合规自动化：Policy as Code

# policies/kubernetes/container_security.rego
package kubernetes.admission.container

# 默认拒绝，除非明确允许
default allow = false

# 允许来自可信命名空间的资源
allow {
    input.request.namespace in ["kube-system", "kyverno", "gatekeeper-system"]
}

# 检查容器安全配置
deny[msg] {
    # 遍历所有容器（包括 initContainers）
    container := input.request.object.spec.containers[_]

    # 规则 1：禁止以 root 用户运行
    not container.securityContext.runAsNonRoot
    msg := sprintf("容器 %v 必须设置 securityContext.runAsNonRoot: true", [container.name])
}

deny[msg] {
    container := input.request.object.spec.containers[_]

    # 规则 2：禁止特权容器
    container.securityContext.privileged == true
    msg := sprintf("容器 %v 不允许设置为特权容器", [container.name])
}

deny[msg] {
    container := input.request.object.spec.containers[_]

    # 规则 3：禁止挂载宿主机敏感路径
    volume := input.request.object.spec.volumes[_]
    sensitive_paths := ["/etc", "/var/run/docker.sock", "/proc", "/sys"]
    volume.hostPath.path in sensitive_paths
    msg := sprintf("容器 %v 挂载了敏感宿主机路径: %v", [container.name, volume.hostPath.path])
}

deny[msg] {
    container := input.request.object.spec.containers[_]

    # 规则 4：资源限制必须设置
    not container.resources.limits.memory
    msg := sprintf("容器 %v 必须设置内存限制", [container.name])
}

deny[msg] {
    container := input.request.object.spec.containers[_]

    # 规则 5：镜像必须来自可信仓库
    trusted_registries := ["gcr.io/myorg", "ghcr.io/myorg"]
    not startswith(container.image, trusted_registries[_])
    msg := sprintf("容器 %v 的镜像 %v 不来自可信仓库", [container.name, container.image])
}

# 警告（不阻断，仅记录）
warn[msg] {
    container := input.request.object.spec.containers[_]

    # 规则：建议设置只读根文件系统
    not container.securityContext.readOnlyRootFilesystem
    msg := sprintf("建议容器 %v 设置 readOnlyRootFilesystem: true", [container.name])
}

# kyverno-policies/require-resource-limits.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-resource-limits
  annotations:
    policies.kyverno.io/title: Require Resource Limits
    policies.kyverno.io/category: Best Practices
    policies.kyverno.io/severity: medium
    policies.kyverno.io/description: |
      要求所有容器设置资源限制（CPU 和内存），
      防止资源耗尽攻击和资源争抢。
spec:
  validationFailureAction: Enforce  # Enforce: 阻断; Audit: 仅记录
  background: true  # 对存量资源也进行检查
  rules:
    - name: validate-memory-limit
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "容器必须设置内存限制"
        pattern:
          spec:
            containers:
              - resources:
                  limits:
                    memory: "?*"  # ?* 表示必须存在且非空

    - name: validate-cpu-limit
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "容器必须设置 CPU 限制"
        pattern:
          spec:
            containers:
              - resources:
                  limits:
                    cpu: "?*"

---
# kyverno-policies/disallow-privileged-containers.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-privileged-containers
  annotations:
    policies.kyverno.io/title: Disallow Privileged Containers
    policies.kyverno.io/category: Pod Security Standards (Restricted)
    policies.kyverno.io/severity: high
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: check-privileged
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "禁止创建特权容器"
        pattern:
          spec:
            containers:
              - securityContext:
                  privileged: false

---
# kyverno-policies/require-image-signature.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-image-signature
  annotations:
    policies.kyverno.io/title: Require Signed Images
spec:
  validationFailureAction: Enforce
  background: false  # 签名验证需要实时进行
  rules:
    - name: verify-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "ghcr.io/myorg/*"
          attestors:
            - entries:
                - keyless:
                    subject: "https://github.com/myorg/*"
                    issuer: "https://token.actions.githubusercontent.com"

