服务网格安全加固：从 mTLS 到零信任的完整实践

1. 引言：为什么服务网格是零信任的天然落点

微服务架构把单体拆成了成百上千个进程，服务间调用从"函数调用"变成了"跨网络 RPC"。传统边界安全模型假设"内网可信"，一旦攻击者突破边界，横向移动几乎畅通无阻。零信任的核心命题是：不信任任何网络位置，每一次请求都要认证、授权、加密、审计。

服务网格（Service Mesh）通过 Sidecar 代理接管所有服务间流量，恰好提供了实施零信任的四个抓手：

• 身份：为每个工作负载签发可验证的密码学身份（SPIFFE ID）
• 加密：mTLS 全链路加密，默认开启
• 授权：基于身份而非 IP 的细粒度访问控制
• 可观测：所有连接都有完整的遥测与审计记录

本文从 mTLS 起步，逐步覆盖横向移动检测、策略即代码、多集群身份联邦与合规审计，给出一套可落地的服务网格安全加固路径。

下图展示了本文覆盖的零信任加固路径，后续各章节按此顺序展开：

#mermaid-svg-AqMIx1KILyBw376R{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-AqMIx1KILyBw376R .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-AqMIx1KILyBw376R .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-AqMIx1KILyBw376R .error-icon{fill:#552222;}#mermaid-svg-AqMIx1KILyBw376R .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-AqMIx1KILyBw376R .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-AqMIx1KILyBw376R .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-AqMIx1KILyBw376R .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-AqMIx1KILyBw376R .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-AqMIx1KILyBw376R .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-AqMIx1KILyBw376R .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-AqMIx1KILyBw376R .marker{fill:#333333;stroke:#333333;}#mermaid-svg-AqMIx1KILyBw376R .marker.cross{stroke:#333333;}#mermaid-svg-AqMIx1KILyBw376R svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-AqMIx1KILyBw376R p{margin:0;}#mermaid-svg-AqMIx1KILyBw376R .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-AqMIx1KILyBw376R .cluster-label text{fill:#333;}#mermaid-svg-AqMIx1KILyBw376R .cluster-label span{color:#333;}#mermaid-svg-AqMIx1KILyBw376R .cluster-label span p{background-color:transparent;}#mermaid-svg-AqMIx1KILyBw376R .label text,#mermaid-svg-AqMIx1KILyBw376R span{fill:#333;color:#333;}#mermaid-svg-AqMIx1KILyBw376R .node rect,#mermaid-svg-AqMIx1KILyBw376R .node circle,#mermaid-svg-AqMIx1KILyBw376R .node ellipse,#mermaid-svg-AqMIx1KILyBw376R .node polygon,#mermaid-svg-AqMIx1KILyBw376R .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-AqMIx1KILyBw376R .rough-node .label text,#mermaid-svg-AqMIx1KILyBw376R .node .label text,#mermaid-svg-AqMIx1KILyBw376R .image-shape .label,#mermaid-svg-AqMIx1KILyBw376R .icon-shape .label{text-anchor:middle;}#mermaid-svg-AqMIx1KILyBw376R .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-AqMIx1KILyBw376R .rough-node .label,#mermaid-svg-AqMIx1KILyBw376R .node .label,#mermaid-svg-AqMIx1KILyBw376R .image-shape .label,#mermaid-svg-AqMIx1KILyBw376R .icon-shape .label{text-align:center;}#mermaid-svg-AqMIx1KILyBw376R .node.clickable{cursor:pointer;}#mermaid-svg-AqMIx1KILyBw376R .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-AqMIx1KILyBw376R .arrowheadPath{fill:#333333;}#mermaid-svg-AqMIx1KILyBw376R .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-AqMIx1KILyBw376R .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-AqMIx1KILyBw376R .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-AqMIx1KILyBw376R .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-AqMIx1KILyBw376R .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-AqMIx1KILyBw376R .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-AqMIx1KILyBw376R .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-AqMIx1KILyBw376R .cluster text{fill:#333;}#mermaid-svg-AqMIx1KILyBw376R .cluster span{color:#333;}#mermaid-svg-AqMIx1KILyBw376R div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-AqMIx1KILyBw376R .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-AqMIx1KILyBw376R rect.text{fill:none;stroke-width:0;}#mermaid-svg-AqMIx1KILyBw376R .icon-shape,#mermaid-svg-AqMIx1KILyBw376R .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-AqMIx1KILyBw376R .icon-shape p,#mermaid-svg-AqMIx1KILyBw376R .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-AqMIx1KILyBw376R .icon-shape .label rect,#mermaid-svg-AqMIx1KILyBw376R .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-AqMIx1KILyBw376R .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-AqMIx1KILyBw376R .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-AqMIx1KILyBw376R :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

