k8s资源之role&rolebinding&clusterrole&clusterrolebinding

淩亂°似流年 2023-06-26 10:35 12阅读 0赞

#  欢迎关注我的公众号： #

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAaHhwamF2YTE_size_8_color_FFFFFF_t_70_g_se_x_16][]

目前刚开始写一个月，一共写了18篇原创文章，文章目录如下：

[istio多集群探秘，部署了50次多集群后我得出的结论][istio_50]

[istio多集群链路追踪，附实操视频][istio]

[istio防故障利器，你知道几个,istio新手不要读，太难！][istio_istio]

[istio业务权限控制，原来可以这么玩][istio 1]

[istio实现非侵入压缩，微服务之间如何实现压缩][istio 2]

[不懂envoyfilter也敢说精通istio系列-http-rbac-不要只会用AuthorizationPolicy配置权限][envoyfilter_istio_-http-rbac-_AuthorizationPolicy]

[不懂envoyfilter也敢说精通istio系列-02-http-corsFilter-不要只会vs][envoyfilter_istio_-02-http-corsFilter-_vs]

[不懂envoyfilter也敢说精通istio系列-03-http-csrf filter-再也不用再代码里写csrf逻辑了][envoyfilter_istio_-03-http-csrf filter-_csrf]

[不懂envoyfilter也敢说精通istio系列http-jwt\_authn-不要只会RequestAuthorization][envoyfilter_istio_http-jwt_authn-_RequestAuthorization]

[不懂envoyfilter也敢说精通istio系列-05-fault-filter-故障注入不止是vs][envoyfilter_istio_-05-fault-filter-_vs]

[不懂envoyfilter也敢说精通istio系列-06-http-match-配置路由不只是vs][envoyfilter_istio_-06-http-match-_vs]

[不懂envoyfilter也敢说精通istio系列-07-负载均衡配置不止是dr][envoyfilter_istio_-07-_dr]

[不懂envoyfilter也敢说精通istio系列-08-连接池和断路器][envoyfilter_istio_-08-]

[不懂envoyfilter也敢说精通istio系列-09-http-route filter][envoyfilter_istio_-09-http-route filter]

[不懂envoyfilter也敢说精通istio系列-network filter-redis proxy][envoyfilter_istio_-network filter-redis proxy]

[不懂envoyfilter也敢说精通istio系列-network filter-HttpConnectionManager][envoyfilter_istio_-network filter-HttpConnectionManager]

[不懂envoyfilter也敢说精通istio系列-ratelimit-istio ratelimit完全手册][envoyfilter_istio_-ratelimit-istio ratelimit]

————————————————

# K8s的认证包含以下3种方式： #

证书认证

设置apiserver的启动参数：

--client\_ca\_file=SOMEFILE。

Token认证

设置apiserver的启动参数：

--token\_auth\_file=SOMEFILE。

基本信息认证

设置apiserver的启动参数：

-- basic\_auth\_file=SOMEFILE

# Kubectl config： #

•clusters ：配置要访问的kubernetes集群

•contexts ：配置访问kubernetes集群的具体上下文环境

•current-context: 配置当前使用的上下文环境

•users： 配置访问的用户信息，用户名以及证书信息

•kubectl config view

• kubectl config set-cluster k8s-cluster2 \--server=https://192.168.198.155:6443 \--certificate-authority=/etc/kubernetes/ssl/ca.pem \--embed-certs=true

•kubectl config set-context kube\-system-ctx \--cluster=k8s-cluster1 --user=kubectl \--namespace=kube\-system

•kubectl config unset \[clusters | contexts | users | current-context\]

•cfssl gencert \-ca /etc/kubernetes/ssl/ca.pem \-ca\-key /etc/kubernetes/ssl/ca-key.pem \-config /etc/kubernetes/ssl/ca-config.json \-profile kubernetes kubectl-csr.json | cfssljson \-bare kubectl

•*kubectl* *config* *set-credentials* *mark --**client-certificate=**admin.pem* *--client-key=admin-**key.pem* *--**embed-certs=true*

•kubectl config \--kubeconfig=config\-demo set-credentials experimenter --username=exp \--password=some-password

\[root@master01 auth\]\# vi basic\_auth\_file

123456,mark,123,"group1,group2,group3“

Vi /etc/systemd/system/kube-apiserver.service

\--basic-auth\-file=/etc/kubernetes/auth/basic\_auth\_file \\

# K8s权限控制： #

•在Kubernetes中，授权有ABAC（基于属性的访问控制）、RBAC（基于角色的访问控制）、Webhook、Node、AlwaysDeny（一直拒绝）和AlwaysAllow（一直允许）这6种模式。

