OpenShift 4 - 锁定被保护的 OpenShift 资源，禁止删除和修改操作（附视频）

《OpenShift 4.x HOL教程汇总》
说明：本文已经在OpenShift 4.9环境中验证

安装 Resource Locker Operator

在 OpenShift 中使用缺省配置安装 Resource Locker Operator 即可。

配置被保护的 OpenShift 资源

1. 执行命令，创建项目

$ oc new-project resource-locker-test

2. 创建一个 Role（注意：角色可以对 configmaps 类对象进行修改），并绑定到 serviceaccount。

$ oc create serviceaccount sa-resource-locker -n resource-locker-test
 
$ oc apply -f - << EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: role-configmaps
  namespace: resource-locker-test
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - list
  - get
  - watch
  - create
  - update
  - patch
EOF
 
$ oc apply -f - << EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: sa-resource-locker-can-manage-configmaps
  namespace: resource-locker-test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: role-configmaps
subjects:
- kind: ServiceAccount
  name: sa-resource-locker
  namespace: resource-locker-test
EOF

3. 创建一个 ResourceLocker 对象，其中包含被保护的 ConfigMap 对象，并使用前面创建的 ServiceAccount。注意：“excludedPaths”部分是不受保护的部分

$ oc apply -f - << EOF
apiVersion: redhatcop.redhat.io/v1alpha1
kind: ResourceLocker
metadata:
  name: resourelocker-configmap
  namespace: resource-locker-test
spec:
  resources:
    - excludedPaths:
        - .metadata
        - .status
        - .spec.replicas
      object:
        apiVersion: v1
        kind: ConfigMap
        metadata:
          name: locked-configmap
          namespace: resource-locker-test
        data:
          key1: value1
  serviceAccountRef:
    name: sa-resource-locker
EOF

3. 查看 ConfigMap 对象的内容。

$ oc get configmap locked-configmap -n resource-locker-test
NAME               DATA   AGE
locked-configmap   1      48s

$ oc get configmap locked-configmap -n resource-locker-test -oyaml
apiVersion: v1
data:
  key1: value1
kind: ConfigMap
。。。

4. 修改 ConfigMap 对象，确认虽然提示修改成功。但是再查看 ConfigMap 对象内容，确认对象实际没有发生变化。

$ oc apply -n resource-locker-test -f - << EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: locked-configmap
  namespace: resource-locker-test
data:
  key1: modified-value1
EOF
 
$ oc get configmap locked-configmap -n resource-locker-test -oyaml

5. 删除 ConfigMap 对象，确认虽然提示删除成功。但是再查看 ConfigMap 对象，确认对象实际没有被删除。

$ oc delete configmap locked-configmap -n resource-locker-test
configmap "locked-configmap" deleted

$ oc get configmap locked-configmap -n resource-locker-test
NAME               DATA   AGE
locked-configmap   1      7s

更改被保护OpenShift 资源

1. 删除名为 resourelocker-configmap 的 ResourceLocker。

$ oc delete ResourceLocker resourelocker-configmap -n resource-locker-test

2. 确认此时 locked-configmap 对象还有存在。

$ oc get configmap locked-configmap -n resource-locker-test -oyaml
apiVersion: v1
data:
  key1: value1
kind: ConfigMap
。。。

3. 修改 locked-configmap 对象，确认此时可以修改了。

$ oc patch configmap locked-configmap -p '{"data": {"key1": "value1-new"}}'
configmap/locked-configmap patched
$ oc get configmap locked-configmap -n resource-locker-test -oyaml
apiVersion: v1
data:
  key1: value1-new
kind: ConfigMap
。。。

4. 执行命令，创建新的 ResourceLocker 对象，其中定义了 locked-configmap 对象的新内容。

$ oc apply -f - << EOF
apiVersion: redhatcop.redhat.io/v1alpha1
kind: ResourceLocker
metadata:
  name: resourelocker-configmap-modified
  namespace: resource-locker-test
spec:
  resources:
    - excludedPaths:
        - .metadata
        - .status
        - .spec.replicas
      object:
        apiVersion: v1
        kind: ConfigMap
        metadata:
          name: locked-configmap
          namespace: resource-locker-test
        data:
          key1: value1-modified
  serviceAccountRef:
    name: sa-resource-locker
EOF

5. 确认此时 locked-configmap 对象的内容又被新的 ResourceLocker 对象锁定了。

$ oc get configmap locked-configmap -n resource-locker-test -oyaml
apiVersion: v1
data:
  key1: value1-modified
kind: ConfigMap
。。。

演示视频

视频

参考

https://github.com/redhat-cop/resource-locker-operator