Kubernetes 密碼管理的最佳實踐與未來趨勢

# 新增 HashiCorp 的 Helm Repository
helm repo add hashicorp https://helm.releases.hashicorp.com

# 更新 Helm Repository 索引
helm repo update

# 安裝 Vault,啟用 Vault Agent Injector
helm install vault hashicorp/vault \
  --set "server.ha.enabled=true" \
  --set "server.ha.replicas=3" \
  --set "injector.enabled=true" \
  --set "ui.enabled=true"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-application
  labels:
    app: web
spec:
  replicas: 2
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
      annotations:
        # 啟用 Vault Agent Injector
        vault.hashicorp.com/agent-inject: "true"
        # 指定 Vault 角色
        vault.hashicorp.com/role: "web-app"
        # 定義要注入的密碼路徑與檔案名稱
        vault.hashicorp.com/agent-inject-secret-database: "database/creds/web-app-role"
        # 指定密碼注入後的檔案路徑
        vault.hashicorp.com/agent-inject-file-database: "db-credentials.txt"
        # 設定密碼的範本格式
        vault.hashicorp.com/agent-inject-template-database: |
          {{- with secret "database/creds/web-app-role" -}}
          username: {{ .Data.username }}
          password: {{ .Data.password }}
          {{- end }}
    spec:
      serviceAccountName: web-app
      containers:
      - name: web
        image: nginx:latest
        ports:
        - containerPort: 80
        # 應用程式從 /vault/secrets/ 路徑讀取密碼檔案
        volumeMounts:
        - name: secrets
          mountPath: /vault/secrets
          readOnly: true
      volumes:
      - name: secrets
        emptyDir: {}

# 建立 Vault 策略檔案
cat > web-app-policy.hcl <<EOF
# 允許讀取資料庫動態憑證
path "database/creds/web-app-role" {
  capabilities = ["read"]
}

# 允許更新憑證租期
path "sys/leases/renew" {
  capabilities = ["update"]
}
EOF

# 將策略寫入 Vault
vault policy write web-app web-app-policy.hcl

# 建立 Kubernetes 認證角色,綁定策略與 ServiceAccount
vault write auth/kubernetes/role/web-app \
  bound_service_account_names=web-app \
  bound_service_account_namespaces=default \
  policies=web-app \
  ttl=24h \
  max_ttl=72h

# 啟用資料庫引擎
vault secrets enable database

# 配置 PostgreSQL 連線
vault write database/config/postgresql \
  plugin_name=postgresql-database-plugin \
  allowed_roles="web-app-role" \
  connection_url="postgresql://{{username}}:{{password}}@postgres.default.svc.cluster.local:5432/myapp?sslmode=require" \
  username="vault-admin" \
  password="secure-password"

# 建立資料庫角色,定義動態憑證的權限
vault write database/roles/web-app-role \
  db_name=postgresql \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
  default_ttl="1h" \
  max_ttl="24h"

# 建立 Conjur 專用的 Namespace
kubectl create namespace conjur

# 部署 Conjur Follower(用於 Kubernetes 叢集內的密碼分發)
kubectl apply -f conjur-follower-deployment.yaml

# 配置 Conjur Authenticator
kubectl apply -f conjur-authenticator-configmap.yaml

# Conjur 策略定義
- !policy
  id: kubernetes-cluster
  body:
    # 定義應用程式身份
    - !host
      id: web-application
      annotations:
        kubernetes/namespace: default
        kubernetes/service-account: web-app
        kubernetes/authentication-container-name: authenticator
    
    # 定義密碼變數
    - !variable
      id: database/username
    
    - !variable
      id: database/password
    
    # 授予應用程式讀取密碼的權限
    - !grant
      role: !host web-application
      privileges: [ read, execute ]
      resource: !variable database/username
    
    - !grant
      role: !host web-application
      privileges: [ read, execute ]
      resource: !variable database/password

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-application
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      serviceAccountName: web-app
      containers:
      # 應用容器
      - name: web
        image: myapp:latest
        ports:
        - containerPort: 8080
        env:
        # 應用程式連線到本地的 Secretless Broker
        - name: DATABASE_URL
          value: "postgresql://localhost:5432/myapp"
      
      # Secretless Broker Sidecar
      - name: secretless
        image: cyberark/secretless-broker:latest
        args: ["-f", "/etc/secretless/secretless.yml"]
        volumeMounts:
        - name: config
          mountPath: /etc/secretless
          readOnly: true
        # Conjur 連線配置
        env:
        - name: CONJUR_APPLIANCE_URL
          value: "https://conjur.example.com"
        - name: CONJUR_ACCOUNT
          value: "myorg"
        - name: CONJUR_AUTHN_LOGIN
          value: "host/kubernetes-cluster/web-application"
      
      volumes:
      - name: config
        configMap:
          name: secretless-config

version: "2"
services:
  # PostgreSQL 連線代理
  postgres:
    connector: pg
    listenOn: tcp://0.0.0.0:5432
    credentials:
      # 從 Conjur 取得憑證
      username:
        from: conjur
        get: kubernetes-cluster/database/username
      password:
        from: conjur
        get: kubernetes-cluster/database/password
      host:
        from: literal
        value: postgres.database.svc.cluster.local
      port:
        from: literal
        value: "5432"
      sslmode:
        from: literal
        value: require

