k8s、ServiceAccount权限详解、RBAC 详解(基于角色的访问控制),常用操作指令

文章目录

    • Service Account应用示例
    • RBAC 详解(基于角色的访问控制)
    • 创建一个角色(role)---权限
    • 实验二
    • 常用操作指令

Service Account应用示例

概念图权限关系
k8s、ServiceAccount权限详解、RBAC 详解(基于角色的访问控制),常用操作指令_第1张图片
我自己的理解就是,Service Account就是pod的权限

1、创建serviceaccount

[root@kub-k8s-master ~]# kubectl create serviceaccount mysa
serviceaccount/mysa created

2、查看mysa

[root@kub-k8s-master ~]# kubectl describe sa mysa
Name:                mysa
Namespace:           default
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   mysa-token-cknwf
Tokens:              mysa-token-cknwf
Events:              <none>

3、查看mysa自动创建的secret

[root@kub-k8s-master ~]# kubectl  get secret
NAME                  TYPE                                  DATA   AGE
db-user-pass          Opaque                                2      11h
default-token-6svwp   kubernetes.io/service-account-token   3      4d23h
mysa-token-cknwf      kubernetes.io/service-account-token   3      76s
mysecret              Opaque                                2      11h
mysecret-01           Opaque                                2      6h58m
pass                  Opaque                                1      7h6m
user                  Opaque                                1      7h7m

4、使用mysa的sa资源配置pod

[root@kub-k8s-master prome]# vim mysa-pod.yaml
---
apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
  labels:
    app: my-pod
spec:
  containers:
  - name: my-pod
    image: daocloud.io/library/nginx
    ports:
    - name: http
      containerPort: 80
  serviceAccountName: mysa   #指定serviceaccount的名称

5、导入

[root@kub-k8s-master prome]# kubectl apply -f  mysa-pod.yaml
pod/nginx-pod created

6、查看

[root@kub-k8s-master prome]# kubectl describe pod nginx-pod

7、查看使用的token和secret(使用的是mysa的token)

[root@kub-k8s-master prome]# kubectl get pod nginx-pod -o jsonpath={".spec.volumes"}
[map[name:mysa-token-cknwf secret:map[defaultMode:420 secretName:mysa-token-cknwf]]]
[root@kub-k8s-master prome]#

RBAC 详解(基于角色的访问控制)

一个实验搞定RBAC

Role与ClusterRole
 Role:角色可以由命名空间内的Role对象定义,一个Role对象只能用于授予对某一单一命名空间中资源的访问权限。
 ClusterRole:整个Kubernetes集群范围内有效的角色则通过ClusterRole对象实现。

创建k8s账号与RBAC授权使用
创建账号/用户
1、创建私钥

[root@kub-k8s-master ~]# (umask 077; openssl genrsa -out soso.key 2048)

Generating RSA private key, 2048 bit long modulus
...............................+++
..........................+++
e is 65537 (0x10001)

用此私钥创建一个csr(证书签名请求)文件

[root@kub-k8s-master ~]# openssl  req -new -key soso.key -out soso.csr -subj  "/CN=soso"

拿着私钥和请求文件生成证书

[root@kub-k8s-master ~]# openssl x509 -req -in soso.csr -CA  /etc/kubernetes/pki/ca.crt  -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out soso.crt -days 365

Signature ok
subject=/CN=soso
Getting CA Private Key

2、查看证书内容

[root@kub-k8s-master ~]# openssl  x509 -in soso.crt -text -noout

生成账号

[root@kub-k8s-master ~]# kubectl config set-credentials soso --client-certificate=soso.crt --client-key=soso.key --embed-certs=true

User "soso" set.

3、设置上下文环境–指的是这个账号只能在这个环境中才能用

[root@kub-k8s-master ~]# kubectl config set-context soso@kubernetes --cluster=kubernetes --user=soso

Context "soso@kubernetes" created.

查看当前的工作上下文

[root@kub-k8s-master ~]# kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://192.168.246.166:6443
....

4、切换用户(切换上下文)

[root@kub-k8s-master ~]# kubectl  config use-context soso@kubernetes
Switched to context "soso@kubernetes".

