Kubernetes入门学习-十七-RBAC

川长思鸟来 2022-02-28 04:44 258阅读 0赞

[最近学习k8s遇到很多问题，建了一个qq群：153144292，交流devops、k8s、docker等][k8s_qq_153144292_devops_k8s_docker]

授权插件：Node，ABAC,RBAC,Webhook  
Kubernetes的授权是基于插件形式的，其常用的授权插件有以下几种：  
    Node（节点认证）  
    ABAC(基于属性的访问控制)  
    RBAC（基于角色的访问控制）  
    Webhook（基于http回调机制的访问控制）  
      
    RBAC:Role-based AC  
      
    角色（role）  
    许可（permission）  
    让一个用户（Users）扮演一个角色（Role），角色拥有权限，从而让用户拥有这样的权限，随  
后在授权机制当中，只需要将权限授予某个角色，此时用户将获取对应角色的权限，从而实现角色的  
访问控制。

用户--角色--oper-->objects

定义角色role:   
    operations  
    objects  
      
rolebinding  
    user account OR service account  
    role

基于角色的访问控制（Role-Based Access Control, 即”RBAC”）使用”rbac.authorization.k8s.io” API  
Group实现授权决策，允许管理员通过Kubernetes API动态配置策略。

在k8s的授权机制当中，采用RBAC的方式进行授权，其工作逻辑是把对对象的操作权限定义到一个角色当中，  
再将用户绑定到该角色，从而使用户得到对应角色的权限。此种方式仅作用于名称空间当中，这是什么意思呢？  
当User1绑定到Role角色当中，User1就获取了对该NamespaceA的操作权限，但是对NamespaceB是没有权限进行操  
作的，如get，list等操作。

另外，k8s为此还有一种集群级别的授权机制，就是定义一个集群角色（ClusterRole），对集群内的所有资  
源都有可操作的权限，从而将User2，User3通过ClusterRoleBinding到ClusterRole，从而使User2、User3拥有  
集群的操作权限。  
      
k8s中资源分别属于两个级别：集群和名称空间  
    role和rolebinding授予是在名称空间级别  
    clusterrole和clusterrolebinding授予是在集群级别  
以上都是k8s标准资源

但是这里有2种绑定ClusterRoleBinding、RoleBinding。也可以使用RoleBinding去绑定ClusterRole。  
当使用这种方式进行绑定时，用户仅能获取当前名称空间的所有权限。为什么这么绕呢？？举例有10个名  
称空间，每个名称空间都需要一个管理员，而该管理员的权限都是一致的。那么此时需要去定义这样的管  
理员，使用RoleBinding就需要创建10个Role，这样显得更加繁重。为此当使用RoleBinding去绑定一个  
ClusterRole时，该User仅仅拥有对当前名称空间的集群操作权限，换句话说，此时只需要创建一个  
ClusterRole就解决了以上的需求。

这里要注意的是：RoleBinding仅仅对当前名称空间有对应的权限。  
在RBAC API中，一个角色包含了一套表示一组权限的规则。 权限以纯粹的累加形式累积（没有”否定”的  
规则）。角色可以由命名空间（namespace）内的Role对象定义，而整个Kubernetes集群范围内有效的角  
色则通过ClusterRole对象实现。

1、User --> Rolebinding --> Role  
 （1）角色的创建  
一个Role对象只能用于授予对某一单一命名空间中资源的访问权限  
\[root@master ~\]\# kubectl create role -h   
Create a role with single rule.

Examples:  
  \# Create a Role named "pod-reader" that allows user to perform "get", "watch" and "list" on pods  
  kubectl create role pod-reader --verb=get --verb=list --verb=watch --resource=pods  
    
  \# Create a Role named "pod-reader" with ResourceName specified  
  kubectl create role pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod  
    
  \# Create a Role named "foo" with API Group specified  
  kubectl create role foo --verb=get,list,watch --resource=rs.extensions  
    
  \# Create a Role named "foo" with SubResource specified  
  kubectl create role foo --verb=get,list,watch --resource=pods,pods/status

Options:  
      --allow-missing-template-keys=true: If true, ignore any errors in templates when a field or map key is missing in  
the template. Only applies to golang and jsonpath output formats.  
      --dry-run=false: If true, only print the object that would be sent, without sending it.  
  -o, --output='': Output format. One of:  
json|yaml|name|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-file.  
      --resource=\[\]: Resource that the rule applies to  
      --resource-name=\[\]: Resource in the white list that the rule applies to, repeat this flag for multiple items  
      --save-config=false: If true, the configuration of current object will be saved in its annotation. Otherwise, the  
annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.  
      --template='': Template string or path to template file to use when -o=go-template, -o=go-template-file. The  
template format is golang templates \[http://golang.org/pkg/text/template/\#pkg-overview\].  
      --validate=true: If true, use a schema to validate the input before sending it  
      --verb=\[\]: Verb that applies to the resources contained in the rule

