┌─────────────────────────────────────────────────────────────┐
│                    Kubernetes Cluster                       │
├─────────────────────────────────────────────────────────────┤
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐         │
│  │   Trivy     │  │   Falco     │  │   Policy    │         │
│  │  Scanner    │  │  Runtime    │  │  Engine     │         │
│  └─────────────┘  └─────────────┘  └─────────────┘         │
├─────────────────────────────────────────────────────────────┤
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐         │
│  │  Prometheus │  │   Grafana   │  │   Alert     │         │
│  │  Metrics    │  │  Dashboard  │  │  Manager    │         │
│  └─────────────┘  └─────────────┘  └─────────────┘         │
├─────────────────────────────────────────────────────────────┤
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐         │
│  │   SIEM      │  │   SOC       │  │   Incident  │         │
│  │ Integration │  │  Team       │  │  Response   │         │
│  └─────────────┘  └─────────────┘  └─────────────┘         │
└─────────────────────────────────────────────────────────────┘

# Trivy Installation
helm repo add aquasecurity https://aquasecurity.github.io/helm-charts/
helm install trivy aquasecurity/trivy-operator \
  --namespace trivy-system \
  --create-namespace

# Vulnerability Scanning konfigurieren
kubectl apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: trivy-config
  namespace: trivy-system
data:
  trivy.yaml: |
    vulnerability:
      severity: CRITICAL,HIGH,MEDIUM
      ignoreUnfixed: false
    image:
      pullPolicy: IfNotPresent
EOF

# Falco Installation
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco \
  --namespace falco-system \
  --create-namespace \
  --set falco.jsonOutput=true \
  --set falco.webserver.enabled=true

# Custom Rules erstellen
kubectl apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: falco-rules
  namespace: falco-system
data:
  custom-rules.yaml: |
    - rule: Suspicious Container Creation
      desc: Detect suspicious container creation
      condition: spawned_process and container and proc.name=sh
      output: Suspicious container creation (user=%user.name container=%container.name)
      priority: WARNING
EOF

# OPA Gatekeeper Policies
apiVersion: config.gatekeeper.sh/v1alpha1
kind: Config
metadata:
  name: config
  namespace: gatekeeper-system
spec:
  sync:
    syncOnly:
      - group: ''
        version: 'v1'
        kind: 'Pod'
  validation:
    - name: pod-security-policy
      kind: Pod
      spec:
        securityContext:
          runAsNonRoot: true
          runAsUser: 1000

# Prometheus Alert Rules
groups:
  - name: kubernetes-security
    rules:
      - alert: HighVulnerabilityDetected
        expr: trivy_vulnerabilities_total{severity="HIGH"} > 0
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: 'High severity vulnerability detected'
          description: '{{ $labels.container }} has {{ $value }} high severity vulnerabilities'

# 1. Namespace erstellen
kubectl create namespace trivy-system

# 2. Trivy Operator installieren
helm repo add aquasecurity https://aquasecurity.github.io/helm-charts/
helm repo update
helm install trivy-operator aquasecurity/trivy-operator \
  --namespace trivy-system \
  --set trivy.ignoreUnfixed=true \
  --set trivy.severity=CRITICAL,HIGH,MEDIUM

# 3. Vulnerability Scanner konfigurieren
kubectl apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: trivy-config
  namespace: trivy-system
data:
  trivy.yaml: |
    vulnerability:
      severity: CRITICAL,HIGH,MEDIUM
      ignoreUnfixed: false
      ignoreFile: .trivyignore
    image:
      pullPolicy: IfNotPresent
    registry:
      insecure: false
      skipTLSVerify: false
EOF

# 1. Falco installieren
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update
helm install falco falcosecurity/falco \
  --namespace falco-system \
  --create-namespace \
  --set falco.jsonOutput=true \
  --set falco.webserver.enabled=true \
  --set falco.webserver.port=9376

# 2. Custom Security Rules
kubectl apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: falco-rules
  namespace: falco-system
data:
  custom-rules.yaml: |
    - rule: Unauthorized Process Execution
      desc: Detect unauthorized process execution in containers
      condition: spawned_process and container and not proc.name in (nginx,apache,node,python)
      output: Unauthorized process execution detected (user=%user.name container=%container.name proc=%proc.name)
      priority: WARNING

    - rule: Privilege Escalation
      desc: Detect privilege escalation attempts
      condition: spawned_process and proc.name=su and proc.args contains "-"
      output: Privilege escalation attempt detected (user=%user.name container=%container.name)
      priority: CRITICAL

    - rule: Network Connection to Suspicious IP
      desc: Detect connections to known malicious IPs
      condition: outbound and fd.type=ipv4 and fd.rip in (192.168.1.100,10.0.0.50)
      output: Suspicious network connection detected (user=%user.name container=%container.name remote_ip=%fd.rip)
      priority: WARNING
EOF

