kubectl version
Client Version: v1.30.4
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.30.4
kubectl get nodes -o wide
NAME STATUS ROLES AGE VERSION INTERNAL-IP OS-IMAGE CONTAINER-RUNTIME
demo-node1 Ready control-plane 40d v1.30.4 192.168.10.5 Ubuntu 22.04.4 LTS containerd://1.7.19
demo-node2 Ready worker 40d v1.30.4 192.168.10.6 Ubuntu 22.04.4 LTS containerd://1.7.19
demo-node3 Ready worker 40d v1.30.4 192.168.10.7 Ubuntu 22.04.4 LTS containerd://1.7.19
kubectl cluster-info
Kubernetes control plane is running at https://192.168.10.5:6443
CoreDNS is running at https://192.168.10.5:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
kubectl get --raw='/readyz?verbose'
[+]ping ok
[+]log ok
[+]etcd ok
[+]poststarthook/start-apiserver-admission-initializer ok
healthz check passed
（另：kubectl get cs 回显 "Warning: v1 ComponentStatus is deprecated in v1.19+"，仅作对照留存）
kubectl -n kube-system get pod kube-apiserver-demo-node1 -o yaml | grep anonymous-auth
- --anonymous-auth=false
curl -sk https://192.168.10.5:6443/version | head -c 300
{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}
（匿名访问已关闭：无凭据请求回显 401，属预期阴性证据）
kubectl auth can-i --list --as=system:anonymous（另一现场开启匿名时的抽样，节选）
Resources Non-Resource URLs Resource Names Verbs
[/version] [] [get]
[/healthz...] [] [get]
（匿名仅命中 system:public-info-viewer 的公开只读端点，未见资源类权限）
kubectl -n kube-system get pod kube-apiserver-demo-node1 -o yaml | grep "oidc-"
- --oidc-issuer-url=https://sso.demo.local/realms/demo
- --oidc-client-id=kubernetes
- --oidc-username-claim=email
- --oidc-groups-claim=groups
- --oidc-ca-file=/etc/kubernetes/pki/sso-ca.crt
（人员用户经单位统一认证平台 SSO 签发 JWT 接入，证书 CN 账户仅保留给节点与系统组件）
kubectl get pods -A -o jsonpath=...（节选）
212 <空>/自动挂载
38 false
12 true
kubectl -n demo-namespace get pod demo-app-7f9c6b5d4-x2v8p -o jsonpath=...
/var/run/secrets/kubernetes.io/serviceaccount
（业务命名空间 38 个 Pod 已显式关闭自动挂载；kube-system 系统 Pod 属正常挂载）
ls -l /etc/kubernetes/admin.conf
-rw------- 1 root root 5652 Aug 24 09:12 /etc/kubernetes/admin.conf
kubectl config view（节选）
- name: kubernetes-admin
user:
client-certificate-data: DATA+OMITTED
client-key-data: DATA+OMITTED
ls -l /var/lib/kubelet/pki
-rw------- 1 root root 1289 kubelet-client-current.pem
-rw-r--r-- 1 root root 1237 kubelet.crt
（kubeconfig 权限 600，凭据在取证输出中自动脱敏）
kubectl get clusterrolebinding cluster-admin -o jsonpath=...
