sudo cp /etc/kubernetes/manifests/kube-apiserver.yaml /root/kube-apiserver.yaml.bak

sudo cp /root/kube-apiserver.yaml.bak /etc/kubernetes/manifests/kube-apiserver.yaml

# El pla de control triga entre 20 i 60 segons a recuperar-se
sudo crictl ps | grep kube-apiserver
kubectl get nodes

sudo crictl ps -a | grep apiserver
sudo crictl logs <container-id> 2>&1 | tail -20

# Executar-lo sobre el node de control
kube-bench run --targets=master

# Sobre un node treballador
kube-bench run --targets=node

# Només un control concret
kube-bench run --targets=master --check=1.2.20

[INFO] 1 Control Plane Security Configuration
[INFO] 1.2 API Server
[FAIL] 1.2.20 Ensure that the --profiling argument is set to false (Automated)
[PASS] 1.2.21 Ensure that the --audit-log-path argument is set (Automated)

== Remediations master ==
1.2.20 Edit the API server pod specification file
/etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the below parameter.
--profiling=false

authentication:
  anonymous:
    enabled: false          # mai true
  webhook:
    enabled: true
authorization:
  mode: Webhook             # mai AlwaysAllow
readOnlyPort: 0             # tancar el port 10255
protectKernelDefaults: true

# Escanejar una imatge
trivy image rutas-norte/api-reserves:2.4

# Només vulnerabilitats crítiques i altes
trivy image --severity CRITICAL,HIGH rutas-norte/api-reserves:2.4

# Només les que tenen pedaç disponible
trivy image --ignore-unfixed --severity CRITICAL nginx:1.27-alpine

# Sortida compacta, ideal per a l'examen
trivy image --severity CRITICAL --format table --quiet postgres:16

# Escanejar manifests de Kubernetes (anàlisi estàtica)
trivy config /ruta/a/manifests/

# Escanejar un clúster complet
trivy k8s --report summary cluster

rutas-norte/api-reserves:2.4 (alpine 3.20)
==========================================
Total: 3 (CRITICAL: 3)

┌────────────┬────────────────┬──────────┬───────────────────┬───────────────┐
│  Library   │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │
├────────────┼────────────────┼──────────┼───────────────────┼───────────────┤
│ openssl    │ CVE-2024-XXXXX │ CRITICAL │ 3.1.4-r5          │ 3.1.6-r0      │
└────────────┴────────────────┴──────────┴───────────────────┴───────────────┘

# 1. Treure les imatges dels pods del namespace
kubectl get pods -n rutas-norte-pro \
  -o custom-columns='POD:.metadata.name,IMATGE:.spec.containers[*].image'

# 2. Escanejar-les una a una
for img in nginx:1.27-alpine postgres:16 redis:7-alpine node:20-alpine; do
  echo "=== $img ==="
  trivy image --severity CRITICAL --quiet "$img" | grep -c CVE || true
done

# 3. Eliminar els que correspongui
kubectl delete pod <nom> -n rutas-norte-pro

# Estat i logs
sudo systemctl status falco
sudo journalctl -u falco -f
sudo journalctl -u falco --since "10 minutes ago" | grep Warning

# Recarregar després de canviar regles
sudo systemctl restart falco

# Validar la sintaxi de les regles sense arrencar
falco --validate /etc/falco/falco_rules.local.yaml

09:14:22.113 Notice A shell was spawned in a container with an attached terminal
  (user=root container_id=a1b2c3d4 container_name=api-reserves
   shell=sh parent=runc cmdline=sh)

# /etc/falco/falco_rules.local.yaml
- rule: Terminal shell in container
  output: >
    %evt.time,%user.name,%container.id,%container.name,%proc.name
  override:
    output: replace

- rule: Escriptura sospitosa a /etc dins de contenidor
  desc: Detecta escriptures a /etc dins d un contenidor
  condition: >
    container and
    evt.type in (open, openat) and
    evt.is_open_write=true and
    fd.name startswith /etc
  output: >
    Escriptura a /etc detectada (usuari=%user.name contenidor=%container.name
    fitxer=%fd.name comanda=%proc.cmdline)
  priority: WARNING
  tags: [filesystem, container]

sudo journalctl -u falco --no-pager | grep "Terminal shell" > /opt/incidencies.log

