云原生安全与可观测性

// eBPF 程序示例：监控系统调用
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>

SEC("tp/syscalls/sys_enter_execve")
int trace_execve(struct trace_event_raw_sys_enter *ctx)
{
    u32 uid = bpf_get_current_uid_gid() >> 32;
    
    // 监控 root 用户执行的命令
    if (uid == 0) {
        char comm[16];
        bpf_get_current_comm(comm, sizeof(comm));
        bpf_printk("Root executed: %s", comm);
    }
    
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

# falco-rules.yaml
- rule: Unauthorized Privilege Escalation
  desc: Detect privilege escalation attempts
  condition: >
    spawned_process and
    (base64_encoded_command or 
     shell_procs and 
     proc.name in (sudo, su, pkexec))
  output: >
    Privilege escalation attempt detected
    user=%user.name command=%proc.cmdline
  priority: CRITICAL

- rule: Sensitive File Access
  desc: Monitor access to sensitive files
  condition: >
    open_read and
    (fd.name contains "/etc/shadow" or
     fd.name contains "/etc/passwd" or
     fd.name contains ".ssh/id_rsa")
  output: >
    Sensitive file accessed
    user=%user.name file=%fd.name
  priority: WARNING

- rule: Outbound Connection from Database
  desc: Database pods should not make outbound connections
  condition: >
    outbound and
    k8s.pod.label.role = "database" and
    not (fd.sip in (trusted_ips))
  output: >
    Unexpected outbound connection from database
    pod=%k8s.pod.name ip=%fd.sip
  priority: HIGH

# Istio 安全配置
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT  # 强制 mTLS
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: service-policy
  namespace: production
spec:
  selector:
    matchLabels:
      app: payment-service
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/frontend/sa/web-app"]
  - to:
    - operation:
        methods: ["POST"]
        paths: ["/api/v1/payments"]

# Cosign 镜像签名验证
cosign verify --key cosign.pub myregistry.io/app:v1.2.3

# SLSA 构建来源验证
slsa-verifier verify-image \
  --source-uri github.com/my-org/my-app \
  --builder-id https://github.com/slsa-framework/slsa-github-generator \
  myregistry.io/app:v1.2.3

# 自定义安全指标
- name: falco_events_total
  help: Total number of Falco security events
  type: counter
  labels: [priority, rule]

# 告警规则
- alert: HighPrivilegeEscalation
  expr: increase(falco_events_total{priority="CRITICAL"}[5m]) > 0
  for: 0s
  labels:
    severity: critical
  annotations:
    summary: "检测到权限提升尝试"
    runbook_url: "https://wiki/security-runbooks/privilege-escalation"