sudo cp /etc/kubernetes/manifests/kube-apiserver.yaml /root/kube-apiserver.yaml.bak

sudo cp /root/kube-apiserver.yaml.bak /etc/kubernetes/manifests/kube-apiserver.yaml

# El plano de control tarda entre 20 y 60 segundos en recuperarse
sudo crictl ps | grep kube-apiserver
kubectl get nodes

sudo crictl ps -a | grep apiserver
sudo crictl logs <container-id> 2>&1 | tail -20

# Ejecutarlo sobre el nodo de control
kube-bench run --targets=master

# Sobre un nodo trabajador
kube-bench run --targets=node

# Solo un control concreto
kube-bench run --targets=master --check=1.2.20

[INFO] 1 Control Plane Security Configuration
[INFO] 1.2 API Server
[FAIL] 1.2.20 Ensure that the --profiling argument is set to false (Automated)
[PASS] 1.2.21 Ensure that the --audit-log-path argument is set (Automated)

== Remediations master ==
1.2.20 Edit the API server pod specification file
/etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the below parameter.
--profiling=false

authentication:
  anonymous:
    enabled: false          # nunca true
  webhook:
    enabled: true
authorization:
  mode: Webhook             # nunca AlwaysAllow
readOnlyPort: 0             # cerrar el puerto 10255
protectKernelDefaults: true

# Escanear una imagen
trivy image rutas-norte/api-reservas:2.4

# Solo vulnerabilidades críticas y altas
trivy image --severity CRITICAL,HIGH rutas-norte/api-reservas:2.4

# Solo las que tienen parche disponible
trivy image --ignore-unfixed --severity CRITICAL nginx:1.27-alpine

# Salida compacta, ideal para el examen
trivy image --severity CRITICAL --format table --quiet postgres:16

# Escanear manifiestos de Kubernetes (análisis estático)
trivy config /ruta/a/manifiestos/

# Escanear un clúster completo
trivy k8s --report summary cluster

rutas-norte/api-reservas:2.4 (alpine 3.20)
==========================================
Total: 3 (CRITICAL: 3)

┌────────────┬────────────────┬──────────┬───────────────────┬───────────────┐
│  Library   │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │
├────────────┼────────────────┼──────────┼───────────────────┼───────────────┤
│ openssl    │ CVE-2024-XXXXX │ CRITICAL │ 3.1.4-r5          │ 3.1.6-r0      │
└────────────┴────────────────┴──────────┴───────────────────┴───────────────┘

# 1. Sacar las imágenes de los pods del namespace
kubectl get pods -n rutas-norte-pro \
  -o custom-columns='POD:.metadata.name,IMAGEN:.spec.containers[*].image'

# 2. Escanear cada una
for img in nginx:1.27-alpine postgres:16 redis:7-alpine node:20-alpine; do
  echo "=== $img ==="
  trivy image --severity CRITICAL --quiet "$img" | grep -c CVE || true
done

# 3. Eliminar los que corresponda
kubectl delete pod <nombre> -n rutas-norte-pro

# Estado y logs
sudo systemctl status falco
sudo journalctl -u falco -f
sudo journalctl -u falco --since "10 minutes ago" | grep Warning

# Recargar tras cambiar reglas
sudo systemctl restart falco

# Validar la sintaxis de las reglas sin arrancar
falco --validate /etc/falco/falco_rules.local.yaml

09:14:22.113 Notice A shell was spawned in a container with an attached terminal
  (user=root container_id=a1b2c3d4 container_name=api-reservas
   shell=sh parent=runc cmdline=sh)

# /etc/falco/falco_rules.local.yaml
- rule: Terminal shell in container
  output: >
    %evt.time,%user.name,%container.id,%container.name,%proc.name
  override:
    output: replace

- rule: Escritura sospechosa en /etc dentro de contenedor
  desc: Detecta escrituras en /etc dentro de un contenedor
  condition: >
    container and
    evt.type in (open, openat) and
    evt.is_open_write=true and
    fd.name startswith /etc
  output: >
    Escritura en /etc detectada (usuario=%user.name contenedor=%container.name
    fichero=%fd.name comando=%proc.cmdline)
  priority: WARNING
  tags: [filesystem, container]

sudo journalctl -u falco --no-pager | grep "Terminal shell" > /opt/incidencias.log