# 1. Al NODE on correrà el pod: crear el perfil
sudo tee /etc/apparmor.d/k8s-rutas-norte-deny-write <<'EOF'
#include <tunables/global>

profile k8s-rutas-norte-deny-write flags=(attach_disconnected) {
  #include <abstractions/base>

  file,
  deny /** w,          # denegar tota escriptura
}
EOF

# 2. Carregar-lo en mode enforce
sudo apparmor_parser -q /etc/apparmor.d/k8s-rutas-norte-deny-write

# 3. Comprovar que està carregat
sudo aa-status | grep rutas-norte

   k8s-rutas-norte-deny-write

apiVersion: v1
kind: Pod
metadata:
  name: worker-notificacions
  namespace: rutas-norte-pro
spec:
  containers:
  - name: worker
    image: busybox:1.36
    command: ["sleep", "3600"]
    securityContext:
      appArmorProfile:
        type: Localhost
        localhostProfile: k8s-rutas-norte-deny-write

metadata:
  annotations:
    container.apparmor.security.beta.kubernetes.io/worker: localhost/k8s-rutas-norte-deny-write

kubectl exec worker-notificacions -n rutas-norte-pro -- touch /tmp/prova
# touch: /tmp/prova: Permission denied

apiVersion: v1
kind: Pod
metadata:
  name: api-reserves-seccomp
  namespace: rutas-norte-pro
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault          # el perfil per defecte del runtime: el més comú
  containers:
  - name: api
    image: nginx:1.27-alpine

sudo mkdir -p /var/lib/kubelet/seccomp/profiles
sudo tee /var/lib/kubelet/seccomp/profiles/auditar.json <<'EOF'
{
  "defaultAction": "SCMP_ACT_LOG"
}
EOF

    securityContext:
      seccompProfile:
        type: Localhost
        localhostProfile: profiles/auditar.json    # ruta RELATIVA a /var/lib/kubelet/seccomp/

apiVersion: audit.k8s.io/v1
kind: Policy
omitStages:
  - RequestReceived
rules:
# No registrar peticions de només lectura sorolloses
- level: None
  verbs: ["get", "list", "watch"]
  resources:
  - group: ""
    resources: ["events"]

# Secrets i ConfigMaps: només metadades, mai el contingut
- level: Metadata
  resources:
  - group: ""
    resources: ["secrets", "configmaps"]

# Pods del namespace crític: cos complet de petició i resposta
- level: RequestResponse
  namespaces: ["rutas-norte-pro"]
  resources:
  - group: ""
    resources: ["pods"]

# Tota la resta, a nivell de metadades
- level: Metadata

spec:
  containers:
  - command:
    - kube-apiserver
    - --audit-policy-file=/etc/kubernetes/audit/policy.yaml
    - --audit-log-path=/var/log/kubernetes/audit/audit.log
    - --audit-log-maxage=30
    - --audit-log-maxbackup=10
    - --audit-log-maxsize=100
    volumeMounts:
    - mountPath: /etc/kubernetes/audit
      name: audit-policy
      readOnly: true
    - mountPath: /var/log/kubernetes/audit
      name: audit-log
      readOnly: false
  volumes:
  - name: audit-policy
    hostPath:
      path: /etc/kubernetes/audit
      type: DirectoryOrCreate
  - name: audit-log
    hostPath:
      path: /var/log/kubernetes/audit
      type: DirectoryOrCreate

sudo crictl ps | grep kube-apiserver
sudo tail -3 /var/log/kubernetes/audit/audit.log | head -1

kubectl label namespace rutas-norte-pro \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=v1.30 \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/audit=restricted \
  --overwrite

kubectl run insegur --image=nginx --privileged -n rutas-norte-pro

Error from server (Forbidden): pods "insegur" is forbidden:
violates PodSecurity "restricted:v1.30": privileged (container "insegur"
must not set securityContext.privileged=true), allowPrivilegeEscalation != false,
unrestricted capabilities, runAsNonRoot != true, seccompProfile

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: nomes-registre-corporatiu
spec:
  validationFailureAction: Enforce
  background: false
  rules:
  - name: comprovar-registre
    match:
      any:
      - resources:
          kinds:
          - Pod
          namespaces:
          - rutas-norte-pro
    validate:
      message: "Es permeten nomes imatges de registry.rutasnorte.es"
      pattern:
        spec:
          containers:
          - image: "registry.rutasnorte.es/*"

