207 lines
6.8 KiB
Bash
Executable File
207 lines
6.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# Partie 1 - Vérification complète du cluster sécurisé
|
|
# À exécuter sur le nœud MASTER
|
|
|
|
set -e
|
|
|
|
PASS=0
|
|
FAIL=0
|
|
|
|
# Nettoyer les ressources de test même en cas d'échec
|
|
CLEANUP_RESOURCES=()
|
|
cleanup() {
|
|
if [[ ${#CLEANUP_RESOURCES[@]} -gt 0 ]]; then
|
|
echo ""
|
|
echo "--- Nettoyage des ressources de test ---"
|
|
for res in "${CLEANUP_RESOURCES[@]}"; do
|
|
kubectl delete $res --ignore-not-found=true 2>/dev/null || true
|
|
done
|
|
fi
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
check_ok() { echo " ✓ $1"; ((PASS++)); }
|
|
check_fail() { echo " ✗ $1"; ((FAIL++)); }
|
|
|
|
echo "=== Vérification du cluster Kubernetes sécurisé ==="
|
|
echo ""
|
|
|
|
# --- 1. Nœuds ---
|
|
echo "1. Nœuds du cluster:"
|
|
kubectl get nodes -o wide
|
|
echo ""
|
|
|
|
# --- 2. Composants control plane ---
|
|
echo "2. Composants control plane:"
|
|
kubectl get pods -n kube-system
|
|
echo ""
|
|
|
|
# --- 3. Cilium ---
|
|
echo "3. Cilium:"
|
|
if cilium status 2>/dev/null | grep -q "OK"; then
|
|
check_ok "Cilium opérationnel"
|
|
else
|
|
check_fail "Cilium non opérationnel"
|
|
fi
|
|
|
|
if kubectl get pods -n kube-system -l app.kubernetes.io/name=cilium 2>/dev/null | grep -q "Running"; then
|
|
check_ok "Pods Cilium en état Running"
|
|
else
|
|
check_fail "Pods Cilium non Running"
|
|
fi
|
|
|
|
if kubectl get pods -n kube-system -l app.kubernetes.io/name=hubble-relay 2>/dev/null | grep -q "Running"; then
|
|
check_ok "Hubble relay opérationnel"
|
|
else
|
|
check_fail "Hubble relay non opérationnel"
|
|
fi
|
|
|
|
if kubectl get pods -n kube-system -l app.kubernetes.io/name=tetragon 2>/dev/null | grep -q "Running"; then
|
|
check_ok "Tetragon opérationnel"
|
|
else
|
|
check_fail "Tetragon non opérationnel"
|
|
fi
|
|
echo ""
|
|
|
|
# --- 4. KubeArmor ---
|
|
echo "4. KubeArmor:"
|
|
if kubectl get pods -n kubearmor 2>/dev/null | grep -q "Running"; then
|
|
check_ok "Pods KubeArmor en état Running"
|
|
else
|
|
check_fail "Pods KubeArmor non Running"
|
|
fi
|
|
|
|
KUBEARMOR_POLICIES=$(kubectl get clusterkubearmorpholicies 2>/dev/null | grep -c "block\|audit" || echo "0")
|
|
if [[ "$KUBEARMOR_POLICIES" -ge 4 ]]; then
|
|
check_ok "ClusterKubeArmorPolicies actives: ${KUBEARMOR_POLICIES}"
|
|
else
|
|
check_fail "ClusterKubeArmorPolicies insuffisantes (trouvées: ${KUBEARMOR_POLICIES}, attendues: 4)"
|
|
fi
|
|
echo ""
|
|
|
|
# --- 5. Kyverno ---
|
|
echo "5. Kyverno:"
|
|
if kubectl get pods -n kyverno 2>/dev/null | grep -q "Running"; then
|
|
check_ok "Pods Kyverno en état Running"
|
|
else
|
|
check_fail "Pods Kyverno non Running"
|
|
fi
|
|
|
|
KYVERNO_POLICIES=$(kubectl get clusterpolicies 2>/dev/null | grep -c "pass\|fail" || \
|
|
kubectl get clusterpolicies 2>/dev/null | tail -n +2 | wc -l || echo "0")
|
|
if [[ "$KYVERNO_POLICIES" -ge 8 ]]; then
|
|
check_ok "ClusterPolicies Kyverno actives: ${KYVERNO_POLICIES}"
|
|
else
|
|
check_fail "ClusterPolicies Kyverno insuffisantes (trouvées: ${KYVERNO_POLICIES}, attendues: 8)"
|
|
fi
|
|
echo ""
|
|
|
|
# --- 6. Audit logs ---
|
|
echo "6. Audit logging:"
|
|
AUDIT_LOG="/var/log/kubernetes/audit/audit.log"
|
|
if sudo test -f "$AUDIT_LOG" 2>/dev/null; then
|
|
AUDIT_LINES=$(sudo wc -l < "$AUDIT_LOG" 2>/dev/null || echo "0")
|
|
check_ok "Audit log actif ($AUDIT_LINES entrées): $AUDIT_LOG"
|
|
else
|
|
check_fail "Audit log non trouvé: $AUDIT_LOG"
|
|
fi
|
|
echo ""
|
|
|
|
# --- 7. Chiffrement etcd at-rest ---
|
|
echo "7. Chiffrement etcd at-rest:"
|
|
# Créer un secret test et vérifier qu'il est chiffré dans etcd
|
|
kubectl create secret generic etcd-encryption-check \
