSlices zinazosimamiwa kwa mikono na kuelekeza traffic kwenda kwenye destination zisizo za Pod au zisizotarajiwa.
|
||||
|
||||
### Ingress
|
||||
|
||||
Tofauti na mifano yote hapo juu, **Ingress SI aina ya service**. Badala yake, iko **mbele ya services nyingi na hufanya kazi kama “smart router”** au entrypoint ndani ya cluster yako.
|
||||
Tofauti na mifano yote iliyo hapo juu, **Ingress SI aina ya service**. Badala yake, huwa **mbele ya services nyingi na hufanya kazi kama “smart router”** au entrypoint kwenye cluster yako.
|
||||
|
||||
Unaweza kufanya mambo mengi tofauti na Ingress, na kuna **aina nyingi za Ingress controllers zenye capabilities tofauti**.
|
||||
Unaweza kufanya mambo mengi tofauti na Ingress, na zipo **aina nyingi za Ingress controllers zenye capabilities tofauti**.
|
||||
|
||||
Default GKE ingress controller ita-spin up [HTTP(S) Load Balancer](https://cloud.google.com/compute/docs/load-balancing/http/) kwa ajili yako. Hii itakuwezesha kufanya routing ya path-based na subdomain-based kwenda backend services. Kwa mfano, unaweza kutuma kila kitu kwenye foo.yourdomain.com kwenda service ya foo, na kila kitu chini ya path ya yourdomain.com/bar/ kwenda service ya bar.
|
||||
Default GKE ingress controller ita- spin up [HTTP(S) Load Balancer](https://cloud.google.com/compute/docs/load-balancing/http/) kwa ajili yako. Hii itakuwezesha kufanya routing ya path-based na subdomain-based kwenda backend services. Kwa mfano, unaweza kutuma kila kitu kwenye foo.yourdomain.com kwenda kwenye foo service, na kila kitu kilicho chini ya path ya yourdomain.com/bar/ kwenda kwenye bar service.
|
||||
|
||||
YAML ya object ya Ingress kwenye GKE yenye [L7 HTTP Load Balancer](https://cloud.google.com/compute/docs/load-balancing/http/) inaweza kuonekana hivi:
|
||||
YAML ya Ingress object kwenye GKE yenye [L7 HTTP Load Balancer](https://cloud.google.com/compute/docs/load-balancing/http/) inaweza kuonekana hivi:
|
||||
```yaml
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
@@ -201,15 +212,15 @@ Orodhesha ingresses zote:
|
||||
```bash
|
||||
kubectl get ingresses --all-namespaces -o=custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,RULES:spec.rules[*],STATUS:status'
|
||||
```
|
||||
Ingawa katika kesi hii ni bora kupata info ya kila moja mmoja mmoja ili kuisoma vizuri zaidi:
|
||||
Ingawa katika kesi hii ni bora kupata info ya kila moja moja moja ili kuisoma vizuri zaidi:
|
||||
```bash
|
||||
kubectl get ingresses --all-namespaces -o=yaml
|
||||
```
|
||||
### Gateway API
|
||||
|
||||
Gateway API ni Kubernetes API mpya zaidi ya kufichua Services. Inatenganisha vitu vya Gateway vinavyomilikiwa na infrastructure kutoka kwa vitu vya Route vinavyomilikiwa na application kama HTTPRoute. Hii ni muhimu kwa delegation, lakini pia inamaanisha exposure inaweza kugawanywa across namespaces.
|
||||
Gateway API ni Kubernetes API mpya zaidi kwa kufichua Services. Hutenganisha vitu vya Gateway vinavyomilikiwa na infrastructure kutoka kwa vitu vya Route vinavyomilikiwa na application kama vile HTTPRoute. Hii ni muhimu kwa delegation, lakini pia inamaanisha exposure inaweza kugawanywa across namespaces.
|
||||
|
||||
Orodhesha vitu vya Gateway API exposure:
|
||||
List Gateway API exposure objects:
|
||||
```bash
|
||||
kubectl get gatewayclasses
|
||||
kubectl get gateways --all-namespaces
|
||||
@@ -217,13 +228,16 @@ kubectl get httproutes --all-namespaces
|
||||
kubectl get gateway -n <namespace> <gateway-name> -o yaml
|
||||
kubectl get httproute -n <namespace> <route-name> -o yaml
|
||||
```
|
||||
Angalia Gateway listeners, allowed route namespaces, Route `parentRefs`, hostnames, filters, backend references, na status conditions kama vile ikiwa route ilikubaliwa. Route ambayo imekubaliwa na shared Gateway inaweza kufichua backend hata wakati hakuna legacy Ingress object iliyopo.
|
||||
Angalia Gateway listeners, allowed route namespaces, Route `parentRefs`, hostnames, filters, backend references, na status conditions kama vile kama route ilikubaliwa. Route ambayo imekubaliwa na shared Gateway inaweza kufichua backend hata wakati hakuna legacy Ingress object iliyopo.
|
||||
|
||||
### References
|
||||
|
||||
- [https://medium.com/google-cloud/kubernetes-nodeport-vs-loadbalancer-vs-ingress-when-should-i-use-what-922f010849e0](https://medium.com/google-cloud/kubernetes-nodeport-vs-loadbalancer-vs-ingress-when-should-i-use-what-922f010849e0)
|
||||
- [https://kubernetes.io/docs/concepts/services-networking/service/](https://kubernetes.io/docs/concepts/services-networking/service/)
|
||||
- [https://kubernetes.io/blog/2026/05/14/kubernetes-v1-36-deprecation-and-removal-of-service-externalips/](https://kubernetes.io/blog/2026/05/14/kubernetes-v1-36-deprecation-and-removal-of-service-externalips/)
|
||||
- [https://kubernetes.io/docs/concepts/services-networking/service-traffic-policy/](https://kubernetes.io/docs/concepts/services-networking/service-traffic-policy/)
|
||||
- [https://kubernetes.io/docs/tutorials/services/source-ip/](https://kubernetes.io/docs/tutorials/services/source-ip/)
|
||||
- [https://kubernetes.io/docs/concepts/services-networking/topology-aware-routing/](https://kubernetes.io/docs/concepts/services-networking/topology-aware-routing/)
|
||||
- [https://kubernetes.io/docs/concepts/services-networking/endpoint-slices/](https://kubernetes.io/docs/concepts/services-networking/endpoint-slices/)
|
||||
- [https://gateway-api.sigs.k8s.io/](https://gateway-api.sigs.k8s.io/)
|
||||
|
||||
|
||||
@@ -1,64 +1,66 @@
|
||||
# Kubernetes Basics
|
||||
# Misingi ya Kubernetes
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
|
||||
**Mwandishi asili wa ukurasa huu ni** [**Jorge**](https://www.linkedin.com/in/jorge-belmonte-a924b616b/) **(soma chapisho lake la asili** [**hapa**](https://sickrov.github.io)**)**
|
||||
**Mwandishi asilia wa ukurasa huu ni** [**Jorge**](https://www.linkedin.com/in/jorge-belmonte-a924b616b/) **(soma chapisho lake la awali** [**hapa**](https://sickrov.github.io)**)**
|
||||
|
||||
## Architecture & Basics
|
||||
|
||||
### What does Kubernetes do?
|
||||
### Kubernetes hufanya nini?
|
||||
|
||||
- Huwezesha kuendesha container/s kwenye container engine.
|
||||
- Schedule huruhusu containers kutumwa kwa ufanisi wa misheni.
|
||||
- Hufanya containers zibaki hai.
|
||||
- Huwezesha mawasiliano ya containers.
|
||||
- Huwezesha deployment techniques.
|
||||
- Hushughulikia volumes of information.
|
||||
- Huruhusu kuendesha container/s ndani ya container engine.
|
||||
- Schedule huruhusu containers kutekelezwa kwa ufanisi.
|
||||
- Huweka containers zikiwa hai.
|
||||
- Huruhusu communications za containers.
|
||||
- Huruhusu deployment techniques.
|
||||
- Hushughulikia volumes za information.
|
||||
|
||||
### Architecture
|
||||
|
||||
|
||||
|
||||
- **Node**: operating system yenye pod au pods.
|
||||
- **Pod**: Wrapper kuzunguka container au containers nyingi pamoja nayo. Pod inapaswa kuwa na application moja tu (kwa kawaida, pod huendesha container 1 tu). Pod ni njia ambayo kubernetes hutumia kuabstract container technology inayotekelezwa.