# Exigir etiquetes obligatòries
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: exigir-etiqueta-propietari
spec:
  validationFailureAction: Enforce
  rules:
  - name: comprovar-propietari
    match:
      any:
      - resources:
          kinds: ["Deployment", "StatefulSet"]
    validate:
      message: "Falta l'etiqueta 'propietari'"
      pattern:
        metadata:
          labels:
            propietari: "?*"

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sallowedrepos
spec:
  crd:
    spec:
      names:
        kind: K8sAllowedRepos
      validation:
        openAPIV3Schema:
          type: object
          properties:
            repos:
              type: array
              items:
                type: string
  targets:
  - target: admission.k8s.gatekeeper.sh
    rego: |
      package k8sallowedrepos
      violation[{"msg": msg}] {
        container := input.review.object.spec.containers[_]
        satisfied := [good | repo := input.parameters.repos[_]
                             good := startswith(container.image, repo)]
        not any(satisfied)
        msg := sprintf("imatge no permesa: %v", [container.image])
      }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
  name: registres-permesos
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Pod"]
    namespaces: ["rutas-norte-pro"]
  parameters:
    repos:
    - "registry.rutasnorte.es/"

kubectl run prova --image=docker.io/nginx -n rutas-norte-pro
# Error from server: admission webhook denied the request: ...

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: gvisor
handler: runsc              # ha de coincidir amb el handler configurat a containerd

apiVersion: v1
kind: Pod
metadata:
  name: carrega-no-fiable
  namespace: rutas-norte-pre
spec:
  runtimeClassName: gvisor
  containers:
  - name: app
    image: nginx:1.27-alpine

kubectl exec carrega-no-fiable -n rutas-norte-pre -- dmesg | head -3

[    0.000000] Starting gVisor...

# 1. Denegar TOT al namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: denegar-tot
  namespace: rutas-norte-pro
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

# 2. Permetre DNS (imprescindible, s'oblida sempre)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: permetre-dns
  namespace: rutas-norte-pro
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53

# 3. Permetre només el que cal
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-a-postgres
  namespace: rutas-norte-pro
spec:
  podSelector:
    matchLabels:
      app: api-reserves
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: postgres-reserves
    ports:
    - protocol: TCP
      port: 5432

# 1. La ServiceAccount
kubectl create serviceaccount app-reserves -n rutas-norte-pro

# 2. El Role amb el mínim imprescindible
kubectl create role app-reserves-role \
  --verb=get,list \
  --resource=configmaps \
  --resource-name=config-api \
  -n rutas-norte-pro

# 3. El binding
kubectl create rolebinding app-reserves-binding \
  --role=app-reserves-role \
  --serviceaccount=rutas-norte-pro:app-reserves \
  -n rutas-norte-pro

# 4. Assignar-la al Deployment
kubectl set serviceaccount deployment/api-reserves app-reserves -n rutas-norte-pro

kubectl auth can-i get configmap/config-api \
  --as=system:serviceaccount:rutas-norte-pro:app-reserves -n rutas-norte-pro    # yes
kubectl auth can-i get configmaps \
  --as=system:serviceaccount:rutas-norte-pro:app-reserves -n rutas-norte-pro    # no (list de tots)
kubectl auth can-i create pods \
  --as=system:serviceaccount:rutas-norte-pro:app-reserves -n rutas-norte-pro    # no

# A) A la ServiceAccount: afecta tots els pods que la facin servir
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-reserves
  namespace: rutas-norte-pro
automountServiceAccountToken: false

# B) Al Pod: guanya sobre la ServiceAccount
apiVersion: v1
kind: Pod
metadata:
  name: api-reserves
  namespace: rutas-norte-pro
spec:
  serviceAccountName: app-reserves
  automountServiceAccountToken: false
  containers:
  - name: api
    image: rutas-norte/api-reserves:2.4

# C) Apedaçar la ServiceAccount "default" del namespace (tasca molt típica)
kubectl patch serviceaccount default -n rutas-norte-pro \
  -p '{"automountServiceAccountToken": false}'

kubectl exec api-reserves -n rutas-norte-pro -- ls /var/run/secrets/kubernetes.io/serviceaccount
# ls: ...: No such file or directory

