首页/资讯中心/详情

Kubernetes策略即代码：Kyverno实践指南

Kubernetes策略即代码：Kyverno实践指南
📅 发布时间：2026/7/18 2:03:16

1. 为什么需要策略即代码？

在Kubernetes集群规模扩大后，单纯依靠人工检查配置的方式会变得力不从心。想象一下，当你有上百个团队在同一个集群中部署应用时，如何确保每个Pod都设置了资源限制？如何防止某个团队意外部署了root权限的容器？这就是策略即代码（Policy as Code）要解决的问题。

Kyverno这个名字来源于希腊语"kyverno"，意为"治理"。它作为Kubernetes原生的策略引擎，允许你像管理应用代码一样管理集群策略。与传统的准入控制器不同，Kyverno策略本身就是Kubernetes资源，使用YAML编写，完全融入Kubernetes生态。

提示：策略即代码的核心价值在于将策略定义、执行和审计都纳入版本控制系统，实现策略的声明式管理和自动化验证。

2. Kyverno的核心工作机制

2.1 动态准入控制原理

Kyverno作为动态准入控制器（Dynamic Admission Controller）运行，它会拦截所有发往Kubernetes API Server的请求。当用户创建或更新资源时，Kyverno会根据已注册的策略进行验证或变更。整个过程分为三个关键阶段：

  1. 匹配阶段：策略中定义的match字段确定该策略适用于哪些资源
  2. 验证/变更阶段：根据策略类型执行相应操作
  3. 执行阶段：允许、拒绝请求或修改资源定义

这种机制使得策略执行对用户完全透明，开发者无需额外操作就能自动符合规范。

2.2 策略类型详解

Kyverno支持三种基本策略类型：

  1. Validate（验证策略）：
apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: require-labels spec: validationFailureAction: enforce rules: - name: check-for-labels match: resources: kinds: - Pod validate: message: "All pods must have 'app' and 'tier' labels" pattern: metadata: labels: app: "?*" tier: "?*"
  1. Mutate（变更策略）：
apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: add-safe-to-evict spec: rules: - name: annotate-pods match: resources: kinds: - Pod mutate: patchStrategicMerge: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
  1. Generate（生成策略）：
apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: generate-networkpolicy spec: rules: - name: default-deny match: resources: kinds: - Namespace selector: matchLabels: security-level: high generate: kind: NetworkPolicy name: default-deny namespace: "{{request.object.metadata.name}}" data: spec: podSelector: {} policyTypes: - Ingress - Egress

3. 生产环境部署实践

3.1 Helm安装最佳实践

推荐使用Helm 3进行安装，以下命令会创建kyverno命名空间并部署所有必要组件：

helm repo add kyverno https://kyverno.github.io/kyverno/ helm repo update helm install kyverno kyverno/kyverno -n kyverno --create-namespace \ --set replicaCount=3 \ --set podAnnotations."cluster-autoscaler\.kubernetes\.io/safe-to-evict"="true"

关键配置参数说明：

  • replicaCount: 根据集群规模设置，生产环境建议≥3
  • podDisruptionBudget: 确保至少2个Pod始终可用
  • resources.limits: 根据策略复杂度调整，默认500m CPU/1Gi内存可能不足

3.2 策略组织方案

随着策略数量增加，推荐采用以下目录结构管理策略YAML：

policies/ ├── base/ │ ├── mandatory/ │ │ ├── require-resource-limits.yaml │ │ └── prohibit-host-path.yaml │ └── recommended/ │ ├── check-image-registry.yaml │ └── require-pod-disruption-budget.yaml ├── overlays/ │ └── production/ │ ├── kustomization.yaml │ └── stricter-resource-limits.yaml └── tests/ ├── test-require-labels.yaml └── test-mutate-annotations.yaml

使用Kustomize进行环境差异化配置，例如在production环境中启用更严格的资源限制策略。

4. 高级策略模式解析

4.1 上下文感知策略

Kyverno可以基于集群状态动态决策。以下策略会检查新Pod是否来自受信任的镜像仓库，同时验证镜像签名：

apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: check-image-source spec: validationFailureAction: enforce background: false rules: - name: verify-image-registry context: - name: trustedRegistries configMap: name: trusted-registries namespace: kyverno preconditions: - key: "{{ request.operation }}" operator: Equals value: "CREATE" match: resources: kinds: - Pod validate: message: "Only images from trusted registries are allowed" pattern: spec: containers: - image: "{{ trustedRegistries.data.registries }}/*"

