文章目录
RBAC相关概念
在OpenShift中和RBAC(基于角色的访问控制)包括以下相关对象。
身份主体(Subject):一个user、group或serviceaccount。
规则(Rule):定义了对于指定object可以做的操作(操作包括:get, list, create, update, delete, deletecollection, watch)。注意:Rule定义的是许可类型的操作,而不能定义禁止类型的操作。
角色(Role):用一组 Rule 定义权限,分为特定命名空间范围 Role 和集群范围的 ClusterRole。
绑定(Binding):关联一个身份实体和Role。
Role
隶属于集群的Role(Cluster Role)
OpenShift中包括以下几种缺省的ClusterRole:
- admin:可管理除了项目quota外其它所有项目包括的资源对象。
- basic-user:可以获得项目和用户的基本信息。
- cluster-admin:可以对任何项目进行任何操作。
- cluster-status:可以获得集群状态信息的角色。
- edit:除了Role和Binding外,可以修改项目中其它对象。
- self-provisioner:可以创建属于自己的项目。
- view:不能对项目中的对象进行任何更改,但是可以查看项目中的对象。
- 查看集群范围包括的所有ClusterRole,其中有我们常用的admin、cluster-admin等ClusterRole。
$ oc get clusterrole
NAME AGE
admin 9d
advanced-cluster-management.v2.0.0-csbg7 2d6h
advanced-cluster-management.v2.0.0-cv7p2 2d6h
advanced-cluster-management.v2.0.0-lbf42 2d6h
advanced-cluster-management.v2.0.0-q7dxx 2d6h
aggregate-olm-edit 9d
aggregate-olm-view 9d
alertmanager-main 9d
applications.app.k8s.io-v1beta1-admin 2d6h
applications.app.k8s.io-v1beta1-crdview 2d6h
applications.app.k8s.io-v1beta1-edit 2d6h
applications.app.k8s.io-v1beta1-view 2d6h
basic-user 9d
channels.apps.open-cluster-management.io-v1-admin 2d6h
channels.apps.open-cluster-management.io-v1-crdview 2d6h
channels.apps.open-cluster-management.io-v1-edit 2d6h
channels.apps.open-cluster-management.io-v1-view 2d6h
checlusters.org.eclipse.che-v1-admin 9d
checlusters.org.eclipse.che-v1-crdview 9d
checlusters.org.eclipse.che-v1-edit 9d
checlusters.org.eclipse.che-v1-view 9d
cloud-credential-operator-role 9d
cluster-admin
。。。
- 查看名为cluster-admin的ClusterRole,可以看到其中的PolicyRule部分通过“通配符*”让该角色可以对所有资源进行所有操作。
$ oc describe clusterrole cluster-admin
Name: cluster-admin
Labels: kubernetes.io/bootstrapping=rbac-defaults
Annotations: rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
*.* [] [] [*]
[*] [] [*]
隶属于项目的Role(Local Role)
- 查看一个项目中包含的本地Role。
$ oc new-project my-project
$ oc get role -n my-project
No resources found in my-project namespace.
