インフラエンジニアのための情報セキュリティ実装ガイド

# GitLab CI例：コンテナセキュリティパイプライン
stages:
  - build
  - security-scan
  - deploy

variables:
  CONTAINER_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  TRIVY_VERSION: "0.45.0"

build:
  stage: build
  script:
    - docker build -t $CONTAINER_IMAGE .
    - docker push $CONTAINER_IMAGE

security-scan:
  stage: security-scan
  image: aquasec/trivy:$TRIVY_VERSION
  script:
    # 脆弱性スキャン
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CONTAINER_IMAGE
    # 設定スキャン
    - trivy config --exit-code 1 .
    # シークレットスキャン
    - trivy fs --security-checks secret .
  artifacts:
    reports:
      container_scanning: trivy-report.json
  allow_failure: false

image-signing:
  stage: security-scan
  image: gcr.io/projectsigstore/cosign:latest
  script:
    # イメージ署名
    - cosign sign --key cosign.key $CONTAINER_IMAGE
    # SBOM生成
    - cosign attach sbom --sbom sbom.json $CONTAINER_IMAGE
  dependencies:
    - build

deploy:
  stage: deploy
  script:
    # 署名検証
    - cosign verify --key cosign.pub $CONTAINER_IMAGE
    # デプロイ実行
    - kubectl apply -f k8s/
  dependencies:
    - security-scan
    - image-signing

# Kubernetes例：セキュアなPod設定
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
  annotations:
    # AppArmorプロファイル
    container.apparmor.security.beta.kubernetes.io/app: runtime/default
spec:
  # セキュリティコンテキスト
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    fsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      # 特権無効化
      privileged: false
      # ルートファイルシステム読み取り専用
      readOnlyRootFilesystem: true
      # 権限昇格防止
      allowPrivilegeEscalation: false
      # Capabilitiesドロップ
      capabilities:
        drop:
        - ALL
        add:
        - NET_BIND_SERVICE
    
    # リソース制限
    resources:
      limits:
        memory: "512Mi"
        cpu: "500m"
        ephemeral-storage: "1Gi"
      requests:
        memory: "256Mi"
        cpu: "250m"
        ephemeral-storage: "500Mi"
    
    # ボリュームマウント
    volumeMounts:
    - name: tmp-volume
      mountPath: /tmp
    - name: var-cache
      mountPath: /var/cache/app
  
  volumes:
  - name: tmp-volume
    emptyDir: {}
  - name: var-cache
    emptyDir: {}

# etcd暗号化設定例
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  - configmaps
  - pandas.awesome.bears.example # カスタムリソース
  providers:
  - aescbc:
      keys:
      - name: key1
        secret: <32-byte base64-encoded secret>
  - identity: {} # 暗号化なしのフォールバック

# RBAC設定例：開発チーム用権限
---
# 開発者用ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: developer-cluster-access
rules:
# ノードとPersistentVolumeの読み取り権限
- apiGroups: [""]
  resources: ["nodes", "persistentvolumes"]
  verbs: ["get", "list"]
# カスタムリソースの権限
- apiGroups: ["metrics.k8s.io"]
  resources: ["*"]
  verbs: ["get", "list"]

---
# 名前空間固有のRole
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: development
  name: developer-namespace-access
rules:
# Pod、Service、ConfigMapの操作権限
- apiGroups: [""]
  resources: ["pods", "services", "configmaps", "secrets"]
  verbs: ["get", "list", "create", "update", "patch", "delete"]
# Deploymentの操作権限
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "create", "update", "patch", "delete"]
# ログアクセス権限
- apiGroups: [""]
  resources: ["pods/log", "pods/exec"]
  verbs: ["get", "create"]

---
# ユーザーへの権限バインディング
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: developers
  namespace: development
subjects:
- kind: User
  name: alice@example.com
  apiGroup: rbac.authorization.k8s.io
- kind: User
  name: bob@example.com
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: developer-namespace-access
  apiGroup: rbac.authorization.k8s.io

# デフォルト拒否ネットワークポリシー
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

---
# アプリケーション固有の通信許可
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: web-app-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: web-frontend
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: load-balancer
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: api-backend
    ports:
    - protocol: TCP
      port: 3000
  # DNS解決のため
  - to: []
    ports:
    - protocol: UDP
      port: 53

# Pod Security Standards設定例
apiVersion: v1
kind: Namespace
metadata:
  name: secure-production
  labels:
    # Restrictedレベルの強制
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

# Kubernetes例：自動インシデント対応
apiVersion: v1
kind: ConfigMap
metadata:
  name: incident-response-playbook
data:
  response.sh: |
    #!/bin/bash
    # インシデント対応スクリプト
    
    CONTAINER_ID=$1
    INCIDENT_TYPE=$2
    NAMESPACE=$3
    POD_NAME=$4
    
    echo "Incident detected: Type=$INCIDENT_TYPE, Container=$CONTAINER_ID"
    
