k8s的登录用户和rabc账户

k8s的登录用户和rabc账户

创建一个k8s用户

创建证书

(umask 077; openssl genrsa -out winsa.key 2048) 
openssl req -new -key winsa.key -out winsa.csr -subj "/CN=winsa"
openssl x509 -req -in winsa.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out winsa.crt -days 3650
openssl x509 -in winsa.crt -text -noout

把用户信息添加到k8s集群中

kubectl config set-credentials winsa --client-certificate=./winsa.crt --client-key=./winsa.key --embed-certs=true
kubectl config set-context winsa@kubernetes --cluster=kubernetes --user=winsa 

给用户winsa创建角色

定义角色文件winsa-role.yaml,主要处理pod的权限,可以根据需要调整自己的校色权限

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: winsa
  name: winsa-role
rules:
  - apiGroups: [""]  
    resources: ["services"]
    verbs: ["get", "watch", "list"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["create","delete","get","list","patch","update","watch"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create","delete","get","list","patch","update","watch"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get","list","watch"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]
  - apiGroups: ["batch", "externsions"]
    resources: ["jobs"]
    verbs: ["get","list","watch","create", "update","patch","delete"]

创建角色绑定

定义角色绑定文件winsa-role-binding.yaml

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: winsa-role-binding
  namespace: winsa
subjects:
- kind: User
  name: winsa
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: winsa-role
  apiGroup: rbac.authorization.k8s.io

切换winsa用户

kubectl config use-context winsa@kubernetes

验证权限

kubectl get pod -n winsa

切换成管理员

kubectl config use-context kubernetes-admin@kubernetes

导出config

kubectl config view --raw   --output='json' >config

可以看到我们新添加的用户已经在config文件中了

[root@k8s-master01 go]# kubectl config get-contexts
CURRENT   NAME                          CLUSTER      AUTHINFO           NAMESPACE
*         kubernetes-admin@kubernetes   kubernetes   kubernetes-admin   
          winsa@kubernetes              kubernetes   winsa     

rbac基于角色的访问控制

1）定义角色：在定义角色时会指定此角色对于资源的访问控制的规则
2）绑定角色：将主体与角色进行绑定，对用户进行访问授权
其中角色绑定又分为:CluserRoleBinding和RoleBinding
两者的区别:
CluserRoleBinding是针对集群的，而RoleBinding是只针对namespace的

角色和角色绑定的详细配置可以参考文章
https://www.kubernetes.org.cn/4062.html

通过命令生成serviceaccount yaml配置
kubectl create serviceaccount testa -o yaml > testa.yaml

角色和角色绑定可以参考上面的配置yaml

两种账户的区别

登录账户useraccount
使用config在客户端连接K8S集群的账户。相当于登录k8s平台的账户
服务账户serviceaccount
指管理k8s资源的账户,一般用在POD的管理，设置POD启动后的各种操作权限。防止运维,开发误操作

参考文献

https://www.kubernetes.org.cn/4062.html
http://blog.itpub.net/28916011/viewspace-2215100/