CC00220.CloudKubernetes——|KuberNetes&细粒度权限控制.V04|——|RBAC.v04|ServiceAccount|

yanqi_vip

已于 2022-04-02 16:32:47 修改

阅读量1.1k

点赞数

分类专栏： cloudv017——kubernetes.v002 文章标签： kubernetes python docker javascript oracle

于 2022-03-31 12:56:00 首次发布

不予转载

本文链接：https://blog.csdn.net/yanqi_vip/article/details/123874768

版权

cloudv017——kubernetes.v002 专栏收录该内容

417 篇文章 9 订阅

订阅专栏

一、ClusterRole和ClusterRoleBinding架构图说明

### --- ClusterRole和ClusterRoleBinding架构图说明

~~~     首先我们有了一个cluster-admin的ClusterRole
~~~     然后还有一个admin-user的一个ServiceAccount，在kube-system的namespace下
~~~     然后创建了一个clusterRoleBinding，它把这个权限绑定到了ServiceAccount上
~~~     绑定到ServiceAccount上之后这个ServiceAccount就具有了这个ClusterRole的所有的权限

二、ServiceAccount

### --- 查看ServiceAccount

[root@k8s-master01 ~]#  kubectl get sa -n kube-system
NAME                                 SECRETS   AGE
admin-user                           1         23d

### --- 查看ClusterRole
~~~     注：写的都是* ，*表示对系统apigroup下所有的操作都是允许的
~~~     这个权限是非常高的，泄露非常危险

[root@k8s-master01 ~]# kubectl get clusterrole cluster-admin -oyaml
NAME            CREATED AT
cluster-admin   2021-04-09T13:52:18Z    // 这个ClusterRole是系统自动创建的
[root@k8s-master01 ~]# kubectl get clusterrole cluster-admin -oyaml
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
- nonResourceURLs:                      // 所有权限下的所有资源
  - '*'
  verbs:
  - '*'

三、serviceaccount的启用方式

### --- 启用方式一：service的启用方式：

~~~     一个pod启动的时候，就可以就可以通过ingress的方式来指定ServiceAccount的权限就是它，
~~~     当然这样操作是非常危险的

### --- 启用方式二：

[root@k8s-master01 ~]#  kubectl get sa
NAME      SECRETS   AGE
default   1         23d

### --- 创建一个ServiceAccount
~~~     注：在创建ServiceAccount之后就会自动生成一个以yanqi开头的secret

[root@k8s-master01 ~]# kubectl create sa yanqi
serviceaccount/yanqi created
[root@k8s-master01 ~]# kubectl get secret
NAME                  TYPE                                  DATA   AGE
yanqi-token-zz7k5     kubernetes.io/service-account-token   3      20s

### --- 查看secret
~~~     注：这个secret是有一个token的，这个token就可以在dashboard上，就具有了增删改查的权限 

[root@k8s-master01 ~]# kubectl desicribe secret yanqi-token-zz7k5
Type:  kubernetes.io/service-account-token
namespace:  7 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6InQ2ci1YY3cwaTZjVlQ2bzhaeTJiaGhMNE1fblFzMExrWDhOd25PZmFMXzAifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6InlhbnFpLXRva2VuLXp6N2s1Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6InlhbnFpIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMDJkYjk4ODEtZGJmZS00ZDU1LTkxYzUtNWUyZjk4ZGQ0NWZlIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50OmRlZmF1bHQ6eWFucWkifQ.hz2BcbrLcVk8yjbXdS7sGcwAWnlmELR5EnfMWiaLZxYfZvqHy1wwhRyTyoqGkYtOKYZnCZ8vCZYwqZqXHIGZf_tX5COhrpvWmK6KY904Hb6v77nEQI8_sDd1-WoTfC8-bAnCtSWwpedyAWtwiTKp4w0rdLALz_ilTEpRS2CEJNRHQLXsPfDiZ96yhd0xqzv1LsN8b90NGBM5ljLfL4pLKBsh0keepu-SM4vS9b6s7Nf1-ySmPLJekwKFV2HN13o_lOnIQz_jE4M6eKJ1KnMNibiIuCjEXq7AzwR28I6-ZhC8Gei3g6QVPi6NI6y8iVtBMh3KscP2Bo9EVNRl3KOk4g
ca.crt:     1411 bytes