- 在指定项目中创建一个新的Local Role。
$ oc create role podview --verb=get --resource=pod -n my-project
role.rbac.authorization.k8s.io/podview created
$ oc get role -n my-project
NAME AGE
podview 22s
$ oc describe role podview -n my-project
Name: podview
Labels: <none>
Annotations: <none>
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
pods [] [] [get]
- 查看所有项目中包含的本地Role。
$ oc get role -A
NAMESPACE NAME AGE
default prometheus-k8s 9d
kube-public system:controller:bootstrap-signer 9d
kube-system aws-creds-secret-reader 9d
kube-system extension-apiserver-authentication-reader 9d
kube-system prometheus-k8s 9d
kube-system system::leader-locking-kube-controller-manager 9d
kube-system system::leader-locking-kube-scheduler 9d
kube-system system:controller:bootstrap-signer 9d
kube-system system:controller:cloud-provider 9d
kube-system system:controller:token-cleaner 9d
kube-system system:openshift:leader-election-lock-kube-controller-manager 9d
kube-system system:openshift:leader-locking-openshift-controller-manager 9d
openshift-apiserver-operator prometheus-k8s 9d
openshift-apiserver prometheus-k8s 9d
openshift-authentication-operator prometheus-k8s 9d
openshift-authentication prometheus-k8s 9d
openshift-cloud-credential-operator prometheus-k8s 9d
openshift-cluster-machine-approver prometheus-k8s
。。。
- 查看以上结果中同属于openshift-machine-api项目的不同Role的PolicyRule。确认名为machine-api-operator的Role能查看相关资源,而名为machine-api-controllers的Role能创建和修改相关资源。
$ oc describe role -n openshift-machine-api machine-api-controllers
Name: machine-api-controllers
Labels: <none>
Annotations: include.release.openshift.io/self-managed-high-availability: true
include.release.openshift.io/single-node-developer: true
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
*.healthchecking.openshift.io [] [] [*]
*.machine.openshift.io [] [] [*]
events [] [] [create watch list patch]
configmaps [] [] [get list watch create update patch delete]
secrets [] [] [get list watch create update patch delete]
leases.coordination.k8s.io [] [] [get list watch create update patch delete]
baremetalhosts.metal3.io [] [] [get list watch update patch]
baremetalhosts.metal3.io/finalizers [] [] [update]
baremetalhosts.metal3.io/status [] [] [update]
$ oc describe role -n openshift-machine-api machine-api-operator
Name: machine-api-operator
Labels: <none>
Annotations: include.release.openshift.io/self-managed-high-availability: true
include.release.openshift.io/single-node-developer: true
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
services [] [] [create watch get list patch]
servicemonitors.monitoring.coreos.com [] [] [create watch get list patch]
secrets [] [] [get create]
configmaps [] [] [get list watch create update patch delete]
daemonsets.apps [] [] [get list watch create update patch delete]
deployments.apps [] [] [get list watch create update patch delete]
*.machine.openshift.io [] [] [list watch]
RoleBinding
角色绑定(RoleBinding)是将角色中定义的权限赋予一个或者一组用户。 它包含若干主体(用户,组和SerIveAccount)的列表和对这些主体所获得的角色的引用。 我们可以使用 RoleBinding 在指定的命名空间中执行授权, 或者在集群范围的命名空间使用 ClusterRoleBinding 来执行授权。
查看RoleBinding
- 查看openshift-machine-api项目中的名为cluster-autoscaler的Role,这个Role定义了它能对什么资源做哪些操作。
$ oc describe role cluster-autoscaler -n openshift-machine-api
Name: cluster-autoscaler
Labels: k8s-addon=cluster-autoscaler.addons.k8s.io
k8s-app=cluster-autoscaler
Annotations: <none>
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
configmaps [] [] [create]
configmaps [] [cluster-autoscaler-status] [delete get update]
- 查看openshift-machine-api项目中的名为cluster-autoscaler的RoleBinding,它将名为cluster-autoscaler的Role和名为cluster-autoscaler的SerIveAccount类型用户绑定,使得cluster-autoscaler的SerIveAccount拥有了在名为cluster-autoscaler的Role的权限。
