kubernetes rbac权限认证

亦凉 2022-04-03 17:16 211阅读 0赞

RBAC 基于角色的访问控制，引入了4个资源对象，分别是Role，ClusterRole，RoleBinding，ClusterRoleBinding.

1.角色(ROLE):

Role表示是一组规则权限，只能累加，Role可以定义在一个namespace中，只能用于授予对单个命名空间中的资源访问的权限

2.集群角色(ClusterRole)

ClusterRole具有与Role相同的权限角色控制能力，不同的是ClusterRole是集群级别的，可以用于:

*  集群级别的资源控制(例如 node 访问权限)
 *  非资源型 endpoints(例如 /healthz 访问)
 *  所有命名空间资源控制(例如 pods)

3.角色绑定(RoleBinding)集群角色绑定(ClusterRoleBinding)

RoloBinding可以将角色中定义的权限授予用户或用户组，RoleBinding包含一组权限列表(subjects)，权限列表中包含有不同形式的待授予权限资源类型(users、groups、service accounts)，RoleBinding适用于某个命名空间内授权，而 ClusterRoleBinding适用于集群范围内的授权。

RoleBinding同样可以引用ClusterRole来对当前 namespace 内用户、用户组或 ServiceAccount 进行授权，这种操作允许集群管理员在整个集群内定义一些通用的 ClusterRole，然后在不同的 namespace 中使用 RoleBinding 来引用

开启RBAC认证：

apiserver 启动的时候指定RBAC参数

\--authorization-mode=Node,RBAC

例子：

现在有个需求集群外的服务器需要获取集群管理员的权限，我们可以这样写：

kubectl create serviceaccount root

kubectl create clusterrolebinding root-cluster --clusterrole=cluster-admin --user=root

或者通过yaml文件实现

apiVersion: v1

kind: ServiceAccount

metadata:

\---

kind: ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1beta1

metadata:

subjects:

\- kind: ServiceAccount

namespace: default

roleRef:

kind: ClusterRole

apiGroup: rbac.authorization.k8s.io

查看root的配置及绑定的角色

\# kubectl get sa root -o yaml  
apiVersion: v1  
kind: ServiceAccount  
metadata:  
  creationTimestamp: 2018-12-22T13:51:06Z  
  name: root  
  namespace: default  
  resourceVersion: "3928601"  
  selfLink: /api/v1/namespaces/default/serviceaccounts/root  
  uid: a143d8fd-05f0-11e9-9b39-c659655aa83d  
secrets:  
\- name: root-token-9f84k

\# kubectl get ClusterRoleBinding root-admin -o yaml  
apiVersion: rbac.authorization.k8s.io/v1  
kind: ClusterRoleBinding  
metadata:  
  creationTimestamp: 2018-12-23T12:03:30Z  
  name: root-admin  
  resourceVersion: "4068948"  
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/root-admin  
  uid: c33133a7-06aa-11e9-960b-005056a99383  
roleRef:  
  apiGroup: rbac.authorization.k8s.io  
  kind: ClusterRole  
  name: cluster-admin  
subjects:  
\- kind: ServiceAccount  
  name: root  
  namespace: default  
获取root的token：

\# kubectl get secret $(kubectl get serviceaccount root -o jsonpath='\{.secrets\[\].name\}') -o jsonpath='\{.data.token\}' | base64 --decode  eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6InJvb3QtdG9rZW4tOWY4NGsiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoicm9vdCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImExNDNkOGZkLTA1ZjAtMTFlOS05YjM5LWM2NTk2NTVhYTgzZCIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OnJvb3QifQ.G6-JRbqUs3WYGYHR8Z2Mih5kPIZEx0kn1VnI7lnJmD16KZhU0mMbzuzqya4iznKUThkPASKk5lmeqKFKkL2\_wfiHzrY7T7\_huo68HuDRaroL61yjMJKO8MPo6bx9yZYBudvf0hvJJ4NFscC1\_qfltD6vlO6VoGmJtmbP7jaliw8-0103p8PUMjcUweRo0MR\_wZ6Ni6yT168lnmufyT7ucIFsKDwW\_wm4DE1RlIfaa0rZqdUj7t8DZmyvgTmTVdyb803OBFkboJax34QcKVIwlfo2cXuS39Tvmiw7aFq-Jk3r2wgOeH2S0E\_YnWdKQEdhA63GU2oS7tJyOqcvDLgX\_Q

现在有另外一个需求就是不同的用户访问不同的命名空间里的资源并且有这个命名空间里的所有权限：

apiVersion: v1

kind: ServiceAccount

metadata:

namespace: dev

\---

kind: Role

apiVersion: rbac.authorization.k8s.io/v1

metadata:

namespace: dev

rules:

\- apiGroups: \[""\]

resources: \["pods"\]

verbs: \["get", "list", "watch", "delete", "update", "patch"\]

\- apiGroups: \[""\]

resources: \["pods/portforward", "pods/proxy"\]

verbs: \["get", "list", "watch", "create", "update", "patch", "delete"\]

\- apiGroups: \[""\]

resources: \["pods/log"\]

verbs: \["get", "list", "watch", "delete"\]

\- apiGroups: \["extensions", "apps"\]

resources: \["deployments"\]

verbs: \["get", "list", "watch", "create", "update", "patch", "delete"\]

\- apiGroups: \[""\]

resources: \["namespaces"\]

verbs: \["get", "watch", "list"\]

\- apiGroups: \[""\]

resources: \["events"\]

verbs: \["get", "watch", "list"\]

\- apiGroups: \["apps", "extensions"\]

resources: \["replicasets"\]

verbs: \["get", "watch", "list", "create", "update", "pathch", "delete"\]

\- apiGroups: \[""\]

resources: \["configmaps"\]

verbs: \["get", "watch", "list", "create", "update", "pathch", "delete"\]

\- apiGroups: \[""\]

resources: \["persistentvolumeclaims"\]

verbs: \["get", "watch", "list"\]

\- apiGroups: \[""\]

resources: \["secrets"\]

verbs: \["get", "watch", "list"\]

\- apiGroups: \[""\]

resources: \["services"\]

verbs: \["get", "watch", "list", "create", "update", "pathch", "delete"\]

\- apiGroups: \["extensions"\]

resources: \["ingresses"\]

verbs: \["get", "watch", "list"\]

\- apiGroups: \["apps"\]

resources: \["daemonsets"\]

verbs: \["get", "watch", "list"\]

\- apiGroups: \["batch"\]

resources: \["jobs"\]

verbs: \["get", "watch", "list"\]

\- apiGroups: \["batch"\]

resources: \["cronjobs"\]

verbs: \["get", "watch", "list"\]

\- apiGroups: \[""\]

resources: \["replicationcontrollers"\]

verbs: \["get", "watch", "list"\]

\- apiGroups: \["apps"\]

resources: \["statefulsets"\]

verbs: \["get", "watch", "list"\]

\- apiGroups: \[""\]

resources: \["endpoints"\]

verbs: \["get", "watch", "list"\]

\---

kind: RoleBinding

apiVersion: rbac.authorization.k8s.io/v1

metadata:

namespace: dev

subjects:

\- kind: ServiceAccount

namespace: dev

roleRef:

kind: Role

apiGroup: rbac.authorization.k8s.io

生成kubeconfig用于kubectl去访问集群或者去访问dashborad

kubectl config set-cluster kubernetes \\

\--insecure-skip-tls-verify=true \\

\--server="https://API-SERVER:6443"

kubectl config set-credentials dev-user1 \\

\--token='token'

定义context运行环境

kubectl config set-context kubernetes \\

\--cluster=kubernetes \\

\--user=dev-user1 \\

\--namespace=dev

kubectl config use-context kubernetes

通过windwos去访问集群

windows kubectl命令安装

命令下载：

[https://storage.googleapis.com/kubernetes-release/release/v1.12.0/bin/windows/amd64/kubectl.exe][https_storage.googleapis.com_kubernetes-release_release_v1.12.0_bin_windows_amd64_kubectl.exe]

然后将其放至系统PATH目录下，比如c:\\Windows

将生成好的kubeconfig文件放在加目录里

文件名为config，文件放到 ~/.kube/下（~为用户家目录），因为kubectl命令默认读取此文件，否则每次使用kubectl命令，需要用参数--kubeconfig=configpath指定。

效果如图（我赋予的角色是cluster-admin）：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNTQzOTkx_size_16_color_FFFFFF_t_70][]

或者通过kubernetes dashborad去访问

如果是我刚才创建的root的话可以正常访问如图:

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNTQzOTkx_size_16_color_FFFFFF_t_70 1][]

如果是我张三这个用户的话 那就只能访问自己命名空间的资源

如图：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNTQzOTkx_size_16_color_FFFFFF_t_70 2][]

我们切换命名空间到dev就不会出错

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNTQzOTkx_size_16_color_FFFFFF_t_70 3][]

[https_storage.googleapis.com_kubernetes-release_release_v1.12.0_bin_windows_amd64_kubectl.exe]: https://storage.googleapis.com/kubernetes-release/release/v1.12.0/bin/windows/amd64/kubectl.exe
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNTQzOTkx_size_16_color_FFFFFF_t_70]: /images/20220403/381538dda3014adf931fab93356cedce.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNTQzOTkx_size_16_color_FFFFFF_t_70 1]: /images/20220403/cbb4238a901d40d59d61027f6f649c4c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNTQzOTkx_size_16_color_FFFFFF_t_70 2]: /images/20220403/f8a806acde94454da88c0f9c75e6282e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNTQzOTkx_size_16_color_FFFFFF_t_70 3]: /images/20220403/1543451e67714b1b810af44aff55e97c.png