Merge pull request #45186 from my-git9/security-index1
[zh-cn]sync security/_index.md
This commit is contained in:
Kubernetes Prow Robot
GitHub
commit
db31d7c348
|
|
@ -2,4 +2,253 @@
|
||||||
title: "安全"
|
title: "安全"
|
||||||
weight: 85
|
weight: 85
|
||||||
description: 确保云原生工作负载安全的一组概念。
|
description: 确保云原生工作负载安全的一组概念。
|
||||||
|
simple_list: true
|
||||||
---
|
---
|
||||||
|
|
||||||
|
<!--
|
||||||
|
title: "Security"
|
||||||
|
weight: 85
|
||||||
|
description: >
|
||||||
|
Concepts for keeping your cloud-native workload secure.
|
||||||
|
simple_list: true
|
||||||
|
-->
|
||||||
|
|
||||||
|
<!--
|
||||||
|
This section of the Kubernetes documentation aims to help you learn to run
|
||||||
|
workloads more securely, and about the essential aspects of keeping a
|
||||||
|
Kubernetes cluster secure.
|
||||||
|
|
||||||
|
Kubernetes is based on a cloud-native architecture, and draws on advice from the
|
||||||
|
{{< glossary_tooltip text="CNCF" term_id="cncf" >}} about good practice for
|
||||||
|
cloud native information security.
|
||||||
|
-->
|
||||||
|
Kubernetes 文档的这一部分内容的旨在引导你学习如何更安全地运行工作负载，
|
||||||
|
以及维护 Kubernetes 集群的基本安全性。
|
||||||
|
|
||||||
|
Kubernetes 基于云原生架构，并借鉴了
|
||||||
|
{{< glossary_tooltip text="CNCF" term_id="cncf" >}} 有关云原生信息安全良好实践的建议。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Read [Cloud Native Security and Kubernetes](/docs/concepts/security/cloud-native-security/)
|
||||||
|
for the broader context about how to secure your cluster and the applications that
|
||||||
|
you're running on it.
|
||||||
|
-->
|
||||||
|
请阅读[云原生安全和 Kubernetes](/zh-cn/docs/concepts/security/cloud-native-security/)，
|
||||||
|
了解有关如何保护集群及其上运行的应用程序的更广泛背景信息。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
## Kubernetes security mechanisms {#security-mechanisms}
|
||||||
|
|
||||||
|
Kubernetes includes several APIs and security controls, as well as ways to
|
||||||
|
define [policies](#policies) that can form part of how you manage information security.
|
||||||
|
-->
|
||||||
|
## Kubernetes 安全机制 {#security-mechanisms}
|
||||||
|
|
||||||
|
Kubernetes 包含多个 API 和安全组件，
|
||||||
|
以及定义[策略](#policies)的方法，这些策略可以作为你的信息安全管理的一部分。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
### Control plane protection
|
||||||
|
|
||||||
|
A key security mechanism for any Kubernetes cluster is to
|
||||||
|
[control access to the Kubernetes API](/docs/concepts/security/controlling-access).
|
||||||
|
-->
|
||||||
|
### 控制平面保护
|
||||||
|
|
||||||
|
任何 Kubernetes 集群的一个关键安全机制是[控制对 Kubernetes API 的访问](/zh-cn/docs/concepts/security/controlling-access)。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Kubernetes expects you to configure and use TLS to provide
|
||||||
|
[data encryption in transit](/docs/tasks/tls/managing-tls-in-a-cluster/)
|
||||||
|
within the control plane, and between the control plane and its clients.
|
||||||
|
You can also enable [encryption at rest](/docs/tasks/administer-cluster/encrypt-data/)
|
||||||
|
for the data stored within Kubernetes control plane; this is separate from using
|
||||||
|
encryption at rest for your own workloads' data, which might also be a good idea.
|
||||||
|
-->
|
||||||
|
Kubernetes 希望你配置并使用 TLS，
|
||||||
|
以便在控制平面内以及控制平面与其客户端之间提供[传输中的数据加密](/zh-cn/docs/tasks/tls/managing-tls-in-a-cluster/)。
|
||||||
|
你还可以为 Kubernetes 控制平面中存储的数据启用静态加密；
|
||||||
|
这与对你自己的工作负载数据使用静态加密不同，后者可能也是一个好主意。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
### Secrets
|
||||||
|
|
||||||
|
The [Secret](/docs/concepts/configuration/secret/) API provides basic protection for
|
||||||
|
configuration values that require confidentiality.
|
||||||
|
-->
|
||||||
|
### Secret
|
||||||
|
|
||||||
|
[Secret](/zh-cn/docs/concepts/configuration/secret/) API
|
||||||
|
为需要保密的配置值提供基本保护。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
### Workload protection
|
||||||
|
|
||||||
|
Enforce [Pod security standards](/docs/concepts/security/pod-security-standards/) to
|
||||||
|
ensure that Pods and their containers are isolated appropriately. You can also use
|
||||||
|
[RuntimeClasses](/docs/concepts/containers/runtime-class) to define custom isolation
|
||||||
|
if you need it.