### --- 查看这个secret有什么权限
~~~     注：这个token就是它的值，是加密类型的，解密查看内容

[root@k8s-master01 ~]# kubectl get secret yanqi-token-zz7k5 -oyaml
apiVersion: v1
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQ1RENDQXN5Z0F3SUJBZ0lVTnNjUDNPR0p2cTczWjhlSFk5dEZmck5TbWFnd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2R6RUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbAphV3BwYm1jeEV6QVJCZ05WQkFvVENrdDFZbVZ5Ym1WMFpYTXhHakFZQmdOVkJBc1RFVXQxWW1WeWJtVjBaWE10CmJXRnVkV0ZzTVJNd0VRWURWUVFERXdwcmRXSmxjbTVsZEdWek1DQVhEVEl4TURRd09UQTVOVEV3TUZvWUR6SXgKTWpFd016RTJNRGsxTVRBd1dqQjNNUXN3Q1FZRFZRUUdFd0pEVGpFUU1BNEdBMVVFQ0JNSFFtVnBhbWx1WnpFUQpNQTRHQTFVRUJ4TUhRbVZwYW1sdVp6RVRNQkVHQTFVRUNoTUtTM1ZpWlhKdVpYUmxjekVhTUJnR0ExVUVDeE1SClMzVmlaWEp1WlhSbGN5MXRZVzUxWVd3eEV6QVJCZ05WQkFNVENtdDFZbVZ5Ym1WMFpYTXdnZ0VpTUEwR0NTcUcKU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRRHFXYzJ1Ylp3M2RIYmZZS0J2MlFjZkhlK3hRalBoa0VvUgpMcmljRjBFZXhOb1VrWEYrUXFibGFzSjZOVTJpZkFTRXBFcFI0Z3FHdGo2MloxMys2eXM5RndvQXA0Zll6SndSCkFvZ1BmdUxoYUFINTVRUllnelllaytoOFZtWEtsVDJpR3NIdFhkSndLbEVoVjZYdkJnVTUrL0RQSzdHZlo2WXIKblhaaGRaeDlaeUwwaGFjOWZkSVNVVGNjWFpIUnUwRzJ3aFJUc2g0NVUyaW1rWi9CMlM4eWtiNVRVSzdUeWFZcApWdndKdGo3d2NZNTZVS2h4clNLSXdCbTZiTU9MbFRkemJnZGFxbHRZZUczNFo5cGZjUHJDeUllQ0FLYzFxK1BZCjMySFY2b1o3Tnc0czFWL0hWejN3TC9URXFQbXExSGx4OHpBbXBiWTh6eDZ6VjU1Mld5S0xBZ01CQUFHalpqQmsKTUE0R0ExVWREd0VCL3dRRUF3SUJCakFTQmdOVkhSTUJBZjhFQ0RBR0FRSC9BZ0VDTUIwR0ExVWREZ1FXQkJUQQpBTXN3Z2dnMDBCOG05K2FoWnhoMzF3TVFEakFmQmdOVkhTTUVHREFXZ0JUQUFNc3dnZ2cwMEI4bTkrYWhaeGgzCjF3TVFEakFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBNkNXamVLTG1aSXRoVEg0bm16Yk43SHFRSUNLdHQvRW4KRXFHQzc3MmorQy9YdUVSZGF2WVE4anlnS0hoYzFaSGJGWllsQ1c4dlFYWnc1MGxRelZXc1ZrM05NMktJZkh3UgpLWG1URVNjVVlKQVF4c0hrdktZS0NrVWhPWVJmUmhuUjBKRXNWalhEeE5NQTMvOEk1b3dIYklLN2NweUFmR2txClFVOTczdmZzZzNWcUVHOG41ZHVEcTRMMGw0aWxnanVUb2lxNURKcWJXUXE3blJBK3pKTkZCWTB4M0IxM2VPVVYKSVh6ODJYaTQwMThlVURhZHh0RHovM0x4eUhRenpnOFpXOFd0dXZVL1JWQ2w4OGx2cUduT2oyb3V4ZWd0elM2QwpYUktxYStvY2VPTWhmTEJyTGZrZVppTjF4ZVlrbVNyenZtYVBzYzBIdXBQdW9SMlRJb2FpZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  namespace: ZGVmYXVsdA==