# 安装 Conftest
brew install conftest  # macOS
# 或
go install github.com/open-policy-agent/conftest@latest

# 测试 Kubernetes 配置文件
conftest test deployment.yaml --policy ./policies/

# 测试 Terraform 配置
conftest test main.tf --policy ./policies/

# 输出 JUnit 格式（用于 CI）
conftest test deployment.yaml --policy ./policies/ --output junit

# 测试目录下所有文件
conftest test ./manifests/ --policy ./policies/ --recursive

# policies/kubernetes/deployment.rego
package kubernetes.admission

# 禁止使用 latest 标签
deny[msg] {
    input.kind == "Deployment"
    container := input.spec.template.spec.containers[_]
    endswith(container.image, ":latest")
    msg := sprintf("Deployment %v 的容器 %v 使用了 latest 标签，必须指定明确版本", [input.metadata.name, container.name])
}

# 要求设置副本数
deny[msg] {
    input.kind == "Deployment"
    not input.spec.replicas
    msg := sprintf("Deployment %v 必须明确设置 replicas", [input.metadata.name])
}

# 要求设置健康检查
warn[msg] {
    input.kind == "Deployment"
    container := input.spec.template.spec.containers[_]
    not container.livenessProbe
    msg := sprintf("Deployment %v 的容器 %v 建议设置 livenessProbe", [input.metadata.name, container.name])
}

warn[msg] {
    input.kind == "Deployment"
    container := input.spec.template.spec.containers[_]
    not container.readinessProbe
    msg := sprintf("Deployment %v 的容器 %v 建议设置 readinessProbe", [input.metadata.name, container.name])
}

# .github/workflows/policy-check.yml
name: Policy as Code Check

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  # 1. IaC 策略检查
  iac-policy-check:
    name: IaC Policy Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Checkov IaC Scan
        uses: bridgecrewio/checkov-action@master
        with:
          directory: 'infra/'
          framework: 'terraform,kubernetes,dockerfile'
          output_format: 'sarif'
          output_file_path: 'checkov-results.sarif'
          soft_fail: false
          skip_check: 'CKV_K8S_21'  # 跳过特定检查

      - name: Upload SARIF Results
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'checkov-results.sarif'

  # 2. Kubernetes 配置策略检查
  k8s-policy-check:
    name: Kubernetes Policy Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Conftest
        run: |
          curl -LO https://github.com/open-policy-agent/conftest/releases/download/v0.47.0/conftest_0.47.0_Linux_x86_64.tar.gz
          tar -xzf conftest_0.47.0_Linux_x86_64.tar.gz
          sudo mv conftest /usr/local/bin/

      - name: Run Conftest
        run: |
          conftest test ./manifests/**/*.yaml \
            --policy ./policies/kubernetes/ \
            --output junit \
            --all-namespaces

  # 3. Kyverno 策略测试
  kyverno-policy-test:
    name: Kyverno Policy Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Kyverno CLI
        run: |
          curl -LO https://github.com/kyverno/kyverno/releases/download/v1.10.0/kyverno-cli_v1.10.0_linux_x86_64.tar.gz
          tar -xzf kyverno-cli_v1.10.0_linux_x86_64.tar.gz
          sudo mv kyverno /usr/local/bin/

      - name: Test Kyverno Policies
        run: |
          kyverno test ./kyverno-policies/ --manifests ./test-manifests/

  # 4. OPA 策略测试
  opa-policy-test:
    name: OPA Policy Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install OPA
        run: |
          curl -LO https://openpolicyagent.org/downloads/v0.58.0/opa_linux_amd64
          chmod +x opa_linux_amd64
          sudo mv opa_linux_amd64 /usr/local/bin/opa

      - name: Run OPA Tests
        run: |
          opa test ./policies/ -v

      - name: OPA Coverage Report
        run: |
          opa test ./policies/ --coverage --format json > coverage.json
          echo "Policy coverage: $(jq '.coverage' coverage.json)%"

