基于角色的访问控制（RBAC）在K8s自托管代理中的实施

Kubernetes的RBAC系统通过定义角色（Role/ClusterRole）和绑定（RoleBinding/ClusterRoleBinding）实现细粒度权限控制。在自托管代理场景中，需确保代理服务仅具备必要权限。

创建最小权限角色

为代理服务创建专用角色，限定其操作范围。例如，仅允许读取特定命名空间的资源：

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: proxy-ns
  name: proxy-reader
rules:
- apiGroups: [""]
  resources: ["pods", "services"]
  verbs: ["get", "list", "watch"]

服务账户与角色绑定

创建专用服务账户并绑定角色，避免使用default账户：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: proxy-agent
  namespace: proxy-ns
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: proxy-binding
  namespace: proxy-ns
subjects:
- kind: ServiceAccount
  name: proxy-agent
  namespace: proxy-ns
roleRef:
  kind: Role
  name: proxy-reader
  apiGroup: rbac.authorization.k8s.io

网络策略隔离

结合NetworkPolicy限制代理服务的网络访问范围：

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: proxy-network-policy
  namespace: proxy-ns
spec:
  podSelector:
    matchLabels:
      app: proxy-agent
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: allowed-ns
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24

定期审计权限

通过kubectl命令检查权限使用情况：

kubectl auth can-i --list --as=system:serviceaccount:proxy-ns:proxy-agent

使用准入控制器增强

启用PodSecurityPolicy或OPA/Gatekeeper等准入控制器，防止权限提升：

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: proxy-psp
spec:
  privileged: false
  allowPrivilegeEscalation: false
  runAsUser:
    rule: MustRunAsNonRoot
  volumes:
  - configMap
  - emptyDir