Skip to content

Commit 06302ad

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #35998 from sarazqy/main
translate content/zh-cn/blog/_posts/2021-12-17-security-profiles-operator-v0.4.0/index.md into Chinese
2 parents 34beb24 + 96ed1a2 commit 06302ad

File tree

1 file changed

+284
-0
lines changed
  • content/zh-cn/blog/_posts/2021-12-17-security-profiles-operator-v0.4.0

1 file changed

+284
-0
lines changed

‎content/zh-cn/blog/_posts/2021-12-17-security-profiles-operator-v0.4.0/index.md

Lines changed: 284 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,284 @@
1+
---
2+
layout: blog
3+
title: "Security Profiles Operator v0.4.0 中的新功能"
4+
date: 2021-12-17
5+
slug: security-profiles-operator
6+
---
7+
8+
<!--
9+
layout: blog
10+
title: "What's new in Security Profiles Operator v0.4.0"
11+
date: 2021-12-17
12+
slug: security-profiles-operator
13+
-->
14+
15+
<!--
16+
**Authors:** Jakub Hrozek, Juan Antonio Osorio, Paulo Gomes, Sascha Grunert
17+
-->
18+
**作者:** Jakub Hrozek, Juan Antonio Osorio, Paulo Gomes, Sascha Grunert
19+
20+
---
21+
22+
<!--
23+
The [Security Profiles Operator (SPO)](https://sigs.k8s.io/security-profiles-operator)
24+
is an out-of-tree Kubernetes enhancement to make the management of
25+
[seccomp](https://en.wikipedia.org/wiki/Seccomp),
26+
[SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) and
27+
[AppArmor](https://en.wikipedia.org/wiki/AppArmor) profiles easier and more
28+
convenient. We're happy to announce that we recently [released
29+
v0.4.0](https://github.com/kubernetes-sigs/security-profiles-operator/releases/tag/v0.4.0)
30+
of the operator, which contains a ton of new features, fixes and usability
31+
improvements.
32+
-->
33+
34+
[Security Profiles Operator (SPO)](https://sigs.k8s.io/security-profiles-operator)
35+
是一种树外 Kubernetes 增强功能，用于更方便、更便捷地管理 [seccomp](https://en.wikipedia.org/wiki/Seccomp)、
36+
[SELinux](https://zh.wikipedia.org/wiki/%E5%AE%89%E5%85%A8%E5%A2%9E%E5%BC%BA%E5%BC%8FLinux) 和
37+
[AppArmor](https://zh.wikipedia.org/wiki/AppArmor) 配置文件。
38+
我们很高兴地宣布，我们最近[发布了 v0.4.0](https://github.com/kubernetes-sigs/security-profiles-operator/releases/tag/v0.4.0)
39+
的 Operator，其中包含了大量的新功能、缺陷修复和可用性改进。
40+
41+
<!--
42+
## What's new
43+
44+
It has been a while since the last
45+
[v0.3.0](https://github.com/kubernetes-sigs/security-profiles-operator/releases/tag/v0.3.0)
46+
release of the operator. We added new features, fine-tuned existing ones and
47+
reworked our documentation in 290 commits over the past half year.
48+
-->
49+
## 有哪些新特性
50+
51+
距离上次的 [v0.3.0](https://github.com/kubernetes-sigs/security-profiles-operator/releases/tag/v0.3.0)
52+
的发布已经有一段时间了。在过去的半年里，我们增加了新的功能，对现有的功能进行了微调，
53+
并且在过去的半年里，我们通过 290 个提交重新编写了文档。
54+
55+
56+
<!--
57+
One of the highlights is that we're now able to record seccomp and SELinux
58+
profiles using the operators [log enricher](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#log-enricher-based-recording).
59+
This allows us to reduce the dependencies required for profile recording to have
60+
[auditd](https://linux.die.net/man/8/auditd) or
61+
[syslog](https://en.wikipedia.org/wiki/Syslog) (as fallback) running on the
62+
nodes. All profile recordings in the operator work in the same way by using the
63+
`ProfileRecording` CRD as well as their corresponding [label
64+
selectors](/docs/concepts/overview/working-with-objects/labels). The log
65+
enricher itself can be also used to gather meaningful insights about seccomp and
66+
SELinux messages of a node. Checkout the [official
67+
documentation](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#using-the-log-enricher)
68+
to learn more about it.
69+
-->
70+
71+
亮点之一是我们现在能够使用 Operator 的[日志增强组件](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#log-enricher-based-recording)