# **RBAC** #

•Role-based access control(RBAC)基于企业内个人用户属于角色来访问计算和网络的常规访问控制方法。简单理解为权限与角色关联，用户通过成为角色的成员来得到角色的权限。K8S的RBAC使用rbac.authorization.k8s.io/v1 API组驱动认证决策，准许管理员通过API动态配置策略。为了启用RBAC，需要在apiserver启动参数添加\--authorization-mode=RBAC。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70][]

# 支持的动作 #

create delete deletecollection get list patch update watch，bind等

# 支持的资源 #

“services”, “endpoints”, “pods“，"deployments“

“jobs”，“configmaps”，“nodes”，“rolebindings”，“clusterroles”，等

# 示例: #

kind: Role
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      namespace: default
      name: pod-reader
    rules:
    - apiGroups: [""]
      resources: ["pods"]
      verbs: ["get", "watch", "list"]
    ---
    kind: RoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: read-pods
      namespace: default
    subjects:
    - kind: User
      name: mark
      apiGroup: rbac.authorization.k8s.io
    roleRef:
      kind: Role
      name: pod-reader
      apiGroup: rbac.authorization.k8s.io

kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: svc-reader
    rules:
    - apiGroups: [""]
      resources: ["services"]
      verbs: ["get","watch","list"]
    ---
    kind: RoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: read-svc
      namespace: default 
    subjects:
    - kind: User
      name: mark
      apiGroup: rbac.authorization.k8s.io
    roleRef:
      kind: ClusterRole
      name: svc-reader
      apiGroup: rbac.authorization.k8s.io

kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: svc-reader
    rules:
    - apiGroups: [""]
      resources: ["services"]
      verbs: ["get","watch","list"]
    ---
    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: read-svc-global
    subjects:
    - kind: User
      name: mark
      apiGroup: rbac.authorization.k8s.io
    roleRef:
      kind: ClusterRole
      name: svc-reader
      apiGroup: rbac.authorization.k8s.io

kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: svc-reader
    rules:
    - apiGroups: [""]
      resources: ["services"]
      verbs: ["get","watch","list"]
    ---
    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: read-svc-global
    subjects:
    - kind: Group
      name: group1
      apiGroup: rbac.authorization.k8s.io
    roleRef:
      kind: ClusterRole
      name: svc-reader
      apiGroup: rbac.authorization.k8s.io

子资源:

kind: Role
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
     namespace: default
     name: pod-and-pod-logs-reader
    rules:
    - apiGroups: [""]
      resources: ["pods","pods/log"]
      verbs: ["get","list"]
    ---
    kind: RoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: read-pods-log
      namespace: default
    subjects:
    - kind: User
      name: mark
      apiGroup: rbac.authorization.k8s.io
    roleRef:
      kind: Role
      name: pod-and-pod-logs-reader
      apiGroup: rbac.authorization.k8s.io

特定资源:

•kubectl create cm my-configmap \--from-literal=username=mark --from-literal=pass=123456

kind: Role
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      namespace: default
      name: configmap-updater
    rules:
    - apiGroups: [""]
      resources: ["configmaps"]
      resourceNames: ["my-configmap"]
      verbs: ["update","get"]
    ---
    kind: RoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: configmap-updater-default
      namespace: default
    subjects:
    - kind: User
      name: mark
      apiGroup: rbac.authorization.k8s.io
    roleRef:
      kind: Role
      name: configmap-updater
      apiGroup: rbac.authorization.k8s.io

所有被认证的用户:

kind: Role
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      namespace: default
      name: pod-reader
    rules:
    - apiGroups: [""]
      resources: ["pods"]
      verbs: ["get", "watch", "list"]
    ---
    kind: RoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: read-pods
      namespace: default
    subjects:
    - kind: Group
      name: system:authenticated
      apiGroup: rbac.authorization.k8s.io
    roleRef:
      kind: Role
      name: pod-reader
      apiGroup: rbac.authorization.k8s.io

serviceaccount:

• kubectl  create  sa mysa

kind: Role
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      namespace: default
      name: pod-reader
    rules:
    - apiGroups: [""]
      resources: ["pods"]
      verbs: ["get", "watch", "list"]
    ---
    kind: RoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: read-pods
      namespace: default
    subjects:
    - kind: ServiceAccount
      name: mysa
      namespace: default
    roleRef:
      kind: Role
      name: pod-reader
      apiGroup: rbac.authorization.k8s.io

