第7周作业

1、在Kubernetes中创建一个Nginx Service。

kubectl apply -f nginx-dp-svc.yaml

cat nginx-dp-svc.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  labels:
    app: nginx-dp
  name: nginx-dp
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-dp
  template:
    metadata:
      labels:
        app: nginx-dp
    spec:
      containers:
      - image: nginx:1.22
        name: nginx1-23-sfs82
---
apiVersion: v1
kind: Service
metadata:
  name: ng-svc
spec:
  ports:
  - name: http
    port: 80
    targetPort: 80
    protocol: TCP
  type: NodePort
  clusterIP: 10.100.21.199
  selector:
    app: nginx-dp

查看svc和ep

root@k8s-node02:~# kubectl get ep,svc ng-svc
NAME               ENDPOINTS                       AGE
endpoints/ng-svc   10.244.1.27:80,10.244.3.29:80   20s

NAME             TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
service/ng-svc   NodePort   10.100.21.199   <none>        80:31318/TCP   20ss

2、使用RBAC实现访问权限控制。

2.1 基于X509客户端证书认证用户添加至kubeusers.conf文件中

cd  /etc/kubernetes/pki
 (umask 077;openssl genrsa -out xiaoluo.key 4096)
 
openssl  req  -new -key ./xiaoluo.key  --out ./xiaoluo.csr -subj  '/CN=mason/O=kubeadmin'

openssl  x509  -req  -days  3655 -CAkey ./ca.key  -CA ./ca.crt  -CAcreateserial  -in ./xiaoluo.csr  -out ./xiaoluo.crt
Signature ok
subject=CN = mason, O = kubeadmin
Getting CA Private Key

拷贝证书到node节点测试，测试时要移除.kube目录下的config文件
root@k8s-master01:/etc/kubernetes/pki# scp -p xiaoluo.key xiaoluo.crt 192.168.1.185:/etc/kubernetes/pki/

kubectl -s https://192.168.1.180:6443 --client-certificate=/etc/kubernetes/pki/xiaoluo.crt --client-key=/etc/kubernetes/pki/xiaoluo.key --insecure-skip-tls-verify=true get pods
Error from server (Forbidden): pods is forbidden: User “mason” cannot list resource “pods” in API group “” in the namespace "defaul

2.2为静态令牌认证的用户设定一个自定义的kubeconfig文件

定义cluster

 kubectl config  set-cluster  mykube --embed-certs=true --certificate-authority=./ca.crt  --server="https://192.168.1.180:6443"  --kubeconfig=$HOME/.kueb/mykube.conf
Cluster "mykube" set.

定义user

root@k8s-node03:/etc/kubernetes/pki# kubectl config set-credentials  mason --embed-certs=true --client-certificate=./xiaoluo.crt  --client-key=./xiaoluo.key  --kubeconfig=$HOME/.kube/mykube.conf
User "mason" set

定义 context

root@k8s-node03:/etc/kubernetes/pki# kubectl config  set-context mason@mykube --cluster=mykube --user=mason --kubeconfig=$HOME/.kube/mykube.conf
Context "mason@mykube" created.

设定Current-Context

root@k8s-node03:/etc/kubernetes/pki# kubectl config  set-context mason@mykube --cluster=mykube --user=mason --kubeconfig=$HOME/.kube/mykube.conf 
Context "mason@mykube" modified.

2.3 RBAC

RBAC（Role-Based Access Control）是 Kubernetes（K8s）中的一种访问控制机制，用于管理集群中用户、组和服务账户的权限。RBAC通过定义角色（Role）和角色绑定（RoleBinding）来控制对 Kubernetes 资源的访问。

角色（Role）定义了一组权限（即可访问的操作和资源），它们可以被授予用户、组或服务账户。角色绑定（RoleBinding）用于将角色与用户、组或服务账户进行关联，从而授予它们相应的权限。

RBAC 的核心概念包括：

1. Role：定义了一组操作和资源的权限。例如，可以创建一个只能读取 Pod 和 Service 资源的 Role。
2. ClusterRole：类似于 Role，但是作用于整个集群，而不是特定的命名空间。
3. RoleBinding：将 Role 与用户、组或服务账户绑定在一起，以授予它们相应的权限。例如，将 Role 绑定到一个特定的用户，使其具有特定权限。
4. ClusterRoleBinding：类似于 RoleBinding，但是作用于整个集群，而不是特定的命名空间。
5. Subject：可以是用户、组或服务账户。RoleBinding 和 ClusterRoleBinding 将角色授予主体。

通过使用 RBAC，管理员可以根据需要细粒度地控制用户和服务账户对 Kubernetes 资源的访问权限，以提高集群的安全性和管理灵活性。

创建了一个名为"reader"的角色，该角色在"default"命名空间中具有对Pods和Services资源的get、list和watch操作的权限。这样，该角色可以查看和监视该命名空间中的Pods和Services资源的信息。

kubectl create  role reader --verb=get,list,watch --resource=pods,services  -n default

将用户"mason"与ClusterRole"cluster-reade"关联起来，以授予用户在default命名空间访问权限

 kubectl create  rolebinding  mason-ander-role    --role=reader --user=mason -n default

在node节点测试配置默认认证文件
root@k8s-node03:~/.kube# export KUBECONFIG=/root/.kube/mykube.conf

可以查看default的pod。但其他命名空间的pod不能查看

root@k8s-node03:~/.kube# kubectl get pods
NAME                         READY   STATUS    RESTARTS        AGE
demoapp10-84b964c9d-9msrl    1/1     Running   0               5h8m
demoapp11-5b894bd66-88f96    1/1     Running   0               5h8m
my-dep-754679dc46-jkqfp      1/1     Running   2 (15d ago)     20d
my-dep-754679dc46-phhzk      1/1     Running   2 (8h ago)      20d
my-dep-754679dc46-qsnqx      1/1     Running   2 (8h ago)      20d
nginx-nfs-test               1/1     Running   1 (7h10m ago)   7h17m
nginx-test-cccbfc778-9cmvg   1/1     Running   0               83m
nginx-test-cccbfc778-jfn5v   1/1     Running   0               83m
nignx-6d6d5c585-2r5jl        1/1     Running   2 (15d ago)     20d
nignx-6d6d5c585-gfpmv        1/1     Running   2 (15d ago)     20d
nignx-6d6d5c585-qw84p        1/1     Running   2 (15d ago)     20d
pod-using-hostnetwork        1/1     Running   2 (15d ago)     18d
root@k8s-node03:~/.kube# kubectl get pods -n kube-system
Error from server (Forbidden): pods is forbidden: User "mason" cannot list resource "pods" in API group "" in the namespace "kube-system

绑定集群角色

创建集群角色

kubectl create clusterrole cluster-reader --verb=get,list,watch  --resource=storageclass,persistentvolumes,namespaces,deployments

绑定前不能查看
root@k8s-node03:~/.kube# kubectl get deployment -n kube-system
Error from server (Forbidden): deployments.apps is forbidden: User “mason” cannot list resource “deployments” in API group “apps” in the namespace “kube-system”: RBAC: clusterrole.rbac.authorization.k8s.io “crcluster-reader” not foun

绑定

root@k8s-master01:/etc/kubernetes/pki# kubectl create rolebinding cluster-bing --clusterrole=cluster-reader --user=mason
rolebinding.rbac.authorization.k8s.io/cluster-bing created

绑定后可以查看

root@k8s-node03:~/.kube# kubectl get deployment -n kube-system
NAME      READY   UP-TO-DATE   AVAILABLE   AGE
coredns   2/2     2            2           20d

3、使用Ingress发布服务。

3.1 部署ingress

下载ingress文件并修改为国内镜像

wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/cloud/deploy.yaml -O  ingress-controller-v1.8.2-deploy.yaml
sed -i s/registry.k8s.io/k8s.mirror.nju.edu.cn/g ingress-controller-v1.8.2-deploy.yaml

应用yaml，查看容器状态

root@k8s-node03:~# kubectl get pod -n ingress-nginx 
NAME                                        READY   STATUS      RESTARTS   AGE
ingress-nginx-admission-create-v7gsf        0/1     Completed   0          5h19m
ingress-nginx-admission-patch-8nd6f         0/1     Completed   1          5h19m
ingress-nginx-controller-5886c5f886-sl7dz   1/1     Running     0          5h19m

修改ingress service ，添加一个外部流量地址，我这里使用的192.168.1.201是server节点的一个ip

kubectl edit svc -n ingress-nginx ingress-nginx-controller
  externalIPs:
  - 192.168.1.201
  externalTrafficPolicy: Cluster

查看service

root@k8s-node03:~# kubectl get svc  -n ingress-nginx 
NAME                                 TYPE           CLUSTER-IP     EXTERNAL-IP     PORT(S)                      AGE
ingress-nginx-controller             LoadBalancer   10.96.70.31    192.168.1.201   80:32316/TCP,443:31278/TCP   5h40m
ingress-nginx-controller-admission   ClusterIP      10.102.84.77   <none>          443/TCP                      5h40m

2.2 部署nginx服务

创建deployment
kubectl create deployment nginx-test --image=nginx:1.22 --replicas=2

创建svc

root@k8s-node03:~# cat service-ingress-test.yaml 
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-ingress-test
  labels:
    name: nginx-ingress-test
spec:
  type: NodePort    
  ports:
  - port: 8080        
    targetPort: 80  
    protocol: TCP
    nodePort: 32222
  selector:
    app: nginx-test

查看 svc 后端有ep

 kubectl get  ep nginx-ingress-test 
NAME                 ENDPOINTS                       AGE
nginx-ingress-test   10.244.2.35:80,10.244.3.42:80   26s

2.3 创建ingress

应用ingress 资源

root@k8s-node03:~# cat ingress-test.yaml 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
  name: demoapp
  namespace: default
spec:
  ingressClassName: nginx
  rules:
  - host: nginx.luo.com
    http:
      paths:
      - backend:
          service:
            name: nginx-ingress-test
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
status:
  loadBalancer:
    ingress:
    - ip: 192.168.1.201

进入容器修改nginx的默认文件

root@nginx-test-cccbfc778-9cmvg:/usr/share/nginx/html# echo 666 > index.html

在window本地添加hosts文件并测试
192.168.1.201 nginx.luo.com

刷新访问到不同页面