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - aescbc:
      keys:
      - name: clau1
        secret: <CLAU_BASE64_DE_32_BYTES>
  - identity: {}

head -c 32 /dev/urandom | base64

    - --encryption-provider-config=/etc/kubernetes/enc/enc.yaml
    volumeMounts:
    - name: enc
      mountPath: /etc/kubernetes/enc
      readOnly: true
  volumes:
  - name: enc
    hostPath:
      path: /etc/kubernetes/enc
      type: DirectoryOrCreate

kubectl get secrets --all-namespaces -o json | kubectl replace -f -

sudo ETCDCTL_API=3 etcdctl get /registry/secrets/rutas-norte-pro/credencials-postgres \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key | hexdump -C | head -3

00000000  2f 72 65 67 69 73 74 72  79 2f 73 65 63 72 65 74  |/registry/secret|
00000020  6b 38 73 3a 65 6e 63 3a  61 65 73 63 62 63 3a 76  |k8s:enc:aescbc:v|

apiVersion: v1
kind: Pod
metadata:
  name: api-reserves-endurit
  namespace: rutas-norte-pro
spec:
  automountServiceAccountToken: false
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    fsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: api
    image: registry.rutasnorte.es/api-reserves:2.4
    securityContext:
      privileged: false
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir: {}

# 1. Aïllar-lo del Service (traient l'etiqueta que el selecciona)
kubectl label pod api-reserves-abc123 -n rutas-norte-pro app-

# 2. Tallar-li la xarxa completament amb una NetworkPolicy dirigida
cat <<'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: quarantena-api-abc123
  namespace: rutas-norte-pro
spec:
  podSelector:
    matchLabels:
      quarantena: "true"
  policyTypes:
  - Ingress
  - Egress
EOF

kubectl label pod api-reserves-abc123 -n rutas-norte-pro quarantena=true

# 3. Preservar evidències
kubectl logs api-reserves-abc123 -n rutas-norte-pro > /opt/evidencies/logs.txt
kubectl describe pod api-reserves-abc123 -n rutas-norte-pro > /opt/evidencies/describe.txt
kubectl get events -n rutas-norte-pro --sort-by=.lastTimestamp > /opt/evidencies/esdeveniments.txt
sudo journalctl -u falco --since "1 hour ago" > /opt/evidencies/falco.txt

# 4. Quan l'anàlisi ha acabat: eliminar-lo
kubectl delete pod api-reserves-abc123 -n rutas-norte-pro --force --grace-period=0

# Buscar accions d'un usuari concret
sudo grep '"username":"suport"' /var/log/kubernetes/audit/audit.log | tail -5

# Buscar accessos a Secrets
sudo cat /var/log/kubernetes/audit/audit.log | \
  jq 'select(.objectRef.resource=="secrets") | {user:.user.username, verb:.verb, ns:.objectRef.namespace, name:.objectRef.name, t:.requestReceivedTimestamp}'

# Buscar eliminacions en un namespace
sudo cat /var/log/kubernetes/audit/audit.log | \
  jq 'select(.verb=="delete" and .objectRef.namespace=="rutas-norte-pro") | {user:.user.username, res:.objectRef.resource, name:.objectRef.name}'

# Sense jq disponible
sudo grep '"verb":"delete"' /var/log/kubernetes/audit/audit.log | \
  grep 'rutas-norte-pro' | tail -3

{"user":"suport","verb":"get","ns":"rutas-norte-pro","name":"credencials-postgres","t":"2026-08-06T09:12:44Z"}

kubectl get pod worker-notificacions -n rutas-norte-pro -o yaml > worker.yaml
vim worker.yaml

apiVersion: v1
kind: Pod
metadata:
  name: worker-notificacions
  namespace: rutas-norte-pro
spec:
  # hostPID: true  ← ELIMINAT
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: worker
    image: busybox:1.36
    command: ["sleep", "3600"]
    securityContext:
      privileged: false
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir: {}

kubectl delete pod worker-notificacions -n rutas-norte-pro
kubectl apply -f worker.yaml

kubectl get pod worker-notificacions -n rutas-norte-pro
kubectl exec worker-notificacions -n rutas-norte-pro -- id
kubectl exec worker-notificacions -n rutas-norte-pro -- touch /arrel