72+
记录 seccomp 和 SELinux 的配置文件。
73+
这使我们能够减少配置文件记录所需的依赖事项，使得仅剩的依赖变为在节点上运行
74+
[auditd](https://linux.die.net/man/8/auditd) 或 [syslog](https://en.wikipedia.org/wiki/Syslog)（作为一种回退机制）。
75+
通过使用 `ProfileRecording` CRD 及其对应的[标签选择算符](/zh-cn/concepts/overview/working-with-objects/labels)，
76+
Operator 中的所有配置文件记录都以相同的方式工作。
77+
日志增强组件本身也可用于获得有关节点上的 seccomp 和 SELinux 消息的有意义的洞察。
78+
查看[官方文档](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#using-the-log-enricher)
79+
了解更多信息。
80+
81+
<!--
82+
### seccomp related improvements
83+
84+
Beside the log enricher based recording we now offer an alternative to record
85+
seccomp profiles by utilizing [ebpf](https://ebpf.io). This optional feature can
86+
be enabled by setting `enableBpfRecorder` to `true`. This results in running a
87+
dedicated container, which ships a custom bpf module on every node to collect
88+
the syscalls for containers. It even supports older Kernel versions which do not
89+
expose the [BPF Type Format (BTF)](https://www.kernel.org/doc/html/latest/bpf/btf.html) per
90+
default as well as the `amd64` and `arm64` architectures. Checkout
91+
[our documentation](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#ebpf-based-recording)
92+
to see it in action. By the way, we now add the seccomp profile architecture of
93+
the recorder host to the recorded profile as well.
94+
-->
95+
96+
### 与 seccomp 有关的改进
97+
98+
除了基于日志丰富器的记录之外，我们现在还使用 [ebpf](https://ebpf.io)
99+
作为记录 seccomp 配置文件的一种替代方法。可以通过将 `enableBpfRecorder` 设置为 `true` 来启用此可选功能。
100+
启用之后会导致一个专用的容器被启动运行；该容器在每个节点上提供一个自定义 bpf 模块以收集容器的系统调用。
101+
它甚至支持默认不公开 [BPF 类型格式 (BTF)](https://www.kernel.org/doc/html/latest/bpf/btf.html)
102+
的旧内核版本以及 `amd64 ` 和 `arm64` 架构。查看 [我们的文档](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#ebpf-based-recording)
103+
以查看它的实际效果。顺便说一句，我们现在也将记录器主机的 seccomp 配置文件体系结构添加到记录的配置文件中。
104+
105+
<!--
106+
We also graduated the seccomp profile API from `v1alpha1` to `v1beta1`. This
107+
aligns with our overall goal to stabilize the CRD APIs over time. The only thing
108+
which has changed is that the seccomp profile type `Architectures` now points to
109+
`[]Arch` instead of `[]*Arch`.
110+
-->
111+
我们还将 seccomp 配置文件 API 从 `v1alpha1` 升级到 `v1beta1`。
112+
这符合我们随着时间的推移稳定 CRD API 的总体目标。
113+
唯一改变的是 seccomp 配置文件类型 `Architectures` 现在指向 `[]Arch` 而不是 `[]*Arch`。
114+
115+
116+
<!--
117+
### SELinux enhancements
118+
119+
Managing SELinux policies (an equivalent to using `semodule` that
120+
you would normally call on a single server) is not done by SPO
121+
itself, but by another container called selinuxd to provide better
122+
isolation. This release switched to using selinuxd containers from
123+
a personal repository to images located under [our team's quay.io
124+
repository](https://quay.io/organization/security-profiles-operator).
125+
The selinuxd repository has moved as well to [the containers GitHub
126+
organization](https://github.com/containers/selinuxd).
127+
-->
128+
### SELinux 增强功能
129+
130+
管理 SELinux 策略（相当于使用通常在单个服务器上调用的 `semodule` ）不是由 SPO 本身完成的，
131+
而是由另一个名为 selinuxd 的容器完成，以提供更好的隔离。此版本将所使用的 selinuxd
132+
容器镜像从个人仓库迁移到位于[我们团队的 quay.io 仓库](https://quay.io/organization/security-profiles-operator)下的镜像。
133+
selinuxd 仓库也已移至[GitHub 组织 containers](https://github.com/containers/selinuxd)。
134+
135+
<!--
136+
Please note that selinuxd links dynamically to `libsemanage` and mounts the
137+
SELinux directories from the nodes, which means that the selinuxd container
138+
must be running the same distribution as the cluster nodes. SPO defaults
139+
to using CentOS-8 based containers, but we also build Fedora based ones.
140+
If you are using another distribution and would like us to add support for
141+