{
  "timestamp": "2025-11-24T10:30:45.123Z",
  "severity": "info",
  "operation": "fetch",
  "resource": "kubernetes-cluster:variable:database/password",
  "role": "host:kubernetes-cluster/web-application",
  "client_ip": "10.244.1.5",
  "result": "success",
  "message": "密碼已成功提供給應用程式"
}

# 建立 etcd 快照
ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot-$(date +%Y%m%d-%H%M%S).db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# 驗證快照完整性
ETCDCTL_API=3 etcdctl snapshot status /backup/etcd-snapshot-*.db \
  --write-out=table

# 從快照還原 etcd(災難復原時使用)
ETCDCTL_API=3 etcdctl snapshot restore /backup/etcd-snapshot-20251124-103000.db \
  --data-dir=/var/lib/etcd-restored

# 下載並安裝 Velero CLI
wget https://github.com/vmware-tanzu/velero/releases/download/v1.12.0/velero-v1.12.0-linux-amd64.tar.gz
tar -xvf velero-v1.12.0-linux-amd64.tar.gz
sudo mv velero-v1.12.0-linux-amd64/velero /usr/local/bin/

# 建立 AWS S3 儲存桶
aws s3 mb s3://my-kubernetes-backups --region ap-northeast-1

# 建立 IAM 使用者並設定權限(省略詳細步驟)
# 將存取金鑰儲存到檔案
cat > credentials-velero <<EOF
[default]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
EOF

# 安裝 Velero 到 Kubernetes 叢集
velero install \
  --provider aws \
  --plugins velero/velero-plugin-for-aws:v1.8.0 \
  --bucket my-kubernetes-backups \
  --backup-location-config region=ap-northeast-1 \
  --snapshot-location-config region=ap-northeast-1 \
  --secret-file ./credentials-velero \
  --use-volume-snapshots=false

# 建立每日備份排程,保留 30 天
velero schedule create daily-backup \
  --schedule="0 2 * * *" \
  --ttl 720h0m0s \
  --include-namespaces default,production

# 手動觸發一次性備份,僅備份 Secrets
velero backup create secrets-backup \
  --include-resources secrets \
  --include-namespaces default,production

# 檢視備份狀態
velero backup get

# 從備份還原資源
velero restore create --from-backup daily-backup-20251124020000

# 建立 Vault 快照(需要 root 或具備 sys/storage/raft/snapshot 權限的 token)
vault operator raft snapshot save vault-snapshot-$(date +%Y%m%d-%H%M%S).snap

# 檢視快照資訊
vault operator raft snapshot inspect vault-snapshot-*.snap

# 從快照還原 Vault
vault operator raft snapshot restore vault-snapshot-20251124-103000.snap

# 定義角色:僅允許讀取特定 Secret
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: database-secret-reader
  namespace: production
rules:
# 只允許讀取名為 database-credentials 的 Secret
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["database-credentials"]
  verbs: ["get"]

---
# 將角色綁定到特定的 ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: web-app-database-access
  namespace: production
subjects:
# 只授權給 web-app 這個 ServiceAccount
- kind: ServiceAccount
  name: web-app
  namespace: production
roleRef:
  kind: Role
  name: database-secret-reader
  apiGroup: rbac.authorization.k8s.io

# 配置資料庫角色的預設租期為 1 小時,最長 24 小時
vault write database/roles/web-app-role \
  db_name=postgresql \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';" \
  default_ttl="1h" \
  max_ttl="24h" \
  rotation_period="6h"

#!/bin/bash
# Kubernetes Secret 自動輪替腳本

# 設定變數
SECRET_NAME="database-credentials"
NAMESPACE="production"
NEW_PASSWORD=$(openssl rand -base64 32)

# 產生新的 Secret YAML
cat > updated-secret.yaml <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: ${SECRET_NAME}
  namespace: ${NAMESPACE}
  annotations:
    # 記錄輪替時間
    rotated-at: "$(date -Iseconds)"
    rotated-by: "automated-rotation-script"
type: Opaque
stringData:
  username: dbuser
  password: ${NEW_PASSWORD}
EOF

# 更新資料庫密碼(此處應調用實際的資料庫管理 API)
# update_database_password "dbuser" "${NEW_PASSWORD}"

# 套用新的 Secret
kubectl apply -f updated-secret.yaml

# 觸發使用此 Secret 的 Pod 重新啟動,載入新密碼
kubectl rollout restart deployment/web-application -n ${NAMESPACE}

# 記錄輪替事件到日誌系統
echo "[$(date -Iseconds)] Secret ${SECRET_NAME} rotated successfully" | \
  logger -t secret-rotation

# 清理臨時檔案
rm -f updated-secret.yaml

echo "密碼輪替完成"

