Kubernetes API服务安全防护

炒栗子不加糖

已于 2023-03-02 23:32:25 修改

阅读量152

点赞数

分类专栏： Kubernetes实践文章标签： Kubernetes实践

于 2021-03-05 12:15:54 首次发布

本文链接：https://blog.csdn.net/github_38730134/article/details/114389740

版权

Kubernetes实践专栏收录该内容

7 篇文章 0 订阅

订阅专栏

Kubernetes API服务安全防护

用户和组

创建ServiceAccount

    vim prometheus-service-account.yml

    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: prometheus

创建Cluster级别角色

    vim prometheus-clusterrole.yml

    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRole
    metadata:
      name: prometheus
    rules:
    - apiGroups: ["","extensions","apps"]
      resources:
      - nodes
      - nodes/proxy
      - services
      - endpoints
      - pods
      - deployments
      verbs: ["get", "list", "watch"]
      - nonResourceURLs: ["/metrics"]

绑定角色及用户

    kubectl create clusterrolebinding prometheus-clusterrole-binding --clusterrole=prometheus --serviceaccount=default:prometheus

任意启动一个pod，serviceAccountName指定为如上的prometheus

    vim example.yml

    apiVersion: v1
    kind: Pod
    metadata:
      name: example
    spec:
      serviceAccountName: prometheus
      containers:
      - image: luksa/kubia
        name: kubia
        ports:
        - containerPort: 8080
          protocol: TCP

拷贝这个Pod的ca.crt/token/namespace

    kubectl describe pod example

    ---
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from prometheus-token-7vdmz (ro)
    ---

    kubectl cp default/example:/var/run/secrets/kubernetes.io/serviceaccount ./

    # 可能会报警告，无法成功，通过警告提示的命令执行即可
    kubectl exec -n "default" "example" -- tar cf - "/var/run/secrets/kubernetes.io/serviceaccount" | tar xf -