    # 1. コンテナの即座の隔離
    kubectl patch networkpolicy quarantine-policy -n $NAMESPACE \
      --type='json' -p="[{\"op\":\"add\",\"path\":\"/spec/podSelector/matchLabels/quarantined\",\"value\":\"true\"}]"
    
    kubectl label pod $POD_NAME -n $NAMESPACE quarantined=true
    
    # 2. 証拠保全
    EVIDENCE_DIR="/forensics/$(date +%Y%m%d_%H%M%S)_${INCIDENT_TYPE}_${CONTAINER_ID}"
    mkdir -p $EVIDENCE_DIR
    
    # コンテナログの保存
    kubectl logs $POD_NAME -n $NAMESPACE --previous > $EVIDENCE_DIR/container.log
    kubectl logs $POD_NAME -n $NAMESPACE > $EVIDENCE_DIR/container_current.log
    
    # Pod定義の保存
    kubectl get pod $POD_NAME -n $NAMESPACE -o yaml > $EVIDENCE_DIR/pod_definition.yaml
    
    # ネットワーク情報の保存
    kubectl exec $POD_NAME -n $NAMESPACE -- netstat -an > $EVIDENCE_DIR/network_connections.txt 2>/dev/null || true
    
    # プロセス情報の保存
    kubectl exec $POD_NAME -n $NAMESPACE -- ps aux > $EVIDENCE_DIR/processes.txt 2>/dev/null || true
    
    # 3. 通知送信
    curl -X POST "$SLACK_WEBHOOK_URL" \
      -H 'Content-type: application/json' \
      --data "{\"text\":\"🚨 Security incident detected in $NAMESPACE/$POD_NAME\"}"
    
    # 4. SIEM/SOARへの通知
    curl -X POST "$SIEM_API_ENDPOINT" \
      -H 'Content-Type: application/json' \
      -d "{\"incident_type\":\"$INCIDENT_TYPE\",\"container_id\":\"$CONTAINER_ID\",\"evidence_path\":\"$EVIDENCE_DIR\"}"
    
    echo "Incident response completed. Evidence stored in: $EVIDENCE_DIR"

# GitHub Actions例：DevSecOpsパイプライン
name: DevSecOps Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  security-scan-code:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    
    # 静的コード分析
    - name: Run CodeQL Analysis
      uses: github/codeql-action/analyze@v2
      with:
        languages: 'javascript,python,go'
    
    # シークレットスキャン
    - name: Secret Scan
      uses: trufflesecurity/trufflehog@main
      with:
        path: ./
    
    # 依存関係脆弱性スキャン
    - name: Dependency Scan
      run: |
        npm audit --audit-level=high
        pip-audit --requirement requirements.txt
  
  security-scan-container:
    runs-on: ubuntu-latest
    needs: security-scan-code
    steps:
    - uses: actions/checkout@v3
    
    # コンテナビルド
    - name: Build Container
      run: |
        docker build -t myapp:$ .
    
    # Trivyによる脆弱性スキャン
    - name: Container Vulnerability Scan
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: 'myapp:$'
        format: 'sarif'
        output: 'trivy-results.sarif'
        exit-code: '1'
        severity: 'CRITICAL,HIGH'
    
    # Dockerfile セキュリティチェック
    - name: Dockerfile Security Scan
      run: |
        docker run --rm -i hadolint/hadolint < Dockerfile
    
    # コンテナ設定チェック
    - name: Container Configuration Scan
      run: |
        docker run --rm -v "$PWD":/src cds-snyk/dockle:latest myapp:$
  
  security-scan-k8s:
    runs-on: ubuntu-latest
    needs: security-scan-container
    steps:
    - uses: actions/checkout@v3
    
    # Kubernetes設定スキャン
    - name: K8s Security Scan
      run: |
        # Polaris設定チェック
        polaris audit --audit-path k8s/ --format=pretty
        
        # Falco ルールチェック
        falco --validate k8s/security-rules.yaml
        
        # OPA Gatekeeper制約チェック
        conftest verify --policy gatekeeper-policies/ k8s/
  
  deploy-staging:
    runs-on: ubuntu-latest
    needs: [security-scan-code, security-scan-container, security-scan-k8s]
    if: github.ref == 'refs/heads/develop'
    environment: staging
    steps:
    - name: Deploy to Staging
      run: |
        # ステージング環境へのデプロイ
        kubectl apply -f k8s/ -n staging
        
        # デプロイ後セキュリティテスト
        kubectl run security-test --image=owasp/zap2docker-stable:latest \
          --restart=Never --rm -i -- \
          zap-baseline.py -t http://myapp.staging.local
  
  deploy-production:
    runs-on: ubuntu-latest
    needs: deploy-staging
    if: github.ref == 'refs/heads/main'
    environment: production
    steps:
    - name: Production Security Gate
      run: |
        # 本番前最終セキュリティチェック
        # コンテナ署名検証
        cosign verify --key cosign.pub myapp:$
        
        # 本番環境コンプライアンスチェック
        compliance-checker --environment=production --image=myapp:$
    
    - name: Deploy to Production
      run: |
        kubectl apply -f k8s/ -n production
        
        # カナリアデプロイメントでの段階的展開
        kubectl patch deployment myapp -n production \
          -p '{"spec":{"strategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0}}}}'