Kubernetes中RBAC实战一 servicecount 10月2日实验笔记

Kubernetes的servicecount简单实战

一、创建servicecount

我这里使用的命令创建，可以用yaml进行声明式创建

kubectl create servicecount my-service-account 

我们查看一下sa的yaml文件

[root@node1 ~]# kubectl get sa my-service-account  -oyaml
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: "2021-10-02T08:21:38Z"
  name: my-service-account
  namespace: default
  resourceVersion: "1131562"
  selfLink: /api/v1/namespaces/default/serviceaccounts/my-service-account
  uid: 3fa61359-d969-4701-b73a-f049749c6816
secrets:
- name: my-service-account-token-kbvh6

注意：创建sa的同时，会自动创建一个sa关联的secrets，从上面命令也可以很清晰的看出来When creating an SA, an SA associated secret will be automatically created, which can be clearly seen from the above commands

二、创建POD关联刚才创建sa

yaml文件如下：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-v3
  namespace: default
  labels:
    app: nginx-v3
spec:
  selector:
    matchLabels:
      app: nginx-v3
  replicas: 1
  template:
    metadata:
      name: nginx-v3tem
      labels:
        app: nginx-v3
    spec:
      serviceAccountName: my-service-account
      containers:
      - name: nginxv3-pod
        image: nginx
        imagePullPolicy: IfNotPresent
        ports:
        - name: http
          containerPort: 80

笔者是为了图省事找了一个之前的deploy的yaml来创建的。亦可以之间创建pod通过serviceAccountName: my-service-account来关联

三、测试无权限访问ApiServer

我们通过命令进入到刚才的容器中；

kubectl exec -it nginx-v3-79dd7b64d8-wc4gf  -- /bin/bash

注意：

• 默认的servercount文件会被sa准入控制器挂载到容器内部的/var/run/secrets/kubernetes.io/serviceaccount目录
• 访问的地址是namespaces而不是namespace！！！（这个问题我排查了20分钟，有个s）
  

使用curl命令向ApiServer发出请求：

cd /var/run/secrets/kubernetes.io/serviceaccount
curl --cacert ./ca.crt -H "Authorization: Bearer $(cat ./token)"   https://kubernetes/api/v1/namespaces/$(cat ./namespace)
## --cacert用于指定证书
## -H 用于指定头部
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "namespace \"default\" is forbidden: User \"system:serviceaccount:default:my-service-account\" cannot get resource \"namespace\" in API group \"\" at the cluster scope",
  "reason": "Forbidden",
  "details": {
    "name": "default",
    "kind": "namespace"
  },
  "code": 403

这里我们可以看到通过指定token是可以成功访问到apiServer的，因为这个sa没有添加任何权限，所以会报403的错误，接下来我们尝试给sa添加default命名空间下的权限。

四、添加权限后访问ApiServer

我们退出容器，使用命令行给sa赋予admin的操作权限

kubectl create rolebinding namespace-admin-binding-admin --clusterrole=admin --serviceaccount=default:my-service-account -n default

查看rolebinding

[root@master dailytest]# kubectl describe rolebinding namespace-admin-binding-admin
Name:         namespace-admin-binding-admin
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  admin
Subjects:
  Kind            Name                Namespace
  ----            ----                ---------
  ServiceAccount  my-service-account  default

测试访问：

curl --cacert ./ca.crt -H "Authorization: Bearer $(cat ./token)"   https://kubernetes/api/v1/namespaces/default
{
  "kind": "Namespace",
  "apiVersion": "v1",
  "metadata": {
    "name": "default",
    "selfLink": "/api/v1/namespaces/default",
    "uid": "facb579e-e545-465c-9310-43dbbc251475",
    "resourceVersion": "155",
    "creationTimestamp": "2021-05-22T06:37:19Z",
    "managedFields": [
      {
        "manager": "kube-apiserver",
        "operation": "Update",
        "apiVersion": "v1",
        "time": "2021-05-22T06:37:19Z",
        "fieldsType": "FieldsV1",
        "fieldsV1": {"f:status":{"f:phase":{}}}
      }
    ]
  },
  "spec": {
    "finalizers": [
      "kubernetes"
    ]
  },
  "status": {
    "phase": "Active"
  }

因为赋予的是admin的权限，实际上crud是都有的，我们来访问一下default命名空间下的sa资源

 curl --cacert ./ca.crt -H "Authorization: Bearer $(cat ./token)"   https://kubenetes/api/v1/namespaces/default/serviceaccounts
  {
      "metadata": {
        "name": "my-service-account",
        "namespace": "default",
        "selfLink": "/api/v1/namespaces/default/serviceaccounts/my-service-account",
        "uid": "3fa61359-d969-4701-b73a-f049749c6816",
        "resourceVersion": "1131562",
        "creationTimestamp": "2021-10-02T08:21:38Z"
      },
      "secrets": [
        {
          "name": "my-service-account-token-kbvh6"
        }
      ]
    }

同时因为只赋予了default命名空间下的权限，所以是无法访问其他命名空间的

curl --cacert ./ca.crt -H "Authorization: Bearer $(cat ./token)"   https://kubenetes/api/v1/namespaces/kube-system
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "namespaces \"kube-system\" is forbidden: User \"system:serviceaccount:default:my-service-account\" cannot get resource \"namespaces\" in API group \"\" in the namespace \"kube-system\"",
  "reason": "Forbidden",
  "details": {
    "name": "kube-system",
    "kind": "namespaces"
  },
  "code": 403
}