Group system:masters
（cluster-admin 仅绑定 system:masters 组，人员账户不直接持有）
kubectl get clusterrolebindings -o jsonpath=... | grep -E "system:anonymous|system:unauthenticated"
（无输出：匿名与未认证主体未绑定任何 ClusterRole）
kubectl get clusterrolebindings -o wide（节选）
NAME ROLE AGE USERS GROUPS SERVICEACCOUNTS
system:public-info-viewer ClusterRole/... 40d [system:authenticated system:unauthenticated]
（默认绑定与官方文档一致：未认证组仅可读非敏感公开信息）
kubectl get namespace demo-namespace --show-labels
demo-namespace Active 12d kubernetes.io/metadata.name=demo-namespace,pod-security.kubernetes.io/enforce=baseline,pod-security.kubernetes.io/warn=restricted
（业务命名空间 enforce=baseline、warn=restricted；对照：默认 privileged 级别不产生任何限制）
kubectl -n kube-system get pod kube-apiserver-demo-node1 -o yaml | grep admission
- --enable-admission-plugins=NodeRestriction,AlwaysPullImages
（默认插件已含 PodSecurity，此处为额外启用的插件）
kubectl get pods -A -o jsonpath=...（hostNetwork/hostPID/hostIPC，节选）
kube-system/kube-proxy true false false
kube-system/calico-node true true false
demo-namespace/demo-app-7f9c6b5d4-x2v8p false false false
kubectl get pods -A -o jsonpath=...（privileged，节选）
kube-system/calico-node true
demo-namespace/demo-web-67c9 false
（特权容器仅集中在 kube-system 网络组件，业务命名空间未见 hostPID/hostNetwork/privileged）
kubectl -n kube-system get pod kube-apiserver-demo-node1 -o yaml | grep audit
- --audit-policy-file=/etc/kubernetes/audit-policy.yaml
- --audit-log-path=/var/log/kubernetes/audit/audit.log
- --audit-log-maxage=180
- --audit-log-maxbackup=10
- --audit-log-maxsize=100
grep -E "apiVersion|kind|level" /etc/kubernetes/audit-policy.yaml | head -n 6
apiVersion: audit.k8s.io/v1
kind: Policy
omitStages:
- "RequestReceived"
- level: Metadata # 兜底规则：全部请求记元数据
（secrets 等敏感资源取 Metadata 级别，鉴权失败与删除类取 Request 级别）
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"5f2a...","stage":"ResponseComplete",
"requestURI":"/api/v1/namespaces/demo-namespace/secrets","verb":"create",
"user":{"username":"demo-admin","groups":["demo-team","system:authenticated"]},
"sourceIPs":["192.168.30.21"],"objectRef":{"resource":"secrets","namespace":"demo-namespace","name":"demo-db-credential"},
"responseStatus":{"metadata":{},"code":201},"requestReceivedTimestamp":"2026-08-28T03:12:05.001Z",
"stageTimestamp":"2026-08-28T03:12:05.018Z"}
（用户、动词、对象、来源 IP、结果五要素齐全，事件经采集器上送日志平台）
journalctl -u kubelet --no-pager | tail（节选）
Aug 28 03:00:02 demo-node1 kubelet[2150]: I0828 ... "Pod status updated" pod="demo-namespace/demo-app-7f9c6b5d4-x2v8p" status=Running
Aug 28 09:41:17 demo-node1 kubelet[2150]: E0828 ... "Failed to pull image" pod="demo-namespace/demo-web-67c9" err="pull access denied"
（节点侧日志经 journald 持久化并由采集器上送日志平台，平台留存 365 天）
ss -lntp | grep -E "10250|10255"
LISTEN 0 1024 192.168.10.6:10250 users:(("kubelet",pid=2150,fd=7))
（10255 无监听）
grep -A 3 "authentication" /var/lib/kubelet/config.yaml
authentication:
anonymous:
enabled: false
x509:
clientCAFile: /etc/kubernetes/pki/ca.crt
curl -sk https://192.168.10.6:10250/pods | head -c 200
Unauthorized
（匿名访问关闭，10255 只读端口未开放，授权模式 Webhook）
ss -lntp | grep 2379
LISTEN 0 128 192.168.10.5:2379 users:(("etcd",pid=1876,fd=9))
grep -E "client-cert-auth|listen-client-urls" /etc/kubernetes/manifests/etcd.yaml
- --listen-client-urls=https://127.0.0.1:2379,https://192.168.10.5:2379
- --client-cert-auth=true
- --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
ETCDCTL_API=3 etcdctl ... member list（节选）
4a1b..., started, demo-node1, https://192.168.10.5:2380, https://192.168.10.5:2379, false
（仅监听本机与管理网地址，客户端证书双向认证生效）
kubectl version（节选）
Server Version: v1.30.4
kubectl get nodes -o jsonpath=...
demo-node1 v1.30.4
demo-node2 v1.30.4
demo-node3 v1.30.4
（v1.30 在官方维护的最近三个小版本窗口内，季度漏洞扫描与补丁记录在案）
ss -lntp | grep -E "6443|2379"（节选）
LISTEN 0 128 192.168.10.5:6443 users:(("kube-apiserver",pid=1702,fd=7))
LISTEN 0 128 192.168.10.5:2379 users:(("etcd",pid=1876,fd=9))
iptables -L INPUT -n -v（节选）
1 ACCEPT tcp -- * * 192.168.30.0/24 192.168.10.5 tcp dpt:6443
2 DROP tcp -- * * 0.0.0.0/0 192.168.10.5 tcp dpt:6443
（6443 仅业务/运维网段可达，宿主机部署 EDR 且病毒库当日更新）
kubectl -n kube-system get pod kube-apiserver-demo-node1 -o yaml | grep etcd-
- --etcd-servers=https://127.0.0.1:2379,https://192.168.10.5:2379
- --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
- --etcd-certfile=/etc/kubernetes/pki/etcd/server.crt
- --etcd-keyfile=/etc/kubernetes/pki/etcd/server.key
（etcd 地址为 HTTPS 且 CA/证书/私钥三件套齐备，与 etcd 侧 client-cert-auth 对应）
kubectl get pods -A -o jsonpath=...（节选）
registry.demo.local/demo/app@sha256:9c7f1e2b...