Usage:  
  kubectl create role NAME --verb=verb --resource=resource.group/subresource \[--resource-name=resourcename\] \[--dry-run\]  
\[options\]  
使用kubectl create进行创建角色，指定角色名称，--verb指定权限，--resource指定资源或者资源组，--dry-run单跑模式并不会创建  
Use "kubectl options" for a list of global command-line options (applies to all commands).

使用--dry-run参数查看role清单定义  
\[root@master ~\]\# kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run -o yaml  
apiVersion: rbac.authorization.k8s.io/v1  
kind: Role  
metadata:  
  creationTimestamp: null  
  name: pods-reader  
rules:  
\- apiGroups:       \#对那些api组内的资源进行操作  
  - ""  
  resources:       \#对那些资源定义  
  - pods  
  verbs:           \#操作权限定义  
  - get  
  - list  
  - watch  
\[root@master manifests\]\# kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run -o yaml > role-demo.yaml  
\[root@master manifests\]\# vi role-demo.yaml   
\[root@master manifests\]\# cat role-demo.yaml   
apiVersion: rbac.authorization.k8s.io/v1  
kind: Role  
metadata:  
  name: pods-reader  
  namespace: default  
rules:  
\- apiGroups:  
  - ""  
  resources:  
  - pods  
  verbs:  
  - get  
  - list  
  - watch  
\[root@master manifests\]\# kubectl apply -f role-demo.yaml   
role.rbac.authorization.k8s.io/pods-reader created  
\[root@master manifests\]\# kubectl get role  
NAME          AGE  
pods-reader   40s  
\[root@master manifests\]\# kubectl describe role pods-reader  
Name:         pods-reader  
Labels:       <none>  
Annotations:  kubectl.kubernetes.io/last-applied-configuration:  
                \{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":\{"annotations":\{\},"name":"pods-reader","namespace":"default"\},"rules...  
PolicyRule:  
  Resources  Non-Resource URLs  Resource Names  Verbs  
  ---------  -----------------  --------------  -----  
  pods       \[\]                 \[\]              \[get list watch\]  
  \#此处已经定义了pods-reader这个角色对pods资源拥有get、list、watch的权限  
    
（2）角色的绑定  
RoleBinding可以引用在同一命名空间内定义的Role对象。  
\[root@master manifests\]\# kubectl create rolebinding -h  
Create a RoleBinding for a particular Role or ClusterRole.

Examples:  
  \# Create a RoleBinding for user1, user2, and group1 using the admin ClusterRole  
  kubectl create rolebinding admin --clusterrole=admin --user=user1 --user=user2 --group=group1

Options:  
      --allow-missing-template-keys=true: If true, ignore any errors in templates when a field or map key is missing in  
the template. Only applies to golang and jsonpath output formats.  
      --clusterrole='': ClusterRole this RoleBinding should reference  
      --dry-run=false: If true, only print the object that would be sent, without sending it.  
      --generator='rolebinding.rbac.authorization.k8s.io/v1alpha1': The name of the API generator to use.  
      --group=\[\]: Groups to bind to the role  
  -o, --output='': Output format. One of:  
json|yaml|name|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-file.  
      --role='': Role this RoleBinding should reference  
      --save-config=false: If true, the configuration of current object will be saved in its annotation. Otherwise, the  
annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.  
      --serviceaccount=\[\]: Service accounts to bind to the role, in the format <namespace>:<name>  
      --template='': Template string or path to template file to use when -o=go-template, -o=go-template-file. The  
template format is golang templates \[http://golang.org/pkg/text/template/\#pkg-overview\].  
      --validate=true: If true, use a schema to validate the input before sending it