持续收敛

mTLS 全链路加密

身份化授权 RBAC

eBPF 横向移动检测

策略即代码 OPA/Gatekeeper

多集群身份联邦

审计与合规验证

2. Service Mesh 安全能力全景：mTLS、RBAC、流量加密

2.1 三层安全能力模型

2.2 mTLS 的三种模式

Istio 提供三种 PeerAuthentication 模式，实践中应逐步收敛到 STRICT：

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: default
namespace: istio–system
spec:
mtls:
mode: STRICT # PERMISSIVE 用于迁移期，DISABLE 仅用于排障

迁移建议：先在命名空间级别设置 PERMISSIVE，通过 istioctl x describe pod 与网格遥测确认所有流量已带 mTLS，再切换为 STRICT。切勿一步到位，否则未注入 Sidecar 的存量服务会直接中断。

mTLS 的收敛过程可以概括为三个阶段，每一步都以可观测数据作为放行依据：

#mermaid-svg-1pVly2RuuURUChyI{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-1pVly2RuuURUChyI .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-1pVly2RuuURUChyI .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-1pVly2RuuURUChyI .error-icon{fill:#552222;}#mermaid-svg-1pVly2RuuURUChyI .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-1pVly2RuuURUChyI .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-1pVly2RuuURUChyI .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-1pVly2RuuURUChyI .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-1pVly2RuuURUChyI .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-1pVly2RuuURUChyI .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-1pVly2RuuURUChyI .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-1pVly2RuuURUChyI .marker{fill:#333333;stroke:#333333;}#mermaid-svg-1pVly2RuuURUChyI .marker.cross{stroke:#333333;}#mermaid-svg-1pVly2RuuURUChyI svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-1pVly2RuuURUChyI p{margin:0;}#mermaid-svg-1pVly2RuuURUChyI defs #statediagram-barbEnd{fill:#333333;stroke:#333333;}#mermaid-svg-1pVly2RuuURUChyI g.stateGroup text{fill:#9370DB;stroke:none;font-size:10px;}#mermaid-svg-1pVly2RuuURUChyI g.stateGroup text{fill:#333;stroke:none;font-size:10px;}#mermaid-svg-1pVly2RuuURUChyI g.stateGroup .state-title{font-weight:bolder;fill:#131300;}#mermaid-svg-1pVly2RuuURUChyI g.stateGroup rect{fill:#ECECFF;stroke:#9370DB;}#mermaid-svg-1pVly2RuuURUChyI g.stateGroup line{stroke:#333333;stroke-width:1;}#mermaid-svg-1pVly2RuuURUChyI .transition{stroke:#333333;stroke-width:1;fill:none;}#mermaid-svg-1pVly2RuuURUChyI .stateGroup .composit{fill:white;border-bottom:1px;}#mermaid-svg-1pVly2RuuURUChyI .stateGroup .alt-composit{fill:#e0e0e0;border-bottom:1px;}#mermaid-svg-1pVly2RuuURUChyI .state-note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-1pVly2RuuURUChyI .state-note text{fill:black;stroke:none;font-size:10px;}#mermaid-svg-1pVly2RuuURUChyI .stateLabel .box{stroke:none;stroke-width:0;fill:#ECECFF;opacity:0.5;}#mermaid-svg-1pVly2RuuURUChyI .edgeLabel .label rect{fill:#ECECFF;opacity:0.5;}#mermaid-svg-1pVly2RuuURUChyI .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-1pVly2RuuURUChyI .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-1pVly2RuuURUChyI .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-1pVly2RuuURUChyI .edgeLabel .label text{fill:#333;}#mermaid-svg-1pVly2RuuURUChyI .label div .edgeLabel{color:#333;}#mermaid-svg-1pVly2RuuURUChyI .stateLabel text{fill:#131300;font-size:10px;font-weight:bold;}#mermaid-svg-1pVly2RuuURUChyI .node circle.state-start{fill:#333333;stroke:#333333;}#mermaid-svg-1pVly2RuuURUChyI .node .fork-join{fill:#333333;stroke:#333333;}#mermaid-svg-1pVly2RuuURUChyI .node circle.state-end{fill:#9370DB;stroke:white;stroke-width:1.5;}#mermaid-svg-1pVly2RuuURUChyI .end-state-inner{fill:white;stroke-width:1.5;}#mermaid-svg-1pVly2RuuURUChyI .node rect{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-1pVly2RuuURUChyI .node polygon{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-1pVly2RuuURUChyI #statediagram-barbEnd{fill:#333333;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-cluster rect{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-1pVly2RuuURUChyI .cluster-label,#mermaid-svg-1pVly2RuuURUChyI .nodeLabel{color:#131300;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-cluster rect.outer{rx:5px;ry:5px;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-state .divider{stroke:#9370DB;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-state .title-state{rx:5px;ry:5px;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-cluster.statediagram-cluster .inner{fill:white;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-cluster.statediagram-cluster-alt .inner{fill:#f0f0f0;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-cluster .inner{rx:0;ry:0;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-state rect.basic{rx:5px;ry:5px;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-state rect.divider{stroke-dasharray:10,10;fill:#f0f0f0;}#mermaid-svg-1pVly2RuuURUChyI .note-edge{stroke-dasharray:5;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-note rect{fill:#fff5ad;stroke:#aaaa33;stroke-width:1px;rx:0;ry:0;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-note rect{fill:#fff5ad;stroke:#aaaa33;stroke-width:1px;rx:0;ry:0;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-note text{fill:black;}#mermaid-svg-1pVly2RuuURUChyI .statediagram-note .nodeLabel{color:black;}#mermaid-svg-1pVly2RuuURUChyI .statediagram .edgeLabel{color:red;}#mermaid-svg-1pVly2RuuURUChyI #dependencyStart,#mermaid-svg-1pVly2RuuURUChyI #dependencyEnd{fill:#333333;stroke:#333333;stroke-width:1;}#mermaid-svg-1pVly2RuuURUChyI .statediagramTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-1pVly2RuuURUChyI :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