|
||||
- **Service**: Kila pod ina **IP address** 1 ya ndani kutoka internal range ya node. Hata hivyo, inaweza pia kufichuliwa kupitia service. **Service pia ina IP address** yake na lengo lake ni kudumisha mawasiliano kati ya pods ili ikiwa moja ikifa **replacement mpya** (yenye tofauti internal IP) **iweze kupatikana** na kufichuliwa kwenye **IP ileile ya service**. Inaweza kusanidiwa kama internal au external. Service pia hufanya kazi kama **load balancer wakati 2 pods zimeunganishwa** kwenye service moja.\
|
||||
- **Pod**: Wrapper inayozunguka container au containers nyingi pamoja na. Pod inapaswa kuwa na application moja tu (kwa kawaida, pod huendesha container 1 tu). Pod ndiyo njia ambayo kubernetes hutumia kuficha technology ya container inayotumika.
|
||||
- **Service**: Kila pod ina **IP address** 1 ya ndani kutoka range ya ndani ya node. Hata hivyo, inaweza pia kuonyeshwa kupitia service. **service pia ina IP address** na lengo lake ni kudumisha communication kati ya pods ili ikifa moja, **replacement mpya** (yenye internal IP tofauti) **iweze kufikiwa** ikiwa imeonyeshwa kwenye **IP ileile ya service**. Inaweza kusanidiwa kama internal au external. Service pia hufanya kazi kama **load balancer wakati pods 2 zimeunganishwa** kwenye service ileile.\
|
||||
Wakati **service** **imeundwa** unaweza kupata endpoints za kila service kwa kuendesha `kubectl get endpoints`
|
||||
- **Kubelet**: Primary node agent. Component inayoweka mawasiliano kati ya node na kubectl, na inaweza tu kuendesha pods (kupitia API server). Kubelet haisimamii containers ambazo hazikuundwa na Kubernetes.
|
||||
- **Kube-proxy**: ni service inayoshughulikia mawasiliano (services) kati ya apiserver na node. Msingi wake ni IPtables kwa nodes. Watumiaji wenye uzoefu zaidi wanaweza kusakinisha kube-proxies nyingine kutoka vendors wengine.
|
||||
- **Sidecar container**: Sidecar containers ni containers zinazopaswa kuendeshwa pamoja na main container ndani ya pod. Sidecar pattern hii huongeza na kuboresha functionality ya containers za sasa bila kuzibadilisha. Siku hizi, tunajua kuwa tunatumia container technology kufunga dependencies zote za application ili iendeshe popote. Container hufanya jambo moja tu na hulifanya jambo hilo vizuri sana.
|
||||
- **Kubelet**: Primary node agent. Component inayoweka communication kati ya node na kubectl, na inaweza tu kuendesha pods (kupitia API server). kubelet haidhibiti containers ambazo hazikuundwa na Kubernetes.
|
||||
- **Kube-proxy**: ni service inayoshughulikia communications (services) kati ya apiserver na node. Msingi wake ni IPtables kwa nodes. Watumiaji waliobobea zaidi wanaweza kusanidi kube-proxies zingine kutoka vendors wengine.
|
||||
- **Sidecar container**: Sidecar containers ni containers zinazopaswa kuendesha pamoja na main container ndani ya pod. sidecar pattern hii huongeza na kuboresha functionality ya containers zilizopo bila kuzibadilisha. Siku hizi, tunajua kuwa tunatumia container technology kufungasha dependencies zote za application ili iendeshe popote. Container hufanya kitu kimoja tu na hufanya hicho kitu vizuri sana.
|
||||
- **Master process:**
|
||||
- **Api Server:** Ni njia ambayo users na pods hutumia kuwasiliana na master process. Ni request zilizo authenticated pekee ndizo zinapaswa kuruhusiwa.
|
||||
- **Scheduler**: Scheduling inarejelea kuhakikisha kuwa Pods zinalinganishwa na Nodes ili Kubelet iweze kuziendesha. Ina akili ya kutosha kuamua node gani ina resources nyingi zaidi zinazopatikana na kisha kukabidhi new pod humo. Kumbuka kuwa scheduler haianzi pods mpya, inawasiliana tu na Kubelet process inayotembea ndani ya node, ambayo itazindua new pod.
|
||||
- **Kube Controller manager**: Huchunguza resources kama replica sets au deployments ili kuangalia kama, kwa mfano, idadi sahihi ya pods au nodes zinaendelea. Ikiwa pod haipo, itawasiliana na scheduler kuanzisha mpya. Huidhibiti replication, tokens, na account services kwa API.
|
||||
- **etcd**: Data storage, persistent, consistent, na distributed. Ni database ya Kubernetes na key-value storage ambamo huhifadhi state kamili ya clusters (kila mabadiliko huandikwa hapa). Components kama Scheduler au Controller manager hutegemea data hii kujua ni mabadiliko gani yametokea (available resourced of the nodes, number of pods running...)
|
||||
- **Cloud controller manager**: Ni controller maalum kwa flow controls na applications, yaani: ikiwa una clusters katika AWS au OpenStack.
|
||||
- **Api Server:** Hii ndiyo njia ambayo users na pods hutumia kuwasiliana na master process. Ni requests zilizo authenticated tu ndizo zinapaswa kuruhusiwa.
|
||||
- **Scheduler**: Scheduling inamaanisha kuhakikisha kuwa Pods zinalinganishwa na Nodes ili Kubelet iweze kuzianzisha. Ina intelligence ya kutosha kuamua node gani ina available resources zaidi na kuipa pod mpya. Kumbuka kuwa scheduler haanzi pods mpya, inawasiliana tu na Kubelet process inayoendeshwa ndani ya node, ambayo itazindua pod mpya.
|
||||
- **Kube Controller manager**: Hukagua resources kama replica sets au deployments ili kuona kama, kwa mfano, idadi sahihi ya pods au nodes zinaendeshwa. Iwapo pod haipo, itawasiliana na scheduler ili kuanzisha mpya. Hudhibiti replication, tokens, na account services kwa API.
|
||||
- **etcd**: Data storage, persistent, consistent, na distributed. Hii ni database ya Kubernetes na key-value storage ambamo huhifadhi complete state ya clusters (kila mabadiliko huandikwa hapa). Components kama Scheduler au Controller manager hutegemea date hii kujua ni mabadiliko gani yametokea (available resourced za nodes, idadi ya pods zinazoendeshwa...)
|
||||
- **Cloud controller manager**: Huu ni controller mahususi wa flow controls na applications, i.e: kama una clusters katika AWS au OpenStack.
|
||||
|
||||
Kumbuka kuwa huenda kukawa na nodes kadhaa (zinazoendesha pods kadhaa), na pia huenda kukawa na master processes kadhaa ambazo access yao kwa Api server imewekwa load balanced na etcd zao zimesynchroniza.
|
||||
Kumbuka kuwa kwa kuwa huenda kukawa na nodes kadhaa (zinazoendesha pods kadhaa), pia huenda kukawa na master processes kadhaa ambazo access yao kwa Api server imewekwa load balanced na etcd zao zimesynchronize.
|
||||
|
||||
**Volumes:**
|
||||
|
||||
Wakati pod inapounda data ambayo haipaswi kupotea pod ikitoweka inapaswa kuhifadhiwa kwenye physical volume. **Kubernetes huruhusu kuattach volume kwenye pod ili kudumisha data**. Volume inaweza kuwa kwenye local machine au kwenye **remote storage**. Ikiwa unaendesha pods kwenye tofauti physical nodes unapaswa kutumia remote storage ili pods zote ziweze kuifikia.
|
||||
Wakati pod inaunda data ambayo haipaswi kupotea pod ikitoweka, inapaswa kuhifadhiwa kwenye physical volume. **Kubernetes huruhusu kuattach volume kwa pod ili kudumuisha data**. Volume inaweza kuwa kwenye local machine au kwenye **remote storage**. Ikiwa unaendesha pods kwenye physical nodes tofauti, unapaswa kutumia remote storage ili pods zote ziweze kuipata.
|
||||
|
||||
Kubernetes pia inasaidia **image volumes** katika versions za hivi karibuni. `image` volume hu-mount OCI image au artifact kama **read-only** filesystem source ndani ya Pod, kwa kutumia fields kama `volumes[].image.reference` na `volumes[].image.pullPolicy`. kubelet hu-pull artifact kwa kutumia credential sources zilezile zinazotumiwa kwa container images, ikiwemo node credentials, Pod `imagePullSecrets`, na ServiceAccount `imagePullSecrets`. Wakati wa security review, tazama image volumes kama runtime inputs na supply-chain dependencies: hakikisha reference imepinned kwa digest, ni registry credentials gani zinaweza kuipata, ime-mount wapi, na kama `subPath` inapunguza directory inayoonekana.
|
||||
|
||||
**Other configurations:**
|
||||
|
||||
- **ConfigMap**: Unaweza kusanidi **URLs** ili kufikia services. Pod itapata data kutoka hapa ili kujua jinsi ya kuwasiliana na services nyingine (pods). Kumbuka kuwa hii si sehemu inayopendekezwa kuhifadhi credentials!
|
||||
- **Secret**: Hii ni mahali pa **kuhifadhi secret data** kama passwords, API keys... encoded katika B64. Pod itaweza kufikia data hii kutumia credentials zinazohitajika.