# 1. Gatekeeper installieren
kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/master/deploy/gatekeeper.yaml

# 2. Security Policies definieren
kubectl apply -f - <<EOF
apiVersion: config.gatekeeper.sh/v1alpha1
kind: Config
metadata:
  name: config
  namespace: gatekeeper-system
spec:
  sync:
    syncOnly:
      - group: ""
        version: "v1"
        kind: "Pod"
      - group: "apps"
        version: "v1"
        kind: "Deployment"
  validation:
    - name: pod-security-policy
      kind: Pod
      spec:
        securityContext:
          runAsNonRoot: true
          runAsUser: 1000
        containers:
        - securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
EOF

# Prometheus Alert Rules
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: kubernetes-security-alerts
  namespace: monitoring
spec:
  groups:
    - name: kubernetes-security
      rules:
        - alert: HighVulnerabilityDetected
          expr: trivy_vulnerabilities_total{severity="HIGH"} > 0
          for: 5m
          labels:
            severity: warning
          annotations:
            summary: 'High severity vulnerability detected'
            description: '{{ $labels.container }} has {{ $value }} high severity vulnerabilities'

        - alert: FalcoSecurityEvent
          expr: falco_events_total > 0
          for: 1m
          labels:
            severity: critical
          annotations:
            summary: 'Security event detected by Falco'
            description: '{{ $labels.rule }} - {{ $labels.container }}'

# Multi-Stage Build mit Security Scanning
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

# Security Scan Stage
FROM aquasec/trivy:latest AS scanner
COPY --from=builder /app /app
RUN trivy fs --exit-code 1 --severity HIGH,CRITICAL /app

# Production Stage
FROM node:18-alpine AS production
RUN addgroup -g 1001 -S nodejs
RUN adduser -S nodejs -u 1001
WORKDIR /app
COPY --from=builder --chown=nodejs:nodejs /app .
USER nodejs
EXPOSE 3000
CMD ["node", "app.js"]

# Falco Custom Rules für deutsche Compliance
- rule: DSGVO Data Access
  desc: Detect unauthorized access to personal data
  condition: open_write and container and proc.name in (cat,cp,mv,rm) and fd.name contains "personal"
  output: Unauthorized access to personal data (user=%user.name container=%container.name file=%fd.name)
  priority: CRITICAL

- rule: BSI Compliance Check
  desc: Detect compliance violations according to BSI standards
  condition: spawned_process and container and proc.name in (su,sudo,passwd) and not proc.args contains "audit"
  output: BSI compliance violation detected (user=%user.name container=%container.name)
  priority: WARNING

# OPA Policy für deutsche Compliance
package kubernetes.admission

deny[msg] {
    input.request.kind.kind == "Pod"
    input.request.object.spec.containers[_].securityContext.runAsRoot == true
    msg := "Pods must not run as root for DSGVO compliance"
}

deny[msg] {
    input.request.kind.kind == "Pod"
    not input.request.object.spec.securityContext.runAsNonRoot
    msg := "Pods must have runAsNonRoot security context"
}

deny[msg] {
    input.request.kind.kind == "Pod"
    input.request.object.spec.containers[_].image =~ ".*:latest$"
    msg := "Using latest tag is not allowed for production deployments"
}

# Problem: Trivy kann Images nicht scannen
# Lösung: Registry-Authentifizierung konfigurieren

kubectl create secret docker-registry trivy-registry-secret \
  --docker-server=your-registry.com \
  --docker-username=your-username \
  --docker-password=your-password

# Trivy Config aktualisieren
kubectl patch configmap trivy-config -n trivy-system --patch '{
  "data": {
    "trivy.yaml": "registry:\n  auth:\n    secretName: trivy-registry-secret"
  }
}'

# Problem: Zu viele False Positives
# Lösung: Custom Rules verfeinern

- rule: Refined Process Execution
  desc: Detect unauthorized processes with exceptions
  condition: spawned_process and container and not proc.name in (nginx,apache,node,python,sh,bash) and not proc.args contains "health"
  output: Unauthorized process execution (user=%user.name container=%container.name proc=%proc.name)
  priority: WARNING
  enabled: true

# Problem: Gatekeeper verlangsamt Deployments
# Lösung: Caching und Exemptions konfigurieren

kubectl patch configmap config -n gatekeeper-system --patch '{
  "spec": {
    "sync": {
      "syncOnly": [
        {"group": "", "version": "v1", "kind": "Pod"},
        {"group": "apps", "version": "v1", "kind": "Deployment"}
      ]
    }
  }
}'