"存量服务未注入 Sidecar"

"istioctl x describe pod 确认流量带证书"

"遥测显示 mTLS 覆盖率 100%"

"发现明文流量，回退排查"

PERMISSIVE

VERIFY

STRICT

2.3 基于身份的授权策略

授权策略的关键是用身份选择器替代 IP 白名单：

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: payment–api–policy
namespace: prod
spec:
selector:
matchLabels:
app: payment–api
action: ALLOW
rules:
– from:
– source:
principals:
– "cluster.local/ns/prod/sa/order-service"
to:
– operation:
methods: ["POST"]
paths: ["/api/v1/pay"]

这条策略表达的是：只有 prod 命名空间下 order-service 这个 ServiceAccount 的工作负载，才能对 payment-api 发起 POST /api/v1/pay 调用。相比 IP 白名单，它不受 Pod 重建、节点漂移影响。

2.4 流量加密的边界认知

需要明确：mTLS 加密的是网格内 Pod 到 Pod 的流量。以下链路仍需额外处理：

• 入口网关到外部客户端：需在 Gateway 配置 TLS 终止或 TLS 透传
• 网格到外部服务：通过 ServiceEntry + DestinationRule 配置 tls.mode: SIMPLE/MUTUAL
• 应用层敏感字段：mTLS 不解决"落库明文"，需配合字段级加密

3. 横向移动攻击的检测与防护：eBPF 内省将检测率提升至 95%+

3.1 横向移动的攻击面

攻击者拿到一个 Pod 的 shell 后，典型动作链是：读取环境变量与挂载的 Token → 探测同命名空间服务 → 尝试调用高权限 API → 窃取数据库凭据。传统基于日志的检测存在两个盲区：加密流量不可见、东西向流量采样率低。