# 1. En el NODO donde correrá el pod: crear el perfil
sudo tee /etc/apparmor.d/k8s-rutas-norte-deny-write <<'EOF'
#include <tunables/global>

profile k8s-rutas-norte-deny-write flags=(attach_disconnected) {
  #include <abstractions/base>

  file,
  deny /** w,          # denegar toda escritura
}
EOF

# 2. Cargarlo en modo enforce
sudo apparmor_parser -q /etc/apparmor.d/k8s-rutas-norte-deny-write

# 3. Comprobar que está cargado
sudo aa-status | grep rutas-norte

   k8s-rutas-norte-deny-write

apiVersion: v1
kind: Pod
metadata:
  name: worker-notificaciones
  namespace: rutas-norte-pro
spec:
  containers:
  - name: worker
    image: busybox:1.36
    command: ["sleep", "3600"]
    securityContext:
      appArmorProfile:
        type: Localhost
        localhostProfile: k8s-rutas-norte-deny-write

metadata:
  annotations:
    container.apparmor.security.beta.kubernetes.io/worker: localhost/k8s-rutas-norte-deny-write

kubectl exec worker-notificaciones -n rutas-norte-pro -- touch /tmp/prueba
# touch: /tmp/prueba: Permission denied

apiVersion: v1
kind: Pod
metadata:
  name: api-reservas-seccomp
  namespace: rutas-norte-pro
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault          # el perfil por defecto del runtime: lo más común
  containers:
  - name: api
    image: nginx:1.27-alpine

sudo mkdir -p /var/lib/kubelet/seccomp/profiles
sudo tee /var/lib/kubelet/seccomp/profiles/auditar.json <<'EOF'
{
  "defaultAction": "SCMP_ACT_LOG"
}
EOF

    securityContext:
      seccompProfile:
        type: Localhost
        localhostProfile: profiles/auditar.json    # ruta RELATIVA a /var/lib/kubelet/seccomp/

apiVersion: audit.k8s.io/v1
kind: Policy
omitStages:
  - RequestReceived
rules:
# No registrar peticiones de solo lectura ruidosas
- level: None
  verbs: ["get", "list", "watch"]
  resources:
  - group: ""
    resources: ["events"]

# Secrets y ConfigMaps: solo metadatos, nunca el contenido
- level: Metadata
  resources:
  - group: ""
    resources: ["secrets", "configmaps"]

# Pods del namespace crítico: cuerpo completo de petición y respuesta
- level: RequestResponse
  namespaces: ["rutas-norte-pro"]
  resources:
  - group: ""
    resources: ["pods"]

# Todo lo demás, a nivel de metadatos
- level: Metadata

spec:
  containers:
  - command:
    - kube-apiserver
    - --audit-policy-file=/etc/kubernetes/audit/policy.yaml
    - --audit-log-path=/var/log/kubernetes/audit/audit.log
    - --audit-log-maxage=30
    - --audit-log-maxbackup=10
    - --audit-log-maxsize=100
    volumeMounts:
    - mountPath: /etc/kubernetes/audit
      name: audit-policy
      readOnly: true
    - mountPath: /var/log/kubernetes/audit
      name: audit-log
      readOnly: false
  volumes:
  - name: audit-policy
    hostPath:
      path: /etc/kubernetes/audit
      type: DirectoryOrCreate
  - name: audit-log
    hostPath:
      path: /var/log/kubernetes/audit
      type: DirectoryOrCreate

sudo crictl ps | grep kube-apiserver
sudo tail -3 /var/log/kubernetes/audit/audit.log | head -1

kubectl label namespace rutas-norte-pro \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=v1.30 \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/audit=restricted \
  --overwrite

kubectl run inseguro --image=nginx --privileged -n rutas-norte-pro

Error from server (Forbidden): pods "inseguro" is forbidden:
violates PodSecurity "restricted:v1.30": privileged (container "inseguro"
must not set securityContext.privileged=true), allowPrivilegeEscalation != false,
unrestricted capabilities, runAsNonRoot != true, seccompProfile

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: solo-registro-corporativo
spec:
  validationFailureAction: Enforce
  background: false
  rules:
  - name: comprobar-registro
    match:
      any:
      - resources:
          kinds:
          - Pod
          namespaces:
          - rutas-norte-pro
    validate:
      message: "Solo se admiten imagenes de registry.rutasnorte.es"
      pattern:
        spec:
          containers:
          - image: "registry.rutasnorte.es/*"