it, please file [an issue against selinuxd](https://github.com/containers/selinuxd/issues).
142+
-->
143+
请注意，selinuxd 动态链接到 libsemanage 并挂载节点上的 SELinux 目录，
144+
这意味着 selinuxd 容器必须与集群节点运行相同的发行版。SPO 默认使用基于 CentOS-8 的容器，
145+
但我们也构建基于 Fedora 的容器。如果你使用其他发行版并希望我们添加对它的支持，
146+
请[针对 selinuxd 提交 issue](https://github.com/containers/selinuxd/issues)。
147+
148+
<!--
149+
#### Profile Recording
150+
151+
This release adds support for recording of SELinux profiles.
152+
The recording itself is managed via an instance of a `ProfileRecording` Custom
153+
Resource as seen in an
154+
[example](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/examples/profilerecording-selinux-logs.yaml)
155+
in our repository. From the user's point of view it works pretty much the same
156+
as recording of seccomp profiles.
157+
-->
158+
#### 配置文件记录
159+
160+
此版本（0.4.0）增加了记录 SELinux 配置文件的支持。记录本身是通过 `ProfileRecording` 自定义资源的实例管理的，
161+
如我们仓库中的[示例](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/examples/profilerecording-selinux-logs.yaml)
162+
所示。从用户的角度来看，它的工作原理与记录 seccomp 配置文件几乎相同。
163+
164+
<!--
165+
Under the hood, to know what the workload is doing SPO installs a special
166+
permissive policy called [selinuxrecording](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/deploy/base/profiles/selinuxrecording.cil)
167+
on startup which allows everything and logs all AVCs to `audit.log`.
168+
These AVC messages are scraped by the log enricher component and when
169+
the recorded workload exits, the policy is created.
170+
-->
171+
在后台，为了知道工作负载在做什么，SPO 安装了一个名为 [selinuxrecording](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/deploy/base/profiles/selinuxrecording.cil)
172+
的、限制宽松的策略，允许执行所有操作并将所有 AVC 记录到 `audit.log` 中。
173+
这些 AVC 消息由日志增强组件抓取，当所记录的工作负载退出时，该策略被创建。
174+
175+
<!--
176+
#### `SELinuxProfile` CRD graduation
177+
178+
An `v1alpha2` version of the `SelinuxProfile` object has been introduced. This
179+
removes the raw Common Intermediate Language (CIL) from the object itself and
180+
instead adds a simple policy language to ease the writing and parsing
181+
experience.
182+
-->
183+
#### `SELinuxProfile` CRD 毕业
184+
185+
我们引入了 `SelinuxProfile` 对象的 `v1alpha2` 版本。
186+
这个版本从对象中删除了原始的通用中间语言 (CIL)，并添加了一种简单的策略语言来简化编写和解析体验。
187+
188+
<!--
189+
Alongside, a `RawSelinuxProfile` object was also introduced. This contains a
190+
wrapped and raw representation of the policy. This was intended for folks to be
191+
able to take their existing policies into use as soon as possible. However, on
192+
validations are done here.
193+
-->
194+
此外，我们还引入了 `RawSelinuxProfile` 对象。该对象包含策略的包装和原始表示。
195+
引入此对象是为了让人们能够尽快将他们现有的策略付诸实现。但是，策略的验证是在这里完成的。
196+
197+
<!--
198+
### AppArmor support
199+
200+
This version introduces the initial support for AppArmor, allowing users to load and
201+
unload AppArmor profiles into cluster nodes by using the new [AppArmorProfile](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/deploy/base/crds/apparmorprofile.yaml) CRD.
202+
-->
203+
### AppArmor 支持
204+
205+
0.4.0 版本引入了对 AppArmor 的初始支持，允许用户通过使用新的
206+
[AppArmorProfile](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/deploy/base/crds/apparmorprofile.yaml)
207+
在集群节点中 CRD 加载或卸载 AppArmor 配置文件。
208+
209+
<!--
210+
To enable AppArmor support use the [enableAppArmor feature gate](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/examples/config.yaml#L10) switch of your SPO configuration.
211+
Then use our [apparmor example](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/examples/apparmorprofile.yaml) to deploy your first profile across your cluster.
212+
-->
213+
要启用 AppArmor 支持，请使用 SPO 配置的 [enableAppArmor 特性门控](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/examples/config.yaml#L10)开关。
214+
然后使用我们的 [apparmor 示例](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/examples/apparmorprofile.yaml) 在集群中部署你第一个配置文件。