uid=10001 gid=0(root)
touch: /arrel: Read-only file system

sudo cp /etc/kubernetes/manifests/kube-apiserver.yaml /root/apiserver.bak
sudo mkdir -p /etc/kubernetes/audit /var/log/kubernetes/audit

sudo tee /etc/kubernetes/audit/policy.yaml <<'EOF'
apiVersion: audit.k8s.io/v1
kind: Policy
omitStages:
  - RequestReceived
rules:
- level: None
  verbs: ["get", "list", "watch"]
  resources:
  - group: ""
    resources: ["events"]
- level: Metadata
  resources:
  - group: ""
    resources: ["secrets"]
- level: RequestResponse
  namespaces: ["rutas-norte-pro"]
  resources:
  - group: ""
    resources: ["pods"]
- level: Metadata
EOF

sudo vim /etc/kubernetes/manifests/kube-apiserver.yaml

    - --audit-policy-file=/etc/kubernetes/audit/policy.yaml
    - --audit-log-path=/var/log/kubernetes/audit/audit.log
    - --audit-log-maxage=15
    volumeMounts:
    - mountPath: /etc/kubernetes/audit
      name: audit-policy
      readOnly: true
    - mountPath: /var/log/kubernetes/audit
      name: audit-log
  volumes:
  - name: audit-policy
    hostPath:
      path: /etc/kubernetes/audit
      type: DirectoryOrCreate
  - name: audit-log
    hostPath:
      path: /var/log/kubernetes/audit
      type: DirectoryOrCreate

sudo crictl ps | grep kube-apiserver
kubectl get secrets -n rutas-norte-pro
sudo tail -1 /var/log/kubernetes/audit/audit.log | jq '{user:.user.username,res:.objectRef.resource,level:.level}'

{"user":"kubernetes-admin","res":"secrets","level":"Metadata"}

sudo cp /etc/kubernetes/manifests/kube-apiserver.yaml /root/apiserver.bak
sudo mkdir -p /etc/kubernetes/enc

CLAU=$(head -c 32 /dev/urandom | base64)

sudo tee /etc/kubernetes/enc/enc.yaml <<EOF
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - aescbc:
      keys:
      - name: clau1
        secret: ${CLAU}
  - identity: {}
EOF

sudo chmod 600 /etc/kubernetes/enc/enc.yaml
sudo vim /etc/kubernetes/manifests/kube-apiserver.yaml

    - --encryption-provider-config=/etc/kubernetes/enc/enc.yaml
    volumeMounts:
    - name: enc
      mountPath: /etc/kubernetes/enc
      readOnly: true
  volumes:
  - name: enc
    hostPath:
      path: /etc/kubernetes/enc
      type: DirectoryOrCreate

# Esperar que l'API torni
until kubectl get nodes >/dev/null 2>&1; do sleep 3; done

# Rexifrar els Secrets existents
kubectl get secrets -n rutas-norte-pro -o json | kubectl replace -f -

sudo ETCDCTL_API=3 etcdctl get /registry/secrets/rutas-norte-pro/credencials-postgres \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key | hexdump -C | head -2

00000020  6b 38 73 3a 65 6e 63 3a  61 65 73 63 62 63 3a 76  |k8s:enc:aescbc:v|

cat <<'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: denegar-tot
  namespace: rutas-norte-pro
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: permetre-dns
  namespace: rutas-norte-pro
spec:
  podSelector: {}
  policyTypes: [Egress]
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-a-postgres
  namespace: rutas-norte-pro
spec:
  podSelector:
    matchLabels:
      app: api-reserves
  policyTypes: [Egress]
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: postgres-reserves
    ports:
    - protocol: TCP
      port: 5432
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: postgres-des-de-api
  namespace: rutas-norte-pro
spec:
  podSelector:
    matchLabels:
      app: postgres-reserves
  policyTypes: [Ingress]
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: api-reserves
    ports:
    - protocol: TCP
      port: 5432
EOF

kubectl exec deploy/api-reserves -n rutas-norte-pro -- nslookup postgres-reserves
kubectl exec deploy/api-reserves -n rutas-norte-pro -- nc -zv postgres-reserves 5432
kubectl exec deploy/botiga-web -n rutas-norte-pro -- nc -zv -w 3 postgres-reserves 5432   # ha de fallar

kubectl get pods -n rutas-norte-pre \
  -o custom-columns='POD:.metadata.name,IMG:.spec.containers[*].image' --no-headers

botiga-web-1     nginx:1.27-alpine
api-reserves-1   node:18.0.0
redis-1          redis:7-alpine
worker-1         ubuntu:20.04