# Exigir etiquetas obligatorias
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: exigir-etiqueta-propietario
spec:
  validationFailureAction: Enforce
  rules:
  - name: comprobar-propietario
    match:
      any:
      - resources:
          kinds: ["Deployment", "StatefulSet"]
    validate:
      message: "Falta la etiqueta 'propietario'"
      pattern:
        metadata:
          labels:
            propietario: "?*"

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sallowedrepos
spec:
  crd:
    spec:
      names:
        kind: K8sAllowedRepos
      validation:
        openAPIV3Schema:
          type: object
          properties:
            repos:
              type: array
              items:
                type: string
  targets:
  - target: admission.k8s.gatekeeper.sh
    rego: |
      package k8sallowedrepos
      violation[{"msg": msg}] {
        container := input.review.object.spec.containers[_]
        satisfied := [good | repo := input.parameters.repos[_]
                             good := startswith(container.image, repo)]
        not any(satisfied)
        msg := sprintf("imagen no permitida: %v", [container.image])
      }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
  name: registros-permitidos
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Pod"]
    namespaces: ["rutas-norte-pro"]
  parameters:
    repos:
    - "registry.rutasnorte.es/"

kubectl run prueba --image=docker.io/nginx -n rutas-norte-pro
# Error from server: admission webhook denied the request: ...

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: gvisor
handler: runsc              # debe coincidir con el handler configurado en containerd

apiVersion: v1
kind: Pod
metadata:
  name: carga-no-confiable
  namespace: rutas-norte-pre
spec:
  runtimeClassName: gvisor
  containers:
  - name: app
    image: nginx:1.27-alpine

kubectl exec carga-no-confiable -n rutas-norte-pre -- dmesg | head -3

[    0.000000] Starting gVisor...

# 1. Denegar TODO en el namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: denegar-todo
  namespace: rutas-norte-pro
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

# 2. Permitir DNS (imprescindible, se olvida siempre)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: permitir-dns
  namespace: rutas-norte-pro
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53

# 3. Permitir solo lo necesario
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-a-postgres
  namespace: rutas-norte-pro
spec:
  podSelector:
    matchLabels:
      app: api-reservas
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: postgres-reservas
    ports:
    - protocol: TCP
      port: 5432

# 1. La ServiceAccount
kubectl create serviceaccount app-reservas -n rutas-norte-pro

# 2. El Role con el mínimo imprescindible
kubectl create role app-reservas-role \
  --verb=get,list \
  --resource=configmaps \
  --resource-name=config-api \
  -n rutas-norte-pro

# 3. El binding
kubectl create rolebinding app-reservas-binding \
  --role=app-reservas-role \
  --serviceaccount=rutas-norte-pro:app-reservas \
  -n rutas-norte-pro

# 4. Asignarla al Deployment
kubectl set serviceaccount deployment/api-reservas app-reservas -n rutas-norte-pro

kubectl auth can-i get configmap/config-api \
  --as=system:serviceaccount:rutas-norte-pro:app-reservas -n rutas-norte-pro    # yes
kubectl auth can-i get configmaps \
  --as=system:serviceaccount:rutas-norte-pro:app-reservas -n rutas-norte-pro    # no (list de todos)
kubectl auth can-i create pods \
  --as=system:serviceaccount:rutas-norte-pro:app-reservas -n rutas-norte-pro    # no

# A) En la ServiceAccount: afecta a todos los pods que la usen
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-reservas
  namespace: rutas-norte-pro
automountServiceAccountToken: false

# B) En el Pod: gana sobre la ServiceAccount
apiVersion: v1
kind: Pod
metadata:
  name: api-reservas
  namespace: rutas-norte-pro
spec:
  serviceAccountName: app-reservas
  automountServiceAccountToken: false
  containers:
  - name: api
    image: rutas-norte/api-reservas:2.4

# C) Parchear la ServiceAccount "default" del namespace (tarea muy típica)
kubectl patch serviceaccount default -n rutas-norte-pro \
  -p '{"automountServiceAccountToken": false}'

kubectl exec api-reservas -n rutas-norte-pro -- ls /var/run/secrets/kubernetes.io/serviceaccount
# ls: ...: No such file or directory

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - aescbc:
      keys:
      - name: clave1
        secret: <CLAVE_BASE64_DE_32_BYTES>
  - identity: {}

head -c 32 /dev/urandom | base64

    - --encryption-provider-config=/etc/kubernetes/enc/enc.yaml
    volumeMounts:
    - name: enc
      mountPath: /etc/kubernetes/enc
      readOnly: true
  volumes:
  - name: enc
    hostPath:
      path: /etc/kubernetes/enc
      type: DirectoryOrCreate

kubectl get secrets --all-namespaces -o json | kubectl replace -f -

sudo ETCDCTL_API=3 etcdctl get /registry/secrets/rutas-norte-pro/credenciales-postgres \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key | hexdump -C | head -3

00000000  2f 72 65 67 69 73 74 72  79 2f 73 65 63 72 65 74  |/registry/secret|
00000020  6b 38 73 3a 65 6e 63 3a  61 65 73 63 62 63 3a 76  |k8s:enc:aescbc:v|

apiVersion: v1
kind: Pod
metadata:
  name: api-reservas-endurecido
  namespace: rutas-norte-pro
spec:
  automountServiceAccountToken: false
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    fsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: api
    image: registry.rutasnorte.es/api-reservas:2.4
    securityContext:
      privileged: false
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir: {}

# 1. Aislarlo del Service (quitando la etiqueta que lo selecciona)
kubectl label pod api-reservas-abc123 -n rutas-norte-pro app-

# 2. Cortarle la red por completo con una NetworkPolicy dirigida
cat <<'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: cuarentena-api-abc123
  namespace: rutas-norte-pro
spec:
  podSelector:
    matchLabels:
      cuarentena: "true"
  policyTypes:
  - Ingress
  - Egress
EOF

kubectl label pod api-reservas-abc123 -n rutas-norte-pro cuarentena=true

# 3. Preservar evidencias
kubectl logs api-reservas-abc123 -n rutas-norte-pro > /opt/evidencias/logs.txt
kubectl describe pod api-reservas-abc123 -n rutas-norte-pro > /opt/evidencias/describe.txt
kubectl get events -n rutas-norte-pro --sort-by=.lastTimestamp > /opt/evidencias/eventos.txt
sudo journalctl -u falco --since "1 hour ago" > /opt/evidencias/falco.txt

# 4. Cuando el análisis ha terminado: eliminarlo
kubectl delete pod api-reservas-abc123 -n rutas-norte-pro --force --grace-period=0

# Buscar acciones de un usuario concreto
sudo grep '"username":"soporte"' /var/log/kubernetes/audit/audit.log | tail -5

# Buscar accesos a Secrets
sudo cat /var/log/kubernetes/audit/audit.log | \
  jq 'select(.objectRef.resource=="secrets") | {user:.user.username, verb:.verb, ns:.objectRef.namespace, name:.objectRef.name, t:.requestReceivedTimestamp}'

# Buscar eliminaciones en un namespace
sudo cat /var/log/kubernetes/audit/audit.log | \
  jq 'select(.verb=="delete" and .objectRef.namespace=="rutas-norte-pro") | {user:.user.username, res:.objectRef.resource, name:.objectRef.name}'

# Sin jq disponible
sudo grep '"verb":"delete"' /var/log/kubernetes/audit/audit.log | \
  grep 'rutas-norte-pro' | tail -3

{"user":"soporte","verb":"get","ns":"rutas-norte-pro","name":"credenciales-postgres","t":"2026-08-06T09:12:44Z"}

kubectl get pod worker-notificaciones -n rutas-norte-pro -o yaml > worker.yaml
vim worker.yaml

apiVersion: v1
kind: Pod
metadata:
  name: worker-notificaciones
  namespace: rutas-norte-pro
spec:
  # hostPID: true  ← ELIMINADO
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: worker
    image: busybox:1.36
    command: ["sleep", "3600"]
    securityContext:
      privileged: false
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir: {}

kubectl delete pod worker-notificaciones -n rutas-norte-pro
kubectl apply -f worker.yaml

kubectl get pod worker-notificaciones -n rutas-norte-pro
kubectl exec worker-notificaciones -n rutas-norte-pro -- id
kubectl exec worker-notificaciones -n rutas-norte-pro -- touch /raiz

