fix(content): harden kubernetes and signing examples

14_kubernetes_setup/14.1_kubeadm.md

@@ -174,13 +174,12 @@ $ sudo kubeadm init \
       --image-repository registry.cn-hangzhou.aliyuncs.com/google_containers \
       --pod-network-cidr 10.244.0.0/16 \
       --cri-socket unix:///run/containerd/containerd.sock \
-      --v 5 \
-      --ignore-preflight-errors=all
+      --v 5
 ```
 
 * `--pod-network-cidr 10.244.0.0/16` 参数与后续 CNI 插件有关，这里以 `flannel` 为例，若后续部署其他类型的网络插件请更改此参数。
 
-> 执行可能出现错误，例如缺少依赖包，根据提示安装即可。
+> 若 `kubeadm` 预检失败，应按提示修复缺失依赖、内核参数、swap 或运行时配置。实验环境确需忽略预检时，只忽略明确理解且可接受的单项检查，不建议使用 `--ignore-preflight-errors=all`。
 
 执行成功会输出
 

14_kubernetes_setup/14.2_kubeadm-docker.md

@@ -200,14 +200,13 @@ $ sudo systemctl daemon-reload
 $ sudo kubeadm init --image-repository registry.cn-hangzhou.aliyuncs.com/google_containers \
       --pod-network-cidr 10.244.0.0/16 \
       --cri-socket unix:///var/run/cri-dockerd.sock \
-      --v 5 \
-      --ignore-preflight-errors=all
+      --v 5
 ```
 
 * `--cri-socket unix:///var/run/cri-dockerd.sock` 参数指定使用 cri-dockerd 作为容器运行时接口。
 * `--pod-network-cidr 10.244.0.0/16` 参数与后续 CNI 插件有关，这里以 `flannel` 为例，若后续部署其他类型的网络插件请更改此参数。
 
-> 执行可能出现错误，例如缺少依赖包，根据提示安装即可。
+> 若 `kubeadm` 预检失败，应按提示修复缺失依赖、内核参数、swap 或运行时配置。实验环境确需忽略预检时，只忽略明确理解且可接受的单项检查，不建议使用 `--ignore-preflight-errors=all`。
 
 执行成功会输出
 

18_security/18.6_image_security.md

@@ -313,7 +313,8 @@ RUN apt-get update && apt-get install -y curl
 
 # ✓ 推荐：固定基础镜像版本和摘要
 FROM ubuntu:22.04@sha256:a6d2b38300ce017add71440577d5b0a90460d0e6e0e14...（完整 64 位哈希）
-RUN apt-get update && apt-get install -y curl=7.68.0-1ubuntu1
+RUN apt-get update && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
 ```
 
 #### 2. 构建时扫描
@@ -414,6 +415,7 @@ jobs:
       contents: read
       packages: write
       security-events: write
+      id-token: write
 
     steps:
     - name: Checkout code
@@ -422,7 +424,11 @@ jobs:
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v4
 
-    - name: Build Docker image
+    - name: Install Cosign
+      if: github.event_name == 'push'
+      uses: sigstore/cosign-installer@v3
+
+    - name: Build Docker image for scan
       uses: docker/build-push-action@v7
       with:
         context: .
@@ -459,11 +465,6 @@ jobs:
         name: sbom
         path: sbom-cyclonedx.json
 
-    - name: Sign image with Cosign
-      if: github.event_name == 'push'
-      run: |
-        cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
     - name: Login to Registry and Push
       if: github.event_name == 'push'
       uses: docker/login-action@v3
@@ -473,11 +474,18 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Push image
+      if: github.event_name == 'push'
+      id: build-push
       uses: docker/build-push-action@v7
       with:
         context: .
         push: true
         tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+
+    - name: Sign image with Cosign
+      if: github.event_name == 'push'
+      run: |
+        cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-push.outputs.digest }}
 ```
 
 #### GitLab CI 工作流示例
@@ -486,8 +494,8 @@ jobs:
 stages:
   - build
   - scan
-  - sign
   - push
+  - sign
 
 variables:
   REGISTRY: registry.gitlab.com
@@ -524,14 +532,6 @@ generate:sbom:
     reports:
       sbom: sbom.xml
 
-sign:
-  stage: sign
-  image: gcr.io/projectsigstore/cosign:latest
-  script:
-    - cosign sign --key $COSIGN_KEY $IMAGE_NAME:$CI_COMMIT_SHA
-  only:
-    - main
-
 push:
   stage: push
   image: docker:latest
@@ -541,6 +541,21 @@ push:
     - docker load < image.tar
     - echo "$REGISTRY_PASSWORD" | docker login --username "$REGISTRY_USER" --password-stdin "$REGISTRY"
     - docker push $IMAGE_NAME:$CI_COMMIT_SHA
+    - DIGEST=$(docker buildx imagetools inspect "$IMAGE_NAME:$CI_COMMIT_SHA" --format '{{.Manifest.Digest}}')
+    - echo "$IMAGE_NAME@$DIGEST" > image-digest.txt
+  artifacts:
+    paths:
+      - image-digest.txt
+  only:
+    - main
+
+sign:
+  stage: sign
+  image: gcr.io/projectsigstore/cosign:latest
+  script:
+    - cosign sign --key $COSIGN_KEY "$(cat image-digest.txt)"
+  only:
+    - main
   only:
     - main
 ```