[zh-cn]sync security/_index.md
Signed-off-by: xin.li <xin.li@daocloud.io>pull/45186/head
xin.li
parent
89cbe46516
commit
4e209de15a
|
|
@ -2,4 +2,253 @@
|
|||
title: "安全"
|
||||
weight: 85
|
||||
description: 确保云原生工作负载安全的一组概念。
|
||||
simple_list: true
|
||||
---
|
||||
|
||||
<!--
|
||||
title: "Security"
|
||||
weight: 85
|
||||
description: >
|
||||
Concepts for keeping your cloud-native workload secure.
|
||||
simple_list: true
|
||||
-->
|
||||
|
||||
<!--
|
||||
This section of the Kubernetes documentation aims to help you learn to run
|
||||
workloads more securely, and about the essential aspects of keeping a
|
||||
Kubernetes cluster secure.
|
||||
|
||||
Kubernetes is based on a cloud-native architecture, and draws on advice from the
|
||||
{{< glossary_tooltip text="CNCF" term_id="cncf" >}} about good practice for
|
||||
cloud native information security.
|
||||
-->
|
||||
Kubernetes 文档的这一部分内容的旨在引导你学习如何更安全地运行工作负载，
|
||||
以及维护 Kubernetes 集群的基本安全性。
|
||||
|
||||
Kubernetes 基于云原生架构，并借鉴了
|
||||
{{< glossary_tooltip text="CNCF" term_id="cncf" >}} 有关云原生信息安全良好实践的建议。
|
||||
|
||||
<!--
|
||||
Read [Cloud Native Security and Kubernetes](/docs/concepts/security/cloud-native-security/)
|
||||
for the broader context about how to secure your cluster and the applications that
|
||||
you're running on it.
|
||||
-->
|
||||
请阅读[云原生安全和 Kubernetes](/zh-cn/docs/concepts/security/cloud-native-security/)，
|
||||
了解有关如何保护集群及其上运行的应用程序的更广泛背景信息。
|
||||
|
||||
<!--
|
||||
## Kubernetes security mechanisms {#security-mechanisms}
|
||||
|
||||
Kubernetes includes several APIs and security controls, as well as ways to
|
||||
define [policies](#policies) that can form part of how you manage information security.
|
||||
-->
|
||||
## Kubernetes 安全机制 {#security-mechanisms}
|
||||
|
||||
Kubernetes 包含多个 API 和安全组件，
|
||||
以及定义[策略](#policies)的方法，这些策略可以作为你的信息安全管理的一部分。
|
||||
|
||||
<!--
|
||||
### Control plane protection
|
||||
|
||||
A key security mechanism for any Kubernetes cluster is to
|
||||
[control access to the Kubernetes API](/docs/concepts/security/controlling-access).
|
||||
-->
|
||||
### 控制平面保护
|
||||
|
||||
任何 Kubernetes 集群的一个关键安全机制是[控制对 Kubernetes API 的访问](/zh-cn/docs/concepts/security/controlling-access)。
|
||||
|
||||
<!--
|
||||
Kubernetes expects you to configure and use TLS to provide
|
||||
[data encryption in transit](/docs/tasks/tls/managing-tls-in-a-cluster/)
|
||||
within the control plane, and between the control plane and its clients.
|
||||
You can also enable [encryption at rest](/docs/tasks/administer-cluster/encrypt-data/)
|
||||
for the data stored within Kubernetes control plane; this is separate from using
|
||||
encryption at rest for your own workloads' data, which might also be a good idea.
|
||||
-->
|
||||
Kubernetes 希望你配置并使用 TLS，
|
||||
以便在控制平面内以及控制平面与其客户端之间提供[传输中的数据加密](/zh-cn/docs/tasks/tls/managing-tls-in-a-cluster/)。
|
||||
你还可以为 Kubernetes 控制平面中存储的数据启用静态加密；
|
||||
这与对你自己的工作负载数据使用静态加密不同，后者可能也是一个好主意。
|
||||
|
||||
<!--
|
||||
### Secrets
|
||||
|
||||
The [Secret](/docs/concepts/configuration/secret/) API provides basic protection for
|
||||
configuration values that require confidentiality.
|
||||
-->
|
||||
### Secret
|
||||
|
||||
[Secret](/zh-cn/docs/concepts/configuration/secret/) API
|
||||
为需要保密的配置值提供基本保护。
|
||||
|
||||
<!--
|
||||
### Workload protection
|
||||
|
||||
Enforce [Pod security standards](/docs/concepts/security/pod-security-standards/) to
|
||||
ensure that Pods and their containers are isolated appropriately. You can also use
|
||||
[RuntimeClasses](/docs/concepts/containers/runtime-class) to define custom isolation
|
||||
if you need it.