|
||||
- **Deployments**: Hapa ndipo components zinazopaswa kuendeshwa na kubernetes huainishwa. User kwa kawaida hafanyi kazi moja kwa moja na pods, pods huwekwa abstract katika **ReplicaSets** (idadi ya pods zinazofanana zilizoreplicated), ambazo huendeshwa kupitia deployments. Kumbuka kuwa deployments ni kwa applications za **stateless**. Minimum configuration kwa deployment ni jina na image ya kuendesha.
|
||||
- **StatefulSet**: Component hii imekusudiwa hasa kwa applications kama **databases** ambazo zinahitaji **kufikia storage ileile**.
|
||||
- **Ingress**: Huu ni configuration inayotumika **kufichua application hadharani kwa kutumia URL**. Kumbuka kuwa hii pia inaweza kufanywa kwa kutumia external services, lakini hii ndiyo njia sahihi ya kufichua application.
|
||||
- Ukitekeleza Ingress utahitaji kuunda **Ingress Controllers**. Ingress Controller ni **pod** ambayo itakuwa endpoint inayopokea requests na kuzikagua na kisha kuzi load balance kwenda services. ingress controller itatuma **request kulingana na ingress rules zilizosanidiwa**. Kumbuka kuwa ingress rules zinaweza kuelekeza kwenye paths tofauti au hata subdomains tofauti kwenda internal kubernetes services tofauti.
|
||||
- Mazoea bora ya usalama ni kutumia cloud load balancer au proxy server kama entrypoint ili kutokuwa na sehemu yoyote ya Kubernetes cluster iliyofichuliwa.
|
||||
- Wakati request ambayo haiendani na ingress rule yoyote inapokelewa, ingress controller itaielekeza kwenye "**Default backend**". Unaweza `describe` ingress controller ili kupata address ya parameter hii.
|
||||
- **ConfigMap**: Unaweza kusanidi **URLs** za kufikia services. Pod itapata data hapa ili kujua jinsi ya kuwasiliana na rest of the services (pods). Kumbuka kuwa hii si sehemu inayopendekezwa kuhifadhi credentials!
|
||||
- **Secret**: Hii ndiyo sehemu ya **kuhifadhi secret data** kama passwords, API keys... zikiwa encoded katika B64. Pod itaweza kufikia data hii ili kutumia credentials zinazohitajika.
|
||||
- **Deployments**: Hapa ndipo components zinazopaswa kuendeshwa na kubernetes huonyeshwa. User kwa kawaida hafanyi kazi moja kwa moja na pods, pods hufichwa ndani ya **ReplicaSets** (idadi ya pods zinazofanana zilizorudiwa), ambazo huendeshwa kupitia deployments. Kumbuka kuwa deployments ni kwa ajili ya applications za **stateless**. Minimum configuration ya deployment ni jina na image ya kuendesha.
|
||||
- **StatefulSet**: Component hii imekusudiwa mahsusi kwa applications kama **databases** ambazo zinahitaji **kufikia storage ileile**.
|
||||
- **Ingress**: Hii ni configuration inayotumika **kufichua application hadharani kwa URL**. Kumbuka kuwa hili pia linaweza kufanywa kwa kutumia external services, lakini huu ndio njia sahihi ya kufichua application.
|
||||
- Ukitekeleza Ingress utahitaji kuunda **Ingress Controllers**. Ingress Controller ni **pod** ambayo itakuwa endpoint itakayopokea requests na kuzikagua na kuzipa load balance kwenda kwenye services. ingress controller itakuwa **inatuma request kulingana na ingress rules zilizosanidiwa**. Kumbuka kuwa ingress rules zinaweza kuelekeza paths tofauti au hata subdomains tofauti kwenda kwa internal kubernetes services tofauti.
|
||||
- Mbinu bora zaidi ya security ingekuwa kutumia cloud load balancer au proxy server kama entrypoint ili kusiwe na sehemu yoyote ya Kubernetes cluster iliyofichuliwa.
|
||||
- Request isiyolingana na ingress rule yoyote ikipokelewa, ingress controller itaielekeza kwenye "**Default backend**". Unaweza `describe` ingress controller ili kupata address ya parameter hii.
|
||||
- `minikube addons enable ingress`
|
||||
|
||||
### PKI infrastructure - Certificate Authority CA:
|
||||
|
||||
|
||||
|
||||
- CA ni root ya kuaminika kwa certificates zote ndani ya cluster.
|
||||
- Huwezesha components kuthibitishana.
|
||||
- Certificates zote za cluster husainiwa na CA.
|
||||
- ETCd ina certificate yake.
|
||||
- CA ni root inayoaminika kwa certificates zote ndani ya cluster.
|
||||
- Huruhusu components kuvalidate kila moja kwa nyingine.
|
||||
- Certificates zote za cluster zinasainiwa na CA.
|
||||
- ETCd ina certificate yake yenyewe.
|
||||
- types:
|
||||
- apiserver cert.
|
||||
- kubelet cert.
|
||||
@@ -68,7 +70,7 @@ Wakati pod inapounda data ambayo haipaswi kupotea pod ikitoweka inapaswa kuhifad
|
||||
|
||||
### Minikube
|
||||
|
||||
**Minikube** inaweza kutumika kufanya baadhi ya **quick tests** kwenye kubernetes bila kuhitaji deploy mazingira yote ya kubernetes. Itaendesha **master na node processes kwenye machine moja**. Minikube itatumia virtualbox kuendesha node. Tazama [**hapa jinsi ya kuisakinisha**](https://minikube.sigs.k8s.io/docs/start/).
|
||||
**Minikube** inaweza kutumika kufanya baadhi ya **quick tests** kwenye kubernetes bila kuhitaji deploy ya whole kubernetes environment. Itaendesha **master na node processes kwenye machine moja**. Minikube itatumia virtualbox kuendesha node. Angalia [**hapa jinsi ya kuiinstall**](https://minikube.sigs.k8s.io/docs/start/).
|
||||
```
|
||||
$ minikube start
|
||||
😄 minikube v1.19.0 on Ubuntu 20.04
|
||||
@@ -103,9 +105,9 @@ $ minikube delete
|
||||
🔥 Deleting "minikube" in virtualbox ...
|
||||
💀 Removed all traces of the "minikube" cluster
|
||||
```
|
||||
### Kubectl Basics
|
||||
### Misingi ya Kubectl
|
||||
|
||||
**`Kubectl`** ni command line tool kwa kubernetes clusters. Hucommunicate na Api server ya master process ili kufanya actions katika kubernetes au kuomba data.
|
||||
**`Kubectl`** ni zana ya mstari wa amri kwa ajili ya makundi ya kubernetes. Inawasiliana na Api server ya mchakato wa master ili kutekeleza vitendo ndani ya kubernetes au kuomba data.
|
||||
```bash
|
||||
kubectl version #Get client and server version
|
||||
kubectl get pod
|
||||
@@ -138,7 +140,7 @@ kubectl apply -f deployment.yml
|
||||
```
|
||||
### Minikube Dashboard
|
||||
|
||||
Dashboard hukuwezesha kuona kwa urahisi kile kinachoendeshwa na minikube, unaweza kupata URL ya kuifikia katika:
|
||||
Dashboard hukuwezesha kuona kwa urahisi kinachoendeshwa na minikube, unaweza kupata URL ya kuifikia katika:
|
||||
```
|
||||
minikube dashboard --url
|
||||
|
||||
@@ -151,14 +153,14 @@ minikube dashboard --url
|
||||
🤔 Verifying proxy health ...
