Sécurité DevOps - Avancé

Application → Vault Agent → Vault Server → Backend (AWS, DB, PKI…)
                 ↑
         s'authentifie
         (Kubernetes, AWS IAM, AppRole…)

# Vault génère des credentials PostgreSQL temporaires
vault read database/creds/mon-role

# Résultat :
# Key                Value
# ---                -----
# lease_duration     1h          ← expire dans 1 heure
# username           v-token-abc123
# password           A1-XyZqRsT...

# Annotation sur un pod pour injecter les secrets automatiquement
apiVersion: v1
kind: Pod
metadata:
  name: mon-app
  annotations:
    vault.hashicorp.com/agent-inject: "true"
    vault.hashicorp.com/role: "mon-app-role"
    # Vault Agent monte le secret dans /vault/secrets/config
    vault.hashicorp.com/agent-inject-secret-config: "secret/data/mon-app/config"
spec:
  containers:
    - name: mon-app
      image: mon-app:latest

# Générer un SBOM avec Trivy (format CycloneDX)
trivy image --format cyclonedx --output sbom.json mon-app:latest

# Générer avec Syft (autre outil populaire)
syft mon-app:latest -o cyclonedx-json > sbom.json

# Analyser le SBOM pour détecter des vulnérabilités
grype sbom:./sbom.json

- name: Generate SBOM
  uses: anchore/sbom-action@v0.17.0
  with:
    image: mon-app:${{ github.sha }}
    artifact-name: sbom.spdx.json
    output-file: ./sbom.spdx.json

- name: Scan SBOM for vulnerabilities
  uses: anchore/scan-action@v4
  with:
    sbom: ./sbom.spdx.json
    fail-build: true
    severity-cutoff: critical

# Installer cosign
brew install cosign  # macOS

# Signer une image (sans clé - via OIDC GitHub Actions)
cosign sign --yes mon-registry/mon-app:latest

# Vérifier la signature
cosign verify \
  --certificate-identity https://github.com/mon-org/mon-repo/.github/workflows/release.yml@refs/heads/main \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  mon-registry/mon-app:latest

- name: Sign the Docker image
  env:
    DIGEST: ${{ steps.build.outputs.digest }}
  run: cosign sign --yes mon-registry/mon-app@${DIGEST}

- name: Build with SLSA provenance
  uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
  with:
    image: mon-registry/mon-app
    digest: ${{ steps.build.outputs.digest }}

# Rôle : lecture seule sur les pods dans le namespace "production"
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: pod-reader
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]   # pas de create, delete, update

---
# Lier ce rôle à un ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods-binding
  namespace: production
subjects:
  - kind: ServiceAccount
    name: monitoring-agent
    namespace: production
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

# Peut-il créer des pods ?
kubectl auth can-i create pods --as=system:serviceaccount:production:monitoring-agent -n production
# no

# Peut-il lire des pods ?
kubectl auth can-i get pods --as=system:serviceaccount:production:monitoring-agent -n production
# yes

# Politique "deny all" : bloquer tout trafic entrant et sortant par défaut
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: production
spec:
  podSelector: {}      # s'applique à tous les pods du namespace
  policyTypes:
    - Ingress
    - Egress

---
# Autoriser uniquement les requêtes du frontend vers le backend
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend          # s'applique aux pods "backend"
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend # uniquement depuis les pods "frontend"
      ports:
        - port: 3000

# Appliquer le profil "restricted" sur un namespace
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/warn: restricted

Développeur → GitHub → GitHub Actions → Registry → Kubernetes

# ConstraintTemplate : définit une règle réutilisable
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        openAPIV3Schema:
          type: object
          properties:
            labels:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels

        violation[{"msg": msg}] {
          provided := {label | input.review.object.metadata.labels[label]}
          required := {label | label := input.parameters.labels[_]}
          missing := required - provided
          count(missing) > 0
          msg := sprintf("Labels manquants : %v", [missing])
        }

---
# Constraint : applique la règle sur les namespaces de prod
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-team-label
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Namespace"]
  parameters:
    labels: ["team", "environment"]

# Installer opa
brew install opa

# Tester une règle
opa eval --input input.json --data policy.rego "data.k8srequiredlabels.violation"