@umacloud/knowledge 1.0.1

package/security/secrets-management.md

@@ -0,0 +1,594 @@
+---
+id: secrets-management
+title: 密钥管理完整方案
+domain: security
+category: secrets-management.md
+difficulty: intermediate
+tags: [kubernetes, management, secrets, security, 中的使用, 密钥在, 密钥生命周期管理, 密钥管理]
+quality_score: 70
+last_updated: 2026-06-15
+---
+# 密钥管理完整方案
+
+## 概述
+密钥管理(Secrets Management)是保护敏感信息(密码、API 密钥、证书等)的系统化方法,防止泄露和未授权访问。
+
+## 密钥类型
+
+### 1. 基础设施密钥
+- 数据库凭证
+- API 密钥
+- SSH 密钥
+- TLS/SSL 证书
+- 云服务访问密钥(AWS Access Key, GCP Service Account)
+
+### 2. 应用程序密钥
+- 加密密钥
+- 签名密钥
+- Session 密钥
+- OAuth Client Secret
+
+### 3. 业务敏感信息
+- 第三方服务凭证
+- 支付网关密钥
+- 监控和日志访问令牌
+
+## 密钥生命周期管理
+
+### 1. 生成(Generation)
+```bash
+# 强密码生成
+openssl rand -base64 32
+
+# RSA 密钥对
+openssl genrsa -out private.pem 2048
+openssl rsa -in private.pem -pubout -out public.pem
+
+# SSH 密钥
+ssh-keygen -t ed25519 -C "deploy@company.com" -f deploy_key
+
+# API 密钥
+uuidgen | tr -d '-' | lower
+```
+
+### 2. 存储(Storage)
+```yaml
+# HashiCorp Vault 示例
+vault kv put secret/myapp \
+  db_password="$(openssl rand -base64 32)" \
+  api_key="$(uuidgen)" \
+  tls_cert=@"cert.pem"
+```
+
+### 3. 分发(Distribution)
+```yaml
+# Kubernetes Secret
+apiVersion: v1
+kind: Secret
+metadata:
+  name: app-secrets
+type: Opaque
+data:
+  db_password: <base64-encoded>
+---
+# 从 Vault 注入
+apiVersion: apps/v1
+kind: Deployment
+spec:
+  template:
+    spec:
+      containers:
+      - name: app
+        env:
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: vault-secret
+              key: db_password
+```
+
+### 4. 轮换(Rotation)
+```yaml
+# Vault 动态数据库凭证
+vault write database/config/myapp \
+  plugin_name=postgresql-database-plugin \
+  allowed_roles="myapp-role" \
+  connection_url="postgresql://{{username}}:{{password}}@db:5432/myapp"
+
+vault write database/roles/myapp-role \
+  db_name=myapp \
+  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';" \
+  default_ttl="1h" \
+  max_ttl="24h"
+```
+
+### 5. 吊销(Revocation)
+```bash
+# 吊销 Vault 令牌
+vault token revoke <token>
+
+# 吊销 PKI 证书
+vault write pki/revoke serial_number=<serial>
+```
+
+## 密钥管理解决方案
+
+### 1. HashiCorp Vault
+
+#### 架构
+```
+Client -> Vault Agent -> Vault Server -> Storage Backend
+                                |
+                                -> Auth Method (AppRole, K8s, OIDC)
+                                -> Secrets Engine (KV, Database, PKI)
+```
+
+#### 核心功能
+```hcl
+# 启用审计日志
+audit {
+  type = "file"
+  options = {
+    file_path = "/var/log/vault/audit.log"
+  }
+}
+
+# AppRole 认证
+auth "approle" {
+  path = "approle"
+}
+
+# 数据库密钥引擎
+secrets "database" {
+  path = "database"
+}
+```
+
+#### 最佳实践
+```yaml
+# 1. 使用命名空间隔离
+vault namespace create team-a
+vault namespace create team-b
+
+# 2. 细粒度策略
+path "secret/data/team-a/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "secret/data/team-b/*" {
+  capabilities = ["deny"]
+}
+
+# 3. 响应包装
+vault kv get -wrap-ttl=60s secret/myapp
+```
+
+### 2. AWS Secrets Manager
+
+```python
+import boto3
+import json
+
+client = boto3.client('secretsmanager')
+
+# 存储密钥
+response = client.create_secret(
+    Name='myapp/db-password',
+    SecretString=json.dumps({
