OpenShift 那些事

Overview

OpenShift v3 is a layered system designed to expose underlying Docker-formatted container image and Kubernetes concepts as accurately as possible, with a focus on easy composition of applications by a developer. For example, install Ruby, push code, and add MySQL.

OpenShift Authorization

Authorization

# oc get clusterRole
NAME                                                                   AGE
admin                                                                  20d
basic-user                                                             20d
cluster-admin                                                          20d
cluster-debugger                                                       20d
cluster-reader                                                         20d
cluster-status                                                         20d
edit                                                                   20d
registry-admin                                                         20d
registry-editor                                                        20d
registry-viewer                                                        20d
self-access-reviewer                                                   20d
self-provisioner                                                       20d
storage-admin                                                          20d
sudoer                                                                 20d
system:aggregate-to-admin                                              20d
system:aggregate-to-edit                                               20d
system:aggregate-to-view                                               20d
system:auth-delegator                                                  20d
system:aws-cloud-provider                                              20d
system:basic-user                                                      20d
system:build-controller                                                20d

SCC

Security context constraints allow administrators to control permissions for pods.

赋权限给user

cat test-scc.yaml

# cat test-scc.yaml
kind: SecurityContextConstraints
apiVersion: v1
metadata:
  name: test-scc
allowPrivilegedContainer: true
allowHostDirVolumePlugin: true
allowedCapabilities:
- SYS_ADMIN
- SYS_RESOURCE
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: RunAsAny
fsGroup:
  type: RunAsAny
supplementalGroups:
  type: RunAsAny
users:
- test

这样用户test 就有权限 hostmount 了

Users

Interaction with OKD is associated with a user. An OKD user object represents an actor which may be granted permissions in the system by adding roles to them or to their groups.

Namespaces

Namespaces provide a unique scope for:

• Named resources to avoid basic naming collisions.

• Delegated management authority to trusted users.

• The ability to limit community resource consumption.

Projects

A Kubernetes namespace provides a mechanism to scope resources in a cluster. In OKD, a project is a Kubernetes namespace with additional annotations.

A project is a Kubernetes namespace with additional annotations, and is the central vehicle by which access to resources for regular users is managed（并且是管理常规用户资源访问的中心工具）. A project allows a community of users to organize and manage their content in isolation from other communities. Users must be given access to projects by administrators, or if allowed to create projects, automatically have access to their own projects.

Projects provided at installation

OKD comes with a number of projects out of the box, and projects starting with openshift- are the most essential to users. These projects host master components that run as pods and other infrastructure components.

# oc get projects
NAME                            DISPLAY NAME   STATUS
default                                        Active
kube-dns                                       Active
kube-proxy                                     Active
kube-public                                    Active
kube-system                                    Active
myproject                       My Project     Active
openshift                                      Active
openshift-apiserver                            Active
openshift-controller-manager                   Active
openshift-core-operators                       Active
openshift-infra                                Active
openshift-node                                 Active
openshift-service-cert-signer                  Active
openshift-web-console                          Active
spark-project                                  Active

reference doc

https://docs.okd.io/3.11/architecture/additional_concepts/authorization.html