|
||||||
|
-->
|
||||||
|
### 工具负载保护
|
||||||
|
|
||||||
|
实施 [Pod 安全标准](/zh-cn/docs/concepts/security/pod-security-standards/)以确保
|
||||||
|
Pod 及其容器得到适当隔离。如果需要，你还可以使用
|
||||||
|
[RuntimeClass](/zh-cn/docs/concepts/containers/runtime-class) 来配置自定义隔离。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
[Network policies](/docs/concepts/services-networking/network-policies/) let you control
|
||||||
|
network traffic between Pods, or between Pods and the network outside your cluster.
|
||||||
|
|
||||||
|
You can deploy security controls from the wider ecosystem to implement preventative
|
||||||
|
or detective controls around Pods, their containers, and the images that run in them.
|
||||||
|
-->
|
||||||
|
[网络策略（NetworkPolicy)](/zh-cn/docs/concepts/services-networking/network-policies/)
|
||||||
|
可让控制 Pod 之间或 Pod 与集群外部网络之间的网络流量。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
### Auditing
|
||||||
|
|
||||||
|
Kubernetes [audit logging](/docs/tasks/debug/debug-cluster/audit/) provides a
|
||||||
|
security-relevant, chronological set of records documenting the sequence of actions
|
||||||
|
in a cluster. The cluster audits the activities generated by users, by applications
|
||||||
|
that use the Kubernetes API, and by the control plane itself.
|
||||||
|
-->
|
||||||
|
### 审计
|
||||||
|
|
||||||
|
Kubernetes [审计日志记录](/zh-cn/docs/tasks/debug/debug-cluster/audit/)提供了一组与安全相关、
|
||||||
|
按时间顺序排列的记录，记录了集群中的操作序列。
|
||||||
|
集群审计用户、使用 Kubernetes API 的应用程序以及控制平面本身生成的活动。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
## Cloud provider security
|
||||||
|
|
||||||
|
{{% thirdparty-content vendor="true" %}}
|
||||||
|
|
||||||
|
If you are running a Kubernetes cluster on your own hardware or a different cloud provider,
|
||||||
|
consult your documentation for security best practices.
|
||||||
|
Here are links to some of the popular cloud providers' security documentation:
|
||||||
|
-->
|
||||||
|
## 云提供商安全
|
||||||
|
|
||||||
|
{{% thirdparty-content vendor="true" %}}
|
||||||
|
|
||||||
|
如果你在自己的硬件或不同的云平台上运行 Kubernetes 集群，请参阅对应云平台的文档以了解安全最佳实践。
|
||||||
|
以下是一些流行云提供商的安全文档的链接：
|
||||||
|
|
||||||
|
<!--
|
||||||
|
{{< table caption="Cloud provider security" >}}
|
||||||
|
|
||||||
|
IaaS Provider | Link |
|
||||||
|
-------------------- | ------------ |
|
||||||
|
Alibaba Cloud | https://www.alibabacloud.com/trust-center |
|
||||||
|
Amazon Web Services | https://aws.amazon.com/security |
|
||||||
|
Google Cloud Platform | https://cloud.google.com/security |
|
||||||
|
Huawei Cloud | https://www.huaweicloud.com/intl/en-us/securecenter/overallsafety |
|
||||||
|
IBM Cloud | https://www.ibm.com/cloud/security |
|
||||||
|
Microsoft Azure | https://docs.microsoft.com/en-us/azure/security/azure-security |
|
||||||
|
Oracle Cloud Infrastructure | https://www.oracle.com/security |
|
||||||
|
VMware vSphere | https://www.vmware.com/security/hardening-guides |
|
||||||
|
|
||||||
|
{{< /table >}}
|
||||||
|
-->
|
||||||
|
{{< table caption="Cloud provider security" >}}
|
||||||
|
|
||||||
|
IaaS 提供商 | 链接 |
|
||||||
|
-------------------- | ------------ |
|
||||||
|
阿里云 | https://www.alibabacloud.com/trust-center |
|
||||||
|
亚马逊网络服务 | https://aws.amazon.com/security |
|
||||||
|
谷歌云平台 | https://cloud.google.com/security |
|
||||||
|
华为云 | https://www.huaweicloud.com/intl/en-us/securecenter/overallsafety |
|
||||||
|
IBM 云 | https://www.ibm.com/cloud/security |
|
||||||
|
微软 Azure | https://docs.microsoft.com/en-us/azure/security/azure-security |
|
||||||
|
Oracle 云基础设施| https://www.oracle.com/security |
|
||||||
|
VMware vSphere | https://www.vmware.com/security/hardening-guides |
|
||||||
|
|
||||||
|
{{< /table >}}
|
||||||
|
|
||||||
|
<!--
|
||||||
|
## Policies
|
||||||
|
|
||||||
|
You can define security policies using Kubernetes-native mechanisms,
|
||||||
|
such as [NetworkPolicy](/docs/concepts/services-networking/network-policies/)
|
||||||
|
(declarative control over network packet filtering) or
|
||||||
|
[ValidatingAdmisisonPolicy](/docs/reference/access-authn-authz/validating-admission-policy/) (declarative restrictions on what changes
|
||||||
|
someone can make using the Kubernetes API).