uid=10001 gid=0(root)
touch: /raiz: Read-only file system

sudo cp /etc/kubernetes/manifests/kube-apiserver.yaml /root/apiserver.bak
sudo mkdir -p /etc/kubernetes/audit /var/log/kubernetes/audit

sudo tee /etc/kubernetes/audit/policy.yaml <<'EOF'
apiVersion: audit.k8s.io/v1
kind: Policy
omitStages:
  - RequestReceived
rules:
- level: None
  verbs: ["get", "list", "watch"]
  resources:
  - group: ""
    resources: ["events"]
- level: Metadata
  resources:
  - group: ""
    resources: ["secrets"]
- level: RequestResponse
  namespaces: ["rutas-norte-pro"]
  resources:
  - group: ""
    resources: ["pods"]
- level: Metadata
EOF

sudo vim /etc/kubernetes/manifests/kube-apiserver.yaml

    - --audit-policy-file=/etc/kubernetes/audit/policy.yaml
    - --audit-log-path=/var/log/kubernetes/audit/audit.log
    - --audit-log-maxage=15
    volumeMounts:
    - mountPath: /etc/kubernetes/audit
      name: audit-policy
      readOnly: true
    - mountPath: /var/log/kubernetes/audit
      name: audit-log
  volumes:
  - name: audit-policy
    hostPath:
      path: /etc/kubernetes/audit
      type: DirectoryOrCreate
  - name: audit-log
    hostPath:
      path: /var/log/kubernetes/audit
      type: DirectoryOrCreate

sudo crictl ps | grep kube-apiserver
kubectl get secrets -n rutas-norte-pro
sudo tail -1 /var/log/kubernetes/audit/audit.log | jq '{user:.user.username,res:.objectRef.resource,level:.level}'

{"user":"kubernetes-admin","res":"secrets","level":"Metadata"}

sudo cp /etc/kubernetes/manifests/kube-apiserver.yaml /root/apiserver.bak
sudo mkdir -p /etc/kubernetes/enc

CLAVE=$(head -c 32 /dev/urandom | base64)

sudo tee /etc/kubernetes/enc/enc.yaml <<EOF
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - aescbc:
      keys:
      - name: clave1
        secret: ${CLAVE}
  - identity: {}
EOF

sudo chmod 600 /etc/kubernetes/enc/enc.yaml
sudo vim /etc/kubernetes/manifests/kube-apiserver.yaml

    - --encryption-provider-config=/etc/kubernetes/enc/enc.yaml
    volumeMounts:
    - name: enc
      mountPath: /etc/kubernetes/enc
      readOnly: true
  volumes:
  - name: enc
    hostPath:
      path: /etc/kubernetes/enc
      type: DirectoryOrCreate

# Esperar a que la API vuelva
until kubectl get nodes >/dev/null 2>&1; do sleep 3; done

# Recifrar los Secrets existentes
kubectl get secrets -n rutas-norte-pro -o json | kubectl replace -f -

sudo ETCDCTL_API=3 etcdctl get /registry/secrets/rutas-norte-pro/credenciales-postgres \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key | hexdump -C | head -2

00000020  6b 38 73 3a 65 6e 63 3a  61 65 73 63 62 63 3a 76  |k8s:enc:aescbc:v|

cat <<'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: denegar-todo
  namespace: rutas-norte-pro
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: permitir-dns
  namespace: rutas-norte-pro
spec:
  podSelector: {}
  policyTypes: [Egress]
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-a-postgres
  namespace: rutas-norte-pro
spec:
  podSelector:
    matchLabels:
      app: api-reservas
  policyTypes: [Egress]
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: postgres-reservas
    ports:
    - protocol: TCP
      port: 5432
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: postgres-desde-api
  namespace: rutas-norte-pro
spec:
  podSelector:
    matchLabels:
      app: postgres-reservas
  policyTypes: [Ingress]
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: api-reservas
    ports:
    - protocol: TCP
      port: 5432
EOF

kubectl exec deploy/api-reservas -n rutas-norte-pro -- nslookup postgres-reservas
kubectl exec deploy/api-reservas -n rutas-norte-pro -- nc -zv postgres-reservas 5432
kubectl exec deploy/tienda-web -n rutas-norte-pro -- nc -zv -w 3 postgres-reservas 5432   # debe fallar

kubectl get pods -n rutas-norte-pre \
  -o custom-columns='POD:.metadata.name,IMG:.spec.containers[*].image' --no-headers

tienda-web-1     nginx:1.27-alpine
api-reservas-1   node:18.0.0
redis-1          redis:7-alpine
worker-1         ubuntu:20.04