|
||||
-->
|
||||
### 工具负载保护
|
||||
|
||||
实施 [Pod 安全标准](/zh-cn/docs/concepts/security/pod-security-standards/)以确保
|
||||
Pod 及其容器得到适当隔离。如果需要，你还可以使用
|
||||
[RuntimeClass](/zh-cn/docs/concepts/containers/runtime-class) 来配置自定义隔离。
|
||||
|
||||
<!--
|
||||
[Network policies](/docs/concepts/services-networking/network-policies/) let you control
|
||||
network traffic between Pods, or between Pods and the network outside your cluster.
|
||||
|
||||
You can deploy security controls from the wider ecosystem to implement preventative
|
||||
or detective controls around Pods, their containers, and the images that run in them.
|
||||
-->
|
||||
[网络策略（NetworkPolicy)](/zh-cn/docs/concepts/services-networking/network-policies/)
|
||||
可让控制 Pod 之间或 Pod 与集群外部网络之间的网络流量。
|
||||
|
||||
<!--
|
||||
### Auditing
|
||||
|
||||
Kubernetes [audit logging](/docs/tasks/debug/debug-cluster/audit/) provides a
|
||||
security-relevant, chronological set of records documenting the sequence of actions
|
||||
in a cluster. The cluster audits the activities generated by users, by applications
|
||||
that use the Kubernetes API, and by the control plane itself.
|
||||
-->
|
||||
### 审计
|
||||
|
||||
Kubernetes [审计日志记录](/zh-cn/docs/tasks/debug/debug-cluster/audit/)提供了一组与安全相关、
|
||||
按时间顺序排列的记录，记录了集群中的操作序列。
|
||||
集群审计用户、使用 Kubernetes API 的应用程序以及控制平面本身生成的活动。
|
||||
|
||||
<!--
|
||||
## Cloud provider security
|
||||
|
||||
{{% thirdparty-content vendor="true" %}}
|
||||
|
||||
If you are running a Kubernetes cluster on your own hardware or a different cloud provider,
|
||||
consult your documentation for security best practices.
|
||||
Here are links to some of the popular cloud providers' security documentation:
|
||||
-->
|
||||
## 云提供商安全
|
||||
|
||||
{{% thirdparty-content vendor="true" %}}
|
||||
|
||||
如果你在自己的硬件或不同的云平台上运行 Kubernetes 集群，请参阅对应云平台的文档以了解安全最佳实践。
|
||||
以下是一些流行云提供商的安全文档的链接：
|
||||
|
||||
<!--
|
||||
{{< table caption="Cloud provider security" >}}
|
||||
|
||||
IaaS Provider | Link |
|
||||
-------------------- | ------------ |
|
||||
Alibaba Cloud | https://www.alibabacloud.com/trust-center |
|
||||
Amazon Web Services | https://aws.amazon.com/security |
|
||||
Google Cloud Platform | https://cloud.google.com/security |
|
||||
Huawei Cloud | https://www.huaweicloud.com/intl/en-us/securecenter/overallsafety |
|
||||
IBM Cloud | https://www.ibm.com/cloud/security |
|
||||
Microsoft Azure | https://docs.microsoft.com/en-us/azure/security/azure-security |
|
||||
Oracle Cloud Infrastructure | https://www.oracle.com/security |
|
||||
VMware vSphere | https://www.vmware.com/security/hardening-guides |
|
||||
|
||||
{{< /table >}}
|
||||
-->
|
||||
{{< table caption="Cloud provider security" >}}
|
||||
|
||||
IaaS 提供商 | 链接 |
|
||||
-------------------- | ------------ |
|
||||
阿里云 | https://www.alibabacloud.com/trust-center |
|
||||
亚马逊网络服务 | https://aws.amazon.com/security |
|
||||
谷歌云平台 | https://cloud.google.com/security |
|
||||
华为云 | https://www.huaweicloud.com/intl/en-us/securecenter/overallsafety |
|
||||
IBM 云 | https://www.ibm.com/cloud/security |
|
||||
微软 Azure | https://docs.microsoft.com/en-us/azure/security/azure-security |
|
||||
Oracle 云基础设施| https://www.oracle.com/security |
|
||||
VMware vSphere | https://www.vmware.com/security/hardening-guides |
|
||||
|
||||
{{< /table >}}
|
||||
|
||||
<!--
|
||||
## Policies
|
||||
|
||||
You can define security policies using Kubernetes-native mechanisms,
|
||||
such as [NetworkPolicy](/docs/concepts/services-networking/network-policies/)
|
||||
(declarative control over network packet filtering) or
|
||||
[ValidatingAdmisisonPolicy](/docs/reference/access-authn-authz/validating-admission-policy/) (declarative restrictions on what changes
|
||||
someone can make using the Kubernetes API).
