Kubernetes为所有默认的ServiceAccount授权

环境准备：

创建一个私有的命名空间 mynamespace，创建一个pod，让这个pod使用默认的service account

#cat mynamespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: mynamespace


#cat example-pod3.yaml
apiVersion: v1
kind: Pod
metadata:
  name: test-default-verbs
  namespace: mynamespace
spec:
  shareProcessNamespace: true
  containers:
  - name: shell
    image: radial/busyboxplus:curl
    stdin: true
    tty: true

为什么pod使用镜像： radial/busyboxplus:curl ，是为了方便执行 curl命令来进行验证

此时查看 mynamespace有两个serviceaccount

#kubectl get serviceaccount -n mynamespace
NAME         SECRETS   AGE
default      1         14h
example-sa   1         14h

#kubectl describe serviceaccount default -n mynamespace
Name:                default
Namespace:           mynamespace
Labels:              
Annotations:         
Image pull secrets:  
Mountable secrets:   default-token-sg9f6
Tokens:              default-token-sg9f6
Events:              

进入容器，通过执行curl命令查看pod的权限

#kubectl attach -it test-default-verbs -n mynamespace
$curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt --header "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT/api/v1/namespaces/$(cat/var/run/secrets/kubernetes.io/serviceaccount/namespace)/pods
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "pods is forbidden: User \"system:serviceaccount:mynamespace:default\" cannot list resource \"pods\" in API group \"\" at the cluster scope",
  "reason": "Forbidden",
  "details": {
    "kind": "pods"
  },
  "code": 403

可以看到结果为 pods is forbidden: User ，表示没有权限

授权

接下来就要修改default的权限，来让default拥有list pod的权限。先添加一个权限角色，然后再将角色赋予给default的serviceaccount

#cat example-clusterrole.yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: example-clusterrole
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]


#kubectl apply -f example-clusterrole.yaml
#kubectl describe clusterrole example-clusterrole
Name:         example-clusterrole
Labels:       
Annotations:  PolicyRule:
  Resources   Non-Resource URLs  Resource Names  Verbs
  ---------   -----------------  --------------  -----
  pods        []                 []              [get watch list]

接下来编写一个clusterrolebinding，给所有的default serviceaccount添加角色

    #cat example-clusterrolebinding.yaml
    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: example-clusterrolebinding
    subjects:
    - kind: Group
      name: system:serviceaccounts
      apiGroup: rbac.authorization.k8s.io
    roleRef:
      kind: ClusterRole
      name: example-clusterrole
      apiGroup: rbac.authorization.k8s.io
    #kubectl apply -f example-clusterrolebinding.yaml

    #kubectl describe clusterrolebinding example-clusterrolebinding
    Name:         example-clusterrolebinding
    Labels:       
    Annotations:  Role:
      Kind:       ClusterRole
      Name:       example-clusterrole
    Subjects:
      Kind   Name                    Namespace
      ----   ----                    ---------
      Group  system:serviceaccounts

再次进入容器，通过执行curl命令获取所有pod，执行成功

#kubectl attach -it test-default-verbs -n mynamespace
$curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt --header "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT/api/v1/namespaces/$(cat/var/run/secrets/kubernetes.io/serviceaccount/namespace)/pods
...
"imageID": "docker-pullable://radial/busyboxplus@sha256:a68c05ab1112fd90ad7b14985a48520e9d26dbbe00cb9c09aa79fdc0ef46b372",
            "containerID": "docker://d6b1a94caa364392ac7e3c07dd99faa1c80f15fe6f757aa54509ea778b6c93aa",
            "started": true
          }
        ],
        "qosClass": "BestEffort"
      }
    }
  ]