|
||||||
|
-->
|
||||||
|
## 策略
|
||||||
|
|
||||||
|
你可以使用 Kubernetes 原生机制定义安全策略，例如
|
||||||
|
[NetworkPolicy](/zh-cn/docs/concepts/services-networking/network-policies/)（对网络数据包过滤的声明式控制）
|
||||||
|
或 [ValidatingAdmisisonPolicy](/zh-cn/docs/reference/access -authn-authz/validating-admission-policy/)
|
||||||
|
（对某人可以使用 Kubernetes API 进行哪些更改的声明性限制）。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
However, you can also rely on policy implementations from the wider
|
||||||
|
ecosystem around Kubernetes. Kubernetes provides extension mechanisms
|
||||||
|
to let those ecosystem projects implement their own policy controls
|
||||||
|
on source code review, container image approval, API access controls,
|
||||||
|
networking, and more.
|
||||||
|
-->
|
||||||
|
你还可以依赖 Kubernetes 周边更广泛的生态系统的策略实现。
|
||||||
|
Kubernetes 提供了扩展机制，让这些生态系统项目在源代码审查、
|
||||||
|
容器镜像审批、API 访问控制、网络等方面实施自己的策略控制。
|
||||||
|
|
||||||
|
<!--
|
||||||
|
For more information about policy mechanisms and Kubernetes,
|
||||||
|
read [Policies](/docs/concepts/policy/).
|
||||||
|
-->
|
||||||
|
有关策略机制和 Kubernetes 的更多信息，请阅读[策略](/zh-cn/docs/concepts/policy/)。
|
||||||
|
|
||||||
|
## {{% heading "whatsnext" %}}
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Learn about related Kubernetes security topics:
|
||||||
|
|
||||||
|
* [Securing your cluster](/docs/tasks/administer-cluster/securing-a-cluster/)
|
||||||
|
* [Known vulnerabilities](/docs/reference/issues-security/official-cve-feed/)
|
||||||
|
in Kubernetes (and links to further information)
|
||||||
|
* [Data encryption in transit](/docs/tasks/tls/managing-tls-in-a-cluster/) for the control plane
|
||||||
|
* [Data encryption at rest](/docs/tasks/administer-cluster/encrypt-data/)
|
||||||
|
* [Controlling Access to the Kubernetes API](/docs/concepts/security/controlling-access)
|
||||||
|
* [Network policies](/docs/concepts/services-networking/network-policies/) for Pods
|
||||||
|
* [Secrets in Kubernetes](/docs/concepts/configuration/secret/)
|
||||||
|
* [Pod security standards](/docs/concepts/security/pod-security-standards/)
|
||||||
|
* [RuntimeClasses](/docs/concepts/containers/runtime-class)
|
||||||
|
-->
|
||||||
|
了解相关的 Kubernetes 安全主题：
|
||||||
|
|
||||||
|
* [保护集群](/zh-cn/docs/tasks/administer-cluster/secure-a-cluster/)
|
||||||
|
* Kubernetes 中的[已知漏洞](/zh-cn/docs/reference/issues-security/official-cve-feed/)（以及更多信息的链接）
|
||||||
|
* [传输中的数据加密](/zh-cn/docs/tasks/tls/managing-tls-in-a-cluster/)（针对控制平面）
|
||||||
|
* [静态数据加密](/zh-cn/docs/tasks/administer-cluster/encrypt-data/)
|
||||||
|
* [控制对 Kubernetes API 的访问](/zh-cn/docs/concepts/security/controlling-access)
|
||||||
|
* Pod 的 [网络策略](/zh-cn/docs/concepts/services-networking/network-policies/)
|
||||||
|
* [Kubernetes 中的 Secret](/zh-cn/docs/concepts/configuration/secret/)
|
||||||
|
* [Pod 安全标准](/zh-cn/docs/concepts/security/pod-security-standards/)
|
||||||
|
* [运行时类](/zh-cn/docs/concepts/containers/runtime-class)
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Learn the context:
|
||||||
|
-->
|
||||||
|
了解上下文：
|
||||||
|
|
||||||
|
<!-- if changing this, also edit the front matter of content/en/docs/concepts/security/cloud-native-security.md to match; check the no_list setting -->
|
||||||
|
<!--
|
||||||
|
* [Cloud Native Security and Kubernetes](/docs/concepts/security/cloud-native-security/)
|
||||||
|
-->
|
||||||
|
* [云原生安全和 Kubernetes](/zh-cn/docs/concepts/security/cloud-native-security/)
|
||||||
|
|
||||||
|
<!--
|
||||||
|
Get certified:
|
||||||
|
|
||||||
|
* [Certified Kubernetes Security Specialist](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/)
|
||||||
|
certification and official training course.
|
||||||
|
|
||||||
|
Read more in this section:
|
||||||
|
-->
|
||||||
|
获取认证：
|
||||||
|
|
||||||
|
* [Kubernetes 安全专家认证](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/)和官方培训课程。
|
||||||
|
|
||||||
|
阅读本节的更多内容：
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue