企业 DevOps + 协同办公 + 可观测性 + 网络基础设施平台-Part 15.16 Security Role

本部分生成企业级安全平台自动化部署代码

包含：

Hashicorp Vault 密钥管理
Keycloak IAM身份认证
OAuth2 Proxy统一登录
Cert-Manager自动证书
Sealed Secrets Kubernetes Secret加密
Trivy安全扫描
Fail2ban主机防护
Auditd审计
CIS安全加固
Container Security
Kubernetes Security

适用于：

复制代码

Ubuntu 22.04 / 24.04

Docker

Kubernetes 1.28+

Helm 3+

Ingress-Nginx

MetalLB / HAProxy

15.16.1 Security整体架构

复制代码

                         User


                          |

                          |


                    Keycloak IAM


                          |

        +-----------------+-----------------+

        |                 |                 |

      GitLab            Jenkins          Grafana


        |                 |                 |


        +-----------------+-----------------+


                          |


                    OAuth2 Proxy


                          |


                    Kubernetes


                          |


        +-----------------+----------------+


        |                 |                |


      Vault          Cert-manager     Sealed Secret


        |                 |                |


     Secrets           TLS证书        加密配置

15.16.2 Security目录结构

创建：

复制代码

roles/security/


├── defaults/

│   └── main.yml


├── tasks/

│
│   ├── main.yml
│   ├── vault.yml
│   ├── keycloak.yml
│   ├── oauth2-proxy.yml
│   ├── cert-manager.yml
│   ├── sealed-secret.yml
│   ├── trivy.yml
│   ├── fail2ban.yml
│   ├── auditd.yml
│   └── hardening.yml


├── templates/


│   ├── docker-compose-vault.yml.j2
│   ├── docker-compose-keycloak.yml.j2
│   ├── oauth2-values.yml.j2
│   ├── vault-config.hcl.j2
│   └── security-cron.j2


└── files/

    └── policies/

15.16.3 Security变量

文件：

复制代码

roles/security/defaults/main.yml

---

security_root:

 /opt/security



vault_version:

 1.17



vault_domain:

 vault.company.com



keycloak_domain:

 auth.company.com



oauth2_domain:

 login.company.com



keycloak_admin:

 admin



keycloak_password:

 ChangeMeKeycloak123



vault_password:

 ChangeMeVault123



trivy_version:

 latest



cert_manager_version:

 v1.16.2

15.16.4 Security Playbook

文件：

复制代码

playbooks/security.yml

---

- name:

    Deploy Security Platform


  hosts:

    security


  become:

    true


  roles:


    - security

15.16.5 Security入口

文件：

复制代码

roles/security/tasks/main.yml

---

- import_tasks:

    vault.yml


- import_tasks:

    keycloak.yml


- import_tasks:

    oauth2-proxy.yml


- import_tasks:

    cert-manager.yml


- import_tasks:

    sealed-secret.yml


- import_tasks:

    trivy.yml


- import_tasks:

    fail2ban.yml


- import_tasks:

    auditd.yml


- import_tasks:

    hardening.yml

15.16.6 创建目录

复制代码

---

- name:

    create security directories


  file:


    path:

      "{{ security_root }}/{{ item }}"


    state:

      directory


  loop:


    - vault

    - keycloak

    - trivy

    - policies

Part 15.16.7 Hashicorp Vault部署

架构

复制代码

Application


     |

     |

  Vault Agent


     |

     |

 Vault Server


     |

     |

Encrypted Storage

Docker Compose

文件：

复制代码

templates/docker-compose-vault.yml.j2

services:


 vault:


  image:

    hashicorp/vault:1.17


  container_name:

    vault


  restart:

    always


  cap_add:


    - IPC_LOCK


  ports:


    - "8200:8200"



  volumes:


    - /opt/security/vault:/vault/config



  command:


    vault server -config=/vault/config/vault.hcl

Vault配置

文件：

复制代码

vault-config.hcl.j2

ui = true


storage "file" {


 path="/vault/data"


}


listener "tcp" {


 address="0.0.0.0:8200"


 tls_disable=true


}

部署：

复制代码

---

- name:

    deploy vault


  template:


    src:

      docker-compose-vault.yml.j2


    dest:

      /opt/security/vault/docker-compose.yml



- name:

    start vault


  community.docker.docker_compose:


    project_src:

      /opt/security/vault

Vault初始化

复制代码

docker exec -it vault vault operator init

输出：

复制代码

Unseal Key 1
Unseal Key 2
Unseal Key 3

Root Token

Vault启用KV

复制代码

vault secrets enable kv

创建：

复制代码

vault kv put secret/database \
password=xxxx

15.16.8 Keycloak IAM部署

功能：

SSO
OAuth2
LDAP Federation
MFA
RBAC

架构：

复制代码

LDAP

 |

Keycloak

 |

SSO

 |

GitLab/Jenkins/Jira

Compose

复制代码

services:


 keycloak:


  image:

    quay.io/keycloak/keycloak:latest


  container_name:

    keycloak


  restart:

    always


  ports:


    - "8080:8080"



  environment:


    KEYCLOAK_ADMIN:

      admin


    KEYCLOAK_ADMIN_PASSWORD:

      {{ keycloak_password }}



  command:


    start-dev

部署：

复制代码

---

- name:

    deploy keycloak


  community.docker.docker_compose:


    project_src:

      /opt/security/keycloak

Keycloak LDAP连接

路径：

复制代码

Realm

 |

User Federation

 |

LDAP

参数：

复制代码

Connection URL:

ldap://openldap:389


Base DN:

dc=company,dc=com


Bind DN:

cn=admin,dc=company,dc=com

15.16.9 OAuth2 Proxy

用途：

保护：

Grafana
Kibana
Jenkins
Harbor

Helm Values：

复制代码

config:

 clientID:

  oauth2


 clientSecret:

  secret



provider:

 oidc



oidcIssuerURL:

 https://auth.company.com/realms/company



cookieSecret:

 xxxx

部署：

复制代码

---

- name:

    install oauth2 proxy


  kubernetes.core.helm:


    name:

      oauth2-proxy


    chart_ref:

      oauth2-proxy/oauth2-proxy

15.16.10 Cert-Manager

功能：

自动申请：

Let's Encrypt
企业CA

安装：

复制代码

---

- name:

    install cert-manager


  kubernetes.core.helm:


    name:

      cert-manager


    chart_ref:

      jetstack/cert-manager


    namespace:

      cert-manager


    create_namespace:

      yes


    values:


      installCRDs:

        true

ClusterIssuer

文件：

复制代码

apiVersion:

 cert-manager.io/v1


kind:

 ClusterIssuer



metadata:


 name:

  letsencrypt



spec:


 acme:


  server:

   https://acme-v02.api.letsencrypt.org/directory


  email:

   admin@company.com


  solvers:


  - http01:


      ingress:

       class:

        nginx

15.16.11 Sealed Secrets

用途：

Git保存加密Secret。

安装：

复制代码

---

- name:

    install sealed secret


  kubernetes.core.helm:


    name:

      sealed-secrets


    chart_ref:

      bitnami-labs/sealed-secrets

创建：

复制代码

kubeseal \
--format yaml \
<secret.yaml \
>sealed-secret.yaml

15.16.12 Trivy漏洞扫描

扫描：

Image
Filesystem
Kubernetes

安装：

复制代码

---

- name:

    install trivy


  apt:


    name:

      trivy


    state:

      present

扫描镜像：

复制代码

trivy image nginx:latest

扫描K8s：

复制代码

trivy k8s cluster

15.16.13 Fail2ban

保护：

SSH
Nginx
VPN

安装：

复制代码

---

- name:

    install fail2ban


  apt:


    name:

      fail2ban


    state:

      present

配置：

复制代码

[sshd]


enabled=true


maxretry=5


bantime=3600

启动：

复制代码

systemd:

 name:

  fail2ban

 state:

  started

 enabled:

  yes

15.16.14 Auditd审计

安装：

复制代码

---

- name:

    install auditd


  apt:


    name:

      auditd


    state:

      present

规则：

复制代码

-w /etc/passwd -p wa
-w /etc/sudoers -p wa
-w /var/log -p wa

15.16.15 Linux安全加固

SSH加固

模板：

复制代码

/etc/ssh/sshd_config

配置：

复制代码

PermitRootLogin no

PasswordAuthentication no

MaxAuthTries 3

Kernel安全参数

复制代码

---

- name:

    enable security sysctl


  sysctl:


    name:

      "{{ item.key }}"


    value:

      "{{ item.value }}"


  loop:


  - key:

      net.ipv4.ip_forward

    value:

      0


  - key:

      kernel.randomize_va_space

    value:

      2

15.16.16 Container安全策略

Docker:

复制代码

docker run \
--read-only \
--cap-drop ALL \
--security-opt=no-new-privileges

Kubernetes安全策略

启用：

复制代码

PodSecurity:

restricted

示例：

复制代码

apiVersion:

 v1


kind:

 Namespace


metadata:


 labels:


  pod-security.kubernetes.io/enforce:

   restricted

15.16.17 Security扫描计划

Cron：

复制代码

# Image Scan

0 1 * * *

trivy image company/app



# Kubernetes Scan

0 2 * * *

trivy k8s cluster


# Audit

0 3 * * *

ausearch -ts today

15.16.18 Security健康检查

文件：

复制代码

scripts/check-security.sh

#!/bin/bash


echo "Vault"


curl localhost:8200/v1/sys/health



echo "Keycloak"


curl localhost:8080



echo "Cert Manager"


kubectl get certificate -A



echo "Secrets"


kubectl get sealedsecret -A

Part 15.16完成

✅ Vault密钥管理

✅ Keycloak IAM

✅ LDAP Federation

✅ OAuth2 Proxy

✅ Cert-manager TLS自动化

✅ Sealed Secrets

✅ Trivy漏洞扫描

✅ Fail2ban防护

✅ Auditd审计

✅ Linux Hardening

✅ Kubernetes Security

✅ Container Security