安全机制基于RABC进行访问控制

ゝ一世哀愁。 2022-10-17 05:59 137阅读 0赞

# 1 创建命名空间 #

[root@k8smaster ~]# kubectl logs mypod1
    info hello
    [root@k8smaster ~]# kubectl create ns roledemo
    namespace/roledemo created
    [root@k8smaster ~]# kubectl get ns
    NAME              STATUS   AGE
    default           Active   24h
    kube-node-lease   Active   24h
    kube-public       Active   24h
    kube-system       Active   24h
    roledemo          Active   17s

# 2 在新的命名空间创建pod #

[root@k8smaster ~]# kubectl run nginx --image=nginx -n roledemo
    pod/nginx created

# 3 创建角色 #

[root@k8smaster ~]# cat rbac-role.yaml
    kind: Role
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      namespace: roledemo
      name: pod-reader
    rules:
    - apiGroups: [""] # "" indicates the core API group
      resources: ["pods"]
      verbs: ["get", "watch", "list"]

# 创建一个角色
    [root@k8smaster ~]# kubectl apply -f rbac-role.yaml
    role.rbac.authorization.k8s.io/pod-reader created

# 4 角色绑定 #

[root@k8smaster ~]# cat rbac-rolebinding.yaml
    kind: RoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: read-pods
      namespace: roledemo
    subjects:
    - kind: User
      name: lucy # Name is case sensitive
      apiGroup: rbac.authorization.k8s.io
    roleRef:
      kind: Role #this must be Role or ClusterRole
      name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to
      apiGroup: rbac.authorization.k8s.io

# 角色绑定
    [root@k8smaster ~]# kubectl apply -f rbac-rolebinding.yaml
    rolebinding.rbac.authorization.k8s.io/read-pods created

# 创建用户的脚本
    [root@k8smaster ~]# cat rbac-user.sh
    cat > mary-csr.json <<EOF
    {
      "CN": "mary",
      "hosts": [],
      "key": {
        "algo": "rsa",
        "size": 2048
      },
      "names": [
        {
          "C": "CN",
          "L": "BeiJing",
          "ST": "BeiJing"
        }
      ]
    }
    EOF
    
    cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes mary-csr.json | cfssljson -bare mary
    
    kubectl config set-cluster kubernetes \
      --certificate-authority=ca.pem \
      --embed-certs=true \
      --server=https://192.168.204.140:6443 \
      --kubeconfig=mary-kubeconfig
    
    kubectl config set-credentials mary \
      --client-key=mary-key.pem \
      --client-certificate=mary.pem \
      --embed-certs=true \
      --kubeconfig=mary-kubeconfig
    
    kubectl config set-context default \
      --cluster=kubernetes \
      --user=mary \
      --kubeconfig=mary-kubeconfig
    
    kubectl config use-context default --kubeconfig=mary-kubeconfig

所需文件：ca-config.json ca-csr.json mary-csr.json ca.pem ca-key.pem,ca文件可以生成

# ca-config.json
    {
      "signing": {
        "default": {
          "expiry": "87600h"
        },
        "profiles": {
          "kubernetes": {
             "expiry": "87600h",
             "usages": [
                "signing",
                "key encipherment",
                "server auth",
                "client auth"
            ]
          }
        }
      }
    }
    
    # ca-csr.json
    {
        "CN": "kubernetes",
        "key": {
            "algo": "rsa",
            "size": 2048
        },
        "names": [
            {
                "C": "CN",
                "L": "Beijing",
                "ST": "Beijing",
          	    "O": "k8s",
                "OU": "System"
            }
        ]
    }
    
    # mary-csr.json
    {
      "CN": "lucy",
      "hosts": [],
      "key": {
        "algo": "rsa",
        "size": 2048
      },
      "names": [
        {
          "C": "CN",
          "L": "BeiJing",
          "ST": "BeiJing"
        }
      ]
    }

生成ca：

cat > ca-config.json<< EOF
    {
      "signing": {
        "default": {
          "expiry": "87600h"
        },
        "profiles": {
          "www": {
            "expiry": "87600h",
            "usages": [
              "signing",
              "key encipherment",
              "server auth",
              "client auth"
            ]
          }
        }
      }
    }
    EOF

cat > ca-csr.json<< EOF
    {
      "CN": "etcd CA",
      "key": {
        "algo": "rsa",
        "size": 2048
      },
      "names": [
        {
          "C": "CN",
          "L": "Beijing",
          "ST": "Beijing"
        }
      ]
    }
    EOF

wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
    wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
    wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
    chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64
    mv cfssl_linux-amd64 /usr/local/bin/cfssl
    mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
    mv cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo

[root@k8smaster cahome]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
    2021/05/27 12:45:27 [INFO] generating a new CA key and certificate from CSR
    2021/05/27 12:45:27 [INFO] generate received request
    2021/05/27 12:45:27 [INFO] received CSR
    2021/05/27 12:45:27 [INFO] generating key: rsa-2048
    2021/05/27 12:45:28 [INFO] encoded CSR
    2021/05/27 12:45:28 [INFO] signed certificate with serial number 374170922037680913705510227135887408278472867059
    [root@k8smaster cahome]# ls
    ca-config.json  ca.csr  ca-csr.json  ca-key.pem  ca.pem
    [root@k8smaster cahome]# ls
    ca-config.json  ca.csr  ca-csr.json  ca-key.pem  ca.pem

把ca证书拷贝到上一步执行的目录

[root@k8smaster cahome]# cp ca*.pem ../

执行user创建的脚本

# 执行创建用户的脚本
    [root@k8smaster ~]# bash rbac-user.sh
    2021/05/27 12:53:14 [INFO] generate received request
    2021/05/27 12:53:14 [INFO] received CSR
    2021/05/27 12:53:14 [INFO] generating key: rsa-2048
    2021/05/27 12:53:14 [INFO] encoded CSR
    2021/05/27 12:53:14 [INFO] signed certificate with serial number 29589472598339816965686804164067975746628708395
    2021/05/27 12:53:14 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
    websites. For more information see the Baseline Requirements for the Issuance and Management
    of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
    specifically, section 10.2.3 ("Information Requirements").
    Cluster "kubernetes" set.
    User "mary" set.
    Context "default" created.
    Switched to context "default".

RBAC基于角色的访问控制完成。