이 문서에서는 보안 권장사항에 따라 Knative serving과 주요 구성요소를 구성하는 방법을 설명합니다.
Knative serving 보호
Knative serving은 오픈소스 Knative 프로젝트를 기반으로 하며 보안 상황을 상속합니다.
Knative serving에서 실행되는 워크로드는 동일한 네트워크 및 컴퓨팅 노드를 공유합니다.
상호 신뢰가 없는 워크로드에 대해 별도의 클러스터를 만들어야 합니다.
Knative serving 클러스터는 CI/CD 인프라 또는 데이터베이스와 같이 관련 없는 워크로드를 실행해서는 안 됩니다.
Knative serving 워크로드에 대한 클러스터를 여러 개 만드는 이유는 다음과 같습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Security best practices in Knative serving\n\nThis document describes how to configure Knative serving and its major\ncomponents following security best practices.\n\nSecuring Knative serving\n------------------------\n\nKnative serving is based on the open source\n[Knative](https://knative.dev/) project, and inherits its\nsecurity posture.\n\nWorkloads running on Knative serving share the same network and compute nodes.\nYou should create separate clusters for workloads that don't have mutual trust.\nKnative serving clusters should not run unrelated workloads like CI/CD\ninfrastructure or databases.\n\nReasons to create multiple clusters for Knative serving workloads include:\n\n- Separating development from production environments.\n- Isolating applications owned by different teams.\n- Isolating highly privileged workloads.\n\nOnce you've designed your clusters, take the following actions to help secure them:\n\n- [Restrict access to your cluster](/kubernetes-engine/enterprise/knative-serving/docs/securing/managing-access).\n- [Understand the Knative threat model](https://github.com/knative/community/blob/main/working-groups/security/threat-model.md).\n- [Read the Knative security reference if you plan to use community supported tooling](https://knative.dev/docs/reference/security/).\n\nSecuring components\n-------------------\n\nYou are responsible for securing components that aren't [part of Knative serving](/kubernetes-engine/enterprise/knative-serving/docs/architecture-overview#components_in_the_default_installation).\n\n### Cloud Service Mesh\n\nKnative serving relies on\n[Cloud Service Mesh for routing traffic](/kubernetes-engine/enterprise/knative-serving/docs/architecture-overview#components_in_the_default_installation).\n\nUse the following guides to help you secure Cloud Service Mesh:\n\n- [Cloud Service Mesh security overview and features](/service-mesh/v1.18/docs/security/security-overview).\n- [Cloud Service Mesh security best practices](/service-mesh/v1.18/docs/security/anthos-service-mesh-security-best-practices).\n\n### Google Kubernetes Engine\n\nKnative serving uses Google Kubernetes Engine (GKE) to schedule workloads.\nTake the following actions to help you secure your clusters:\n\n- [Follow the GKE Enterprise security tutorial](/anthos/docs/tutorials/security).\n- [Understand the Google Kubernetes Engine multi-tenancy model](/kubernetes-engine/docs/concepts/multitenancy-overview).\n- [Follow the Google Kubernetes Engine cluster hardening guide](/kubernetes-engine/docs/how-to/hardening-your-cluster).\n- [Understand the Google Kubernetes Engine shared responsibility model](/kubernetes-engine/docs/concepts/shared-responsibility).\n\nKnown vulnerabilities\n---------------------\n\nYou should subscribe to the security bulletins for Knative serving dependencies\nso you can keep up-to-date with known vulnerabilities:\n\n- [Cloud Service Mesh security bulletins](/service-mesh/v1.18/docs/security-bulletins).\n- [GKE Enterprise security bulletins](/anthos/clusters/docs/security-bulletins)."]]