$ oc describe rolebinding cluster-autoscaler -n openshift-machine-api
Name: cluster-autoscaler
Labels: k8s-addon=cluster-autoscaler.addons.k8s.io
k8s-app=cluster-autoscaler
Annotations: <none>
Role:
Kind: Role
Name: cluster-autoscaler
Subjects:
Kind Name Namespace
---- ---- ---------
ServiceAccount cluster-autoscaler openshift-machine-api
操作管理RoleBinding的2种方法
方法1
- 针对当前项目,将Local Role和身份主体绑定或解绑。
$ oc adm policy add-role-to-user <ROLE> <USER>
$ oc adm policy add-role-to-user <ROLE> -z <SERVICEACCOUNT> # 将将当前项目的SERVICEACCOUNT和ROLE绑定
$ oc adm policy add-role-to-group <ROLE> <GROUP>
$ oc adm policy remove-role-from-user <ROLE> <USER>
$ oc adm policy remove-role-from-user <ROLE> -z <SERVICEACCOUNT>
$ oc adm policy remove-role-from-group <ROLE> <GROUP>
$ oc adm policy remove-user <USER> # 将GROUP的所有Binding从当前项目中删除
$ oc adm policy remove-group <GROUP> # 将GROUP的所有Binding从当前项目中删除
- 将Cluster Role和身份主体绑定或解绑。
$ oc adm policy add-cluster-role-to-user <CLUSTERROLE> <USER>
$ oc adm policy add-cluster-role-to-group <CLUSTERROLE> <GROUP>
$ oc adm policy remove-cluster-role-from-user <CLUSTERROLE> <USER>
$ oc adm policy remove-cluster-role-from-group <CLUSTERROLE> <GROUP>
- 将user1用户和my-project项目的podview角色绑定。然后查看自动生成的rolebinding的详细信息,确认它关联了podview角色和user1用户。
$ oc adm policy add-role-to-user podview user1 --role-namespace=my-project -n my-project
role.rbac.authorization.k8s.io/podview added: "user1"
$ oc describe rolebinding podview
Name: podview
Labels: <none>
Annotations: <none>
Role:
Kind: Role
Name: podview
Subjects:
Kind Name Namespace
---- ---- ---------
User user1
方法2
- 还可通过以下方式创建RoleBinding对象,关联一个Role和多个身份主体。
$ oc create rolebinding <ROLEBINDING-NAME> --clusterrole=<CLUSTER-ROLE> --user=<USER-1> --user=<USER-2> --group=<GROUP-1> --group=<GROUP-2>
$ oc create rolebinding <ROLEBINDING-NAME> --role=<ROLE> --user=<USER-1> --user=<USER-2> --group=<GROUP-1> --group=<GROUP-2>
- 删除或编辑RoleBinding对象。
$ oc edit rolebinding <ROLEBINDING-NAME>
$ oc delete rolebinding <ROLEBINDING-NAME>
查看RBAC
查看当前用户的RBAC
- 列出当前用户对指定资源的操作能力。(理论上是该用户所属所有Role所包括的Rule集合)
$ oc auth can-i --list --namespace=my-serviceaccount
Resources Non-Resource URLs Resource Names Verbs
applications.app.k8s.io [] [] [* create update patch delete get list watch]
channels.apps.open-cluster-management.io [] [] [* create update patch delete get list watch]
deployables.apps.open-cluster-management.io [] [] [* create update patch delete get list watch]
clustermanagers.operator.open-cluster-management.io [] [] [* create update patch delete get list watch]
checlusters.org.eclipse.che [] [] [* create update patch delete get list watch]
*.* [] [] [*]
[*] [] [*]
。。。
查看哪些用户具备特定RBAC
- 查看哪些身份主体拥有一个指定的Rule能力。注意:首先要在OpenShift中创建一个名为user1的用户。
$ oc login -u user1 -p <PASSWORD>
$ oc new-project user1-project
$ oc policy who-can list pods -n user1-project
resourceaccessreviewresponse.authorization.openshift.io/<unknown>
Namespace: user1-project
Verb: list
Resource: pods
Users: opentlc-mgr
system:admin
system:kube-controller-manager
system:kube-scheduler
system:serviceaccount:kube-system:attachdetach-controller
system:serviceaccount:kube-system:cronjob-controller
system:serviceaccount:kube-system:daemon-set-controller
system:serviceaccount:kube-system:deployment-controller
system:serviceaccount:kube-system:endpoint-controller
。。。
system:serviceaccount:user1-project:deployer
user1
Groups: system:cluster-admins
system:cluster-readers
system:masters
参考
https://docs.openshift.com/container-platform/4.5/authentication/using-rbac.html
https://www.cnblogs.com/sammyliu/p/10083659.html