個(gè)人中心
退出
K8s:使用 kubectl 插件 kube-score 對(duì)YAML資源文件進(jìn)行合規(guī)分析
kube-score 用于 k8s 中 YAML 資源文件合規(guī)分析
它會(huì)輸出是一個(gè)建議列表，其中列出了可以改進(jìn)的內(nèi)容
博文內(nèi)容涉及：
下載安裝、使用 kube-score
靜態(tài) YAML 文件分析
生成 YAML 文件分析
現(xiàn)有集群導(dǎo)出YAML文件的分析
理解不足小伙伴幫忙指正
靡不有初，鮮克有終?！洞笱拧な帯?/p>
對(duì)于初學(xué)者來(lái)講 ，在集群中定義了一些 API 資源對(duì)象，雖然對(duì)象可以正常創(chuàng)建并且使用，但是確認(rèn)定義的 API 對(duì)象是最優(yōu)的，最合適。需要對(duì)每個(gè)對(duì)象有深入的了解，長(zhǎng)期使用 k8s，否則這是一件不容易做到的事。
這里和小伙伴們分享的 kubectl 插件 kube-socre 即可以替我們完成這樣一件事。kube-score 是一個(gè)對(duì) Kubernetes 對(duì)象定義執(zhí)行靜態(tài)代碼分析的工具。它會(huì)輸出 可以改進(jìn)的建議列表，以使應(yīng)用程序更安全、更有彈性。
下載安裝
如果你可以科學(xué)上網(wǎng)，并且安裝了 krew , 可以通過(guò)下面的方式
kubectl krew install score
否則，可以通過(guò)下面的鏈接下載 二進(jìn)制包，離線安裝
┌──[root@vms81.liruilongs.github.io]-[~/ansible/krew]
└─$wget https://github.com/zegl/kube-score/releases/download/v1.16.1/kube-score_1.16.1_linux_amd64.tar.gz
解壓之后，配置為 kubectl 插件。
┌──[root@vms81.liruilongs.github.io]-[~/ansible/krew]
└─$tar -zxvf kube-score_1.16.1_linux_amd64.tar.gz
LICENSE
kube-score
┌──[root@vms81.liruilongs.github.io]-[~/ansible/krew]
└─$mv kube-score kubectl-score
┌──[root@vms81.liruilongs.github.io]-[~/ansible/krew]
└─$mv kubectl-score /usr/local/bin/
做簡(jiǎn)單測(cè)試，查看版本信息
┌──[root@vms81.liruilongs.github.io]-[~/ansible/krew]
└─$kubectl score version
kube-score version: 1.16.1, commit: 74e551f58e9009e70012773a68dcd6424cf6379d, built: 2022-12-16T12:54:40Z
使用 kube-score
靜態(tài) YAML 文件分析
分析指定目錄的 YAML 資源文件，并給出建議
kube-score score my-app/*.yaml
kube-score score my-app/deployment.yaml my-app/service.yaml
┌──[root@vms81.liruilongs.github.io]-[~/ansible]
└─$kubectl score score k8s-daemonset-create/*.yaml
apps/v1/DaemonSet myds1 ??
[CRITICAL] Container Security Context ReadOnlyRootFilesystem
· nginx -> Container has no configured security context
Set securityContext to run the container in a more secure context.
[CRITICAL] Container Resources
· nginx -> CPU limit is not set
Resource limits are recommended to avoid resource DDOS. Set resources.limits.cpu
· nginx -> Memory limit is not set
Resource limits are recommended to avoid resource DDOS. Set resources.limits.memory
· nginx -> CPU request is not set
Resource requests are recommended to make sure that the application can start and run
without crashing. Set resources.requests.cpu
· nginx -> Memory request is not set
Resource requests are recommended to make sure that the application can start and run
without crashing. Set resources.requests.memory
[CRITICAL] Container Security Context User Group ID
· nginx -> Container has no configured security context
Set securityContext to run the container in a more secure context.
..........
