Kubernetesda ilovangiz xavfsizligini oshirish uchun…

Tarmoq siyosatlarini ishlatib, podlar o'rtasidagi trafikni nazorat qilish.
Podlar tomonidan resurslardan foydalanishni cheklash uchun Resurs Kvotalari va Limit Oralig'larini qo'llash.
Konteynerlar uchun privilegiyalangan rejimni o'chirish.
Xizmat hisoblariga beriladigan privilegiyalarni minimallashtirish.
Nozik ma'lumotlarni saqlash uchun sirlar (secrets) dan foydalanish.
Konteyner tasvirlarini zaifliklar uchun muntazam skanerlash.
OpenShift'da Security Context Constraints (SCC) yoki Pod Security Policies (PSP) (eskirgan) / toza Kubernetesda Pod Security Standards ni qo'llash.
Klasterni audit qilish uchun Kubesec yoki OpenSCAP kabi vositalardan foydalanish.
Klaster va ilovalar darajasida minimal privilegiyalar prinsipini amalga oshirish.
Podlar va nomlar bo'shliqlarini segmentlash.
Deployments uchun immutability (o'zgarmaslik) ni qo'llash.

Network Policy dan foydalanish misoli:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
spec:
  podSelector:
    matchLabels:
      app: backend # Faqat bu etiketa bilan podlarga taalluqlidir
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend # Faqat frontend podlardan kiruvchi trafikga ruxsat beradi
    ports:
    - protocol: TCP
      port: 8080 # Faqat bu portda trafikga ruxsat beradi

Security Context dan foydalanish misoli:

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000 # Konteynerni ID 1000 bo'lgan foydalanuvchi sifatida ishga tushirish
    runAsGroup: 3000 # Konteynerni ID 3000 bo'lgan guruh sifatida ishga tushirish
    fsGroup: 2000 # Fayl tizimi 2000 guruhiga tegishli bo'ladi
  containers:
  - name: sec-ctx-demo
    image: busybox
    command: [ "sh", "-c", "sleep 1h" ]
    securityContext:
      allowPrivilegeEscalation: false # Privilegiya oshirishni taqiqlash
      readOnlyRootFilesystem: true # Root fayl tizimini faqat o'qish uchun qilish

Kubernetesda ilovangiz xavfsizligini oshirish uchun qanday amaliyotlarni bilasiz?