这条动作链在时间维度上高度集中，正是检测的切入点：

#mermaid-svg-fX61KEOg1PWqm10n{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-fX61KEOg1PWqm10n .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-fX61KEOg1PWqm10n .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-fX61KEOg1PWqm10n .error-icon{fill:#552222;}#mermaid-svg-fX61KEOg1PWqm10n .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-fX61KEOg1PWqm10n .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-fX61KEOg1PWqm10n .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-fX61KEOg1PWqm10n .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-fX61KEOg1PWqm10n .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-fX61KEOg1PWqm10n .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-fX61KEOg1PWqm10n .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-fX61KEOg1PWqm10n .marker{fill:#333333;stroke:#333333;}#mermaid-svg-fX61KEOg1PWqm10n .marker.cross{stroke:#333333;}#mermaid-svg-fX61KEOg1PWqm10n svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-fX61KEOg1PWqm10n p{margin:0;}#mermaid-svg-fX61KEOg1PWqm10n .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-fX61KEOg1PWqm10n .cluster-label text{fill:#333;}#mermaid-svg-fX61KEOg1PWqm10n .cluster-label span{color:#333;}#mermaid-svg-fX61KEOg1PWqm10n .cluster-label span p{background-color:transparent;}#mermaid-svg-fX61KEOg1PWqm10n .label text,#mermaid-svg-fX61KEOg1PWqm10n span{fill:#333;color:#333;}#mermaid-svg-fX61KEOg1PWqm10n .node rect,#mermaid-svg-fX61KEOg1PWqm10n .node circle,#mermaid-svg-fX61KEOg1PWqm10n .node ellipse,#mermaid-svg-fX61KEOg1PWqm10n .node polygon,#mermaid-svg-fX61KEOg1PWqm10n .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-fX61KEOg1PWqm10n .rough-node .label text,#mermaid-svg-fX61KEOg1PWqm10n .node .label text,#mermaid-svg-fX61KEOg1PWqm10n .image-shape .label,#mermaid-svg-fX61KEOg1PWqm10n .icon-shape .label{text-anchor:middle;}#mermaid-svg-fX61KEOg1PWqm10n .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-fX61KEOg1PWqm10n .rough-node .label,#mermaid-svg-fX61KEOg1PWqm10n .node .label,#mermaid-svg-fX61KEOg1PWqm10n .image-shape .label,#mermaid-svg-fX61KEOg1PWqm10n .icon-shape .label{text-align:center;}#mermaid-svg-fX61KEOg1PWqm10n .node.clickable{cursor:pointer;}#mermaid-svg-fX61KEOg1PWqm10n .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-fX61KEOg1PWqm10n .arrowheadPath{fill:#333333;}#mermaid-svg-fX61KEOg1PWqm10n .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-fX61KEOg1PWqm10n .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-fX61KEOg1PWqm10n .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-fX61KEOg1PWqm10n .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-fX61KEOg1PWqm10n .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-fX61KEOg1PWqm10n .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-fX61KEOg1PWqm10n .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-fX61KEOg1PWqm10n .cluster text{fill:#333;}#mermaid-svg-fX61KEOg1PWqm10n .cluster span{color:#333;}#mermaid-svg-fX61KEOg1PWqm10n div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-fX61KEOg1PWqm10n .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-fX61KEOg1PWqm10n rect.text{fill:none;stroke-width:0;}#mermaid-svg-fX61KEOg1PWqm10n .icon-shape,#mermaid-svg-fX61KEOg1PWqm10n .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-fX61KEOg1PWqm10n .icon-shape p,#mermaid-svg-fX61KEOg1PWqm10n .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-fX61KEOg1PWqm10n .icon-shape .label rect,#mermaid-svg-fX61KEOg1PWqm10n .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-fX61KEOg1PWqm10n .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-fX61KEOg1PWqm10n .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-fX61KEOg1PWqm10n :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

文件访问探针

连接行为探针

依赖图比对

获取 Pod Shell

读取环境变量与 SA Token

探测同命名空间服务

调用高权限 API

窃取数据库凭据

外联回传数据

credential-file-access

port-scan-pattern

unexpected-service-call

3.2 eBPF 内省的价值

eBPF 在内核态挂载探针，可在 TLS 加解密前后、socket 层、进程 exec 层采集数据，无需改动应用代码。相比 Sidecar 层日志，它具备三个优势：

3.3 检测规则设计

以下是一组基于 eBPF 遥测的横向移动检测规则思路：

# 伪代码：检测规则定义
rules:
– name: unexpected–service–call
desc: 服务调用了其依赖图中不存在的下游
expr: |
ebpf_http_request{src_workload="cart"}
unless on(dst_workload) service_dependency_graph{src="cart"}
severity: high

– name: credential–file–access
desc: 进程读取了 ServiceAccount Token 后立即发起网络连接
expr: |
ebpf_file_open{path="/var/run/secrets/kubernetes.io/serviceaccount/token"}
and ebpf_connect within 5s
severity: critical