Usage:  
  kubectl create rolebinding NAME --clusterrole=NAME|--role=NAME \[--user=username\] \[--group=groupname\]  
\[--serviceaccount=namespace:serviceaccountname\] \[--dry-run\] \[options\]  
使用kubectl create进行创建角色绑定，指定角色绑定的名称，--role|--clusterrole指定绑定哪个角色，--user指定哪个用户  
Use "kubectl options" for a list of global command-line options (applies to all commands).  
\[root@master manifests\]\# kubectl create rolebinding wolf-read-pods --role=pods-reader --user=wolf --dry-run -o yaml > rolebinding-demo.yaml  
\[root@master manifests\]\# cat rolebinding-demo.yaml   
apiVersion: rbac.authorization.k8s.io/v1  
kind: RoleBinding  
metadata:  
  creationTimestamp: null  
  name: wolf-read-pods  
roleRef:  
  apiGroup: rbac.authorization.k8s.io  
  kind: Role  
  name: pods-reader  
subjects:  
\- apiGroup: rbac.authorization.k8s.io  
  kind: User  
  name: wolf  
\#创建角色绑定  
\[root@master manifests\]\# kubectl apply -f rolebinding-demo.yaml       
rolebinding.rbac.authorization.k8s.io/wolf-read-pods created  
\#查看角色绑定的信息，这里可以看到user：magedu绑定到了pods-reader这个角色上  
\[root@master manifests\]\# kubectl describe rolebinding wolf-read-pods  
Name:         wolf-read-pods  
Labels:       <none>  
Annotations:  kubectl.kubernetes.io/last-applied-configuration:  
                \{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"RoleBinding","metadata":\{"annotations":\{\},"creationTimestamp":null,"name":"wolf-read-...  
Role:  
  Kind:  Role  
  Name:  pods-reader  
Subjects:  
  Kind  Name  Namespace  
  ----  ----  ---------  
  User  wolf    
    
切换wolf这个用户，并使用get获取pods资源信息  
\[root@master manifests\]\# kubectl config use-context wolf@kubernetes   
Switched to context "wolf@kubernetes".  
\[root@master manifests\]\# kubectl get pods  
NAME                            READY   STATUS    RESTARTS   AGE  
myapp-0                         1/1     Running   0          5d18h  
myapp-1                         1/1     Running   0          5d18h  
myapp-2                         1/1     Running   0          5d18h  
myapp-3                         1/1     Running   0          5d18h  
nginx-7849c4bbcd-dscjr          1/1     Running   0          22d  
nginx-7849c4bbcd-vdd45          1/1     Running   0          22d  
nginx-7849c4bbcd-wrvks          1/1     Running   0          22d  
nginx-deploy-84cbfc56b6-scrnt   1/1     Running   0          5d19h  
pod-sa-demo                     1/1     Running   0          4d18h  
获取其他名称空间测试  
\[root@master manifests\]\#  kubectl get pods -n ingress-nginx  
Error from server (Forbidden): pods is forbidden: User "wolf" cannot list resource "pods" in API group "" in the namespace "ingress-nginx"  
从上面的操作，可以总结出，role的定义和绑定，仅作用于当前名称空间，在获取ingress-nginx名称空间时，一样会出现Forbidden！！！

2、User --> Clusterrolebinding --> Clusterrole  
 （1）clusterrole定义  
ClusterRole对象可以授予与Role对象相同的权限，但由于它们属于集群范围对象， 也可以使用它们授予对以下几种资源的访问权限：

集群范围资源（例如节点，即node）  
非资源类型endpoint（例如”/healthz”）  
跨所有命名空间的命名空间范围资源（例如pod，需要运行命令kubectl get pods --all-namespaces来查询集群中所有的pod）  
先切换回kubernetes-admin  
\[root@master manifests\]\# kubectl config use-context kubernetes-admin@kubernetes  
Switched to context "kubernetes-admin@kubernetes".  
\[root@master manifests\]\# kubectl create clusterrole cluster-read --verb=get,list,watch --resource=pods -o yaml > clusterrole-demo.yaml  
\[root@master manifests\]\# vim clusterrole-demo.yaml  
\[root@master manifests\]\# cat clusterrole-demo.yaml   \#定义clusterrole和权限  
apiVersion: rbac.authorization.k8s.io/v1  
kind: ClusterRole  
metadata:  
  name: cluster-read  
rules:  
\- apiGroups:  
  - ""  
  resources:  
  - pods  
  verbs:  
  - get  
  - list  
  - watch  
\[root@master manifests\]\# kubectl apply -f clusterrole-demo.yaml  
Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply  
clusterrole.rbac.authorization.k8s.io/cluster-read configured  
\[root@master manifests\]\# kubectl get role  
NAME          AGE  
pods-reader   17m  
\[root@master manifests\]\# kubectl get clusterrole  
NAME                                                                   AGE  
admin                                                                  23d  
cluster-admin                                                          23d  
cluster-read                                                           3m42s