這里為了了直觀一點(diǎn)，我們翻譯一下看看。
[關(guān)鍵] 容器安全上下文ReadOnlyRootFilesystem
- nginx -> 容器沒(méi)有配置安全上下文
設(shè)置securityContext以在一個(gè)更安全的環(huán)境中運(yùn)行容器。
[危急] 容器資源
- nginx -> 沒(méi)有設(shè)置CPU限制
推薦使用資源限制來(lái)避免資源DDOS。設(shè)置resources.limit.cpu
- nginx -> 沒(méi)有設(shè)置內(nèi)存限制
建議進(jìn)行資源限制，以避免資源DDOS。設(shè)置resources.limit.memory
- nginx -> 未設(shè)置CPU請(qǐng)求
推薦使用資源請(qǐng)求，以確保應(yīng)用程序能夠啟動(dòng)和運(yùn)行而不崩潰。
而不崩潰。設(shè)置resources.request.cpu
- nginx -> 未設(shè)置內(nèi)存請(qǐng)求
推薦使用資源請(qǐng)求，以確保應(yīng)用程序能夠啟動(dòng)和運(yùn)行而不崩潰。
而不崩潰。設(shè)置resources.request.memory
..............
生成 YAML 文件分析
kube-score 也可以在您的 CI/CD 環(huán)境中運(yùn)行，如果發(fā)現(xiàn)嚴(yán)重錯(cuò)誤，將以退出代碼 1 退出。可以使用 --exit-one-on-warning 參數(shù)將觸發(fā)級(jí)別更改為警告。
kube-score 可以用于分析不同方式生成的 YAML 資源文件
可以是 Helm 對(duì)應(yīng)的 charts 包 導(dǎo)出的 YAML 文件
helm template my-app | kube-score score -
也可以是 Kustomize 生成的合并的 YANL 資源文件
kustomize build . | kube-score score -
┌──[root@vms81.liruilongs.github.io]-[~/kustomize]
└─$kubectl kustomize ./ | kubectl score score -
apps/v1/Deployment web ??
[CRITICAL] Container Resources
· nginx-web -> CPU limit is not set
Resource limits are recommended to avoid resource DDOS. Set
resources.limits.cpu
· nginx-web -> Memory limit is not set
Resource limits are recommended to avoid resource DDOS. Set
resources.limits.memory
· nginx-web -> CPU request is not set
Resource requests are recommended to make sure that the application
can start and run without crashing. Set resources.requests.cpu
· nginx-web -> Memory request is not set
Resource requests are recommended to make sure that the application
can start and run without crashing. Set resources.requests.memory
[CRITICAL] Pod NetworkPolicy
· The pod does not have a matching NetworkPolicy
Create a NetworkPolicy that targets this pod to control who/what
can communicate with this pod. Note, this feature needs to be
supported by the CNI implementation used in the Kubernetes cluster
to have an effect.
[CRITICAL] Container Ephemeral Storage Request and Limit
· nginx-web -> Ephemeral Storage limit is not set
Resource limits are recommended to avoid resource DDOS. Set
resources.limits.ephemeral-storage
[CRITICAL] Container Security Context User Group ID
· nginx-web -> Container has no configured security context
Set securityContext to run the container in a more secure context.
。。。。。。。。
現(xiàn)有集群的分析
可以通過(guò)下面的命令對(duì) 現(xiàn)有的集群的 API 對(duì)應(yīng) 的 YAML 文件進(jìn)行分析
┌──[root@vms81.liruilongs.github.io]-[~/awx-operator]
└─$kubectl api-resources --verbs=list --namespaced -o name | xargs -n1 -I{} bash -c "kubectl get {} --all-namespaces -oyaml && echo ---" | kubectl score score -
apps/v1/DaemonSet calico-node in kube-system ??
[CRITICAL] Pod NetworkPolicy
· The pod does not have a matching NetworkPolicy
Create a NetworkPolicy that targets this pod to control who/what
can communicate with this pod. Note, this feature needs to be
supported by the CNI implementation used in the Kubernetes cluster
to have an effect.
.............
博文參考
https://github.com/zegl/kube-score
作者：山河已無(wú)恙
歡迎關(guān)注微信公眾號(hào) ：山河已無(wú)恙
分類(lèi)導(dǎo)航