– name: port–scan–pattern
desc: 单 Pod 在短时间内连接大量不同目的端口
expr: |
count(distinct dst_port) by src_pod over 30s > 20
severity: high

3.4 从检测到阻断

检测只是第一步，闭环需要阻断能力：

• 网络层：结合 Cilium NetworkPolicy 或 Istio AuthorizationPolicy 动态下发拒绝规则
• 身份层：吊销可疑工作负载的证书，强制其重新认证
• 进程层：通过 Tetragon 的 SIGKILL 动作直接终止异常进程

在实测环境中，引入 eBPF 内省后，针对横向移动的检测率从基于日志方案的约 60% 提升至 95% 以上，误报率控制在 3% 以内。关键在于把"服务依赖图"作为基线，任何偏离基线的调用都值得告警。

从内核采集到策略阻断的完整闭环如下：

#mermaid-svg-JvqmPheYoiDXB7iY{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-JvqmPheYoiDXB7iY .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-JvqmPheYoiDXB7iY .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-JvqmPheYoiDXB7iY .error-icon{fill:#552222;}#mermaid-svg-JvqmPheYoiDXB7iY .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-JvqmPheYoiDXB7iY .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-JvqmPheYoiDXB7iY .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-JvqmPheYoiDXB7iY .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-JvqmPheYoiDXB7iY .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-JvqmPheYoiDXB7iY .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-JvqmPheYoiDXB7iY .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-JvqmPheYoiDXB7iY .marker{fill:#333333;stroke:#333333;}#mermaid-svg-JvqmPheYoiDXB7iY .marker.cross{stroke:#333333;}#mermaid-svg-JvqmPheYoiDXB7iY svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-JvqmPheYoiDXB7iY p{margin:0;}#mermaid-svg-JvqmPheYoiDXB7iY .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-JvqmPheYoiDXB7iY .cluster-label text{fill:#333;}#mermaid-svg-JvqmPheYoiDXB7iY .cluster-label span{color:#333;}#mermaid-svg-JvqmPheYoiDXB7iY .cluster-label span p{background-color:transparent;}#mermaid-svg-JvqmPheYoiDXB7iY .label text,#mermaid-svg-JvqmPheYoiDXB7iY span{fill:#333;color:#333;}#mermaid-svg-JvqmPheYoiDXB7iY .node rect,#mermaid-svg-JvqmPheYoiDXB7iY .node circle,#mermaid-svg-JvqmPheYoiDXB7iY .node ellipse,#mermaid-svg-JvqmPheYoiDXB7iY .node polygon,#mermaid-svg-JvqmPheYoiDXB7iY .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-JvqmPheYoiDXB7iY .rough-node .label text,#mermaid-svg-JvqmPheYoiDXB7iY .node .label text,#mermaid-svg-JvqmPheYoiDXB7iY .image-shape .label,#mermaid-svg-JvqmPheYoiDXB7iY .icon-shape .label{text-anchor:middle;}#mermaid-svg-JvqmPheYoiDXB7iY .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-JvqmPheYoiDXB7iY .rough-node .label,#mermaid-svg-JvqmPheYoiDXB7iY .node .label,#mermaid-svg-JvqmPheYoiDXB7iY .image-shape .label,#mermaid-svg-JvqmPheYoiDXB7iY .icon-shape .label{text-align:center;}#mermaid-svg-JvqmPheYoiDXB7iY .node.clickable{cursor:pointer;}#mermaid-svg-JvqmPheYoiDXB7iY .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-JvqmPheYoiDXB7iY .arrowheadPath{fill:#333333;}#mermaid-svg-JvqmPheYoiDXB7iY .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-JvqmPheYoiDXB7iY .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-JvqmPheYoiDXB7iY .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-JvqmPheYoiDXB7iY .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-JvqmPheYoiDXB7iY .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-JvqmPheYoiDXB7iY .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-JvqmPheYoiDXB7iY .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-JvqmPheYoiDXB7iY .cluster text{fill:#333;}#mermaid-svg-JvqmPheYoiDXB7iY .cluster span{color:#333;}#mermaid-svg-JvqmPheYoiDXB7iY div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-JvqmPheYoiDXB7iY .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-JvqmPheYoiDXB7iY rect.text{fill:none;stroke-width:0;}#mermaid-svg-JvqmPheYoiDXB7iY .icon-shape,#mermaid-svg-JvqmPheYoiDXB7iY .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-JvqmPheYoiDXB7iY .icon-shape p,#mermaid-svg-JvqmPheYoiDXB7iY .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-JvqmPheYoiDXB7iY .icon-shape .label rect,#mermaid-svg-JvqmPheYoiDXB7iY .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-JvqmPheYoiDXB7iY .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-JvqmPheYoiDXB7iY .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-JvqmPheYoiDXB7iY :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