  token: ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNkluUTJjaTFZWTNjd2FUWmpWbFEyYnpoYWVUSmlhR2hNTkUxZmJsRnpNRXhyV0RoT2QyNVBabUZNWHpBaWZRLmV5SnBjM01pT2lKcmRXSmxjbTVsZEdWekwzTmxjblpwWTJWaFkyTnZkVzUwSWl3aWEzVmlaWEp1WlhSbGN5NXBieTl6WlhKMmFXTmxZV05qYjNWdWRDOXVZVzFsYzNCaFkyVWlPaUprWldaaGRXeDBJaXdpYTNWaVpYSnVaWFJsY3k1cGJ5OXpaWEoyYVdObFlXTmpiM1Z1ZEM5elpXTnlaWFF1Ym1GdFpTSTZJbmxoYm5GcExYUnZhMlZ1TFhwNk4yczFJaXdpYTNWaVpYSnVaWFJsY3k1cGJ5OXpaWEoyYVdObFlXTmpiM1Z1ZEM5elpYSjJhV05sTFdGalkyOTFiblF1Ym1GdFpTSTZJbmxoYm5GcElpd2lhM1ZpWlhKdVpYUmxjeTVwYnk5elpYSjJhV05sWVdOamIzVnVkQzl6WlhKMmFXTmxMV0ZqWTI5MWJuUXVkV2xrSWpvaU1ESmtZams0T0RFdFpHSm1aUzAwWkRVMUxUa3hZelV0TldVeVpqazRaR1EwTldabElpd2ljM1ZpSWpvaWMzbHpkR1Z0T25ObGNuWnBZMlZoWTJOdmRXNTBPbVJsWm1GMWJIUTZlV0Z1Y1draWZRLmh6MkJjYnJMY1ZrOHlqYlhkUzdzR2N3QVdubG1FTFI1RW5mTVdpYUxaeFlmWnZxSHkxd3doUnlUeW9xR2tZdE9LWVpuQ1o4dkNaWXdxWnFYSElHWmZfdFg1Q09ocnB2V21LNktZOTA0SGI2djc3bkVRSThfc0RkMS1Xb1RmQzgtYkFuQ3RTV3dwZWR5QVd0d2lUS3A0dzByZExBTHpfaWxURXBSUzJDRUpOUkhRTFhzUGZEaVo5NnloZDB4cXp2MUxzTjhiOTBOR0JNNWxqTGZMNHBMS0JzaDBrZWVwdS1TTTR2UzliNnM3TmYxLXlTbVBMSmVrd0tGVjJITjEzb19sT25JUXpfakU0TTZlS0oxS25NTmliaUl1Q2pFWHE3QXp3UjI4STYtWmhDOEdlaTNnNlFWUGk2Tkk2eThpVnRCTWgzS3NjUDJCbzlFVk5SbDNLT2s0Zw==
kind: Secret
metadata:
  annotations:
    kubernetes.io/service-account.name: yanqi
    kubernetes.io/service-account.uid: 02db9881-dbfe-4d55-91c5-5e2f98dd45fe
    manager: kube-controller-manager
    operation: Update
    time: "2021-05-03T13:44:46Z"
  name: yanqi-token-zz7k5
  namespace: default
  resourceVersion: "1613315"
  uid: d211d58e-259a-49dc-ba9b-15db16b19815
type: kubernetes.io/service-account-token