215+
216+
<!--
217+
### Metrics
218+
219+
The operator now exposes metrics, which are described in detail in
220+
our new [metrics documentation](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#using-metrics).
221+
We decided to secure the metrics retrieval process by using
222+
[kube-rbac-proxy](https://github.com/brancz/kube-rbac-proxy), while we ship an
223+
additional `spo-metrics-client` cluster role (and binding) to retrieve the
224+
metrics from within the cluster. If you're using
225+
[OpenShift](https://www.redhat.com/en/technologies/cloud-computing/openshift),
226+
then we provide an out of the box working
227+
[`ServiceMonitor`](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#automatic-servicemonitor-deployment)
228+
to access the metrics.
229+
-->
230+
### 指标
231+
232+
Operator 现在能够公开在我们的新[指标文档](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#using-metrics)中详细描述的指标。
233+
我们决定使用 [kube-rbac-proxy](https://github.com/brancz/kube-rbac-proxy) 来保护指标检索过程，
234+
同时我们提供了一个额外的 `spo-metrics-client` 集群角色（和绑定）以从集群内检索指标。
235+
如果你使用 [OpenShift](https://www.redhat.com/en/technologies/cloud-computing/openshift)，
236+
那么我们提供了一个开箱即用的 [`ServiceMonitor`](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#automatic-servicemonitor-deployment)
237+
来访问指标。
238+
239+
240+
<!--
241+
#### Debuggability and robustness
242+
243+
Beside all those new features, we decided to restructure parts of the Security
244+
Profiles Operator internally to make it better to debug and more robust. For
245+
example, we now maintain an internal [gRPC](https://grpc.io) API to communicate
246+
within the operator across different features. We also improved the performance
247+
of the log enricher, which now caches results for faster retrieval of the log
248+
data. The operator can be put into a more [verbose log mode](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#set-logging-verbosity)
249+
by setting `verbosity` from `0` to `1`.
250+
-->
251+
#### 可调试性和稳健性
252+
253+
除了所有这些新功能外，我们还决定在内部重组安全配置文件操作程序的部分内容，使其更易于调试和更稳健。
254+
例如，我们现在维护了一个内部 [gRPC](https://grpc.io) API，以便在 Operator 内部跨不同功能组件进行通信。
255+
我们还提高了日志增强组件的性能，现在它可以缓存结果，以便更快地检索日志数据。
256+
Operator 可以通过将 `verbosity` 设置从 `0` 改为 `1`，启用更详细的日志模式(https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#set-logging-verbosity)。
257+
258+
<!--
259+
We also print the used `libseccomp` and `libbpf` versions on startup, as well as
260+
expose CPU and memory profiling endpoints for each container via the
261+
[`enableProfiling` option](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#enable-cpu-and-memory-profiling).
262+
Dedicated liveness and startup probes inside of the operator daemon will now
263+
additionally improve the life cycle of the operator.
264+
-->
265+
我们还在启动时打印所使用的 `libseccomp` 和 `libbpf` 版本，
266+
并通过 [`enableProfiling` 选项](https://github.com/kubernetes-sigs/security-profiles-operator/blob/71b3915/installation-usage.md#enable-cpu-and-memory-profiling)
267+
公开每个容器的 CPU 和内存性能分析端点。
268+
Operator 守护程序内部的专用的存活态探测和启动探测现在能进一步改善 Operator 的生命周期管理。
269+
270+
271+
<!--
272+
## Conclusion
273+
274+
Thank you for reading this update. We're looking forward to future enhancements
275+
of the operator and would love to get your feedback about the latest release.
276+
Feel free to reach out to us via the Kubernetes slack
277+
[#security-profiles-operator](https://kubernetes.slack.com/messages/security-profiles-operator)
278+
for any feedback or question.
279+
-->
280+
## 总结
281+
282+
感谢你阅读这次更新。我们期待着 Operater 的未来改进，并希望得到你对最新版本的反馈。
283+
欢迎通过 Kubernetes slack [#security-profiles-operator](https://kubernetes.slack.com/messages/security-profiles-operator)
284+
与我们联系，提出任何反馈或问题。

0 commit comments

Comments
 (0)