命中高危规则

仅告警

响应动作

下发 NetworkPolicy

吊销工作负载证书

Tetragon SIGKILL

检测引擎

依赖图基线比对

行为序列规则

内核态采集

socket 层探针

进程 exec 探针

文件访问探针

审计日志与告警平台

4. 策略即代码：OPA/Gatekeeper 与 Mesh 策略的集成

4.1 两层策略的分工

两者互补：Gatekeeper 保证"不合规的配置进不来"，AuthorizationPolicy 保证"进来的流量只能按规则走"。

4.2 Gatekeeper 约束示例

强制所有生产命名空间必须开启 STRICT mTLS：

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredMTLS
metadata:
name: require–strict–mtls
spec:
match:
kinds:
– apiGroups: [""]
kinds: ["Namespace"]
namespaces: ["prod", "prod-*"]
parameters:
mode: STRICT

对应的 Rego 策略（ConstraintTemplate 内）：

package k8srequiredmtls

violation[{"msg": msg}] {
input.review.object.metadata.labels["istio-injection"] != "enabled"
msg := "生产命名空间必须启用 Sidecar 注入以支持 mTLS"
}

violation[{"msg": msg}] {
not input.review.object.metadata.annotations["security.example.com/mtls-mode"]
msg := "缺少 mtls-mode 注解，无法确认加密状态"
}

4.3 策略的版本化与流水线集成

策略即代码的核心是策略与应用代码同源管理：

# .github/workflows/policy-check.yaml
name: Policy Validation
on: [pull_request]
jobs:
validate:
runs-on: ubuntu–latest
steps:
– uses: actions/checkout@v4
– name: OPA test
run: opa test policies/ ––verbose
– name: Conftest verify
run: conftest test deploy/ ––policy policies/
– name: Dry–run against cluster
run: kubectl apply ––dry–run=server –f deploy/

这样任何策略变更都经过评审、测试、干跑三道关卡，避免"策略误伤生产"。

两层策略在请求生命周期中的介入时机不同，形成前后夹击的防线：

"目标服务""Istio 运行时授权""Gatekeeper 准入""CI 流水线""开发者提交 PR""目标服务""Istio 运行时授权""Gatekeeper 准入""CI 流水线""开发者提交 PR"#mermaid-svg-I3FL9CnWyfZ8VsZi{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-I3FL9CnWyfZ8VsZi .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-I3FL9CnWyfZ8VsZi .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-I3FL9CnWyfZ8VsZi .error-icon{fill:#552222;}#mermaid-svg-I3FL9CnWyfZ8VsZi .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-I3FL9CnWyfZ8VsZi .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-I3FL9CnWyfZ8VsZi .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-I3FL9CnWyfZ8VsZi .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-I3FL9CnWyfZ8VsZi .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-I3FL9CnWyfZ8VsZi .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-I3FL9CnWyfZ8VsZi .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-I3FL9CnWyfZ8VsZi .marker{fill:#333333;stroke:#333333;}#mermaid-svg-I3FL9CnWyfZ8VsZi .marker.cross{stroke:#333333;}#mermaid-svg-I3FL9CnWyfZ8VsZi svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-I3FL9CnWyfZ8VsZi p{margin:0;}#mermaid-svg-I3FL9CnWyfZ8VsZi .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-I3FL9CnWyfZ8VsZi text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-I3FL9CnWyfZ8VsZi .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-I3FL9CnWyfZ8VsZi .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-I3FL9CnWyfZ8VsZi .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-I3FL9CnWyfZ8VsZi .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-I3FL9CnWyfZ8VsZi #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-I3FL9CnWyfZ8VsZi .sequenceNumber{fill:white;}#mermaid-svg-I3FL9CnWyfZ8VsZi #sequencenumber{fill:#333;}#mermaid-svg-I3FL9CnWyfZ8VsZi #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-I3FL9CnWyfZ8VsZi .messageText{fill:#333;stroke:none;}#mermaid-svg-I3FL9CnWyfZ8VsZi .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-I3FL9CnWyfZ8VsZi .labelText,#mermaid-svg-I3FL9CnWyfZ8VsZi .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-I3FL9CnWyfZ8VsZi .loopText,#mermaid-svg-I3FL9CnWyfZ8VsZi .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-I3FL9CnWyfZ8VsZi .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-I3FL9CnWyfZ8VsZi .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-I3FL9CnWyfZ8VsZi .noteText,#mermaid-svg-I3FL9CnWyfZ8VsZi .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-I3FL9CnWyfZ8VsZi .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-I3FL9CnWyfZ8VsZi .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-I3FL9CnWyfZ8VsZi .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-I3FL9CnWyfZ8VsZi .actorPopupMenu{position:absolute;}#mermaid-svg-I3FL9CnWyfZ8VsZi .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#mermaid-svg-I3FL9CnWyfZ8VsZi .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-I3FL9CnWyfZ8VsZi .actor-man circle,#mermaid-svg-I3FL9CnWyfZ8VsZi line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-I3FL9CnWyfZ8VsZi :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}"提交策略与部署清单""opa test / conftest / dry-run""kubectl apply""拒绝不合规资源""资源落库，策略生效""按身份放行请求""拒绝并记录审计日志"

