OpenShift 4 - RBAC基于Role的访问授权

《OpenShift 4.x HOL教程汇总》

RBAC相关概念

在OpenShift中和RBAC（基于角色的访问控制）包括以下相关对象。
身份主体（Subject）：一个user、group或serviceaccount。
规则（Rule）：定义了对于指定object可以做的操作（操作包括：get, list, create, update, delete, deletecollection, watch）。注意：Rule定义的是许可类型的操作，而不能定义禁止类型的操作。
角色（Role）：用一组 Rule 定义权限，分为特定命名空间范围 Role 和集群范围的 ClusterRole。
绑定（Binding）：关联一个身份实体和Role。

Role

隶属于集群的Role（Cluster Role）

OpenShift中包括以下几种缺省的ClusterRole：

• admin：可管理除了项目quota外其它所有项目包括的资源对象。
• basic-user：可以获得项目和用户的基本信息。
• cluster-admin：可以对任何项目进行任何操作。
• cluster-status：可以获得集群状态信息的角色。
• edit：除了Role和Binding外，可以修改项目中其它对象。
• self-provisioner：可以创建属于自己的项目。
• view：不能对项目中的对象进行任何更改，但是可以查看项目中的对象。

1. 查看集群范围包括的所有ClusterRole，其中有我们常用的admin、cluster-admin等ClusterRole。

$ oc get clusterrole
NAME                                                                   AGE
admin                                                                  9d
advanced-cluster-management.v2.0.0-csbg7                               2d6h
advanced-cluster-management.v2.0.0-cv7p2                               2d6h
advanced-cluster-management.v2.0.0-lbf42                               2d6h
advanced-cluster-management.v2.0.0-q7dxx                               2d6h
aggregate-olm-edit                                                     9d
aggregate-olm-view                                                     9d
alertmanager-main                                                      9d
applications.app.k8s.io-v1beta1-admin                                  2d6h
applications.app.k8s.io-v1beta1-crdview                                2d6h
applications.app.k8s.io-v1beta1-edit                                   2d6h
applications.app.k8s.io-v1beta1-view                                   2d6h
basic-user                                                             9d
channels.apps.open-cluster-management.io-v1-admin                      2d6h
channels.apps.open-cluster-management.io-v1-crdview                    2d6h
channels.apps.open-cluster-management.io-v1-edit                       2d6h
channels.apps.open-cluster-management.io-v1-view                       2d6h
checlusters.org.eclipse.che-v1-admin                                   9d
checlusters.org.eclipse.che-v1-crdview                                 9d
checlusters.org.eclipse.che-v1-edit                                    9d
checlusters.org.eclipse.che-v1-view                                    9d
cloud-credential-operator-role                                         9d
cluster-admin  
。。。

2. 查看名为cluster-admin的ClusterRole，可以看到其中的PolicyRule部分通过“通配符*”让该角色可以对所有资源进行所有操作。

$ oc describe clusterrole cluster-admin
Name:         cluster-admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  *.*        []                 []              [*]
             [*]                []              [*]

隶属于项目的Role（Local Role）

1. 查看一个项目中包含的本地Role。

$ oc new-project my-project
$ oc get role -n my-project
No resources found in my-project namespace.

2. 在指定项目中创建一个新的Local Role。

$ oc create role podview --verb=get --resource=pod -n my-project
role.rbac.authorization.k8s.io/podview created
$ oc get role -n my-project
NAME      AGE
podview   22s
$ oc describe role podview -n my-project
Name:         podview
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  pods       []                 []              [get]

3. 查看所有项目中包含的本地Role。

$ oc get role -A
NAMESPACE                                               NAME                                                              AGE
default                                                 prometheus-k8s                                                    9d
kube-public                                             system:controller:bootstrap-signer                                9d
kube-system                                             aws-creds-secret-reader                                           9d
kube-system                                             extension-apiserver-authentication-reader                         9d
kube-system                                             prometheus-k8s                                                    9d
kube-system                                             system::leader-locking-kube-controller-manager                    9d
kube-system                                             system::leader-locking-kube-scheduler                             9d
kube-system                                             system:controller:bootstrap-signer                                9d
kube-system                                             system:controller:cloud-provider                                  9d
kube-system                                             system:controller:token-cleaner                                   9d
kube-system                                             system:openshift:leader-election-lock-kube-controller-manager     9d
kube-system                                             system:openshift:leader-locking-openshift-controller-manager      9d
openshift-apiserver-operator                            prometheus-k8s                                                    9d
openshift-apiserver                                     prometheus-k8s                                                    9d
openshift-authentication-operator                       prometheus-k8s                                                    9d
openshift-authentication                                prometheus-k8s                                                    9d
openshift-cloud-credential-operator                     prometheus-k8s                                                    9d
openshift-cluster-machine-approver                      prometheus-k8s
。。。