|
|
--from-literal=key=valeur-test-chiffrement \
|
|
-n default \
|
|
--dry-run=client -o yaml | kubectl apply -f - > /dev/null 2>&1
|
|
CLEANUP_RESOURCES+=("secret/etcd-encryption-check -n default")
|
|
|
|
ETCD_DATA=$(sudo ETCDCTL_API=3 etcdctl \
|
|
--endpoints=https://127.0.0.1:2379 \
|
|
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
|
|
--cert=/etc/kubernetes/pki/etcd/server.crt \
|
|
--key=/etc/kubernetes/pki/etcd/server.key \
|
|
get /registry/secrets/default/etcd-encryption-check 2>/dev/null || echo "")
|
|
|
|
if echo "$ETCD_DATA" | grep -q "k8s:enc:aescbc"; then
|
|
check_ok "Secrets chiffrés AES-CBC dans etcd"
|
|
elif [[ -z "$ETCD_DATA" ]]; then
|
|
check_fail "Impossible de lire etcd (vérifier les certificats)"
|
|
else
|
|
check_fail "Secrets NON chiffrés dans etcd (données en clair détectées)"
|
|
fi
|
|
echo ""
|
|
|
|
# --- 8. Test NetworkPolicy deny-all ---
|
|
echo "8. NetworkPolicy deny-all:"
|
|
kubectl run netpol-test-sender \
|
|
--image=busybox:1.36 \
|
|
--restart=Never \
|
|
-- sleep 3600 2>/dev/null || true
|
|
CLEANUP_RESOURCES+=("pod/netpol-test-sender -n default")
|
|
|
|
kubectl run netpol-test-receiver \
|
|
--image=busybox:1.36 \
|
|
--restart=Never \
|
|
-- sleep 3600 2>/dev/null || true
|
|
CLEANUP_RESOURCES+=("pod/netpol-test-receiver -n default")
|
|
|
|
kubectl wait --for=condition=ready pod/netpol-test-sender pod/netpol-test-receiver \
|
|
--timeout=60s 2>/dev/null || true
|
|
|
|
RECEIVER_IP=$(kubectl get pod netpol-test-receiver -o jsonpath='{.status.podIP}' 2>/dev/null || echo "")
|
|
if [[ -n "$RECEIVER_IP" ]]; then
|
|
if kubectl exec netpol-test-sender -- \
|
|
wget -qO- --timeout=3 "http://${RECEIVER_IP}" 2>/dev/null; then
|
|
check_fail "NetworkPolicy deny-all NON effective (communication inter-pods possible)"
|
|
else
|
|
check_ok "NetworkPolicy deny-all effective (communication inter-pods bloquée)"
|
|
fi
|
|
else
|
|
check_fail "Impossible de récupérer l'IP du pod receiver"
|
|
fi
|
|
echo ""
|
|
|
|
# --- 9. Test Kyverno : pod privileged refusé ---
|
|
echo "9. Kyverno - rejet pod privileged:"
|
|
KYVERNO_REJECT_OUTPUT=$(kubectl run kyverno-priv-test \
|
|
--image=nginx:1.25 \
|
|
--restart=Never \
|
|
--overrides='{"spec":{"containers":[{"name":"kyverno-priv-test","image":"nginx:1.25","securityContext":{"privileged":true}}]}}' \
|
|
--dry-run=server 2>&1 || true)
|
|
|
|
if echo "$KYVERNO_REJECT_OUTPUT" | grep -qiE "disallow-privileged|admission webhook|denied"; then
|
|
check_ok "Pod privileged correctement refusé par Kyverno"
|
|
else
|
|
check_fail "Pod privileged NON refusé — vérifier la ClusterPolicy disallow-privileged-containers"
|
|
fi
|
|
echo ""
|
|
|
|
# --- 10. Test de déploiement légitime ---
|
|
echo "10. Test déploiement légitime (sans restrictions):"
|
|
kubectl create deployment cluster-verify-test \
|
|
--image=nginx:1.25 \
|
|
--replicas=2 2>/dev/null || true
|
|
CLEANUP_RESOURCES+=("deployment/cluster-verify-test -n default")
|
|
|
|
kubectl wait --for=condition=available deployment/cluster-verify-test \
|
|
--timeout=60s 2>/dev/null && \
|
|
check_ok "Déploiement légitime nginx:1.25 fonctionnel" || \
|
|
check_fail "Déploiement légitime échoué (vérifier les policies)"
|
|
echo ""
|
|
|
|
# --- Résumé ---
|
|
echo "============================================="
|
|
echo " RÉSUMÉ DES VÉRIFICATIONS"
|
|
echo "============================================="
|
|
echo " Succès : $PASS"
|
|
echo " Échecs : $FAIL"
|
|
echo "============================================="
|
|
echo ""
|
|
if [[ $FAIL -eq 0 ]]; then
|
|
echo "✓ Cluster sécurisé opérationnel — toutes les vérifications passées!"
|
|
else
|
|
echo "⚠ $FAIL vérification(s) échouée(s) — voir les détails ci-dessus."
|
|
exit 1
|
|
fi
|