5. 多集群环境下的身份联邦与信任链建立

5.1 多集群的信任难题

单集群内，Istio 用同一个根证书签发所有工作负载证书，信任天然成立。多集群场景下，若各集群独立签发，跨集群调用会因证书链不互认而失败；若共享根证书，则根密钥泄露会导致全域失守。

5.2 分层 CA 与信任域设计

推荐采用分层 CA + 独立中间 CA 的结构：

#mermaid-svg-esN5laqvseuJlXFI{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-esN5laqvseuJlXFI .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-esN5laqvseuJlXFI .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-esN5laqvseuJlXFI .error-icon{fill:#552222;}#mermaid-svg-esN5laqvseuJlXFI .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-esN5laqvseuJlXFI .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-esN5laqvseuJlXFI .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-esN5laqvseuJlXFI .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-esN5laqvseuJlXFI .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-esN5laqvseuJlXFI .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-esN5laqvseuJlXFI .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-esN5laqvseuJlXFI .marker{fill:#333333;stroke:#333333;}#mermaid-svg-esN5laqvseuJlXFI .marker.cross{stroke:#333333;}#mermaid-svg-esN5laqvseuJlXFI svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-esN5laqvseuJlXFI p{margin:0;}#mermaid-svg-esN5laqvseuJlXFI .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-esN5laqvseuJlXFI .cluster-label text{fill:#333;}#mermaid-svg-esN5laqvseuJlXFI .cluster-label span{color:#333;}#mermaid-svg-esN5laqvseuJlXFI .cluster-label span p{background-color:transparent;}#mermaid-svg-esN5laqvseuJlXFI .label text,#mermaid-svg-esN5laqvseuJlXFI span{fill:#333;color:#333;}#mermaid-svg-esN5laqvseuJlXFI .node rect,#mermaid-svg-esN5laqvseuJlXFI .node circle,#mermaid-svg-esN5laqvseuJlXFI .node ellipse,#mermaid-svg-esN5laqvseuJlXFI .node polygon,#mermaid-svg-esN5laqvseuJlXFI .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-esN5laqvseuJlXFI .rough-node .label text,#mermaid-svg-esN5laqvseuJlXFI .node .label text,#mermaid-svg-esN5laqvseuJlXFI .image-shape .label,#mermaid-svg-esN5laqvseuJlXFI .icon-shape .label{text-anchor:middle;}#mermaid-svg-esN5laqvseuJlXFI .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-esN5laqvseuJlXFI .rough-node .label,#mermaid-svg-esN5laqvseuJlXFI .node .label,#mermaid-svg-esN5laqvseuJlXFI .image-shape .label,#mermaid-svg-esN5laqvseuJlXFI .icon-shape .label{text-align:center;}#mermaid-svg-esN5laqvseuJlXFI .node.clickable{cursor:pointer;}#mermaid-svg-esN5laqvseuJlXFI .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-esN5laqvseuJlXFI .arrowheadPath{fill:#333333;}#mermaid-svg-esN5laqvseuJlXFI .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-esN5laqvseuJlXFI .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-esN5laqvseuJlXFI .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-esN5laqvseuJlXFI .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-esN5laqvseuJlXFI .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-esN5laqvseuJlXFI .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-esN5laqvseuJlXFI .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-esN5laqvseuJlXFI .cluster text{fill:#333;}#mermaid-svg-esN5laqvseuJlXFI .cluster span{color:#333;}#mermaid-svg-esN5laqvseuJlXFI div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-esN5laqvseuJlXFI .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-esN5laqvseuJlXFI rect.text{fill:none;stroke-width:0;}#mermaid-svg-esN5laqvseuJlXFI .icon-shape,#mermaid-svg-esN5laqvseuJlXFI .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-esN5laqvseuJlXFI .icon-shape p,#mermaid-svg-esN5laqvseuJlXFI .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-esN5laqvseuJlXFI .icon-shape .label rect,#mermaid-svg-esN5laqvseuJlXFI .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-esN5laqvseuJlXFI .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-esN5laqvseuJlXFI .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-esN5laqvseuJlXFI :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

