AKS集成RBAC与AAD

最新推荐文章于 2024-07-24 18:19:45 发布

Kcopop

最新推荐文章于 2024-07-24 18:19:45 发布

阅读量268

点赞数

分类专栏： AKS 文章标签： kubernetes azure

本文链接：https://blog.csdn.net/qq_29700227/article/details/129129726

版权

AKS 专栏收录该内容

1 篇文章 0 订阅

订阅专栏

3种模式：

K8s自己的rbac
Azure上的RBAC
Azure上的rbac K8s的RBAC与AAD的集成

VSCode实现：
需要：Azure CLI+Rolebinding.yaml+Role.yaml:
注意terminal要切换到Azure cloud shell下。
rbac-aks-aad.azcli:

az aks get-credentials --resource-group Daisyaks --name Daisyaks --admin

kubectl apply -f role.yaml

kubectl get roles

kubectl apply -f role-binding.yaml

kubectl get rolebindings

kubectl get nodes

kubectl get pods

在现有的集群上启用AKS托管的Azure AD集成

az aks update -g Daisyaks -n Daisyaks --enable-aad --aad-admin-group-object-ids 42de7d80-3209-494d-9c7f-1f15c86b8829 --aad-tenant-id 4f165557-1ad2-4f81-953c-cbc3ca9781ed

Rolebinding.yaml:

kind: RoleBinding

apiVersion: rbac.authorization.k8s.io/v1

metadata:

    name: read-pods

    namespace: default #optional

subjects:

  - kind: User

    name: "5a2f5744-e520-4d9d-a70e-c281441bd468"

    apiGroup: rbac.authorization.k8s.io/v1

roleRef:

  apiGroup: Role

  kind: pod-reader

  name: rbac.authorization.k8s.io/v1

Role.yaml:

kind: Role

apiVersion: rbac.authorization.k8s.io/v1

metadata:

    name: read-pods

    namespace: default #optional

rules:

- apiGroups: [""] #the core api group

  resources: ["pods"]

  verbs: ["get", "watch", "list"]