# 命令: #

•**kubectl** **create** **rolebinding**

•*kubectl* *create* *rolebinding* *bob-admin-binding --**clusterrole**=admin --user=bob --**namespace=acme*

•*$* *kubectl* *create* *rolebinding* *myapp**-view-binding --**clusterrole**=view --**serviceaccount**=**acme:myapp** --namespace=acme*

•kubectl create role pod-reader --verb=get --verb=list --verb=watch --resource=pods

•kubectl create role pod-reader --verb=get --resource=pods --resource-name=readablepod \--resource-name=anotherpod

•kubectl create role foo --verb=get,list,watch \--resource=replicasets.apps

•kubectl create role foo --verb=get,list,watch \--resource=pods,pods/status

•kubectl create clusterrole pod-reader --verb=get,list,watch \--resource=pods

•kubectl create clusterrole pod-reader --verb=get --resource=pods --resource-name=readablepod \--resource-name=anotherpod

•kubectl create clusterrole foo --verb=get,list,watch \--resource=replicasets.apps

•kubectl create clusterrole foo --verb=get,list,watch \--resource=pods,pods/status

•kubectl create clusterrole "foo" --verb=get --non-resource-url=/logs/\*

•kubectl create clusterrole monitoring --aggregation-rule="rbac.example.com/aggregate-to-monitoring=true"

•kubectl auth reconcile 子命令已经被添加用来应用 RBAC 资源。当传入一个文件包括 RBAC roles，rolebindings，clusterroles，或者 clusterrolebindings，该命令能够计算出覆盖的权限并且添加遗漏的规则。

•Kubectl auth can-i

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAaHhwamF2YTE_size_8_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/20211007094240106.jpg?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAaHhwamF2YTE=,size_8,color_FFFFFF,t_70,g_se,x_16
[istio_50]: https://mp.weixin.qq.com/s/_OPMjmWCDSTlmbAxytg33A
[istio]: https://mp.weixin.qq.com/s/kjvtno_UzJAGr1joxm3tvw
[istio_istio]: https://mp.weixin.qq.com/s/e2-p_NY31Mc5y07S4Bb1JQ
[istio 1]: https://mp.weixin.qq.com/s/iTV0SCQLhSOTYncp3PxoHQ
[istio 2]: https://mp.weixin.qq.com/s/eINlrT242RlAwfuZu1_PcA
[envoyfilter_istio_-http-rbac-_AuthorizationPolicy]: https://mp.weixin.qq.com/s/Q-yTGBNqkjOov49LTXPrPA
[envoyfilter_istio_-02-http-corsFilter-_vs]: https://mp.weixin.qq.com/s/bFMdrT7OKSqoWv8pDXOIqQ
[envoyfilter_istio_-03-http-csrf filter-_csrf]: https://mp.weixin.qq.com/s/dlG9phV-kMMxs4UPzuRNYg
[envoyfilter_istio_http-jwt_authn-_RequestAuthorization]: https://mp.weixin.qq.com/s/IfrJ-FdLYsdhPkDrcO_YXA
[envoyfilter_istio_-05-fault-filter-_vs]: https://mp.weixin.qq.com/s/a4gDXqD8uswgglMwkUph2Q
[envoyfilter_istio_-06-http-match-_vs]: https://mp.weixin.qq.com/s/TpS3DHdcaJiPivIS_jsIGw
[envoyfilter_istio_-07-_dr]: https://mp.weixin.qq.com/s/k-zJm7n7OOKg6MotQJYPAA
[envoyfilter_istio_-08-]: https://mp.weixin.qq.com/s/n_bJ3saNeTtXRprIymhwzg
[envoyfilter_istio_-09-http-route filter]: https://mp.weixin.qq.com/s/JAeZr0BMVQxIrB3S_7Ru0A
[envoyfilter_istio_-network filter-redis proxy]: https://mp.weixin.qq.com/s/B9IPTI8F3q42nVkqbQRlPw
[envoyfilter_istio_-network filter-HttpConnectionManager]: https://mp.weixin.qq.com/s/W3OPQWkCVvuHGS49cTNhlg
[envoyfilter_istio_-ratelimit-istio ratelimit]: https://mp.weixin.qq.com/s/KgiDsELNol27mgZvDbFsqw
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20191231105657604.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx,size_16,color_FFFFFF,t_70