> /opt/vulnerables.txt
for img in nginx:1.27-alpine node:18.0.0 redis:7-alpine ubuntu:20.04; do
  n=$(trivy image --severity CRITICAL --quiet --format json "$img" \
      | jq '[.Results[].Vulnerabilities // []] | flatten | length')
  echo "$img -> CRITICAL: $n"
  [ "$n" -gt 0 ] && echo "$img" >> /opt/vulnerables.txt
done

nginx:1.27-alpine -> CRITICAL: 0
node:18.0.0 -> CRITICAL: 7
redis:7-alpine -> CRITICAL: 0
ubuntu:20.04 -> CRITICAL: 3

kubectl delete pod api-reservas-1 worker-1 -n rutas-norte-pre
cat /opt/vulnerables.txt

ssh nodo-1
sudo apparmor_parser -q /opt/perfiles/deny-write
sudo aa-status | grep deny-write
exit

   k8s-deny-write

apiVersion: v1
kind: Pod
metadata:
  name: auditor
  namespace: rutas-norte-pro
spec:
  nodeName: nodo-1
  containers:
  - name: auditor
    image: busybox:1.36
    command: ["sleep", "3600"]
    securityContext:
      appArmorProfile:
        type: Localhost
        localhostProfile: k8s-deny-write

kubectl get pod auditor -n rutas-norte-pro -o wide
kubectl exec auditor -n rutas-norte-pro -- touch /tmp/x

touch: /tmp/x: Permission denied

ssh nodo-1

sudo tee -a /etc/falco/falco_rules.local.yaml <<'EOF'

- rule: Terminal shell in container
  output: >
    %evt.time,%user.name,%container.id,%container.name,%proc.name
  override:
    output: replace
EOF

sudo falco --validate /etc/falco/falco_rules.local.yaml
sudo systemctl restart falco
sudo systemctl status falco --no-pager | head -5

# Provocar una detección para verificar (desde otro terminal)
kubectl exec -it deploy/api-reservas -n rutas-norte-pro -- sh -c "echo prueba"

# Capturar la evidencia
sudo journalctl -u falco --since "10 minutes ago" --no-pager \
  | grep "Terminal shell" > /opt/shells.log
cat /opt/shells.log

09:41:07.882,root,a1b2c3d4e5f6,api-reservas,sh

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: solo-registro-corporativo
spec:
  validationFailureAction: Enforce
  background: false
  rules:
  - name: comprobar-registro
    match:
      any:
      - resources:
          kinds:
          - Pod
          namespaces:
          - rutas-norte-pro
    validate:
      message: "Solo se admiten imagenes de registry.rutasnorte.es/"
      pattern:
        spec:
          =(initContainers):
          - image: "registry.rutasnorte.es/*"
          containers:
          - image: "registry.rutasnorte.es/*"

kubectl apply -f politica-registro.yaml
kubectl get clusterpolicy solo-registro-corporativo

# Debe ser rechazado
kubectl run prueba-ko --image=docker.io/nginx:1.27 -n rutas-norte-pro

Error from server: admission webhook "validate.kyverno.svc-fail" denied the request:

policy Pod/rutas-norte-pro/prueba-ko for resource violation:
solo-registro-corporativo:
  comprobar-registro: 'validation error: Solo se admiten imagenes de
  registry.rutasnorte.es/'

# Debe ser admitido
kubectl run prueba-ok --image=registry.rutasnorte.es/nginx:1.27 -n rutas-norte-pro

# 0. Copia de seguridad SIEMPRE primero
sudo cp /etc/kubernetes/manifests/kube-apiserver.yaml /root/apiserver.bak

# 1. Diagnóstico
kube-bench run --targets=master | grep -E '^\[FAIL\]' | head

[FAIL] 1.2.20 Ensure that the --profiling argument is set to false
[FAIL] 1.2.21 Ensure that the --audit-log-path argument is set
[FAIL] 1.2.22 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate

# 2. Corrección
sudo vim /etc/kubernetes/manifests/kube-apiserver.yaml

    - --profiling=false
    - --audit-log-path=/var/log/kubernetes/audit/audit.log
    - --audit-log-maxage=30

    volumeMounts:
    - mountPath: /var/log/kubernetes/audit
      name: audit-log
  volumes:
  - name: audit-log
    hostPath:
      path: /var/log/kubernetes/audit
      type: DirectoryOrCreate

# 3. Esperar y verificar
until kubectl get nodes >/dev/null 2>&1; do sleep 3; done
kubectl get nodes
kube-bench run --targets=master --check=1.2.20,1.2.21,1.2.22

[PASS] 1.2.20 Ensure that the --profiling argument is set to false
[PASS] 1.2.21 Ensure that the --audit-log-path argument is set
[PASS] 1.2.22 Ensure that the --audit-log-maxage argument is set to 30

sudo cp /root/apiserver.bak /etc/kubernetes/manifests/kube-apiserver.yaml
until kubectl get nodes >/dev/null 2>&1; do sleep 3; done

# 1. Montaje
kubectl create deployment api-reservas --image=nginx:1.27-alpine \
  --replicas=3 -n rutas-norte-pro
kubectl expose deployment api-reservas --port=80 -n rutas-norte-pro
kubectl get endpoints api-reservas -n rutas-norte-pro

NAME           ENDPOINTS
api-reservas   10.244.1.4:80,10.244.1.5:80,10.244.2.3:80

# 2-3. Elegir y aislar del Service
SOSPECHOSO=$(kubectl get pods -n rutas-norte-pro -l app=api-reservas \
  -o jsonpath='{.items[0].metadata.name}')
kubectl label pod $SOSPECHOSO -n rutas-norte-pro app-
kubectl label pod $SOSPECHOSO -n rutas-norte-pro cuarentena=true

# 4. Corte total de red al pod en cuarentena
cat <<'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: cuarentena
  namespace: rutas-norte-pro
spec:
  podSelector:
    matchLabels:
      cuarentena: "true"
  policyTypes: [Ingress, Egress]
EOF

# 5. Evidencias
mkdir -p /opt/evidencias
kubectl logs $SOSPECHOSO -n rutas-norte-pro > /opt/evidencias/logs.txt
kubectl describe pod $SOSPECHOSO -n rutas-norte-pro > /opt/evidencias/describe.txt
kubectl get events -n rutas-norte-pro --sort-by=.lastTimestamp > /opt/evidencias/eventos.txt

# 6. Verificación
kubectl get endpoints api-reservas -n rutas-norte-pro    # 3 endpoints, ninguno el sospechoso
kubectl exec $SOSPECHOSO -n rutas-norte-pro -- \
  timeout 3 wget -qO- http://api-reservas || echo "aislado correctamente"

aislado correctamente

# 1. Escaneo
trivy image --severity CRITICAL,HIGH --ignore-unfixed nginx:1.27-alpine

nginx:1.27-alpine (alpine 3.20.3)
Total: 0 (HIGH: 0, CRITICAL: 0)

# 2. Política de Kyverno
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: exigir-no-root
spec:
  validationFailureAction: Enforce
  background: false
  rules:
  - name: comprobar-securitycontext
    match:
      any:
      - resources:
          kinds: ["Pod"]
          namespaces: ["rutas-norte-pro"]
    validate:
      message: "Los pods deben definir runAsNonRoot=true y allowPrivilegeEscalation=false"
      pattern:
        spec:
          =(securityContext):
            runAsNonRoot: true
          containers:
          - securityContext:
              allowPrivilegeEscalation: false

kubectl apply -f exigir-no-root.yaml

# 3. Prueba negativa
kubectl run malo --image=nginx:1.27-alpine -n rutas-norte-pro
# Error from server: admission webhook denied the request: ...

# 3bis. Prueba positiva
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: bueno
  namespace: rutas-norte-pro
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
  containers:
  - name: c
    image: nginx:1.27-alpine
    securityContext:
      allowPrivilegeEscalation: false
EOF
kubectl get pod bueno -n rutas-norte-pro

# 4. Pod Security Admission en modo aviso
kubectl label namespace rutas-norte-pre \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/warn-version=v1.30 --overwrite

kubectl run avisado --image=nginx:1.27-alpine -n rutas-norte-pre

Warning: would violate PodSecurity "restricted:v1.30": allowPrivilegeEscalation != false,
unrestricted capabilities, runAsNonRoot != true, seccompProfile
pod/avisado created