4.2 策略豁免机制

某些系统组件可能需要豁免特定策略。Kyverno提供两种豁免方式：

  1. 资源级别豁免：
apiVersion: kyverno.io/v1 kind: PolicyException metadata: name: kube-system-exception namespace: kube-system spec: exceptions: - policyName: require-resource-limits ruleNames: - "check-resources" resourceNames: - "kube-apiserver" - "kube-controller-manager"
  1. 条件豁免：
apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: allow-privileged-if-approved spec: validationFailureAction: audit rules: - name: check-privileged exclude: resources: annotations: security.kyverno.io/privileged: "approved" match: resources: kinds: - Pod validate: message: "Privileged pods require security approval" pattern: spec: containers: - securityContext: privileged: false

5. 策略测试与验证

5.1 单元测试框架

Kyverno CLI提供了测试框架，可以像测试代码一样测试策略。测试用例示例：

name: test-require-labels policies: - ../../base/mandatory/require-labels.yaml resources: - name: bad-pod resource: | apiVersion: v1 kind: Pod metadata: name: nginx spec: containers: - name: nginx image: nginx:latest - name: good-pod resource: | apiVersion: v1 kind: Pod metadata: name: nginx labels: app: web tier: frontend spec: containers: - name: nginx image: nginx:latest results: - policy: require-labels rule: check-for-labels resource: bad-pod kind: Pod result: fail - policy: require-labels rule: check-for-labels resource: good-pod kind: Pod result: pass

运行测试：

kyverno test ./policies/tests/

5.2 生产环境渐进式推广

为避免策略突然启用导致业务中断，推荐采用分阶段推广方案：

  1. Audit模式运行（validationFailureAction: audit）

    • 监控违反策略的资源但不阻止
    • 使用kyverno policy-reporter生成合规报告

  2. 命名空间逐步启用

    apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: rollout-policy spec: validationFailureAction: enforce rules: - name: rollout-rule match: resources: namespaces: - stage-1 - stage-2

  3. 最终全局强制执行

6. 性能优化与问题排查

6.1 大规模集群优化

当集群规模超过1000节点时，需特别注意：

  1. 策略匹配优化：

    • 避免使用宽泛的match条件
    • 优先使用namespaceSelector而非全局匹配
    • 将频繁变更的策略与稳定策略分离

  2. 缓存配置调整：

# values.yaml config: resourceFilters: - "[Event,*,*]" - "[*,kube-system,*]" - "[*,kube-public,*]" webhooks: namespaceSelector: matchExpressions: - key: kyverno.io/enable operator: In values: ["true"]

6.2 常见问题排查

问题现象：策略变更未生效

  1. 检查Kyverno Pod日志：
    kubectl logs -n kyverno -l app=kyverno --tail=100
  2. 验证策略是否已注册：
    kubectl get clusterpolicy
  3. 检查资源是否匹配策略条件：
    kubectl get <resource> -o yaml | grep kyverno

问题现象：API请求延迟增加

  1. 调整Kyverno资源限制：
    resources: limits: cpu: 2000m memory: 2Gi
  2. 启用指标监控：
    helm upgrade kyverno kyverno/kyverno -n kyverno \ --set metrics.serviceMonitor.enabled=true

7. 安全加固实践

7.1 策略签名验证

确保策略定义未被篡改：

apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: verify-policy-signature spec: validationFailureAction: enforce rules: - name: verify-policy match: resources: kinds: - ClusterPolicy validate: message: "Only signed policies from DevOps team are allowed" pattern: metadata: annotations: "cosign.sigstore.dev/signature": "*"

7.2 关键防护策略示例

  1. 禁止特权容器：
apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: block-privileged spec: validationFailureAction: enforce rules: - name: block-privileged-containers match: resources: kinds: - Pod validate: message: "Privileged mode is not allowed" pattern: spec: containers: - =(securityContext): =(privileged): false
  1. 强制Pod安全标准：
apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: pss-restricted spec: validationFailureAction: enforce background: true rules: - name: restricted match: resources: kinds: - Pod validate: podSecurity: level: restricted version: latest

在实施这些策略时，建议先从audit模式开始，逐步观察策略影响范围。对于已经存在的违规资源，可以使用Kyverno CLI的apply命令进行批量修复：

kyverno apply ./policies/ --resource=deployments.yaml