~~~     # 解密出来的值和describe查看出的值是一致的，那这个token是可以去访问我们的资源

[root@k8s-master01 ~]# echo """ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNkluUTJjaTFZWTNjd2FUWmpWbFEyYnpoYWVUSmlhR2hNTkUxZmJsRnpNRXhyV0RoT2QyNVBabUZNWHpBaWZRLmV5SnBjM01pT2lKcmRXSmxjbTVsZEdWekwzTmxjblpwWTJWaFkyTnZkVzUwSWl3aWEzVmlaWEp1WlhSbGN5NXBieTl6WlhKMmFXTmxZV05qYjNWdWRDOXVZVzFsYzNCaFkyVWlPaUprWldaaGRXeDBJaXdpYTNWaVpYSnVaWFJsY3k1cGJ5OXpaWEoyYVdObFlXTmpiM1Z1ZEM5elpXTnlaWFF1Ym1GdFpTSTZJbmxoYm5GcExYUnZhMlZ1TFhwNk4yczFJaXdpYTNWaVpYSnVaWFJsY3k1cGJ5OXpaWEoyYVdObFlXTmpiM1Z1ZEM5elpYSjJhV05sTFdGalkyOTFiblF1Ym1GdFpTSTZJbmxoYm5GcElpd2lhM1ZpWlhKdVpYUmxjeTVwYnk5elpYSjJhV05sWVdOamIzVnVkQzl6WlhKMmFXTmxMV0ZqWTI5MWJuUXVkV2xrSWpvaU1ESmtZams0T0RFdFpHSm1aUzAwWkRVMUxUa3hZelV0TldVeVpqazRaR1EwTldabElpd2ljM1ZpSWpvaWMzbHpkR1Z0T25ObGNuWnBZMlZoWTJOdmRXNTBPbVJsWm1GMWJIUTZlV0Z1Y1draWZRLmh6MkJjYnJMY1ZrOHlqYlhkUzdzR2N3QVdubG1FTFI1RW5mTVdpYUxaeFlmWnZxSHkxd3doUnlUeW9xR2tZdE9LWVpuQ1o4dkNaWXdxWnFYSElHWmZfdFg1Q09ocnB2V21LNktZOTA0SGI2djc3bkVRSThfc0RkMS1Xb1RmQzgtYkFuQ3RTV3dwZWR5QVd0d2lUS3A0dzByZExBTHpfaWxURXBSUzJDRUpOUkhRTFhzUGZEaVo5NnloZDB4cXp2MUxzTjhiOTBOR0JNNWxqTGZMNHBMS0JzaDBrZWVwdS1TTTR2UzliNnM3TmYxLXlTbVBMSmVrd0tGVjJITjEzb19sT25JUXpfakU0TTZlS0oxS25NTmliaUl1Q2pFWHE3QXp3UjI4STYtWmhDOEdlaTNnNlFWUGk2Tkk2eThpVnRCTWgzS3NjUDJCbzlFVk5SbDNLT2s0Zw==""" |base64 --decode
eyJhbGciOiJSUzI1NiIsImtpZCI6InQ2ci1YY3cwaTZjVlQ2bzhaeTJiaGhMNE1fblFzMExrWDhOd25PZmFMXzAifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6InlhbnFpLXRva2VuLXp6N2s1Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6InlhbnFpIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMDJkYjk4ODEtZGJmZS00ZDU1LTkxYzUtNWUyZjk4ZGQ0NWZlIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50OmRlZmF1bHQ6eWFucWkifQ.hz2BcbrLcVk8yjbXdS7sGcwAWnlmELR5EnfMWiaLZxYfZvqHy1wwhRyTyoqGkYtOKYZnCZ8vCZYwqZqXHIGZf_tX5COhrpvWmK6KY904Hb6v77nEQI8_sDd1-WoTfC8-bAnCtSWwpedyAWtwiTKp4w0rdLALz_ilTEpRS2CEJNRHQLXsPfDiZ96yhd0xqzv1LsN8b90NGBM5ljLfL4pLKBsh0keepu-SM4vS9b6s7Nf1-ySmPLJekwKFV2HN13o_lOnIQz_jE4M6eKJ1KnMNibiIuCjEXq7AzwR28I6-ZhC8Gei3g6QVPi6NI6y8iVtBMh3KscP2Bo9EVNRl3KOk4g