CSR 请求自动批准

1.自动审批的类型

• approve-node-client-csr:
  具有自动批准 nodeclient 类型 CSR 请求的能力，仅在kubelet第一次启动时会产生
• approve-node-client-renewal-csr:
  具有自动批准 selfnodeclient 类型 CSR 请求的能力,自己作为 client 跟 apiserver 通讯时使用的证书产生的
• approve-node-server-renewal-csr: (高版本中已不存在)
  具有自动批准 selfnodeserver 类型 CSR 请求的能力，kubelet 首次申请或后续 renew 自己的 10250 api 端口证书时产生的

2. 查看默认创建的

[root@node4 yaml]# kubectl get clusterrole  |grep certificatesigningrequests
system:certificates.k8s.io:certificatesigningrequests:nodeclient       13h
system:certificates.k8s.io:certificatesigningrequests:selfnodeclient   13h

3.给kubelet-bootstrap 授权，也可以按照group授权

[root@node4 yaml]# kubectl create clusterrolebinding kubelet-bootstrap --clusterrole=system:node-bootstrapper  --user=kubelet-bootstrap
clusterrolebinding.rbac.authorization.k8s.io/kubelet-bootstrap created
[root@node4 yaml]# kubectl create clusterrolebinding node-autoapprove-bootstrap --clusterrole=system:certificates.k8s.io:certificatesigningrequests:nodeclient  --user=kubelet-bootstrap 
clusterrolebinding.rbac.authorization.k8s.io/node-autoapprove-bootstrap created
[root@node4 yaml]# kubectl create clusterrolebinding node-autoapprove-certificate-rotation --clusterrole=system:certificates.k8s.io:certificatesigningrequests:selfnodeclient  --user=kubelet-bootstrap 
clusterrolebinding.rbac.authorization.k8s.io/node-autoapprove-certificate-rotation created

4.在源码中添加默认加载

目录：
/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrap/policy

• controller_policy.go
  包含于controller相关的默认授权
• namespace_policy.go
  包含于namespace相关的默认授权
• policy.go
  其他相关授权

增加默认授权，添加部分有注释

func ClusterRoleBindings() []rbacv1.ClusterRoleBinding {
    rolebindings := []rbacv1.ClusterRoleBinding{
        rbacv1helpers.NewClusterBinding("cluster-admin").Groups(user.SystemPrivilegedGroup).BindingOrDie(),
        rbacv1helpers.NewClusterBinding("system:discovery").Groups(user.AllAuthenticated).BindingOrDie(),
        rbacv1helpers.NewClusterBinding("system:basic-user").Groups(user.AllAuthenticated).BindingOrDie(),
        rbacv1helpers.NewClusterBinding("system:public-info-viewer").Groups(user.AllAuthenticated, user.AllUnauthenticated).BindingOrDie(),
        rbacv1helpers.NewClusterBinding("system:node-proxier").Users(user.KubeProxy).BindingOrDie(),
        rbacv1helpers.NewClusterBinding("system:kube-controller-manager").Users(user.KubeControllerManager).BindingOrDie(),
        rbacv1helpers.NewClusterBinding("system:kube-dns").SAs("kube-system", "kube-dns").BindingOrDie(),
        rbacv1helpers.NewClusterBinding("system:kube-scheduler").Users(user.KubeScheduler).BindingOrDie(),
        rbacv1helpers.NewClusterBinding("system:volume-scheduler").Users(user.KubeScheduler).BindingOrDie(),

        // This default binding of the system:node role to the system:nodes group is deprecated in 1.7 with the availability of the Node authorizer.
        // This leaves the binding, but with an empty set of subjects, so that tightening reconciliation can remove the subject.
        {
            ObjectMeta: metav1.ObjectMeta{Name: systemNodeRoleName},
            RoleRef:    rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "ClusterRole", Name: systemNodeRoleName},
        },
        //自定义添加部分 added by gao at 2019-06-06 begin
        {
            ObjectMeta: metav1.ObjectMeta{Name: "kubelet-bootstrap"},
            RoleRef:    rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "ClusterRole", Name: "system:node-bootstrapper"},
            Subject:    rbacv1.Subject{APIGroup: rbacv1.GroupName, Kind: "User",Name:"kubelet-bootstrap"},
        },
        {
            ObjectMeta: metav1.ObjectMeta{Name: "node-autoapprove-bootstrap"},
            RoleRef:    rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "ClusterRole", Name: "system:certificates.k8s.io:certificatesigningrequests:nodeclient"},
            Subject:    rbacv1.Subject{APIGroup: rbacv1.GroupName, Kind: "User",Name:"kubelet-bootstrap"},
        },
        {
            ObjectMeta: metav1.ObjectMeta{Name: "node-autoapprove-certificate-rotation"},
            RoleRef:    rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "ClusterRole", Name: "system:system:certificates.k8s.io:certificatesigningrequests:selfnodeclient"},
            Subject:    rbacv1.Subject{APIGroup: rbacv1.GroupName, Kind: "User",Name:"kubelet-bootstrap"},
        },
        //自定义添加部分 added by gao at 2019-06-06 end
    }

    addClusterRoleBindingLabel(rolebindings)

    return rolebindings
}

5.证书到期轮换

证书的签发方和申请方：kube-controller-manager和kubelet

• kubelet

--rotate-certificates：设置为true，表示证书即将到期时，会自动发起申请新证书的请求
--feature-gates=RotateKubeletClientCertificate=true  由于证书轮换是 beta 特性，通过该属性启用

• kube-controller-manager

--experimental-cluster-signing-duration duration:签发证书有效期，默认：8760h