RBAC之基于用户授权案例

    1.使用k8s ca签发客户端证
        1.1> 解压证书管理工具包
下载地址:
    https://github.com/cloudflare/cfssl/releases

[root@master231 cfssl]# tar xf oldboyedu-cfssl.tar.gz -C /usr/bin/  && chmod +x /usr/bin/cfssl*

        1.2> 编写证书请求
cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
        "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ],
        "expiry": "87600h"
      }
    }
  }
}
EOF

cat > oldboyedu-csr.json <<EOF
{
  "CN": "oldboyedu",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

        1.3 生成证书
[root@master231 user]# cfssl gencert -ca=/etc/kubernetes/pki/ca.crt -ca-key=/etc/kubernetes/pki/ca.key -config=ca-config.json -profile=kubernetes oldboyedu-csr.json | cfssljson -bare oldboyedu

[root@master231 user]# cfssl-certinfo -cert oldboyedu.pem  # 查看证书详细信息，可跳过

温馨提示:
    查看证书"cfssl-certinfo --cert oldboyedu.pem"。

    2.生成kubeconfig授权文件
        2.1 编写生成kubeconfig文件的脚本
cat > kubeconfig.sh <<'EOF'
# 配置集群
# --certificate-authority
#   指定K8s的ca根证书文件路径
# --embed-certs
#   如果设置为true，表示将根证书文件的内容写入到配置文件中，
#   如果设置为false,则只是引用配置文件，将kubeconfig
# --server
#   指定APIServer的地址。
# --kubeconfig
#   指定kubeconfig的配置文件名称
kubectl config set-cluster oldboyedu-linux86 \
  --certificate-authority=/etc/kubernetes/pki/ca.crt \
  --embed-certs=true \
  --server=https://10.0.0.231:6443 \
  --kubeconfig=oldboyedu-linux86.kubeconfig
 
# 设置客户端认证
kubectl config set-credentials oldboyedu \
  --client-key=oldboyedu-key.pem \
  --client-certificate=oldboyedu.pem \
  --embed-certs=true \
  --kubeconfig=oldboyedu-linux86.kubeconfig

# 设置默认上下文
kubectl config set-context linux86 \
  --cluster=oldboyedu-linux86 \
  --user=oldboyedu \
  --kubeconfig=oldboyedu-linux86.kubeconfig

# 设置当前使用的上下文
kubectl config use-context linux86 --kubeconfig=oldboyedu-linux86.kubeconfig
EOF

        2.2生成kubeconfig文件
bash kubeconfig.sh

    3.创建RBAC授权策略
        3.1 创建rbac等配置文件
[root@master231 user]# cat rbac.yaml 
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: linux-role-reader
rules:
  # API组,""表示核心组,该组包括但不限于"configmaps","nodes","pods","services"等资源.
  # 暂时这样理解:
  #    如果一个资源是apps/v1，则其组取"/"之前的，也就是apps.
  #    如果一个资源是v1，则默认为"/"。
  # 如果遇到不知道所述哪个组的也别着急，他会有报错提示，如下所示:
  #    User "oldboyedu" cannot list resource "deployments" in API group "apps" in the namespace "default"
  # 如上所示，表示的是"deployments"的核心组是"apps"。
- apiGroups: ["","apps"]  
  # 资源类型，不支持写简称，必须写全称哟!!
  # resources: ["pods","deployments"]  
  resources: ["pods","deployments","services"]  
  # 对资源的操作方法.
  # verbs: ["get", "list"]  
  verbs: ["get", "list","delete"]  
- apiGroups: ["","apps"]
  resources: ["configmaps","secrets","daemonsets"]
  verbs: ["get", "list"]  
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["delete"]  

---

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: oldboyedu-linux86-resources-reader
  namespace: default
subjects:
  # 主体类型
- kind: User  
  # 用户名
  name: oldboyedu  
  apiGroup: rbac.authorization.k8s.io
roleRef:
  # 角色类型
  kind: Role  
  # 绑定角色名称
  name: linux-role-reader
  apiGroup: rbac.authorization.k8s.io
[root@master231 user]# 

        3.2 应用rbac授权
[root@master231 user]# kubectl apply -f rbac.yaml 

        3.3 访问测试
[root@master231 user]# kubectl get pods --kubeconfig=oldboyedu-linux86.kubeconfig 
NAME                              READY   STATUS      RESTARTS   AGE
deploy-nginx-v1-b4b98cd7b-6fkk8   1/1     Running     0          7m31s
deploy-nginx-v1-b4b98cd7b-jsbz8   1/1     Running     0          7m31s
deploy-nginx-v1-b4b98cd7b-kqwqr   1/1     Running     0          7m31s
oldboyedu-cj-28124857-skh89       0/1     Completed   0          3m2s
oldboyedu-cj-28124858-6p6c6       0/1     Completed   0          2m2s
oldboyedu-cj-28124859-sxl8g       0/1     Completed   0          62s
oldboyedu-cj-28124860-6w5b9       0/1     Completed   0          2s
[root@master231 user]# 
[root@master231 user]# 
[root@master231 user]# kubectl delete pods --all --kubeconfig=oldboyedu-linux86.kubeconfig 
pod "deploy-nginx-v1-b4b98cd7b-6fkk8" deleted
pod "deploy-nginx-v1-b4b98cd7b-jsbz8" deleted
pod "deploy-nginx-v1-b4b98cd7b-kqwqr" deleted
pod "oldboyedu-cj-28124858-6p6c6" deleted
pod "oldboyedu-cj-28124859-sxl8g" deleted
pod "oldboyedu-cj-28124860-6w5b9" deleted
[root@master231 user]# 
[root@master231 user]# kubectl get deploy,ds --kubeconfig=oldboyedu-linux86.kubeconfig 
NAME                              READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/deploy-nginx-v1   3/3     3            3           10m
[root@master231 user]# 
[root@master231 user]# 
[root@master231 user]# 
[root@master231 user]# kubectl get deploy,ds,svc,cm --kubeconfig=oldboyedu-linux86.kubeconfig 
NAME                              READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/deploy-nginx-v1   3/3     3            3           11m

NAME                          DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
daemonset.apps/oldboyedu-ds   2         2         2       2            2           <none>          25s

NAME                 TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
service/deploy-v1    NodePort    10.200.16.210   <none>        8888:40000/TCP   11m
service/kubernetes   ClusterIP   10.200.0.1      <none>        443/TCP          17h

NAME                         DATA   AGE
configmap/kube-root-ca.crt   1      2d20h
configmap/nginx.conf         1      2d1h
[root@master231 user]#