《OpenShift 4.x HOL教程汇总》
本文在 OpenShift4.9 + RAHACS 环境中进行验证。

创建 RHACS 的 Policy

1. 创建一个 Policy 的 JSON 文件，内容如下。Policy 只针对 OpenShift 的 Production 项目中的资源识别容器是否运行 curl 命令，一旦发现有 curl 命令运行，立即终止 Pod 运行。
   

{"policies": [{"id": "e0a224d9-ca08-48c7-8164-7325245257d8","name": "有 Curl 运行","description": "在容器中运行了 Curl 命令","rationale": "Curl 有可能下载能具有风险的文件","remediation": "可以删除镜像中的 Curl 以便提升安全性","disabled": false,"categories": ["Security Best Practices"],"fields": null,"lifecycleStages": ["RUNTIME"],"eventSource": "DEPLOYMENT_EVENT","whitelists": [],"exclusions": [],"scope": [{"cluster": "","namespace": "production","label": null}],"severity": "LOW_SEVERITY","enforcementActions": ["KILL_POD_ENFORCEMENT","FAIL_KUBE_REQUEST_ENFORCEMENT"],"notifiers": [],"lastUpdated": "2022-01-15T10:30:09.564919243Z","SORTName": "","SORTLifecycleStage": "","SORTEnforcement": false,"policyVersion": "1.1","policySections": [{"sectionName": "Policy Section 1","policyGroups": [{"fieldName": "Process Name","booleanOperator": "OR","negate": false,"values": [{"value": "curl"}]}]}],"mitreAttackVectors": [],"criteriaLocked": false,"mitreVectorsLocked": false,"isDefault": false}]
}

2. 在 RHACS 控制台中进入 Platform Configuration 的 System Policies，然后通过 “Import a policy” 图标将以下 JSON 内容导入到 RHACS。
   

部署测试应用

1. 在 OpenShift 中创建 development 和 production 项目。

oc new-project development
oc new-project production 

2. 分别在 development 和 production 项目中部署 “registry.access.redhat.com/rhscl/httpd-24-rhel7” 镜像。

oc new-app --image=registry.access.redhat.com/rhscl/httpd-24-rhel7 --name=httpd-development -n development
oc new-app --image=registry.access.redhat.com/rhscl/httpd-24-rhel7 --name=httpd-production -n production 

验证

1. 先在 development 项目中的 Pod 运行 curl 命令，确认可以正常运行。

$ oc project development
$ oc exec deploy/httpd-development -- curl http://www.baidu.com -o /dev/null% Total    % Received % Xferd  Average Speed   Time    Time     Time  CurrentDload  Upload   Total   Spent    Left  Speed
100  2381  100  2381    0     0   7369      0 --:--:-- --:--:-- --:--:--  7394

2. 然后在 production 项目中的 Pod 运行 curl 命令，确认最后会提示 “command terminated with exit code 143”。

$ oc project production
$ oc exec deploy/httpd-production -- curl http://www.baidu.com -o /dev/null% Total    % Received % Xferd  Average Speed   Time    Time     Time  CurrentDload  Upload   Total   Spent    Left  Speed0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0command terminated with exit code 143

3. 查看 httpd-production 部署的 Event，确认有提示 Pod 因违反 ““有 Curl 运行”” 的策略被 killed。

$ oc describe deploy httpd-production -n production
。。。
Events:Type     Reason                Age    From                   Message----     ------                ----   ----                   -------Normal   ScalingReplicaSet     140m   deployment-controller  Scaled up replica set httpd-production-6fbdfc6465 to 1Warning  StackRox enforcement  122m   stackrox/sensor        A pod (httpd-production-6fbdfc6465-9gnpq) violated StackRox policy "有 Curl 运行" and was killed

4. 在 RHACS 的 Violations 中确认也有““有 Curl 运行”” 的违规记录。