\[root@master manifests\]\# useradd ik8s  
\[root@master ~\]\# cp -rp .kube/ /home/ik8s/  
\[root@master ~\]\# chown -R ik8s.ik8s /home/ik8s/  
\[root@master ~\]\# su - ik8s  
\[ik8s@master ~\]$ kubectl config use-context wolf@kubernetes  
Switched to context "wolf@kubernetes".  
\[ik8s@master ~\]$ kubectl config view  
apiVersion: v1  
clusters:  
\- cluster:  
    certificate-authority-data: DATA+OMITTED  
    server: https://10.249.6.100:6443  
  name: kubernetes  
contexts:  
\- context:  
    cluster: kubernetes  
    user: kubernetes-admin  
  name: kubernetes-admin@kubernetes  
\- context:  
    cluster: kubernetes  
    user: wolf  
  name: wolf@kubernetes  
current-context: wolf@kubernetes      这里当前用户为wolf  
kind: Config  
preferences: \{\}  
users:  
\- name: kubernetes-admin  
  user:  
    client-certificate-data: REDACTED  
    client-key-data: REDACTED  
\- name: wolf  
  user:  
    client-certificate-data: REDACTED  
    client-key-data: REDACTED  
      
（2）clusterrolebinding定义  
\[root@master manifests\]\# kubectl get rolebinding  
NAME             AGE  
wolf-read-pods   14m

删除之前的role  
\[root@master manifests\]\# kubectl delete rolebinding wolf-read-pods  
rolebinding.rbac.authorization.k8s.io "wolf-read-pods" deleted  
\[root@master manifests\]\# kubectl get pods  
NAME                            READY   STATUS    RESTARTS   AGE  
myapp-0                         1/1     Running   0          5d19h  
myapp-1                         1/1     Running   0          5d19h  
myapp-2                         1/1     Running   0          5d18h  
myapp-3                         1/1     Running   0          5d18h  
nginx-7849c4bbcd-dscjr          1/1     Running   0          22d  
nginx-7849c4bbcd-vdd45          1/1     Running   0          22d  
nginx-7849c4bbcd-wrvks          1/1     Running   0          22d  
nginx-deploy-84cbfc56b6-scrnt   1/1     Running   0          5d19h  
pod-sa-demo                     1/1     Running   0          4d18h  
\-----------------  
普通用户测试  
\[ik8s@master ~\]$ kubectl get pods  
Error from server (Forbidden): pods is forbidden: User "wolf" cannot list resource "pods" in API group "" in the namespace "default"

\----------------  
kubectl create clusterrolebinding wolf-read-all-pods --clusterrole=cluster-read --user=wolf --dry-run -o yaml > clusterrolebinding-demo.yaml  
\[root@master manifests\]\# kubectl create clusterrolebinding wolf-read-all-pods --clusterrole=cluster-read --user=wolf --dry-run -o yaml > clusterrolebinding-demo.yaml  
\[root@master manifests\]\# vim clusterrolebinding-demo.yaml  
\[root@master manifests\]\# cat clusterrolebinding-demo.yaml   
apiVersion: rbac.authorization.k8s.io/v1beta1  
kind: ClusterRoleBinding  
metadata:  
  name: wolf-read-all-pods  
roleRef:  
  apiGroup: rbac.authorization.k8s.io  
  kind: ClusterRole  
  name: cluster-read  
subjects:  
\- apiGroup: rbac.authorization.k8s.io  
  kind: User  
  name: wolf

\[root@master manifests\]\# kubectl get clusterrolebinding  
NAME                                                   AGE  
。。。。  
wolf-read-all-pods                                     3m14s  
\[root@master manifests\]\# kubectl describe clusterrolebinding wolf-read-all-pods  
'Name:         wolf-read-all-pods  
Labels:       <none>  
Annotations:  kubectl.kubernetes.io/last-applied-configuration:  
                \{"apiVersion":"rbac.authorization.k8s.io/v1beta1","kind":"ClusterRoleBinding","metadata":\{"annotations":\{\},"name":"wolf-read-all-pods"\},"r...  
Role:  
  Kind:  ClusterRole  
  Name:  cluster-read  
Subjects:  
  Kind  Name  Namespace  
  ----  ----  ---------  
  User  wolf    
\----------------------------  
在ik8s用户界面查看  
\[ik8s@master ~\]$ kubectl get pods   
NAME                            READY   STATUS    RESTARTS   AGE  
myapp-0                         1/1     Running   0          5d19h  
myapp-1                         1/1     Running   0          5d19h  
myapp-2                         1/1     Running   0          5d19h  
myapp-3                         1/1     Running   0          5d19h  
nginx-7849c4bbcd-dscjr          1/1     Running   0          22d  
nginx-7849c4bbcd-vdd45          1/1     Running   0          22d  
nginx-7849c4bbcd-wrvks          1/1     Running   0          22d  
nginx-deploy-84cbfc56b6-scrnt   1/1     Running   0          5d19h  
pod-sa-demo                     1/1     Running   0          4d18h  
继续查看其他namespace  
\[ik8s@master ~\]$  kubectl get pods -n ingress-nginx  
NAME                                        READY   STATUS    RESTARTS   AGE  
nginx-ingress-controller-797b884cbc-whphv   1/1     Running   0          11d