|
||||
http://127.0.0.1:50034/api/v1/namespaces/kubernetes-dashboard/services/http:kubernetes-dashboard:/proxy/
|
||||
```
|
||||
### Mifano ya faili za usanidi za YAML
|
||||
### Mifano ya YAML configuration files
|
||||
|
||||
Kila faili ya usanidi ina sehemu 3: **metadata**, **specification** (kinachohitaji kuzinduliwa), **status** (hali inayotakiwa).\
|
||||
Ndani ya specification ya faili ya usanidi ya deployment unaweza kupata template iliyofafanuliwa na structure mpya ya usanidi inayoeleza image ya ku-run:
|
||||
Kila configuration file ina sehemu 3: **metadata**, **specification** (nini kinahitaji kuanzishwa), **status** (state inayotakiwa).\
|
||||
Ndani ya specification ya deployment configuration file unaweza kupata template iliyofafanuliwa na structure mpya ya configuration inayobainisha image ya ku-run:
|
||||
|
||||
**Mfano wa Deployment + Service iliyotangazwa katika faili moja la usanidi (kutoka** [**hapa**](https://gitlab.com/nanuchi/youtube-tutorial-series/-/blob/master/demo-kubernetes-components/mongo.yaml)**)**
|
||||
**Mfano wa Deployment + Service iliyotangazwa kwenye configuration file moja (kutoka** [**hapa**](https://gitlab.com/nanuchi/youtube-tutorial-series/-/blob/master/demo-kubernetes-components/mongo.yaml)**)**
|
||||
|
||||
Kwa kuwa service kawaida huhusiana na deployment moja inawezekana kutangaza zote mbili katika faili moja la usanidi (service iliyotangazwa katika config hii inaweza kufikiwa tu internally):
|
||||
Kwa kawaida service inahusiana na deployment moja, hivyo inawezekana kutangaza zote mbili kwenye configuration file moja (service iliyotangazwa kwenye config hii inapatikana tu internally):
|
||||
```yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
@@ -207,7 +209,7 @@ targetPort: 27017
|
||||
```
|
||||
**Mfano wa external service config**
|
||||
|
||||
Huduma hii itapatikana externally (angalia sifa za `nodePort` na `type: LoadBlancer`):
|
||||
Huduma hii itapatikana nje (kagua sifa za `nodePort` na `type: LoadBlancer`):
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -225,11 +227,11 @@ targetPort: 8081
|
||||
nodePort: 30000
|
||||
```
|
||||
> [!NOTE]
|
||||
> Hii ni muhimu kwa testing lakini kwa production unapaswa kuwa na services za ndani pekee na Ingress ili ku-expose application.
|
||||
> Hii ni muhimu kwa ajili ya kupima lakini kwa production unapaswa kuwa na services za ndani pekee na Ingress ili ku-expose application.
|
||||
|
||||
**Example ya Ingress config file**
|
||||
**Example of Ingress config file**
|
||||
|
||||
Hii ita-expose application katika `http://dashboard.com`.
|
||||
Hii itafanya application ipatikane katika `http://dashboard.com`.
|
||||
```yaml
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
@@ -245,9 +247,9 @@ paths:
|
||||
serviceName: kubernetes-dashboard
|
||||
servicePort: 80
|
||||
```
|
||||
**Mfano wa faili ya secrets config**
|
||||
**Mfano wa faili la secrets config**
|
||||
|
||||
Angalia jinsi password zimekodishwa katika B64 (ambayo si secure!)
|
||||
Angalia jinsi passwords zimekodwa kwa B64 (ambayo si secure!)
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
@@ -260,7 +262,7 @@ mongo-root-password: cGFzc3dvcmQ=
|
||||
```
|
||||
**Mfano wa ConfigMap**
|
||||
|
||||
A **ConfigMap** ni configuration inayotolewa kwa pods ili zijue jinsi ya kutafuta na kufikia services nyingine. Katika kesi hii, kila pod itajua kwamba jina `mongodb-service` ni address ya pod ambayo inaweza kuwasiliana nayo (hii pod itakuwa inaendesha mongodb):
|
||||
A **ConfigMap** ni usanidi unaopewa pods ili zijue jinsi ya kutafuta na kufikia huduma nyingine. Katika kesi hii, kila pod itajua kwamba jina `mongodb-service` ni anwani ya pod ambayo zinaweza kuwasiliana nayo (pod hii itakuwa inaendesha mongodb):
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
@@ -269,7 +271,7 @@ name: mongodb-configmap
|
||||
data:
|
||||
database_url: mongodb-service
|
||||
```
|
||||
Kisha, ndani ya **deployment config** anwani hii inaweza kutajwa kwa njia ifuatayo ili ipakiwe ndani ya env ya pod:
|
||||
Kisha, ndani ya **deployment config** anwani hii inaweza kutajwa kwa njia ifuatayo ili ipakwe ndani ya env ya pod:
|
||||
```yaml
|
||||
[...]
|
||||
spec:
|
||||
@@ -290,16 +292,16 @@ name: mongodb-configmap
|
||||
key: database_url
|
||||
[...]
|
||||
```
|
||||
**Example of volume config**
|
||||
**Mfano wa volume config**
|
||||
|
||||
Unaweza kupata mifano tofauti ya faili za usanidi wa storage yaml katika [https://gitlab.com/nanuchi/youtube-tutorial-series/-/tree/master/kubernetes-volumes](https://gitlab.com/nanuchi/youtube-tutorial-series/-/tree/master/kubernetes-volumes).\
|
||||
**Note that volumes aren't inside namespaces**
|
||||
Unaweza kupata mifano tofauti ya storage configuration yaml files katika [https://gitlab.com/nanuchi/youtube-tutorial-series/-/tree/master/kubernetes-volumes](https://gitlab.com/nanuchi/youtube-tutorial-series/-/tree/master/kubernetes-volumes).\
|
||||
**Kumbuka kwamba volumes hazipo ndani ya namespaces**
|
||||
|
||||
### Namespaces
|
||||
|
||||
Kubernetes inasaidia **multiple virtual clusters** zinazotumia cluster ile ile ya physical. Virtual clusters hizi zinaitwa **namespaces**. Hizi zinalenga kutumika katika mazingira yenye users wengi waliogawanyika katika teams nyingi, au projects. Kwa clusters zenye users wachache hadi kadhaa, huhitaji kuunda au kufikiria kuhusu namespaces kabisa. Unapaswa kuanza kutumia namespaces tu ili kuwa na udhibiti na mpangilio bora wa kila sehemu ya application iliyodeploywa katika kubernetes.
|
||||
Kubernetes inasaidia **multiple virtual clusters** zinazoungwa mkono na cluster ile ile ya physical. Hizi virtual clusters zinaitwa **namespaces**. Hizi zimekusudiwa kutumika katika mazingira yenye users wengi walio katika teams nyingi, au projects. Kwa clusters zenye users wachache hadi kadhaa, huhitaji kuunda au hata kufikiria kuhusu namespaces kabisa. Unapaswa kuanza kutumia namespaces tu ili kuwa na udhibiti na organization bora ya kila sehemu ya application iliyodeploywa katika kubernetes.
|
||||
|
||||
Namespaces hutoa scope kwa majina. Majina ya resources yanahitaji kuwa unique ndani ya namespace, lakini si kati ya namespaces. Namespaces haziwezi kuwekwa ndani ya nyingine kwa nesting, na **kila** Kubernetes **resource** inaweza tu kuwa **katika** **namespace** **moja**.
|
||||
Namespaces hutoa scope kwa names. Majina ya resources yanahitaji kuwa ya kipekee ndani ya namespace, lakini si across namespaces. Namespaces haziwezi kuwekwa kwa kuingizwa moja ndani ya nyingine na **kila** Kubernetes **resource** inaweza kuwa tu **katika** **namespace** moja.
|
||||
|
||||
Kuna namespaces 4 kwa default ikiwa unatumia minikube:
|
||||
```
|
||||
@@ -310,47 +312,47 @@ kube-node-lease Active 1d
|
||||
kube-public Active 1d
|
||||
kube-system Active 1d
|
||||
```
|
||||
- **kube-system**: Haikusudiwi kutumiwa na users na hupaswi kuigusa. Ni ya master na kubectl processes.
|
||||
- **kube-public**: Data inayopatikana publicly. Ina configmap ambayo ina cluster information
|
||||
- **kube-node-lease**: Huamua availability ya node
|
||||
- **default**: namespace ambayo user atatumia ku-create resources
|
||||
- **kube-system**: Haijakusudiwa kwa watumiaji kutumia na hupaswi kuigusa. Ni ya master na michakato ya kubectl.
|
||||
- **kube-public**: Data inayopatikana hadharani. Ina configmap ambayo ina taarifa za cluster
|
||||
- **kube-node-lease**: Huamua upatikanaji wa node
|
||||
- **default**: Namespace ambayo mtumiaji atatumia kuunda resources
|
||||
```bash
|
||||
#Create namespace
|
||||
kubectl create namespace my-namespace
|
||||
```
|
||||
> [!NOTE]
|
||||
> Kumbuka kwamba rasilimali nyingi za Kubernetes (k.m. pods, services, replication controllers, na nyingine) ziko ndani ya namespaces fulani. Hata hivyo, rasilimali nyingine kama namespace resources na low-level resources, kama nodes na persistenVolumes haziko ndani ya namespace. Ili kuona ni rasilimali zipi za Kubernetes ziko na haziko ndani ya namespace:
|
||||
> Kumbuka kwamba rasilimali nyingi za Kubernetes (k.m. pods, services, replication controllers, na zingine) ziko katika some namespaces. Hata hivyo, rasilimali nyingine kama namespace resources na low-level resources, kama vile nodes na persistenVolumes haziko katika namespace. Ili kuona ni rasilimali gani za Kubernetes zilizo na zisizo katika namespace:
|
||||
>
|
||||
> ```bash
|
||||
> kubectl api-resources --namespaced=true #Ndani ya namespace
|
||||
> kubectl api-resources --namespaced=false #Siyo ndani ya namespace
|
||||
> kubectl api-resources --namespaced=true #In a namespace
|
||||
> kubectl api-resources --namespaced=false #Not in a namespace
|
||||
> ```
|
||||
|
||||
Unaweza kuhifadhi namespace kwa amri zote zinazofuata za kubectl katika context hiyo.
