kubernetes——RBAC鉴权

最新推荐文章于 2024-08-19 10:52:05 发布

宛如清风03

最新推荐文章于 2024-08-19 10:52:05 发布

阅读量221

点赞数

文章标签： kubernetes 容器云原生

本文链接：https://blog.csdn.net/ZhouXin1111112/article/details/132670500

版权

简介

基于角色的访问控制(RBAC)是一种基于组织中各个用户的角色来调节对计算机或网络资源的访问的方法。

目的：防止k8s里的pod（会运行程序）能随意获取整个集群里的信息和访问集群里的资源

概念

Rule：规则，一组属于不同 API Group 的操作集合；
Role：角色，用于定义一组对 Kubernetes API 对象操作的一组规则，范围限定在 namespace；
ClusterRole：集群角色，该角色不受 namespace 的限制；
Subject：对象，也就是规则作用的对象；
RoleBinding：将角色和对象进行绑定，范围限定在 namespace；
ClusterRoleBinding：将集群角色和对象进行绑定，不受 namespace 限制
Serviceaccount：服务账户--》pod--》apiserver

UserAccount和ServiceAccount介绍

架构图

实验步骤（serviceaccoount使用案例介绍）

1.创建sa并绑定到pod

[root@k8smaster ingress]# kubectl create sa sa-lay
serviceaccount/sa-lay created
[root@k8smaster ~]# kubectl get sa
NAME      SECRETS   AGE
default   1         103d
sa-lay    1         2d3h

2.创建pod

[root@k8smaster sa]# cat sa-pod.yaml
 
apiVersion: v1
kind: Pod
metadata:
  name: sa-lay
  namespace: default
  labels:
    app: sa-lay
spec:
  serviceAccountName: sa-lay
  containers:
  - name: sa-nginx
    ports:
    - containerPort: 80
    image: nginx
    imagePullPolicy: IfNotPresent
    
[root@k8smaster sa]# kubectl apply -f sa-pod.yaml 
pod/sa-lay created

3.验证（拒绝访问）

访问apiserver，没权限

sa能通过https方式成功认证API，但是没有权限访问k8s资源，所以code状态码是403，表示没有权限操作k8s资源

[root@k8smaster sa]# kubectl exec -it sa-lay -- bash
#因为pod 会去访问k8s集群的apiserver，所以需要进入到pod里
root@sa-lay:/# cd /var/run/secrets/kubernetes.io/serviceaccount
root@sa-lay:/var/run/secrets/kubernetes.io/serviceaccount# ls
ca.crt	namespace  token
#执行下面的命令去访问我们的apiserver 
root@sa-lay:/var/run/secrets/kubernetes.io/serviceaccount# curl --cacert ./ca.crt -H "Authorization: Bearer $(cat ./token)" https://kubernetes/api/v1/namespaces/kube-system
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {
    
  },
  "status": "Failure",
  "message": "namespaces \"kube-system\" is forbidden: User \"system:serviceaccount:default:sa-lay\" cannot get resource \"namespaces\" in API group \"\" in the namespace \"kube-system\"",
  "reason": "Forbidden",
  "details": {
    "name": "kube-system",
    "kind": "namespaces"
  },
  "code": 403

4.对sa做授权

cluster-admin 这是一个权力非常大的clusterrole 集群角色
这个角色是k8s系统内部就有的，这是一个内置的集群角色

[root@k8smaster sa]# kubectl create clusterrolebinding sa-test-admin --clusterrole=cluster-admin --serviceaccount=default:sa-lay
将default命名空间里的sa-lay服务账号绑定到 集群角色 cluster-admin 上
clusterrolebinding.rbac.authorization.k8s.io/sa-test-admin created

[root@k8smaster sa]# kubectl get clusterrolebinding  #查看有哪些服务账号进行了集群角色绑定
NAME                                                   ROLE                                                                               AGE
calico-kube-controllers                                ClusterRole/calico-kube-controllers                                                11d
calico-node                                            ClusterRole/calico-node                                                            11d
cluster-admin                                          ClusterRole/cluster-admin                                                          11d
ingress-nginx                                          ClusterRole/ingress-nginx                                                          99m
ingress-nginx-admission                                ClusterRole/system:certificates.k8s.io:certificatesigningrequests:selfnodeclient   11d
kubeadm:node-proxier                                   ClusterRole/system:node-proxier                                                    11d
metrics-server:system:auth-delegator                   ClusterRole/system:auth-delegator                                                  8d
sa-test-gaoshuo                                        ClusterRole/cluster-admin                                                          16s
system:basic-user                                      ClusterRole/system:basic-user                                                      11d
system:controller:attachdetach-controller              ClusterRole/system:controller:attachdetach-controller                              11d
system:controller:certificate-controller               ClusterRole/
[root@k8smaster sa]#

5.再次请求验证

再次请求，使用绑定好的集群角色

[root@k8smaster sa]# kubectl exec -it sa-lay -- bash
root@sa-lay:/# cd /var/run/secrets/kubernetes.io/serviceaccount
root@sa-lay:/var/run/secrets/kubernetes.io/serviceaccount# curl --cacert ./ca.crt -H "Authorization: Bearer $(cat ./token)" https://kubernetes/api/v1/namespaces/kube-system
{
  "kind": "Namespace",
  "apiVersion": "v1",
  "metadata": {
    "name": "kube-system",
    "uid": "1afd57db-8217-4eab-9015-42629f340013",
    "resourceVersion": "17",
    "creationTimestamp": "2023-05-15T12:19:01Z",
    "managedFields": [
      {
        "manager": "kube-apiserver",
        "operation": "Update",
        "apiVersion": "v1",
        "time": "2023-05-15T12:19:01Z",
        "fieldsType": "FieldsV1",
        "fieldsV1": {"f:status":{"f:phase":{}}}
      }
    ]
  },
  "spec": {
    "finalizers": [
      "kubernetes"
    ]
  },
  "status": {
    "phase": "Active"
  }

自定义角色

[root@k8smaster sa]# kubectl get clusterroles
NAME                                                                   CREATED AT
admin                                                                  2023-03-23T09:58:17Z
calico-kube-controllers                                                2023-03-23T10:02:38Z
calico-node                                                            2023-03-23T10:02:38Z
cluster-admin                                                          2023-03-23T09:58:17Z
[root@k8smaster sa]# kubectl describe  clusterroles cluster-admin
Name:         cluster-admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  *.*        []                 []              [*]
             [*]                []              [*]

Resources 代表这个角色可以访问的资源 *.* 代表任意命名空间里的任意资源

Verbs ：可以采取的动作： get list watch

1.创建角色，控制权限

[root@k8smaster sa]# cat role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""] # "" 标明 core API 组
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
[root@k8smaster sa]# kubectl apply -f role.yaml 
role.rbac.authorization.k8s.io/pod-reader created

2.角色绑定

sa绑定role

[root@k8smaster sa]# kubectl create rolebinding sa-test-lay --role=pod-reader --serviceaccount=default:sa-lay
rolebinding.rbac.authorization.k8s.io/sa-test-lay created

查看已经绑定的rolebinding

[root@k8smaster sa]# kubectl get rolebinding
NAME          ROLE              AGE
sa-test-lay   Role/pod-reader   38s

3. 创建一个clusterrole

[root@k8smaster sa]# vim clusterrole.yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  # "namespace" 被忽略，因为 ClusterRoles 不受名字空间限制
  name: secret-reader
rules:
- apiGroups: [""]
  # 在 HTTP 层面，用来访问 Secret 资源的名称为 "secrets"
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]
[root@k8smaster sa]# kubectl apply -f clusterrole.yaml 
clusterrole.rbac.authorization.k8s.io/secret-reader created
[root@k8smaster sa]# 
[root@k8smaster sa]# kubectl get clusterrole
secret-reader                                                          2023-04-04T08:51:10Z

4. 将sa-lay 绑定到secret-reader 的集群角色上

[root@k8smaster sa]# kubectl create clusterrolebinding sa-test-lay-2  --clusterrole=secret-reader  --serviceaccount=default:sa-lay
clusterrolebinding.rbac.authorization.k8s.io/sa-test-lay-2 created
[root@k8smaster sa]#
[root@k8smaster sa]# kubectl get clusterrolebinding
NAME                                                   ROLE                                                                               AGE
calico-kube-controllers                                ClusterRole/calico-kube-controllers    
sa-test-lay                                       ClusterRole/cluster-admin                                                          26m
sa-test-lay-2                                      ClusterRole/secret-reader                                                          38s

5. 验证：

启动就是进入sa-lay启动的pod，去访问apiserver里的pod资源和secret资源

[root@k8smaster sa]# kubectl get pod
NAME                               READY   STATUS    RESTARTS   AGE
dapi-test-pod                      0/1     Error     0          4d23h
mypod                              1/1     Running   2          30h
nginx-configmap-test               1/1     Running   3          3d23h
sa-lay                             1/1     Running   0          43m
[root@k8smaster sa]# kubectl exec -it sa-lay  -- bash
root@sa-gaoshuo:/# 
root@sa-gaoshuo:~# cd /var/run/secrets/kubernetes.io/serviceaccount/
root@sa-gaoshuo:/var/run/secrets/kubernetes.io/serviceaccount# 
root@sa-gaoshuo:/var/run/secrets/kubernetes.io/serviceaccount# curl --cacert ./ca.crt  -H "Authorization: Bearer $(cat ./token)"  https://kubernetes/api/v1/pods  
root@sa-gaoshuo:/var/run/secrets/kubernetes.io/serviceaccount# curl --cacert ./ca.crt  -H "Authorization: Bearer $(cat .token)"  https://kubernetes/api/v1/secrets