删除试试  
\[ik8s@master ~\]$ kubectl delete pods pod-sa-demo  
Error from server (Forbidden): pods "pod-sa-demo" is forbidden: User "wolf" cannot delete resource "pods" in API group "" in the namespace "default"  
从上面的实验，我们可以知道对用户wolf进行集群角色绑定，用户wolf将会获取对集群内所有资源的对应权限。

3、User --> Rolebinding --> Clusterrole  
将wolf通过rolebinding到集群角色wolf-read-pods当中，此时，wolf仅作用于当前名称空间的所有pods资源的权限  
kubectl create rolebinding wolf-read-pods --clusterrole=cluster-read --user=wolf --dry-run -o yaml > rolebinding-clusterrole-demo.yaml  
\[root@master manifests\]\# kubectl create rolebinding wolf-read-pods --clusterrole=cluster-read --user=wolf --dry-run -o yaml > rolebinding-clusterrole-demo.yaml  
\[root@master manifests\]\# vim rolebinding-clusterrole-demo.yaml  
\[root@master manifests\]\# cat rolebinding-clusterrole-demo.yaml   
apiVersion: rbac.authorization.k8s.io/v1  
kind: RoleBinding  
metadata:  
  name: wolf-read-pods  
  namespace: default  
roleRef:  
  apiGroup: rbac.authorization.k8s.io  
  kind: ClusterRole  
  name: cluster-read  
subjects:  
\- apiGroup: rbac.authorization.k8s.io  
  kind: User  
  name: wolf  
\[root@master manifests\]\# kubectl apply -f rolebinding-clusterrole-demo.yaml  
rolebinding.rbac.authorization.k8s.io/wolf-read-pods created

\------------  
\[ik8s@master ~\]$ kubectl get pods  
NAME                            READY   STATUS    RESTARTS   AGE  
myapp-0                         1/1     Running   0          5d19h  
myapp-1                         1/1     Running   0          5d19h  
myapp-2                         1/1     Running   0          5d19h  
myapp-3                         1/1     Running   0          5d19h  
nginx-7849c4bbcd-dscjr          1/1     Running   0          22d  
nginx-7849c4bbcd-vdd45          1/1     Running   0          22d  
nginx-7849c4bbcd-wrvks          1/1     Running   0          22d  
nginx-deploy-84cbfc56b6-scrnt   1/1     Running   0          5d19h  
pod-sa-demo                     1/1     Running   0          4d19h  
\[ik8s@master ~\]$ kubectl get pods -n ingress-nginx  
Error from server (Forbidden): pods is forbidden: User "wolf" cannot list resource "pods" in API group "" in the namespace "ingress-nginx"

==============  
RBAC的三种授权访问  
RBAC不仅仅可以对user进行访问权限的控制，还可以通过group和serviceaccount进行访问权限控制。当我们想对一组用户进行权限分配时，即可将这一组用户归并到一个组内，从而通过对group进行访问权限的分配，达到访问权限控制的效果。  
从前面serviceaccount我们可以了解到，Pod可以通过 spec.serviceAccountName来定义其是以某个serviceaccount的身份进行运行，当我们通过RBAC对serviceaccount进行访问授权时，即可以实现Pod对其他资源的访问权限进行控制。也就是说，当我们对serviceaccount进行rolebinding或clusterrolebinding，会使创建Pod拥有对应角色的权限和apiserver进行通信。

pod--（spec:   serviceAccountName: xxx）---->Serviceaccount-->Rolebinding-->role

[k8s_qq_153144292_devops_k8s_docker]: https://blog.csdn.net/yujin2010good/article/details/88652678