# kube-bench-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: kube-bench
  namespace: security
spec:
  template:
    spec:
      hostPID: true
      containers:
        - name: kube-bench
          image: aquasec/kube-bench:v0.6.19
          command: ["kube-bench", "run", "--targets", "node", "--json"]
          volumeMounts:
            - name: var-lib-etcd
              mountPath: /var/lib/etcd
            - name: var-lib-kubelet
              mountPath: /var/lib/kubelet
            - name: etc-systemd
              mountPath: /etc/systemd
            - name: etc-kubernetes
              mountPath: /etc/kubernetes
      volumes:
        - name: var-lib-etcd
          hostPath:
            path: /var/lib/etcd
        - name: var-lib-kubelet
          hostPath:
            path: /var/lib/kubelet
        - name: etc-systemd
          hostPath:
            path: /etc/systemd
        - name: etc-kubernetes
          hostPath:
            path: /etc/kubernetes
      restartPolicy: Never

policies/
├── base/                    # 基础策略（所有环境适用）
│   ├── container-security.rego
│   └── resource-limits.rego
├── environments/            # 环境特定策略
│   ├── production/
│   │   ├── strict-security.rego
│   │   └── network-policy.rego
│   └── development/
│       └── relaxed-limits.rego
├── compliance/              # 合规框架映射
│   ├── cis-benchmark/
│   ├── pci-dss/
│   └── gdpr/
└── tests/                   # 策略测试
    ├── container-security_test.rego
    └── test-data/

# policies/tests/container_security_test.rego
package kubernetes.admission.container

# 测试：应该拒绝特权容器
test_deny_privileged_container {
    input := {
        "request": {
            "namespace": "default",
            "object": {
                "spec": {
                    "containers": [{
                        "name": "test",
                        "image": "nginx",
                        "securityContext": {"privileged": true}
                    }]
                }
            }
        }
    }

    deny[msg] with input as input
    msg == "容器 test 不允许设置为特权容器"
}

# 测试：应该允许非特权容器
test_allow_non_privileged_container {
    input := {
        "request": {
            "namespace": "default",
            "object": {
                "spec": {
                    "containers": [{
                        "name": "test",
                        "image": "nginx",
                        "securityContext": {
                            "runAsNonRoot": true,
                            "privileged": false
                        },
                        "resources": {
                            "limits": {"memory": "256Mi", "cpu": "100m"}
                        }
                    }]
                }
            }
        }
    }

    not deny with input as input
}

# .github/workflows/compliance-report.yml
name: Compliance Report

on:
  schedule:
    - cron: '0 6 * * 1'  # 每周一早上 6 点
  workflow_dispatch:

jobs:
  generate-report:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Policy Scan
        run: |
          # 扫描所有 Kubernetes 配置
          conftest test ./manifests/**/*.yaml \
            --policy ./policies/ \
            --output json \
            > policy-results.json

      - name: Generate Compliance Report
        uses: jamesives/github-pages-deploy-action@v4
        with:
          folder: reports
          target-folder: compliance-reports

      - name: Notify on Violations
        if: steps.scan.outputs.violations > 0
        uses: slackapi/slack-github-action@v1
        with:
          channel-id: 'security-alerts'
          slack-message: |
            :warning: 合规扫描发现 ${{ steps.scan.outputs.violations }} 个违规项
            查看详情: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

# policy-exceptions.yaml
apiVersion: kyverno.io/v2alpha1
kind: PolicyException
metadata:
  name: allow-privileged-monitoring
  namespace: monitoring
spec:
  exceptions:
    - policyName: disallow-privileged-containers
      ruleNames:
        - check-privileged
      resources:
        - kind: Pod
          names:
            - node-exporter-*
          namespaces:
            - monitoring
  match:
    any:
      - resources:
          kinds:
            - Pod
          namespaces:
            - monitoring
  conditions:
    all:
      - key: "{{ request.object.metadata.labels.app }}"
        operator: Equals
        value: node-exporter

# .github/pull_request_template.md
## 策略变更说明

### 变更类型
- [ ] 新增策略
- [ ] 修改策略
- [ ] 删除策略
- [ ] 策略例外

### 变更原因
<!-- 说明为什么需要这个变更 -->

### 影响评估
- 影响的命名空间：
- 影响的工作负载：
- 预期阻断数量：

### 合规映射
- [ ] CIS Benchmark: CIS-X.XX
- [ ] PCI DSS: Requirement X.X
- [ ] SOC 2: CC-X.X
- [ ] 其他：

### 测试验证
- [ ] 已添加/更新策略测试
- [ ] 已在测试环境验证
- [ ] 已评估对生产环境的影响