3. 查看以上结果中同属于openshift-machine-api项目的不同Role的PolicyRule。确认名为machine-api-operator的Role能查看相关资源，而名为machine-api-controllers的Role能创建和修改相关资源。

$ oc describe role -n openshift-machine-api machine-api-controllers
Name:         machine-api-controllers
Labels:       <none>
Annotations:  include.release.openshift.io/self-managed-high-availability: true
              include.release.openshift.io/single-node-developer: true
PolicyRule:
  Resources                            Non-Resource URLs  Resource Names  Verbs
  ---------                            -----------------  --------------  -----
  *.healthchecking.openshift.io        []                 []              [*]
  *.machine.openshift.io               []                 []              [*]
  events                               []                 []              [create watch list patch]
  configmaps                           []                 []              [get list watch create update patch delete]
  secrets                              []                 []              [get list watch create update patch delete]
  leases.coordination.k8s.io           []                 []              [get list watch create update patch delete]
  baremetalhosts.metal3.io             []                 []              [get list watch update patch]
  baremetalhosts.metal3.io/finalizers  []                 []              [update]
  baremetalhosts.metal3.io/status      []                 []              [update]

 
$ oc describe role -n openshift-machine-api machine-api-operator
Name:         machine-api-operator
Labels:       <none>
Annotations:  include.release.openshift.io/self-managed-high-availability: true
              include.release.openshift.io/single-node-developer: true
PolicyRule:
  Resources                              Non-Resource URLs  Resource Names  Verbs
  ---------                              -----------------  --------------  -----
  services                               []                 []              [create watch get list patch]
  servicemonitors.monitoring.coreos.com  []                 []              [create watch get list patch]
  secrets                                []                 []              [get create]
  configmaps                             []                 []              [get list watch create update patch delete]
  daemonsets.apps                        []                 []              [get list watch create update patch delete]
  deployments.apps                       []                 []              [get list watch create update patch delete]
  *.machine.openshift.io                 []                 []              [list watch]

RoleBinding

角色绑定（RoleBinding）是将角色中定义的权限赋予一个或者一组用户。 它包含若干主体（用户，组和SerIveAccount）的列表和对这些主体所获得的角色的引用。 我们可以使用 RoleBinding 在指定的命名空间中执行授权， 或者在集群范围的命名空间使用 ClusterRoleBinding 来执行授权。

查看RoleBinding

1. 查看openshift-machine-api项目中的名为cluster-autoscaler的Role，这个Role定义了它能对什么资源做哪些操作。

$ oc describe role cluster-autoscaler -n openshift-machine-api
Name:         cluster-autoscaler
Labels:       k8s-addon=cluster-autoscaler.addons.k8s.io
              k8s-app=cluster-autoscaler
Annotations:  <none>
PolicyRule:
  Resources   Non-Resource URLs  Resource Names               Verbs
  ---------   -----------------  --------------               -----
  configmaps  []                 []                           [create]
  configmaps  []                 [cluster-autoscaler-status]  [delete get update]

2. 查看openshift-machine-api项目中的名为cluster-autoscaler的RoleBinding，它将名为cluster-autoscaler的Role和名为cluster-autoscaler的SerIveAccount类型用户绑定，使得cluster-autoscaler的SerIveAccount拥有了在名为cluster-autoscaler的Role的权限。

$ oc describe rolebinding cluster-autoscaler -n openshift-machine-api
Name:         cluster-autoscaler
Labels:       k8s-addon=cluster-autoscaler.addons.k8s.io
              k8s-app=cluster-autoscaler
Annotations:  <none>
Role:
  Kind:  Role
  Name:  cluster-autoscaler
Subjects:
  Kind            Name                Namespace
  ----            ----                ---------
  ServiceAccount  cluster-autoscaler  openshift-machine-api

操作管理RoleBinding的2种方法

方法1

1. 针对当前项目，将Local Role和身份主体绑定或解绑。

$ oc adm policy add-role-to-user <ROLE> <USER> 
$ oc adm policy add-role-to-user <ROLE> -z <SERVICEACCOUNT>            # 将将当前项目的SERVICEACCOUNT和ROLE绑定
$ oc adm policy add-role-to-group <ROLE> <GROUP>
$ oc adm policy remove-role-from-user <ROLE> <USER>
$ oc adm policy remove-role-from-user <ROLE> -z <SERVICEACCOUNT>
$ oc adm policy remove-role-from-group <ROLE> <GROUP>                  
$ oc adm policy remove-user <USER>                                     # 将GROUP的所有Binding从当前项目中删除
$ oc adm policy remove-group <GROUP>                                   # 将GROUP的所有Binding从当前项目中删除

2. 将Cluster Role和身份主体绑定或解绑。

$ oc adm policy add-cluster-role-to-user <CLUSTERROLE> <USER>
$ oc adm policy add-cluster-role-to-group <CLUSTERROLE> <GROUP>
$ oc adm policy remove-cluster-role-from-user <CLUSTERROLE> <USER>
$ oc adm policy remove-cluster-role-from-group <CLUSTERROLE> <GROUP>

3. 将user1用户和my-project项目的podview角色绑定。然后查看自动生成的rolebinding的详细信息，确认它关联了podview角色和user1用户。

$ oc adm policy add-role-to-user podview user1 --role-namespace=my-project -n my-project
role.rbac.authorization.k8s.io/podview added: "user1"
$ oc describe rolebinding podview
Name:         podview
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  Role
  Name:  podview
Subjects:
  Kind  Name   Namespace
  ----  ----   ---------
  User  user1

方法2

1. 还可通过以下方式创建RoleBinding对象，关联一个Role和多个身份主体。

$ oc create rolebinding <ROLEBINDING-NAME> --clusterrole=<CLUSTER-ROLE> --user=<USER-1> --user=<USER-2> --group=<GROUP-1> --group=<GROUP-2>
$ oc create rolebinding <ROLEBINDING-NAME> --role=<ROLE> --user=<USER-1> --user=<USER-2> --group=<GROUP-1> --group=<GROUP-2>

2. 删除或编辑RoleBinding对象。

$ oc edit rolebinding <ROLEBINDING-NAME>
$ oc delete rolebinding <ROLEBINDING-NAME>

查看RBAC

查看当前用户的RBAC

1. 列出当前用户对指定资源的操作能力。（理论上是该用户所属所有Role所包括的Rule集合）

$  oc auth can-i --list --namespace=my-serviceaccount
Resources                                                            Non-Resource URLs        Resource Names                                           Verbs
applications.app.k8s.io                                              []                       []                                                       [* create update patch delete get list watch]
channels.apps.open-cluster-management.io                             []                       []                                                       [* create update patch delete get list watch]
deployables.apps.open-cluster-management.io                          []                       []                                                       [* create update patch delete get list watch]
clustermanagers.operator.open-cluster-management.io                  []                       []                                                       [* create update patch delete get list watch]
checlusters.org.eclipse.che                                          []                       []                                                       [* create update patch delete get list watch]
*.*                                                                  []                       []                                                       [*]
                                                                     [*]                      []                                                       [*]
。。。

查看哪些用户具备特定RBAC

1. 查看哪些身份主体拥有一个指定的Rule能力。注意：首先要在OpenShift中创建一个名为user1的用户。

$ oc login -u user1 -p <PASSWORD>
$ oc new-project user1-project
$ oc policy who-can list pods -n user1-project
resourceaccessreviewresponse.authorization.openshift.io/<unknown>
 
Namespace: user1-project
Verb:      list
Resource:  pods
 
Users:  opentlc-mgr
        system:admin
        system:kube-controller-manager
        system:kube-scheduler
        system:serviceaccount:kube-system:attachdetach-controller
        system:serviceaccount:kube-system:cronjob-controller
        system:serviceaccount:kube-system:daemon-set-controller
        system:serviceaccount:kube-system:deployment-controller
        system:serviceaccount:kube-system:endpoint-controller
。。。
        system:serviceaccount:user1-project:deployer
        user1
Groups: system:cluster-admins
        system:cluster-readers
        system:masters

参考

https://docs.openshift.com/container-platform/4.5/authentication/using-rbac.html
https://www.cnblogs.com/sammyliu/p/10083659.html