+        'username': 'admin',
+        'password': 'secure-password',
+        'host': 'db.example.com',
+        'port': 5432
+    }),
+    Tags=[
+        {'Key': 'Environment', 'Value': 'production'},
+        {'Key': 'Application', 'Value': 'myapp'}
+    ]
+)
+
+# 自动轮换
+response = client.rotate_secret(
+    SecretId='myapp/db-password',
+    RotationLambdaARN='arn:aws:lambda:region:account:function:rotate',
+    RotationRules={
+        'AutomaticallyAfterDays': 30
+    }
+)
+```
+
+### 3. Azure Key Vault
+
+```csharp
+// C# 示例
+using Azure.Identity;
+using Azure.Security.KeyVault.Secrets;
+
+var client = new SecretClient(
+    new Uri("https://myvault.vault.azure.net/"),
+    new DefaultAzureCredential()
+);
+
+// 存储密钥
+await client.SetSecretAsync("db-password", "secure-password");
+
+// 读取密钥
+KeyVaultSecret secret = await client.GetSecretAsync("db-password");
+string password = secret.Value;
+```
+
+### 4. Google Secret Manager
+
+```python
+from google.cloud import secretmanager
+
+client = secretmanager.SecretManagerServiceClient()
+
+# 创建密钥
+parent = f"projects/{project_id}"
+response = client.create_secret(
+    request={
+        "parent": parent,
+        "secret_id": "api-key",
+        "secret": {"replication": {"automatic": {}}}
+    }
+)
+
+# 添加版本
+response = client.add_secret_version(
+    request={
+        "parent": response.name,
+        "payload": {"data": b"my-secret-api-key"}
+    }
+)
+```
+
+## 密钥在 CI/CD 中的使用
+
+### GitLab CI
+```yaml
+# .gitlab-ci.yml
+variables:
+  # 从 Vault 获取
+  VAULT_ADDR: "https://vault.company.com"
+
+before_script:
+  # Vault 认证
+  - export VAULT_TOKEN=$(vault write -field=token auth/jwt/login jwt=$CI_JOB_JWT)
+
+deploy:
+  stage: deploy
+  script:
+    - export DB_PASSWORD=$(vault kv get -field=password secret/myapp/db)
+    - kubectl create secret generic app-secrets --from-literal=db-password=$DB_PASSWORD
+```
+
+### GitHub Actions
+```yaml
+name: Deploy
+on: [push]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Import Secrets
+        uses: hashicorp/vault-action@v2
+        with:
+          url: https://vault.company.com
+          role: myapp
+          method: jwt
+          secrets: |
+            secret/data/myapp db_password | DB_PASSWORD
+            secret/data/myapp api_key | API_KEY
+
+      - name: Deploy
+        run: |
+          echo "Deploying with secrets..."
+          kubectl apply -f k8s/
+```
+
+### Jenkins Pipeline
+```groovy
+pipeline {
+  agent any
+
+  stages {
+    stage('Deploy') {
+      steps {
+        script {
+          // 从 Vault 读取
+          withVault(
+            vaultBaseUrl: 'https://vault.company.com',
+            credentialId: 'vault-approle',
+            secrets: [
+              [path: 'secret/myapp', secretValues: [
+                [envVar: 'DB_PASSWORD', vaultKey: 'db_password']
+              ]]
+            ]
+          ) {
+            sh 'kubectl create secret generic app-secrets --from-literal=db-password=$DB_PASSWORD'
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+## Kubernetes 密钥管理
+
+### 1. 原生 Secret
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: app-secrets
+type: Opaque
+stringData:
+  db_password: "secure-password"  # 自动 base64 编码
+```
+
+### 2. External Secrets Operator
+```yaml
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: app-secrets
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: app-secrets
+  data:
+    - secretKey: db_password
+      remoteRef:
+        key: secret/myapp
+        property: db_password
+```
+
+### 3. Sealed Secrets
+```bash
+# 加密 Secret
+kubeseal --format=yaml < secret.yaml > sealed-secret.yaml
+
+# 部署加密后的 Secret
+kubectl apply -f sealed-secret.yaml
+```
+
+## 密钥泄露防护
+
+### 1. 预提交检测
+```bash
+# git-secrets
+git secrets --register-aws
+git secrets --scan
+
+# Gitleaks
+gitleaks detect --source . --config gitleaks.toml
+
+# TruffleHog
+trufflehog git file://. --only-verified
+```
+
+### 2. 运行时检测
+```python
+# 密钥泄露检测规则
+patterns = [
+    r'(?i)aws_access_key_id\s*=\s*[A-Z0-9]{20}',
+    r'(?i)aws_secret_access_key\s*=\s*[A-Za-z0-9/+=]{40}',
+    r'(?i)password\s*=\s*["\'][^"\']+["\']',
+    r'(?i)api_key\s*=\s*["\'][^"\']+["\']',
+    r'-----BEGIN (?:RSA |)PRIVATE KEY-----'
+]
+
+def scan_for_secrets(content):
+    for pattern in patterns:
+        if re.search(pattern, content):
+            alert_security_team(pattern)
+```
+
+### 3. Git 历史清理
+```bash
+# BFG Repo-Cleaner
+bfg --replace-text passwords.txt my-repo.git
+
+# git-filter-repo
+git filter-repo --invert-paths --path secrets.env
+```
+
+## 密钥轮换策略
+
+### 1. 自动轮换
+```yaml
+# Vault 数据库轮换
+vault write database/roles/app \
+  db_name=postgres \
+  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';" \
+  revocation_statements="DROP ROLE \"{{name}}\";" \
+  default_ttl="1h" \
+  max_ttl="24h"
+```
+
+### 2. 零停机轮换
+```yaml
+# 蓝绿密钥策略
+apiVersion: v1
+kind: Secret
+metadata:
+  name: app-secrets-blue
+data:
+  db_password: <current-password>
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: app-secrets-green
+data:
+  db_password: <new-password>
+```
+
+### 3. 渐进式轮换
+```python
+def rotate_secret(secret_name):
+    # 1. 生成新密钥
+    new_secret = generate_secret()
+
+    # 2. 写入新版本
+    add_secret_version(secret_name, new_secret)
+
+    # 3. 监控应用健康
+    if not health_check():
+        # 回滚到旧版本
+        rollback_secret(secret_name)
+        return
+
+    # 4. 标记旧版本为过期
+    expire_old_versions(secret_name, keep_last=2)
+```
+
+## 审计和合规
+
+### 1. 审计日志
+```json
+{
+  "timestamp": "2025-03-20T10:00:00Z",
+  "action": "read",
+  "secret_path": "secret/myapp/db",
+  "actor": "app-service",
+  "ip_address": "10.0.1.100",
+  "user_agent": "vault-client/1.0",
+  "success": true,
+  "response_code": 200
+}
+```
+
+### 2. 访问控制
+```hcl
+# Vault 策略示例
+# 开发者只读访问开发环境
+path "secret/data/dev/*" {
+  capabilities = ["read", "list"]
+}
+
+# 运维完全访问生产环境
+path "secret/data/prod/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+# 审计员只读访问所有
+path "sys/audit" {
+  capabilities = ["read", "list"]
+}
+```
+
+### 3. 合规检查
+```yaml
+# 密钥合规规则
+policies:
+  - name: ensure-secrets-encrypted
+    resource: aws.secretsmanager
+    filters:
+      - type: value
+        key: KmsKeyId
+        value: absent
+
+  - name: ensure-rotation-enabled
+    resource: aws.secretsmanager
+    filters:
+      - type: value
+        key: RotationEnabled