验证是否已经切换到了新的上下文

[root@kub-k8s-master ~]# kubectl config current-context
soso@kubernetes

5.测试(还未赋予权限)

[root@kub-k8s-master ~]# kubectl  get pod

Error from server (Forbidden): pods is forbidden: User "soso" cannot list resource "pods" in API group "" in the namespace "default"

创建一个角色(role)—权限

1.切回管理帐号先

[root@kub-k8s-master ~]# kubectl  config use-context kubernetes-admin@kubernetes

Switched to context "kubernetes-admin@kubernetes".

创建角色:

[root@kub-k8s-master ~]# kubectl  create role  myrole  --verb=get,list,watch --resource=pod,svc

role.rbac.authorization.k8s.io/myrole created
--verb: 相当于是权限
--resource:给什么资源使用

2.绑定用户soso(上面创建的用户),绑定role为myrole

[root@kub-k8s-master ~]# kubectl  create  rolebinding myrole-binding  --role=myrole  --user=soso

rolebinding.rbac.authorization.k8s.io/myrole-binding created

3.切换用户

[root@kub-k8s-master ~]# kubectl  config use-context soso@kubernetes
Switched to context "soso@kubernetes".

4.查看权限(只授权了default名称空间pod和svc的get,list,watch权限)

[root@kub-k8s-master ~]# kubectl  get pod
NAME                    READY   STATUS    RESTARTS   AGE
lifecycle-demo          1/1     Running   1          22h
mypod                   1/1     Running   0          8h
nginx-configmap         1/1     Running   0          4h29m
nginx-pod               1/1     Running   0          39m

测试

[root@kub-k8s-master ~]#  kubectl  get pod -n kube-system  #无权访问kube-system

Error from server (Forbidden): pods is forbidden: User "soso" cannot list resource "pods" in API group "" in the namespace "kube-system"

[root@kub-k8s-master ~]# kubectl  delete pod nginx-pod   #无权限删除

Error from server (Forbidden): pods "nginx-pod" is forbidden: User "soso" cannot delete resource "pods" in API group "" in the namespace "default"

5.切换用户

[root@kub-k8s-master ~]# kubectl  config use-context kubernetes-admin@kubernetes
Switched to context "kubernetes-admin@kubernetes".

实验二

6.删除soso账号之前绑定的rolebinding

[root@kub-k8s-master ~]# kubectl  delete rolebinding myrole-binding 

rolebinding.rbac.authorization.k8s.io "myrole-binding" deleted

7.创建clusterrole #可以访问全部的namespace

[root@kub-k8s-master ~]# kubectl create clusterrole myclusterrole --verb=get,list,watch --resource=pod,svc

clusterrole.rbac.authorization.k8s.io/myclusterrole created

8.绑定集群角色到用户soso

[root@kub-k8s-master ~]# kubectl  create clusterrolebinding my-cluster-rolebinding   --clusterrole=myclusterrole --user=soso

clusterrolebinding.rbac.authorization.k8s.io/my-cluster-rolebinding created

8.切换账号

[root@kub-k8s-master ~]# kubectl  config use-context soso@kubernetes

Switched to context "soso@kubernetes".

9.查看权限 查看kube-system空间的pod

[root@kub-k8s-master ~]# kubectl  get pod -n kube-system
NAME                                     READY   STATUS    RESTARTS   AGE
coredns-5644d7b6d9-sm8hs                 1/1     Running   0          5d
coredns-5644d7b6d9-vddll                 1/1     Running   0          5d
etcd-kub-k8s-master                      1/1     Running   0          5d
... 

注意:10.切换为管理员用户

[root@kub-k8s-master ~]# kubectl  config use-context kubernetes-admin@kubernetes

常用操作指令

设置工作上下文(前提得有用户)

[root@kub-k8s-master ~]# kubectl  config   set-context  soso@kubernetes --cluster=kubernetes --user=soso
Context "soso@kubernetes" created.

查看当前的工作上下文

[root@kub-k8s-master ~]# kubectl config view
apiVersion: v1
clusters:
- cluster:
....

切换上下文(切换用户)

[root@kub-k8s-master ~]# kubectl config use-context soso@kubernetes
Switched to context "soso@kubernetes".

切换为管理员用户

[root@kub-k8s-master prome]# kubectl  config use-context kubernetes-admin@kubernetes
Switched to context "kubernetes-admin@kubernetes".

你可能感兴趣的:(k8s,docker,容器,操作系统,k8s)