> /opt/vulnerables.txt
for img in nginx:1.27-alpine node:18.0.0 redis:7-alpine ubuntu:20.04; do
  n=$(trivy image --severity CRITICAL --quiet --format json "$img" \
      | jq '[.Results[].Vulnerabilities // []] | flatten | length')
  echo "$img -> CRITICAL: $n"
  [ "$n" -gt 0 ] && echo "$img" >> /opt/vulnerables.txt
done

nginx:1.27-alpine -> CRITICAL: 0
node:18.0.0 -> CRITICAL: 7
redis:7-alpine -> CRITICAL: 0
ubuntu:20.04 -> CRITICAL: 3

kubectl delete pod api-reserves-1 worker-1 -n rutas-norte-pre
cat /opt/vulnerables.txt

ssh node-1
sudo apparmor_parser -q /opt/perfils/deny-write
sudo aa-status | grep deny-write
exit

   k8s-deny-write

apiVersion: v1
kind: Pod
metadata:
  name: auditor
  namespace: rutas-norte-pro
spec:
  nodeName: node-1
  containers:
  - name: auditor
    image: busybox:1.36
    command: ["sleep", "3600"]
    securityContext:
      appArmorProfile:
        type: Localhost
        localhostProfile: k8s-deny-write

kubectl get pod auditor -n rutas-norte-pro -o wide
kubectl exec auditor -n rutas-norte-pro -- touch /tmp/x

touch: /tmp/x: Permission denied

ssh node-1

sudo tee -a /etc/falco/falco_rules.local.yaml <<'EOF'

- rule: Terminal shell in container
  output: >
    %evt.time,%user.name,%container.id,%container.name,%proc.name
  override:
    output: replace
EOF

sudo falco --validate /etc/falco/falco_rules.local.yaml
sudo systemctl restart falco
sudo systemctl status falco --no-pager | head -5

# Provocar una detecció per verificar (des d'un altre terminal)
kubectl exec -it deploy/api-reserves -n rutas-norte-pro -- sh -c "echo prova"

# Capturar l'evidència
sudo journalctl -u falco --since "10 minutes ago" --no-pager \
  | grep "Terminal shell" > /opt/shells.log
cat /opt/shells.log

09:41:07.882,root,a1b2c3d4e5f6,api-reserves,sh

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: nomes-registre-corporatiu
spec:
  validationFailureAction: Enforce
  background: false
  rules:
  - name: comprovar-registre
    match:
      any:
      - resources:
          kinds:
          - Pod
          namespaces:
          - rutas-norte-pro
    validate:
      message: "Es permeten nomes imatges de registry.rutasnorte.es/"
      pattern:
        spec:
          =(initContainers):
          - image: "registry.rutasnorte.es/*"
          containers:
          - image: "registry.rutasnorte.es/*"

kubectl apply -f politica-registre.yaml
kubectl get clusterpolicy nomes-registre-corporatiu

# Ha de ser rebutjat
kubectl run prova-ko --image=docker.io/nginx:1.27 -n rutas-norte-pro

Error from server: admission webhook "validate.kyverno.svc-fail" denied the request:

policy Pod/rutas-norte-pro/prova-ko for resource violation:
nomes-registre-corporatiu:
  comprovar-registre: 'validation error: Es permeten nomes imatges de
  registry.rutasnorte.es/'

# Ha de ser admès
kubectl run prova-ok --image=registry.rutasnorte.es/nginx:1.27 -n rutas-norte-pro

# 0. Còpia de seguretat SEMPRE primer
sudo cp /etc/kubernetes/manifests/kube-apiserver.yaml /root/apiserver.bak

# 1. Diagnòstic
kube-bench run --targets=master | grep -E '^\[FAIL\]' | head

[FAIL] 1.2.20 Ensure that the --profiling argument is set to false
[FAIL] 1.2.21 Ensure that the --audit-log-path argument is set
[FAIL] 1.2.22 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate

# 2. Correcció
sudo vim /etc/kubernetes/manifests/kube-apiserver.yaml

    - --profiling=false
    - --audit-log-path=/var/log/kubernetes/audit/audit.log
    - --audit-log-maxage=30

    volumeMounts:
    - mountPath: /var/log/kubernetes/audit
      name: audit-log
  volumes:
  - name: audit-log
    hostPath:
      path: /var/log/kubernetes/audit
      type: DirectoryOrCreate

# 3. Esperar i verificar
until kubectl get nodes >/dev/null 2>&1; do sleep 3; done
kubectl get nodes
kube-bench run --targets=master --check=1.2.20,1.2.21,1.2.22

[PASS] 1.2.20 Ensure that the --profiling argument is set to false
[PASS] 1.2.21 Ensure that the --audit-log-path argument is set
[PASS] 1.2.22 Ensure that the --audit-log-maxage argument is set to 30

sudo cp /root/apiserver.bak /etc/kubernetes/manifests/kube-apiserver.yaml
until kubectl get nodes >/dev/null 2>&1; do sleep 3; done

# 1. Muntatge
kubectl create deployment api-reserves --image=nginx:1.27-alpine \
  --replicas=3 -n rutas-norte-pro
kubectl expose deployment api-reserves --port=80 -n rutas-norte-pro
kubectl get endpoints api-reserves -n rutas-norte-pro

NAME           ENDPOINTS
api-reserves   10.244.1.4:80,10.244.1.5:80,10.244.2.3:80

# 2-3. Triar i aïllar del Service
SOSPITOS=$(kubectl get pods -n rutas-norte-pro -l app=api-reserves \
  -o jsonpath='{.items[0].metadata.name}')
kubectl label pod $SOSPITOS -n rutas-norte-pro app-
kubectl label pod $SOSPITOS -n rutas-norte-pro quarantena=true

# 4. Tall total de xarxa al pod en quarantena
cat <<'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: quarantena
  namespace: rutas-norte-pro
spec:
  podSelector:
    matchLabels:
      quarantena: "true"
  policyTypes: [Ingress, Egress]
EOF

# 5. Evidències
mkdir -p /opt/evidencies
kubectl logs $SOSPITOS -n rutas-norte-pro > /opt/evidencies/logs.txt
kubectl describe pod $SOSPITOS -n rutas-norte-pro > /opt/evidencies/describe.txt
kubectl get events -n rutas-norte-pro --sort-by=.lastTimestamp > /opt/evidencies/esdeveniments.txt

# 6. Verificació
kubectl get endpoints api-reserves -n rutas-norte-pro    # 3 endpoints, cap el sospitós
kubectl exec $SOSPITOS -n rutas-norte-pro -- \
  timeout 3 wget -qO- http://api-reserves || echo "aillat correctament"

aillat correctament

# 1. Escaneig
trivy image --severity CRITICAL,HIGH --ignore-unfixed nginx:1.27-alpine

nginx:1.27-alpine (alpine 3.20.3)
Total: 0 (HIGH: 0, CRITICAL: 0)

# 2. Política de Kyverno
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: exigir-no-root
spec:
  validationFailureAction: Enforce
  background: false
  rules:
  - name: comprovar-securitycontext
    match:
      any:
      - resources:
          kinds: ["Pod"]
          namespaces: ["rutas-norte-pro"]
    validate:
      message: "Els pods han de definir runAsNonRoot=true i allowPrivilegeEscalation=false"
      pattern:
        spec:
          =(securityContext):
            runAsNonRoot: true
          containers:
          - securityContext:
              allowPrivilegeEscalation: false

kubectl apply -f exigir-no-root.yaml

# 3. Prova negativa
kubectl run dolent --image=nginx:1.27-alpine -n rutas-norte-pro
# Error from server: admission webhook denied the request: ...

# 3bis. Prova positiva
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: bo
  namespace: rutas-norte-pro
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
  containers:
  - name: c
    image: nginx:1.27-alpine
    securityContext:
      allowPrivilegeEscalation: false
EOF
kubectl get pod bo -n rutas-norte-pro

# 4. Pod Security Admission en mode avís
kubectl label namespace rutas-norte-pre \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/warn-version=v1.30 --overwrite

kubectl run avisat --image=nginx:1.27-alpine -n rutas-norte-pre

Warning: would violate PodSecurity "restricted:v1.30": allowPrivilegeEscalation != false,
unrestricted capabilities, runAsNonRoot != true, seccompProfile
pod/avisat created