|
||||
Unaweza kuhifadhi namespace kwa ajili ya amri zote zinazofuata za kubectl katika context hiyo.
|
||||
```bash
|
||||
kubectl config set-context --current --namespace=<insert-namespace-name-here>
|
||||
```
|
||||
### Helm
|
||||
|
||||
Helm ni **package manager** ya Kubernetes. Inaruhusu kupackaging faili za YAML na kuzisambaza katika public na private repositories. Packages hizi zinaitwa **Helm Charts**.
|
||||
Helm ni **package manager** ya Kubernetes. Huruhusu kupakia faili za YAML na kuzisambaza katika repositories za umma na za faragha. Packages hizi zinaitwa **Helm Charts**.
|
||||
```
|
||||
helm search <keyword>
|
||||
```
|
||||
Helm pia ni template engine inayoruhusu kuzalisha config files kwa variables:
|
||||
Helm is also a template engine that allows to generate config files with variables:
|
||||
|
||||
## Kubernetes secrets
|
||||
|
||||
A **Secret** ni object ambayo **ina data nyeti** kama vile password, token au key. Taarifa kama hizi vinginevyo zingewekwa kwenye Pod specification au ndani ya image. Users wanaweza kucreate Secrets na system pia hucreate Secrets. Jina la object ya Secret lazima liwe **DNS subdomain name** halali. Soma hapa [the official documentation](https://kubernetes.io/docs/concepts/configuration/secret/).
|
||||
A **Secret** is an object that **contains sensitive data** such as a password, a token or a key. Such information might otherwise be put in a Pod specification or in an image. Users can create Secrets and the system also creates Secrets. The name of a Secret object must be a valid **DNS subdomain name**. Read here [the official documentation](https://kubernetes.io/docs/concepts/configuration/secret/).
|
||||
|
||||
Secrets zinaweza kuwa vitu kama:
|
||||
Secrets might be things like:
|
||||
|
||||
- API, SSH Keys.
|
||||
- OAuth tokens.
|
||||
- Credentials, Passwords (plain text au b64 + encryption).
|
||||
- Information au comments.
|
||||
- Credentials, Passwords (plain text or b64 + encryption).
|
||||
- Information or comments.
|
||||
- Database connection code, strings… .
|
||||
|
||||
Kuna different types of secrets katika Kubernetes
|
||||
There are different types of secrets in Kubernetes
|
||||
|
||||
| Builtin Type | Usage |
|
||||
| ----------------------------------- | ----------------------------------------- |
|
||||
@@ -370,7 +372,7 @@ Kuna different types of secrets katika Kubernetes
|
||||
|
||||
|
||||
|
||||
The following configuration file defines a **secret** inayoitwa `mysecret` yenye key-value pairs 2 `username: YWRtaW4=` na `password: MWYyZDFlMmU2N2Rm`. Pia inafafanua **pod** inayoitwa `secretpod` ambayo itakuwa na `username` na `password` zilizoainishwa ndani ya `mysecret` zikionyeshwa katika **environment variables** `SECRET_USERNAME` \_\_ and \_\_ `SECRET_PASSWOR`. Pia itafanya **mount** `username` secret ndani ya `mysecret` katika path `/etc/foo/my-group/my-username` na ruhusa `0640`.
|
||||
The following configuration file defines a **secret** called `mysecret` with 2 key-value pairs `username: YWRtaW4=` and `password: MWYyZDFlMmU2N2Rm`. It also defines a **pod** called `secretpod` that will have the `username` and `password` defined in `mysecret` exposed in the **environment variables** `SECRET_USERNAME` \_\_ and \_\_ `SECRET_PASSWOR`. It will also **mount** the `username` secret inside `mysecret` in the path `/etc/foo/my-group/my-username` with `0640` permissions.
|
||||
```yaml:secretpod.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
@@ -420,19 +422,19 @@ kubectl get pods #Wait until the pod secretpod is running
|
||||
kubectl exec -it secretpod -- bash
|
||||
env | grep SECRET && cat /etc/foo/my-group/my-username && echo
|
||||
```
|
||||
### Siri katika etcd <a href="#discover-secrets-in-etcd" id="discover-secrets-in-etcd"></a>
|
||||
### Siri fiche ndani ya etcd <a href="#discover-secrets-in-etcd" id="discover-secrets-in-etcd"></a>
|
||||
|
||||
**etcd** ni **key-value store** thabiti na yenye upatikanaji wa juu inayotumika kama backing store ya Kubernetes kwa data zote za klasta. Hebu tupate ufikiaji wa secrets zilizohifadhiwa katika etcd:
|
||||
**etcd** ni **key-value store** yenye uthabiti na upatikanaji wa juu inayotumika kama backing store ya Kubernetes kwa data yote ya cluster. Hebu tufikie siri zilizohifadhiwa ndani ya etcd:
|
||||
```bash
|
||||
cat /etc/kubernetes/manifests/kube-apiserver.yaml | grep etcd
|
||||
```
|
||||
Utaona certs, keys na url’s ziko kwenye FS. Ukizipata, utaweza kuunganishwa na etcd.
|
||||
Utaona certs, keys na urls zilipo kwenye FS. Ukizipata, utaweza kuunganika na etcd.
|
||||
```bash
|
||||
#ETCDCTL_API=3 etcdctl --cert <path to client.crt> --key <path to client.ket> --cacert <path to CA.cert> endpoint=[<ip:port>] health
|
||||
|
||||
ETCDCTL_API=3 etcdctl --cert /etc/kubernetes/pki/apiserver-etcd-client.crt --key /etc/kubernetes/pki/apiserver-etcd-client.key --cacert /etc/kubernetes/pki/etcd/etcd/ca.cert endpoint=[127.0.0.1:1234] health
|
||||
```
|
||||
Mara tu unapofanikiwa kuanzisha mawasiliano utaweza kupata secrets:
|
||||
Mara unapofanikiwa kuanzisha mawasiliano utaweza kupata secrets:
|
||||
```bash
|
||||
#ETCDCTL_API=3 etcdctl --cert <path to client.crt> --key <path to client.ket> --cacert <path to CA.cert> endpoint=[<ip:port>] get <path/to/secret>
|
||||
|
||||
@@ -440,7 +442,7 @@ ETCDCTL_API=3 etcdctl --cert /etc/kubernetes/pki/apiserver-etcd-client.crt --key
|
||||
```
|
||||
**Kuongeza encryption kwenye ETCD**
|
||||
|
||||
Kwa chaguo-msingi, siri zote huhifadhiwa katika maandishi ya kawaida ndani ya etcd isipokuwa utumie layer ya encryption. Mfano ufuatao unategemea [https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/)
|
||||
Kwa chaguo-msingi, secrets zote huhifadhiwa katika maandishi ya kawaida ndani ya etcd isipokuwa utumie encryption layer. Mfano ufuatao unategemea [https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/)
|
||||
```yaml:encryption.yaml
|
||||
apiVersion: apiserver.config.k8s.io/v1
|
||||
kind: EncryptionConfiguration
|
||||
@@ -454,31 +456,31 @@ keys:
|
||||
secret: cjjPMcWpTPKhAdieVtd+KhG4NN+N6e3NmBPMXJvbfrY= #Any random key
|
||||
- identity: {}
|
||||
```
|
||||
Baada ya hapo, unahitaji kuweka bendera ya `--encryption-provider-config` kwenye `kube-apiserver` ili ielekeze kwenye eneo la faili la config lililoundwa. Unaweza kurekebisha `/etc/kubernetes/manifest/kube-apiserver.yaml` na kuongeza mistari ifuatayo:
|
||||
Baada ya hapo, unahitaji kuweka bendera ya `--encryption-provider-config` kwenye `kube-apiserver` ili ielekeze kwenye eneo la faili ya config iliyoundwa. Unaweza kurekebisha `/etc/kubernetes/manifest/kube-apiserver.yaml` na kuongeza mistari ifuatayo:
|
||||
```yaml
|
||||
containers:
|
||||
- command:
|
||||
- kube-apiserver
|
||||
- --encriyption-provider-config=/etc/kubernetes/etcd/<configFile.yaml>
|
||||
```
|
||||
Tembea chini katika volumeMounts:
|
||||
Sogeza chini katika volumeMounts:
|
||||
```yaml
|
||||
- mountPath: /etc/kubernetes/etcd
|
||||
name: etcd
|
||||
readOnly: true
|
||||
```
|
||||
Sogeza chini katika volumeMounts hadi hostPath:
|
||||
Tembea chini katika volumeMounts hadi hostPath:
|
||||
```yaml
|
||||
- hostPath:
|
||||
path: /etc/kubernetes/etcd
|
||||
type: DirectoryOrCreate
|
||||
name: etcd
|
||||
```
|
||||
**Kuhakikisha kwamba data imefichwa kwa encryption**
|
||||
**Kuthibitisha kwamba data imecryptwa**
|
||||
|
||||
Data imefichwa kwa encryption wakati inaandikwa kwenye etcd. Baada ya kuanzisha upya `kube-apiserver` yako, secret yoyote mpya iliyoundwa au iliyosasishwa inapaswa kufichwa kwa encryption inapohifadhiwa. Ili kuangalia, unaweza kutumia programu ya mstari wa amri `etcdctl` kupata maudhui ya secret yako.