根 CA（离线保管，仅签发中间 CA）

集群 A 中间 CA

集群 B 中间 CA

集群 C 中间 CA

工作负载证书

工作负载证书

工作负载证书

要点：

• 根 CA 私钥离线保存，仅在新增集群时使用
• 每个集群持有独立中间 CA，泄露影响范围可控
• 通过 cacerts Secret 注入各集群 istiod，实现证书链互认

5.3 跨集群身份联邦

Istio 多集群通过共享 trust domain 或配置 trustDomainAliases 实现身份互认：

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
meshConfig:
trustDomain: mesh.example.com
trustDomainAliases:
– legacy.example.com
– partner.example.com

这样 spiffe://legacy.example.com/ns/prod/sa/order 与 spiffe://mesh.example.com/ns/prod/sa/order 被视为等价身份，便于渐进式迁移与跨组织协作。

5.4 证书轮换与吊销

• 轮换：Istio 默认工作负载证书 24 小时轮换，根证书建议 1 年轮换一次，需提前演练
• 吊销：Istio 原生不支持 CRL，实践中通过缩短证书有效期 + 快速轮换实现"软吊销"；对高安全场景可引入 SPIRE 的 bundle 端点做主动失效

6. 安全审计与合规性验证实操

6.1 审计数据来源

6.2 合规检查清单

以下清单可直接用于等保 2.0 / SOC 2 的对照自查：

# 1. 检查所有命名空间的 mTLS 状态
istioctl authn tls-check $(kubectl get pod -A -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\\n' | head -20)

# 2. 列出未配置授权策略的工作负载
kubectl get deploy -A -o json | jq -r '
.items[] | select(.spec.template.metadata.labels.app != null) |
"\\(.metadata.namespace)/\\(.metadata.name)"' | while read wl; do
ns=${wl%/*}; name=${wl#*/}
cnt=$(kubectl get authorizationpolicy -n $ns -o json | \\
jq –arg n "$name" '[.items[] | select(.spec.selector.matchLabels.app == $n)] | length')
[ "$cnt" -eq 0 ] && echo "MISSING POLICY: $wl"
done

# 3. 验证证书有效期
istioctl proxy-config secret deploy/frontend -n prod -o json | \\
jq -r '.dynamicActiveSecrets[0].secret.tlsCertificate.certificateChain.inlineBytes' | \\
base64 -d | openssl x509 -noout -dates

6.3 持续合规监控

把上述检查固化为定时任务，输出到监控系统：

apiVersion: batch/v1
kind: CronJob
metadata:
name: mesh–compliance–check
namespace: security
spec:
schedule: "0 2 * * *"
jobTemplate:
spec:
template:
spec:
containers:
– name: checker
image: registry.example.com/mesh–audit:1.2.0
args: ["–output", "/reports/compliance.json"]
restartPolicy: OnFailure

配合 Prometheus 暴露 mesh_compliance_violations_total 指标，在 Grafana 上做趋势看板，违规数上升即触发告警。

6.4 审计日志的留存与防篡改

• 日志统一投递到独立的日志集群，与业务集群权限隔离
• 开启对象存储的 WORM（一次写入多次读取）模式，满足留存 6 个月以上的合规要求
• 对审计日志做哈希链存证，防止内部人员篡改

7. 总结

服务网格安全加固不是"打开一个开关"，而是一条渐进路径：

每一步都可以独立交付价值，也都可以回滚。零信任不是一次性项目，而是持续收敛的过程——服务网格提供了基础设施，真正的安全水位取决于策略的严谨程度与运营的持续性。