# API Server 稽核策略配置
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
# 記錄所有對 Secrets 的請求
- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]
  # 排除系統級 ServiceAccount 的存取(減少日誌量)
  omitStages:
  - RequestReceived
  
# 記錄 Secrets 的建立、更新與刪除操作
- level: Metadata
  verbs: ["create", "update", "patch", "delete"]
  resources:
  - group: ""
    resources: ["secrets"]

# 安裝 Trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | \
  sh -s -- -b /usr/local/bin v0.48.0

# 掃描容器映像檔
trivy image --severity HIGH,CRITICAL nginx:latest

# 掃描映像檔中的敏感資訊(如硬編碼密碼)
trivy image --scanners secret nginx:latest

# 掃描 Kubernetes 叢集配置
trivy k8s --report summary cluster

# 限制只有特定標籤的 Pod 能夠存取 Vault
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: vault-access-policy
  namespace: vault
spec:
  # 套用到 Vault Pod
  podSelector:
    matchLabels:
      app: vault
  policyTypes:
  - Ingress
  ingress:
  # 只允許來自具有 vault-client 標籤的 Pod
  - from:
    - podSelector:
        matchLabels:
          vault-client: "true"
    ports:
    - protocol: TCP
      port: 8200

# 安裝 kube-bench
curl -L https://github.com/aquasecurity/kube-bench/releases/download/v0.7.0/kube-bench_0.7.0_linux_amd64.tar.gz | \
  tar -xz

# 執行完整的安全基準檢查
./kube-bench run --targets master,node,etcd,policies

# 僅檢查與 Secrets 相關的項目
./kube-bench run --check 1.2.33,1.2.34,5.1.5

# GitLab CI/CD 配置範例
stages:
  - build
  - security-scan
  - deploy

# 建置容器映像檔
build-image:
  stage: build
  script:
    - docker build -t myapp:${CI_COMMIT_SHA} .
    - docker push myapp:${CI_COMMIT_SHA}

# 安全掃描階段
trivy-scan:
  stage: security-scan
  script:
    # 掃描映像檔漏洞
    - trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:${CI_COMMIT_SHA}
    # 檢查是否有硬編碼密碼
    - trivy image --exit-code 1 --scanners secret myapp:${CI_COMMIT_SHA}
  # 如果發現嚴重漏洞或洩漏的密碼,阻止部署
  allow_failure: false

# 檢查 Kubernetes 配置
k8s-config-scan:
  stage: security-scan
  script:
    # 掃描 Kubernetes YAML 配置
    - trivy config --exit-code 1 k8s-manifests/
  allow_failure: false

# 部署到 Kubernetes
deploy-production:
  stage: deploy
  script:
    # 確保使用最新的 Secret 版本
    - kubectl apply -f k8s-manifests/secrets/
    # 部署應用程式
    - kubectl apply -f k8s-manifests/deployment.yaml
    # 等待部署完成
    - kubectl rollout status deployment/myapp
  only:
    - main

# Prometheus 告警規則
groups:
- name: secrets-access-alerts
  interval: 30s
  rules:
  # 偵測異常的 Secrets 存取頻率
  - alert: HighSecretsAccessRate
    expr: rate(apiserver_audit_event_total{objectRef_resource="secrets",verb="get"}[5m]) > 10
    for: 5m
    labels:
      severity: warning
      component: secrets
    annotations:
      summary: "偵測到異常的 Secrets 存取頻率"
      description: "Secrets 的存取頻率在過去 5 分鐘內超過每秒 10 次,可能存在異常行為"
  
  # 偵測非預期的 Secrets 修改
  - alert: UnexpectedSecretsModification
    expr: increase(apiserver_audit_event_total{objectRef_resource="secrets",verb=~"update|patch|delete"}[1h]) > 5
    labels:
      severity: critical
      component: secrets
    annotations:
      summary: "偵測到非預期的 Secrets 修改操作"
      description: "在過去 1 小時內有超過 5 次 Secrets 的修改操作,請立即檢查"

# 安裝 Secrets Store CSI Driver 與 AWS Provider
# kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/secrets-store-csi-driver/main/deploy/rbac-secretproviderclass.yaml
# kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/secrets-store-csi-driver/main/deploy/csidriver.yaml
# kubectl apply -f https://raw.githubusercontent.com/aws/secrets-store-csi-driver-provider-aws/main/deployment/aws-provider-installer.yaml

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: aws-secrets
spec:
  provider: aws
  parameters:
    # 從 AWS Secrets Manager 取得密碼
    objects: |
      - objectName: "prod/database/credentials"
        objectType: "secretsmanager"
        jmesPath:
          - path: username
            objectAlias: dbUsername
          - path: password
            objectAlias: dbPassword

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      serviceAccountName: web-app
      containers:
      - name: web
        image: myapp:latest
        volumeMounts:
        # 將 AWS Secrets Manager 的密碼掛載到容器
        - name: secrets-store
          mountPath: "/mnt/secrets"
          readOnly: true
      volumes:
      - name: secrets-store
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: "aws-secrets"