+        value: false
+
+  - name: no-secrets-in-env
+    resource: k8s.deployment
+    filters:
+      - type: env-var
+        key: PASSWORD
+        value: not-null
+```
+
+## 灾难恢复
+
+### 1. 备份策略
+```bash
+# Vault 备份
+vault operator raft snapshot save backup.snap
+
+# 恢复
+vault operator raft snapshot restore backup.snap
+```
+
+### 2. 多区域复制
+```hcl
+# Vault 复制配置
+replication {
+  mode = "primary"
+  primary_cluster_addr = "https://primary.vault:8201"
+
+  performance_replication {
+    paths = ["secret/data/global/*"]
+  }
+}
+```
+
+### 3. 密钥托管
+```yaml
+# Shamir Secret Sharing
+recovery_shares: 5
+recovery_threshold: 3
+
+# 5 人持有密钥分片,至少 3 人才能恢复
+```
+
+## 安全最佳实践
+
+### 1. 最小权限
+- 应用仅获取所需密钥
+- 使用细粒度策略
+- 定期审查权限
+
+### 2. 加密传输和存储
+- TLS 传输加密
+- 密钥静态加密
+- 信封加密
+
+### 3. 审计追踪
+- 记录所有访问
+- 实时告警异常
+- 定期审计日志
+
+### 4. 高可用
+- 多副本部署
+- 自动故障转移
+- 定期演练恢复
+
+### 5. 密钥隔离
+- 按环境隔离(Dev/Staging/Prod)
+- 按团队隔离
+- 按应用隔离
+
+## 实施检查清单
+
+- [ ] 选择密钥管理方案(Vault/云原生)
+- [ ] 建立命名规范
+- [ ] 配置访问控制策略
+- [ ] 实现自动轮换
+- [ ] 集成 CI/CD 流水线
+- [ ] 部署密钥泄露检测
+- [ ] 启用审计日志
+- [ ] 配置告警通知
+- [ ] 定期备份
+- [ ] 制定灾难恢复计划
+- [ ] 安全培训
+- [ ] 定期安全审计
+
+## 参考资料
+- [HashiCorp Vault Documentation](https://www.vaultproject.io/docs)
+- [AWS Secrets Manager Best Practices](https://docs.aws.amazon.com/secretsmanager/latest/userguide/best-practices.html)
+- [OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)
+- [Kubernetes Secrets Management](https://kubernetes.io/docs/concepts/configuration/secret/)

package/security/security-architecture-deep-dive.md

@@ -0,0 +1,37 @@
+---
+id: security-architecture-deep-dive
+title: security-architecture-deep-dive
+domain: security
+category: security-architecture-deep-dive.md
+difficulty: intermediate
+tags: [architecture, deep, dive, security, 安全环节深度知识库]
+quality_score: 70
+last_updated: 2026-06-15
+---
+# 开发：Excellent（11964948@qq.com）
+
+## 安全环节深度知识库
+
+### 目标
+- 形成从设计到运行期的全链路安全防护体系。
+
+### 安全基线
+- 认证授权：最小权限、资源归属校验、租户隔离。
+- 输入输出：参数白名单、长度限制、类型校验、敏感字段脱敏。
+- 数据保护：传输加密、存储加密、密钥轮换、访问审计。
+- 依赖治理：漏洞扫描、版本锁定、风险依赖替换策略。
+
+### 威胁建模
+- 识别资产：账号、交易、隐私、配置、日志。
+- 识别攻击面：接口、回调、文件上传、第三方依赖。
+- 评估影响：数据泄露、权限提升、服务中断、合规风险。
+- 防护方案：预防、检测、响应、恢复四层闭环。
+
+### 响应机制
+- 高危事件必须立即隔离与止损。
+- 保留完整证据链，支持事后审计与合规核查。
+- 事件关闭后必须输出改进项并进入门禁检查。
+
+### 常见失败模式
+- 只做身份认证，不做授权粒度控制。
+- 有安全工具但没有漏洞整改闭环。

package/security/threat-modeling-stride-playbook.md

@@ -0,0 +1,40 @@
+---
+id: threat-modeling-stride-playbook
+title: threat-modeling-stride-playbook
+domain: security
+category: threat-modeling-stride-playbook.md
+difficulty: intermediate
+tags: [modeling, playbook, security, stride, threat, 威胁建模手册]
+quality_score: 70
+last_updated: 2026-06-15
+---
+# 开发：Excellent（11964948@qq.com）
+
+## STRIDE 威胁建模手册
+
+### 目标
+- 在需求与设计阶段提前识别安全风险，降低上线后高危漏洞暴露概率。
+
+### STRIDE 维度
+- S：身份伪造（Spoofing）
+- T：篡改（Tampering）
+- R：抵赖（Repudiation）
+- I：信息泄露（Information Disclosure）
+- D：拒绝服务（Denial of Service）
+- E：权限提升（Elevation of Privilege）
+
+### 建模步骤
+- 列出核心资产与数据流。
+- 为每条数据流逐项评估 STRIDE 风险。
+- 为每个高风险点定义检测与防护措施。
+- 确定验证方式并纳入测试计划。
+
+### 必做检查项
+- 鉴权接口必须验证主体、租户、资源归属。
+- 敏感数据接口必须有审计日志与脱敏策略。
+- 外部输入点必须有参数白名单与长度限制。
+- 高风险操作必须定义速率限制与告警规则。
+
+### 常见失败模式
+- 只做一次建模，不随架构演进更新。
+- 识别风险后没有落地到门禁和测试。