Pod Security — 컨테이너 실행 권한을 제한하는 방법

spec:
  containers:
    - name: app
      image: my-app:1.0
      securityContext:
        runAsNonRoot: true                # root 실행 거부
        runAsUser: 1000                   # UID 1000으로 실행
        runAsGroup: 1000                  # GID 1000으로 실행
        readOnlyRootFilesystem: true      # 루트 파일시스템 읽기 전용
        allowPrivilegeEscalation: false   # 권한 상승 차단
        capabilities:
          drop:
            - ALL                          # 모든 리눅스 capability 제거
          add:
            - NET_BIND_SERVICE             # 필요한 것만 추가

spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000               # 볼륨의 파일 그룹 소유권
    seccompProfile:
      type: RuntimeDefault      # seccomp 프로파일 적용

# 보안 강화된 Pod 예제
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: my-app:1.0
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]

      volumeMounts:
        - name: tmp
          mountPath: /tmp       # 쓰기 필요한 경로만 emptyDir로
        - name: cache
          mountPath: /app/cache
  volumes:
    - name: tmp
      emptyDir: {}
    - name: cache
      emptyDir: {}

# 네임스페이스에 PSA 레이블 추가
kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/audit=restricted \
  pod-security.kubernetes.io/warn=restricted

# 네임스페이스에 직접 설정
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

# Gatekeeper 설치
kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/v3.15.0/deploy/gatekeeper.yaml

# ConstraintTemplate — 정책 템플릿 정의
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sallowedrepos
spec:
  crd:
    spec:
      names:
        kind: K8sAllowedRepos
      validation:
        openAPIV3Schema:
          type: object

          properties:
            repos:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sallowedrepos
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not startswith(container.image, input.parameters.repos[_])
          msg := sprintf("이미지 '%v'는 허용된 레지스트리가 아닙니다", [container.image])
        }

---
# Constraint — 정책 적용
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
  name: allowed-repos
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["production"]
  parameters:
    repos:
      - "myregistry.io/"
      - "docker.io/library/"

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-team-label
      match:
        any:
          - resources:
              kinds: ["Deployment"]
      validate:
        message: "team 레이블이 필요합니다"
        pattern:
          metadata:
            labels:
              team: "?*"

# 프로덕션 워크로드 보안 체크리스트
spec:
  serviceAccountName: dedicated-sa         # 전용 ServiceAccount
  automountServiceAccountToken: false      # 불필요한 API 토큰 마운트 차단
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault

  containers:
    - name: app
      image: myregistry.io/app:v1.2.3     # latest 태그 사용 금지
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
      resources:
        requests:
          cpu: 200m
          memory: 256Mi
        limits:
          memory: 512Mi