registry.demo.local/demo/web:v2.3.1
（核心业务镜像以 digest 固定，其余镜像经内部仓库准入拉取；仓库启用签名校验并保留扫描报告）
kubectl -n kube-system get pod kube-apiserver-demo-node1 -o yaml | grep encryption
- --encryption-provider-config=/etc/kubernetes/encryption-config.yaml
- --encryption-provider-config-automatic-reload=true
grep -E "apiVersion|kind|providers|secretbox" /etc/kubernetes/encryption-config.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
providers:
- secretbox:
（secretbox 为首位 provider，密钥文件权限 600 且仅 root 可读）
kubectl -n demo-namespace get secret demo-db-credential -o jsonpath='{.type}'
Opaque
ETCDCTL_API=3 etcdctl ... get /registry/secrets/demo-namespace/demo-db-credential --print-value-only | head -c 60
k8s:enc:secretbox:v1:key1:<二进制密文…>
grep tls-min-version /etc/kubernetes/manifests/kube-apiserver.yaml
- --tls-min-version=VersionTLS12
（etcd 落盘为 secretbox 密文，API Server 最低 TLS 1.2，kubectl 侧内容经 RBAC 控制访问）
ls -l /var/backups/etcd/
-rw------- 1 root root 47M Aug 28 03:05 snapshot-demo-20260828.db
-rw------- 1 root root 45M Aug 27 03:05 snapshot-demo-20260827.db
etcdutl snapshot status /var/backups/etcd/snapshot-demo-20260828.db -w table
+----------+----------+------------+------------+
| HASH | REVISION | TOTAL KEYS | TOTAL SIZE |
+----------+----------+------------+------------+
| fe1e2c86 | 452817 | 15234 | 45 MB |
+----------+----------+------------+------------+
crontab -l | grep -i etcd
5 3 * * * /usr/local/bin/etcd-backup.sh（每日快照并同步异地存储，保留 30 份）
kubectl get volumesnapshots -A（节选）
NAMESPACE NAME READYTOUSE SOURCEPVC RESTORESIZE
demo-namespace demo-app-snap-20260828 true demo-app-data 20Gi
velero backup get（节选）
NAME STATUS ERRORS WARNINGS CREATED EXPIRES
demo-full-20260828 Completed 0 0 2026-08-28 03:00:05 +0800 26d
demo-full-20260827 Completed 0 0 2026-08-27 03:00:05 +0800 27d
（Velero 每日全量备份至对象存储，卷快照由 CSI 驱动产生，半年一次恢复演练）
kubectl get pvc -A（节选）
NAMESPACE NAME STATUS VOLUME CAPACITY
demo-namespace demo-app-data Bound pvc-3f2a1b6c-... 20Gi
demo-namespace demo-test-old Bound pvc-8c1d9e2a-... 5Gi
kubectl get pv | grep -i released
pvc-1a2b... 10Gi RWO Retain Released demo-namespace/demo-removed
（1 个 Released 卷按 Retain 保留，纳入季度清理计划）
kubectl get secrets -A | grep -i "service-account-token"
demo-namespace legacy-deploy-token kubernetes.io/service-account-token 3 39d
（存量 1 个手工创建的长期 token Secret：业务确认仍需使用，已收窄 RBAC 权限并纳入季度复核；其余均为 v1.24 后签发的短生命周期令牌）
tail -n 1 /var/log/kubernetes/audit/audit.log（节选，已脱敏）
"verb":"get","user":{"username":"demo-admin",...},"sourceIPs":["192.168.30.21"],
"objectRef":{"resource":"secrets","namespace":"demo-namespace","name":"***"}
（secrets 类请求按策略记录 Metadata 级别，未包含请求/响应体；日志平台对 username 与 IP 做展示脱敏，导出需工单审批）
kubectl -n demo-namespace get configmap demo-app-config -o jsonpath='{.data}' | head -c 300
{"log.level":"info","feature.flags":"a,b","admin.contact":"***@demo.local"}
（抽样未见身份证号、手机号等个人信息；联系邮箱为运维公共邮箱，属平台元数据合理字段）