|
||||
-->
|
||||
## 策略
|
||||
|
||||
你可以使用 Kubernetes 原生机制定义安全策略，例如
|
||||
[NetworkPolicy](/zh-cn/docs/concepts/services-networking/network-policies/)（对网络数据包过滤的声明式控制）
|
||||
或 [ValidatingAdmisisonPolicy](/zh-cn/docs/reference/access -authn-authz/validating-admission-policy/)
|
||||
（对某人可以使用 Kubernetes API 进行哪些更改的声明性限制）。
|
||||
|
||||
<!--
|
||||
However, you can also rely on policy implementations from the wider
|
||||
ecosystem around Kubernetes. Kubernetes provides extension mechanisms
|
||||
to let those ecosystem projects implement their own policy controls
|
||||
on source code review, container image approval, API access controls,
|
||||
networking, and more.
|
||||
-->
|
||||
你还可以依赖 Kubernetes 周边更广泛的生态系统的策略实现。
|
||||
Kubernetes 提供了扩展机制，让这些生态系统项目在源代码审查、
|
||||
容器镜像审批、API 访问控制、网络等方面实施自己的策略控制。
|
||||
|
||||
<!--
|
||||
For more information about policy mechanisms and Kubernetes,
|
||||
read [Policies](/docs/concepts/policy/).
|
||||
-->
|
||||
有关策略机制和 Kubernetes 的更多信息，请阅读[策略](/zh-cn/docs/concepts/policy/)。
|
||||
|
||||
## {{% heading "whatsnext" %}}
|
||||
|
||||
<!--
|
||||
Learn about related Kubernetes security topics:
|
||||
|
||||
* [Securing your cluster](/docs/tasks/administer-cluster/securing-a-cluster/)
|
||||
* [Known vulnerabilities](/docs/reference/issues-security/official-cve-feed/)
|
||||
in Kubernetes (and links to further information)
|
||||
* [Data encryption in transit](/docs/tasks/tls/managing-tls-in-a-cluster/) for the control plane
|
||||
* [Data encryption at rest](/docs/tasks/administer-cluster/encrypt-data/)
|
||||
* [Controlling Access to the Kubernetes API](/docs/concepts/security/controlling-access)
|
||||
* [Network policies](/docs/concepts/services-networking/network-policies/) for Pods
|
||||
* [Secrets in Kubernetes](/docs/concepts/configuration/secret/)
|
||||
* [Pod security standards](/docs/concepts/security/pod-security-standards/)
|
||||
* [RuntimeClasses](/docs/concepts/containers/runtime-class)
|
||||
-->
|
||||
了解相关的 Kubernetes 安全主题：
|
||||
|
||||
* [保护集群](/zh-cn/docs/tasks/administer-cluster/secure-a-cluster/)
|
||||
* Kubernetes 中的[已知漏洞](/zh-cn/docs/reference/issues-security/official-cve-feed/)（以及更多信息的链接）
|
||||
* [传输中的数据加密](/zh-cn/docs/tasks/tls/managing-tls-in-a-cluster/)（针对控制平面）
|
||||
* [静态数据加密](/zh-cn/docs/tasks/administer-cluster/encrypt-data/)
|
||||
* [控制对 Kubernetes API 的访问](/zh-cn/docs/concepts/security/controlling-access)
|
||||
* Pod 的 [网络策略](/zh-cn/docs/concepts/services-networking/network-policies/)
|
||||
* [Kubernetes 中的 Secret](/zh-cn/docs/concepts/configuration/secret/)
|
||||
* [Pod 安全标准](/zh-cn/docs/concepts/security/pod-security-standards/)
|
||||
* [运行时类](/zh-cn/docs/concepts/containers/runtime-class)
|
||||
|
||||
<!--
|
||||
Learn the context:
|
||||
-->
|
||||
了解上下文：
|
||||
|
||||
<!-- if changing this, also edit the front matter of content/en/docs/concepts/security/cloud-native-security.md to match; check the no_list setting -->
|
||||
<!--
|
||||
* [Cloud Native Security and Kubernetes](/docs/concepts/security/cloud-native-security/)
|
||||
-->
|
||||
* [云原生安全和 Kubernetes](/zh-cn/docs/concepts/security/cloud-native-security/)
|
||||
|
||||
<!--
|
||||
Get certified:
|
||||
|
||||
* [Certified Kubernetes Security Specialist](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/)
|
||||
certification and official training course.
|
||||
|
||||
Read more in this section:
|
||||
-->
|
||||
获取认证：
|
||||
|
||||
* [Kubernetes 安全专家认证](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/)和官方培训课程。
|
||||
|
||||
阅读本节的更多内容：
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue