kubernetes 权限控制

RBAC引入了4个顶级资源对象：Role、ClusterRole：角色，用于指定一组权限；RoleBinding、ClusterRoleBinding：角色绑定，用于将角色（权限）赋予给对象

咱们通过Role可以配置命名空间下资源的访问权限，例如，pod，service，deployment等资源是否可以修改，删除等权限；Role只能对命名空间内的资源进行授权，需要指定nameapce

ClusterRole是整个kubernetes下的资源的访问权限的控制，跨namespaces的范围资源、非资源类型进行授权

我当前app整个命名空间下有一些pod，我们以app这个命名空间，创建一个xiaom的用户，这个用户只能app这个命名空间下的Pod，Deployment的资源，其他的资源没权限更改

[root@k8s-master1 RBAC]# kubectl get pods -n app -o wide
NAME                                        READY   STATUS    RESTARTS         AGE    IP               NODE          NOMINATED NODE   READINESS GATES
dsf-67b6bd65c9-44rl4                        2/2     Running   16 (3h15m ago)   25d    10.10.135.218    k8s-master3   <none>           <none>
ingress-nginx-controller-74974c55bd-2bw2r   1/1     Running   6 (20h ago)      2d1h   192.168.21.100   k8s-node1     <none>           <none>
ingress-nginx-controller-74974c55bd-j24mf   1/1     Running   10 (3h15m ago)   31d    192.168.21.122   k8s-master3   <none>           <none>
nginx-55c7d65db4-z4rcc                      1/1     Running   4 (20h ago)      2d1h   10.10.36.96      k8s-node1     <none>           <none>
postgres-sonar-5b9d94cd6b-965tk             1/1     Running   2 (3h15m ago)    2d1h   10.10.135.221    k8s-master3   <none>           <none>
tomcat-657677ffb5-2nrfc                     1/1     Running   8 (3h15m ago)    26d    10.10.135.222    k8s-master3   <none>           <none>

Role的配置示例：

[root@k8s-master1 app]# kubectl apply -f app-Role.yaml
role.rbac.authorization.k8s.io/app-authorization-Role created

[root@k8s-master1 app]# cat app-Role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: app                                         #指定命名空间
  name: app-authorization-Role
rules:
  - apiGroups: [ "" ]                                    #支持的API组列表,"" 空字符串，表示核心API群
    resources: [ "pod" ]                   #支持的资源对象列表
    verbs: [ "get","delete","create","delete","exec" ]   #允许的对资源对象的操作方法列表

apiGroups表示支持的API组列表：“”,“apps”, “autoscaling”, “batch”;
resources: 支持的资源对象列表
“services”, “endpoints”, “pods”,“secrets”,“configmaps”,“crontabs”,“deployments”,“jobs”,
“nodes”,“rolebindings”,“clusterroles”,“daemonsets”,“replicasets”,“statefulsets”,
“horizontalpodautoscalers”,“replicationcontrollers”,“cronjobs”
verbs: 对资源对象的操作方法列表
“get”, “list”, “watch”, “create”, “update”, “patch”, “delete”, “exec”

RoleBinding可以将同一namespace中的subject(用户、用户组)绑定到某个Role(规则)下，则此subject即具有该Role定义的权限.

[root@k8s-master1 app]# cat app-RoleBinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-authorization-role-binding
  namespace: app
subjects:
  - kind: User
    name: xiaom
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: app-authorization-Role
  apiGroup: rbac.authorization.k8s.io
[root@k8s-master1 app]# kubectl apply -f app-RoleBinding.yaml

创建一个xiaom的集群用户验证一下

[root@k8s-master1 user]# pwd
/opt/certs/user
(umask 077;openssl genrsa -out xiaom.key 2048)
[root@k8s-master1 user]# openssl req -new -key xiaom.key -out xiaom.csr -subj "/CN=xiaom/O=xiaomgroup"
[root@k8s-master1 user]# openssl x509 -req -in xiaom.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out xiaom.crt -days 3650
[root@k8s-master1 app]# kubectl config set-cluster kubernetes --embed-certs=true --certificate-authority=/opt/kubernetes/certs/ca.pem --server=https://192.168.21.120:6443
[root@k8s-master1 app]# kubectl config set-credentials xiaom --embed-certs=true --client-certificate=/opt/certs/user/xiaom.crt --client-key=/opt/certs/user/xiaom.key
User "xiaom" set.
[root@k8s-master1 app]# kubectl config set-context xiaom@kubernetes --cluster=kubernetes --user=xiaom
Context "xiaom@kubernetes" modified.
[root@k8s-master1 app]# kubectl config use-context xiaom@kubernetes
Switched to context "xiaom@kubernetes".
[root@k8s-master1 ~]# kubectl get pods -n app
NAME                                        READY   STATUS    RESTARTS       AGE
dsf-67b6bd65c9-44rl4                        2/2     Running   18 (17h ago)   26d
host-path-nginx                             2/2     Running   2 (17h ago)    17h
ingress-nginx-controller-74974c55bd-2bw2r   1/1     Running   7 (17h ago)    2d22h
ingress-nginx-controller-74974c55bd-j24mf   1/1     Running   11 (17h ago)   32d
nginx-55c7d65db4-t6mgz                      1/1     Running   0              79m
postgres-sonar-5b9d94cd6b-965tk             1/1     Running   3 (141m ago)   2d22h
tomcat-657677ffb5-2nrfc                     1/1     Running   9 (17h ago)    26d
[root@k8s-master1 ~]# kubectl get deployment -n app
Error from server (Forbidden): deployments.apps is forbidden: User "xiaom" cannot list resource "deployments" in API group "apps" in the namespace "app"

咱们创建一个集群权限，将这个权限赋予给xiaom这个用户，当前xiaom这个用户没有操作deployment的权限，咱们创建一个deployment的集群权限赋予给xiaom这个用户，这样xiaom这个用户可以操作所有命名空间下的deployment

ClusterRole可以对集群范围内资源、跨namespaces的范围资源、非资源类型进行授权

[root@k8s-master1 app]# kubectl apply -f app-ClusterRole.yaml
clusterrole.rbac.authorization.k8s.io/app-authorization-clusterrole created
[root@k8s-master1 app]# cat app-ClusterRole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: app-authorization-clusterrole
rules:
  - apiGroups: [ "apps" ]
    resources: [ "deployments" ]
    verbs: [ "get","delete","create","delete" ]

ClusterRoleBinding在整个集群级别和所有namespaces，将不同namespace中的subject(用户、用户组)与ClusterRole(集群范围内资源)绑定，授予权限

[root@k8s-master1 app]# kubectl apply -f app-ClusterRoleBinding.yaml
clusterrolebinding.rbac.authorization.k8s.io/app-authorization-clusterrole-binding created
[root@k8s-master1 app]# cat app-ClusterRoleBinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: app-authorization-clusterrole-binding
subjects:
  - kind: User
    name: xiaom
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: app-authorization-clusterrole
  apiGroup: rbac.authorization.k8s.io

RoleBinding可以引用ClusterRole，对属于同一命名空间内ClusterRole定义的资源主体进行授权

[root@k8s-master1 app]# cat app-RoleClusterBinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-ClusterRoleBinding
  namespace: app
subjects:
  - kind: User
    name: xiaom
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: app-authorization-clusterrole
  apiGroup: rbac.authorization.k8s.io
[root@k8s-master1 app]# kubectl config use-context xiaom@kubernetes
[root@k8s-master1 app]# kubectl get deployment -A
NAMESPACE              NAME                              READY   UP-TO-DATE   AVAILABLE   AGE
app                    busybox                           0/0     0            0           35d
app                    dsf                               1/1     1            1           26d
app                    hostpath                          0/0     0            0           35d
app                    ingress-nginx-controller          2/2     2            2           32d
app                    nginx                             1/1     1            1           26d
app                    postgres-sonar                    1/1     1            1           3d
app                    tomcat                            1/1     1            1           32d
kube-devops            jenkins                           1/1     1            1           2d4h
kube-devops            nexus-sonatype-nexus              1/1     1            1           2d4h
kube-system            calico-kube-controllers           1/1     1            1           2d23h
kube-system            coredns                           1/1     1            1           2d22h
kubernetes-dashboard   dashboard-metrics-scraper         1/1     1            1           70d
kubernetes-dashboard   kubernetes-dashboard              1/1     1            1           70d
nfs-provisioner        nfs-subdir-external-provisioner   2/2     2            2           50d
test                   tomcat-deploy                     1/1     1            1           13d
[root@k8s-master1 app]# kubectl delete deployment hostpath -n app
deployment.apps "hostpath" deleted

这样xiaom这个用户就有操作所有命名空间下的deployment的权限