|
||||
Data imecryptwa inapowekwa kwenye etcd. Baada ya kuwasha upya `kube-apiserver` yako, secret yoyote mpya iliyoundwa au kusasishwa inapaswa kuwa imecryptwa inapohifadhiwa. Ili kuangalia, unaweza kutumia programu ya mstari wa amri `etcdctl` kupata yaliyomo ya secret yako.
|
||||
|
||||
1. Tengeneza secret mpya inayoitwa `secret1` kwenye namespace `default`:
|
||||
1. Unda secret mpya inayoitwa `secret1` katika namespace `default`:
|
||||
|
||||
```
|
||||
kubectl create secret generic secret1 -n default --from-literal=mykey=mydata
|
||||
@@ -488,29 +490,29 @@ kubectl create secret generic secret1 -n default --from-literal=mykey=mydata
|
||||
|
||||
`ETCDCTL_API=3 etcdctl get /registry/secrets/default/secret1 [...] | hexdump -C`
|
||||
|
||||
ambapo `[...]` lazima iwe arguments za ziada za kuunganishwa na etcd server.
|
||||
ambapo `[...]` lazima iwe hoja za ziada za kuunganisha na server ya etcd.
|
||||
|
||||
3. Thibitisha secret iliyohifadhiwa ina kiambishi `k8s:enc:aescbc:v1:` ambacho kinaonyesha provider `aescbc` imeficha data iliyotokana kwa encryption.
|
||||
4. Thibitisha secret imesimbuliwa kwa usahihi inapopatikana kupitia API:
|
||||
3. Hakikisha secret iliyohifadhiwa ina kiambishi awali `k8s:enc:aescbc:v1:` ambacho kinaonyesha provider `aescbc` amecrypt data iliyotokana.
|
||||
4. Hakikisha secret imedecryptwa ipasavyo inapopatikana kupitia API:
|
||||
|
||||
```
|
||||
kubectl describe secret secret1 -n default
|
||||
```
|
||||
|
||||
inapaswa kuendana na `mykey: bXlkYXRh`, mydata imekodishwa, angalia [decoding a secret](https://kubernetes.io/docs/concepts/configuration/secret#decoding-a-secret) ili ku-decode secret kikamilifu.
|
||||
inapaswa kufanana na `mykey: bXlkYXRh`, mydata imeencoded, angalia [decoding a secret](https://kubernetes.io/docs/concepts/configuration/secret#decoding-a-secret) ili ku-decode kabisa secret.
|
||||
|
||||
**Kwa kuwa secrets hufichwa kwa encryption wakati wa kuandika, kufanya update kwenye secret kutaficha content hiyo:**
|
||||
**Kwa kuwa secrets hucryptwa wakati wa kuandika, kufanya update kwenye secret kutacrypt content hiyo:**
|
||||
```
|
||||
kubectl get secrets --all-namespaces -o json | kubectl replace -f -
|
||||
```
|
||||
**Vidokezo vya mwisho:**
|
||||
|
||||
- Jaribu kutohifadhi secrets kwenye FS, zipate kutoka sehemu nyingine.
|
||||
- Jaribu kutohifadhi secrets ndani ya FS, zipate kutoka sehemu zingine.
|
||||
- Angalia [https://www.vaultproject.io/](https://www.vaultproject.io) kwa kuongeza ulinzi zaidi kwa secrets zako.
|
||||
- [https://kubernetes.io/docs/concepts/configuration/secret/#risks](https://kubernetes.io/docs/concepts/configuration/secret/#risks)
|
||||
- [https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-DAP/11.2/en/Content/Integrations/Kubernetes_deployApplicationsConjur-k8s-Secrets.htm](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-DAP/11.2/en/Content/Integrations/Kubernetes_deployApplicationsConjur-k8s-Secrets.htm)
|
||||
|
||||
## Marejeo
|
||||
## References
|
||||
|
||||
{{#ref}}
|
||||
https://sickrov.github.io/
|
||||
@@ -520,4 +522,12 @@ https://sickrov.github.io/
|
||||
https://www.youtube.com/watch?v=X48VuDVv0do
|
||||
{{#endref}}
|
||||
|
||||
{{#ref}}
|
||||
https://kubernetes.io/docs/concepts/storage/volumes/#image
|
||||
{{#endref}}
|
||||
|
||||
{{#ref}}
|
||||
https://kubernetes.io/docs/tasks/configure-pod-container/image-volumes/
|
||||
{{#endref}}
|
||||
|
||||
{{#include ../../banners/hacktricks-training.md}}
|
||||
|
||||
+43
-37
@@ -4,81 +4,87 @@
|
||||
|
||||
## PodSecurityContext <a href="#podsecuritycontext-v1-core" id="podsecuritycontext-v1-core"></a>
|
||||
|
||||
[**Kutoka kwenye docs:**](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core)
|
||||
[**Kutoka kwa docs:**](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core)
|
||||
|
||||
Unapobainisha security context ya Pod unaweza kutumia sifa kadhaa. Kwa mtazamo wa ulinzi wa usalama unapaswa kuzingatia:
|
||||
Unapobainisha security context ya Pod unaweza kutumia sifa kadhaa. Kutoka kwa mtazamo wa defensive security unapaswa kuzingatia:
|
||||
|
||||
- Kuwa na **runASNonRoot** kama **True**
|
||||
- Kuweka **runASNonRoot** kuwa **True**
|
||||
- Kusanidi **runAsUser**
|
||||
- Ikiwezekana, zingatia **kuzuia** **permissions** kwa kuonyesha **seLinuxOptions** na **seccompProfile**
|
||||
- Usitoe ufikiaji wa **privilege** wa **group** kupitia **runAsGroup** na **supplementaryGroups**
|
||||
- Usipe ufikiaji wa **privilege** wa **group** kupitia **runAsGroup** na **supplementaryGroups**
|
||||
|
||||
| Parameter | Description |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>fsGroup</strong></a><br><em>integer</em></p> | <p>Group maalum ya ziada ambayo inatumika kwa <strong>containers zote katika pod</strong>. Aina fulani za volume huruhusu Kubelet <strong>kubadilisha ownership ya volume hiyo</strong> ili iwe owned na pod:<br>1. Owning GID itakuwa FSGroup<br>2. Setgid bit huwekwa (files mpya zinazoundwa katika volume zitakuwa owned na FSGroup)<br>3. Permission bits huunganishwa kwa OR na rw-rw---- Iwapo haijawekwa, Kubelet haitabadilisha ownership na permissions za volume yoyote</p> |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>fsGroup</strong></a><br><em>integer</em></p> | <p>Kikundi maalum cha ziada kinachotumika kwa <strong>all containers in a pod</strong>. Baadhi ya aina za volume huruhusu Kubelet <strong>kubadilisha ownership ya volume hiyo</strong> iwe inamilikiwa na pod:<br>1. GID inayomiliki itakuwa FSGroup<br>2. Biti ya setgid huwekwa (faili mpya zinazoundwa kwenye volume zitamilikiwa na FSGroup)<br>3. Biti za permission huwekwa kwa OR pamoja na rw-rw---- Iwapo haijawekwa, Kubelet haitabadilisha ownership na permissions za volume yoyote</p> |
|
||||
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>fsGroupChangePolicy</strong></a><br><em>string</em></p> | Hii inafafanua tabia ya **kubadilisha ownership na permission za volume** kabla ya kuonyeshwa ndani ya Pod. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>runAsGroup</strong></a><br><em>integer</em></p> | **GID ya kuendesha entrypoint ya mchakato wa container**. Hutumia runtime default ikiwa haijawekwa. Pia inaweza kuwekwa katika SecurityContext. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>runAsNonRoot</strong></a><br><em>boolean</em></p> | Inaonyesha kwamba container lazima iendeshe kama user asiye root. Ikiwa ni true, Kubelet itathibitisha image wakati wa runtime ili kuhakikisha kwamba haiendeshi kama UID 0 (root) na itashindwa kuanzisha container ikiwa inafanya hivyo. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>runAsUser</strong></a><br><em>integer</em></p> | **UID ya kuendesha entrypoint ya mchakato wa container**. Kwa chaguo-msingi hutumia user aliyeainishwa kwenye image metadata ikiwa haijabainishwa. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>seLinuxOptions</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#selinuxoptions-v1-core"><em>SELinuxOptions</em></a><br><em>More info about</em> <em><strong>seLinux</strong></em></p> | **SELinux context itakayotumika kwa containers zote**. Ikiwa haijabainishwa, container runtime itagawa random SELinux context kwa kila container. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>seccompProfile</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#seccompprofile-v1-core"><em>SeccompProfile</em></a><br><em>More info about</em> <em><strong>Seccomp</strong></em></p> | Chaguo za **seccomp za kutumia na containers** katika pod hii. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>fsGroupChangePolicy</strong></a><br><em>string</em></p> | Hii inafafanua tabia ya **kubadilisha ownership na permission ya volume** kabla ya kuonyeshwa ndani ya Pod. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>runAsGroup</strong></a><br><em>integer</em></p> | **GID ya kuendesha entrypoint ya mchakato wa container**. Hutumia default ya runtime ikiwa haijawekwa. Pia inaweza kuwekwa kwenye SecurityContext. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>runAsNonRoot</strong></a><br><em>boolean</em></p> | Inaonyesha kwamba container lazima iendeshwe kama mtumiaji asiye root. Ikiwa ni true, Kubelet itathibitisha image wakati wa runtime ili kuhakikisha kuwa haiendeshwi kama UID 0 (root) na itashindwa kuanzisha container ikiwa inafanya hivyo. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>runAsUser</strong></a><br><em>integer</em></p> | **UID ya kuendesha entrypoint ya mchakato wa container**. Hutumia default ya mtumiaji aliyeainishwa kwenye metadata ya image ikiwa haijaainishwa. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>seLinuxOptions</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#selinuxoptions-v1-core"><em>SELinuxOptions</em></a><br><em>More info about</em> <em><strong>seLinux</strong></em></p> | The **SELinux context to be applied to all containers**. Iwapo haijaainishwa, container runtime itagawa SELinux context ya nasibu kwa kila container. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>seccompProfile</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#seccompprofile-v1-core"><em>SeccompProfile</em></a><br><em>More info about</em> <em><strong>Seccomp</strong></em></p> | The **seccomp options to use by the containers** in this pod. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>supplementalGroups</strong></a><br><em>integer array</em></p> | Orodha ya **groups zinazotumika kwa process ya kwanza inayoendeshwa katika kila container**, pamoja na primary GID ya container. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>sysctls</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#sysctl-v1-core"><em>Sysctl</em></a> <em>array</em><br><em>More info about</em> <a href="https://www.garron.me/en/go2linux/sysctl-linux.html"><em><strong>sysctls</strong></em></a></p> | Sysctls huhifadhi orodha ya **namespaced sysctls zinazotumika kwa pod**. Pods zenye sysctls ambazo hazitumiki (na container runtime) zinaweza kushindwa kuanza. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>windowsOptions</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#windowssecuritycontextoptions-v1-core"><em>WindowsSecurityContextOptions</em></a></p> | Settings maalum za Windows zinazotumika kwa containers zote. Ikiwa haijabainishwa, options ndani ya SecurityContext ya container zitatumika. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>sysctls</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#sysctl-v1-core"><em>Sysctl</em></a> <em>array</em><br><em>More info about</em> <a href="https://www.garron.me/en/go2linux/sysctl-linux.html"><em><strong>sysctls</strong></em></a></p> | Sysctls zinahifadhi orodha ya **namespaced sysctls used for the pod**. Pods zilizo na unsupported sysctls (na container runtime) zinaweza kushindwa kuanzishwa. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>windowsOptions</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#windowssecuritycontextoptions-v1-core"><em>WindowsSecurityContextOptions</em></a></p> | The Windows specific settings applied to all containers. Iwapo haijaainishwa, options zilizo ndani ya SecurityContext ya container zitatumika. |
|
||||
|
||||
## SecurityContext
|
||||
|
||||
[**Kutoka kwenye docs:**](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core)
|
||||
[**Kutoka kwa docs:**](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core)
|
||||
|
||||
Context hii huwekwa ndani ya **container definitions**. Kwa mtazamo wa ulinzi wa usalama unapaswa kuzingatia:
|
||||
Konteksti hii huwekwa ndani ya **container definitions**. Kutoka kwa mtazamo wa defensive security unapaswa kuzingatia:
|
||||
|
||||
- **allowPrivilegeEscalation** kuwa **False**
|
||||
- Usiongeze **capabilities** nyeti (na ondoa zile zisizohitajika)
|
||||
- Usiongeze **capabilities** nyeti (na ondoa zile usizohitaji)
|
||||
- **privileged** kuwa **False**
|
||||
- Ikiwezekana, weka **readOnlyFilesystem** kama **True**
|
||||
- Ikiwezekana, weka **readOnlyFilesystem** kuwa **True**
|
||||
- Weka **runAsNonRoot** kuwa **True** na weka **runAsUser**
|
||||
- Ikiwezekana, zingatia **kuzuia** **permissions** kwa kuonyesha **seLinuxOptions** na **seccompProfile**
|
||||
- Usitoe ufikiaji wa **privilege** wa **group** kupitia **runAsGroup.**
|
||||
- Usipe ufikiaji wa **privilege** wa **group** kupitia **runAsGroup.**
|
||||
|
||||
Kumbuka kwamba sifa zilizowekwa katika **SecurityContext na PodSecurityContext** zote mbili, thamani iliyobainishwa katika **SecurityContext** ndiyo yenye **precedence**.
|
||||
Kumbuka kuwa sifa zilizowekwa kwenye **SecurityContext na PodSecurityContext** zote mbili, thamani iliyobainishwa kwenye **SecurityContext** ndiyo inayochukua **precedence**.
|
||||
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>allowPrivilegeEscalation</strong></a><br><em>boolean</em></p> | **AllowPrivilegeEscalation** hudhibiti kama process inaweza **kupata privileges zaidi** kuliko parent process yake. Bool hii hudhibiti moja kwa moja ikiwa no_new_privs flag itawekwa kwenye mchakato wa container. AllowPrivilegeEscalation huwa true kila mara wakati container inaendeshwa kama **Privileged** au ina **CAP_SYS_ADMIN** |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>allowPrivilegeEscalation</strong></a><br><em>boolean</em></p> | **AllowPrivilegeEscalation** hudhibiti kama process inaweza **kupata privileges zaidi** kuliko parent process yake. Hii bool hudhibiti moja kwa moja kama no_new_privs flag itawekwa kwenye container process. AllowPrivilegeEscalation huwa true kila wakati container inapoendeshwa kama **Privileged** au ina **CAP_SYS_ADMIN** |
|
||||
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>capabilities</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#capabilities-v1-core"><em>Capabilities</em></a><br><em>More info about</em> <em><strong>Capabilities</strong></em></p> | **Capabilities za kuongeza/kuondoa wakati wa kuendesha containers**. Kwa chaguo-msingi hutumia seti ya default ya capabilities. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>privileged</strong></a><br><em>boolean</em></p> | Endesha container katika privileged mode. Processes ndani ya privileged containers kimsingi ni **sawa na root kwenye host**. Kwa chaguo-msingi ni false. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>procMount</strong></a><br><em>string</em></p> | procMount inaashiria **aina ya proc mount ya kutumia kwa containers**. Default ni DefaultProcMount ambayo hutumia container runtime defaults kwa readonly paths na masked paths. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>readOnlyRootFilesystem</strong></a><br><em>boolean</em></p> | Je, **container hii ina read-only root filesystem**. Default ni false. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>runAsGroup</strong></a><br><em>integer</em></p> | **GID ya kuendesha entrypoint** ya mchakato wa container. Hutumia runtime default ikiwa haijawekwa. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>runAsNonRoot</strong></a><br><em>boolean</em></p> | Inaonyesha kwamba container lazima **iendeshe kama user asiye root**. Ikiwa ni true, Kubelet itathibitisha image wakati wa runtime ili kuhakikisha kwamba haiendeshi kama UID 0 (root) na itashindwa kuanzisha container ikiwa inafanya hivyo. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>runAsUser</strong></a><br><em>integer</em></p> | **UID ya kuendesha entrypoint** ya mchakato wa container. Kwa chaguo-msingi hutumia user aliyeainishwa kwenye image metadata ikiwa haijabainishwa. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>seLinuxOptions</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#selinuxoptions-v1-core"><em>SELinuxOptions</em></a><br><em>More info about</em> <em><strong>seLinux</strong></em></p> | **SELinux context itakayotumika kwa container**. Ikiwa haijabainishwa, container runtime itagawa random SELinux context kwa kila container. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>seccompProfile</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#seccompprofile-v1-core"><em>SeccompProfile</em></a></p> | **Chaguo za seccomp** za kutumia na container hii. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>windowsOptions</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#windowssecuritycontextoptions-v1-core"><em>WindowsSecurityContextOptions</em></a></p> | **Settings maalum za Windows** zinazotumika kwa containers zote. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>capabilities</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#capabilities-v1-core"><em>Capabilities</em></a><br><em>More info about</em> <em><strong>Capabilities</strong></em></p> | **capabilities za kuongeza/kupunguza wakati wa kuendesha containers**. Default ni seti ya capabilities ya default. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>privileged</strong></a><br><em>boolean</em></p> | Endesha container katika privileged mode. Processes ndani ya privileged containers kimsingi ni **sawa na root kwenye host**. Default ni false. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>procMount</strong></a><br><em>string</em></p> | procMount inaonyesha **aina ya proc mount ya kutumia kwa containers**. Default ni DefaultProcMount ambayo hutumia defaults za container runtime kwa readonly paths na masked paths. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>readOnlyRootFilesystem</strong></a><br><em>boolean</em></p> | Iwapo container hii ina read-only root filesystem. Default ni false. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>runAsGroup</strong></a><br><em>integer</em></p> | **GID ya kuendesha entrypoint** ya mchakato wa container. Hutumia default ya runtime ikiwa haijawekwa. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>runAsNonRoot</strong></a><br><em>boolean</em></p> | Inaonyesha kwamba container lazima **iendeshe kama mtumiaji asiye root**. Ikiwa ni true, Kubelet itathibitisha image wakati wa runtime ili kuhakikisha kuwa haiendeshwi kama UID 0 (root) na itashindwa kuanzisha container ikiwa inafanya hivyo. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>runAsUser</strong></a><br><em>integer</em></p> | **UID ya kuendesha entrypoint** ya mchakato wa container. Hutumia default ya mtumiaji aliyeainishwa kwenye metadata ya image ikiwa haijaainishwa. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>seLinuxOptions</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#selinuxoptions-v1-core"><em>SELinuxOptions</em></a><br><em>More info about</em> <em><strong>seLinux</strong></em></p> | The **SELinux context to be applied to the container**. Iwapo haijaainishwa, container runtime itagawa SELinux context ya nasibu kwa kila container. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>seccompProfile</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#seccompprofile-v1-core"><em>SeccompProfile</em></a></p> | The **seccomp options** to use by this container. |
|
||||
| <p><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>windowsOptions</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#windowssecuritycontextoptions-v1-core"><em>WindowsSecurityContextOptions</em></a></p> | The **Windows specific settings** applied to all containers. |
|
||||
|
||||
## Practical workload review checklist
|
||||
|
||||
Unapokagua Pod au workload template, chunguza `spec.securityContext` na kila `securityContext` ya kiwango cha container chini ya `containers`, `initContainers`, na `ephemeralContainers`. Fields za kiwango cha container zinaweza kubatilisha defaults za kiwango cha pod, kwa hiyo pod inayoonekana salama kwa default haihakikishi kwamba kila container ni salama.
|
||||
Unapokagua Pod au template ya workload, kagua `spec.securityContext` na kila `securityContext` ya kiwango cha container chini ya `containers`, `initContainers`, na `ephemeralContainers`. Sehemu za kiwango cha container zinaweza kubatilisha defaults za kiwango cha pod, hivyo pod inayoonekana salama kwa default haihakikishi kwamba kila container ni salama.
|
||||
|
||||
Mchanganyiko wa hatari kubwa unaopaswa kupewa kipaumbele:
|
||||
|
||||
- `privileged: true`, hasa pamoja na `hostPID`, `hostIPC`, `hostNetwork`, `hostPath`, host ports, au runtime socket mounts.
|
||||
- Capabilities zilizoongezwa kama `SYS_ADMIN`, `NET_ADMIN`, `SYS_PTRACE`, `SYS_MODULE`, `DAC_READ_SEARCH`, au `DAC_OVERRIDE`.
|
||||
- `allowPrivilegeEscalation: true` au haijawekwa katika containers zinazoweza kuendesha code inayodhibitiwa na attacker.
|
||||
- `seccompProfile: Unconfined`, `procMount: Unmasked`, au profiles za runtime zinazokosekana kwenye workloads nyeti.
|
||||
- Writable root filesystems au broad writable volume mounts katika workloads zinazoshughulikia input isiyoaminika.
|
||||
- Kukosekana kwa CPU, memory, au ephemeral-storage requests na limits katika namespaces za multi-tenant.
|
||||
- `allowPrivilegeEscalation: true` au haijawekwa kwenye containers zinazoweza kuendesha code inayodhibitiwa na attacker.
|
||||
- `seccompProfile: Unconfined`, `procMount: Unmasked`, au kukosa runtime profiles kwenye workloads nyeti.
|
||||
- Writable root filesystems au broad writable volume mounts kwenye workloads zinazochakata input isiyoaminika.
|
||||
- Kukosa CPU, memory, au ephemeral-storage requests na limits kwenye namespaces za multi-tenant.
|
||||
- Kukosa au kuwa na `spec.resources` budgets zisizo za kweli za kiwango cha pod, na principals wenye `patch` au `update` kwenye subresource ya Pod `resize`, kwa sababu clusters zinazosaidiwa zinaweza kubadilisha running CPU na memory desired state bila kuunda upya Pod.
|
||||
|
||||
Kwa kazi nyingi za application, baseline nzuri ni kuendesha kama non-root UID, kuweka `runAsNonRoot: true`, kuweka `allowPrivilegeEscalation: false`, kuondoa capabilities zote na kurudisha tu zile chache zinazohitajika, kutumia `seccompProfile: RuntimeDefault`, kupendelea read-only root filesystem, na kuepuka host namespaces, hostPath mounts, na privileged mode.
|
||||
Resource controls si sehemu ya `securityContext`, lakini zikague katika pass hiyo hiyo ya workload kwa sababu zinafafanua availability boundary. Kubernetes ya kisasa inaweza kufafanua CPU, memory, na hugepage budgets katika kiwango cha Pod chini ya `spec.resources` pamoja na `resources` ya kiwango cha container. Pod yenye sidecars inaweza kufungwa na aggregate Pod envelope hata wakati container moja haina limits za kibinafsi, huku local ephemeral storage bado ikihitaji `ephemeral-storage` limits tofauti, `emptyDir.sizeLimit`, LimitRanges, na ResourceQuotas. Pia linganisha desired resources kwenye Pod spec na `status.containerStatuses[].resources` baada ya ombi la in-place resize; resize iliyoshindwa au inayosubiri inaweza kuacha thamani iliyoombwa kwenye `spec` wakati kubelet inaendelea na allocation ya awali ya runtime na kuripoti condition ya `PodResizePending`.
|
||||
|
||||
Katika kiwango cha cluster, tumia labels za namespace za [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) ili kutekeleza [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) za Kubernetes pale inapowezekana. Tumia `restricted` kwa namespaces zinazoweza kuihimili, angalau `baseline` kwa ordinary application namespaces, na weka privileged exceptions ziwe nyembamba, zilizoandikwa, na zilizotengwa kwa trusted platform namespaces au node pools.
|
||||
Kwa workloads nyingi za application, baseline nzuri ni kuendesha kama non-root UID, kuweka `runAsNonRoot: true`, kuweka `allowPrivilegeEscalation: false`, kuondoa capabilities zote na kurudisha tu zile chache zinazohitajika, kutumia `seccompProfile: RuntimeDefault`, kupendelea read-only root filesystem, na kuepuka host namespaces, hostPath mounts, na privileged mode.
|
||||
|
||||
Katika kiwango cha cluster, tumia labels za namespace za [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) kutekeleza Kubernetes [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) inapowezekana. Tumia `restricted` kwa namespaces zinazoweza kuihimili, angalau `baseline` kwa ordinary application namespaces, na weka exceptions za privileged ziwe finyu, zenye dokumenti, na zilizo pekee kwa trusted platform namespaces au node pools.
|
||||
|
||||
## References
|
||||
|
||||
- [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core)
|
||||
- [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core)
|
||||
- [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
|
||||
- [https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
|
||||
- [https://kubernetes.io/docs/concepts/security/linux-kernel-security-constraints/](https://kubernetes.io/docs/concepts/security/linux-kernel-security-constraints/)
|
||||
- [https://kubernetes.io/docs/concepts/security/pod-security-standards/](https://kubernetes.io/docs/concepts/security/pod-security-standards/)
|
||||
- [https://kubernetes.io/docs/concepts/security/pod-security-admission/](https://kubernetes.io/docs/concepts/security/pod-security-admission/)
|
||||
- [https://kubernetes.io/docs/tasks/configure-pod-container/assign-pod-level-resources/](https://kubernetes.io/docs/tasks/configure-pod-container/assign-pod-level-resources/)
|
||||
- [https://kubernetes.io/docs/tasks/configure-pod-container/resize-container-resources/](https://kubernetes.io/docs/tasks/configure-pod-container/resize-container-resources/)
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
Reference in New Issue
Block a user