kubernetes学习笔记之十:RBAC(一)

第一章、RBAC介绍

在Kubernetes中,授权有ABAC(基于属性的访问控制)、RBAC(基于角色的访问控制)、Webhook、Node、AlwaysDeny(一直拒绝)和AlwaysAllow(一直允许)这6种模式。从1.6版本起,Kubernetes 默认启用RBAC访问控制策略。从1.8开始,RBAC已作为稳定的功能。通过设置–authorization-mode=RBAC,启用RABC。在RABC API中,通过如下的步骤进行授权:1)定义角色:在定义角色时会指定此角色对于资源的访问控制的规则;2)绑定角色:将主体与角色进行绑定,对用户进行访问授权。

1、 角色和集群角色

在RBAC API中,角色包含代表权限集合的规则。在这里,权限只有被授予,而没有被拒绝的设置。在Kubernetes中有两类角色,即普通角色和集群角色。可以通过Role定义在一个命名空间中的角色,或者可以使用ClusterRole定义集群范围的角色。一个角色只能被用来授予访问单一命令空间中的资源。
集群角色(ClusterRole)能够被授予如下资源的权限:
    集群范围的资源(类似于Node)
    非资源端点(类似于”/healthz”)
    集群中所有命名空间的资源(类似Pod)

2、角色绑定和集群角色绑定

角色绑定用于将角色与一个或一组用户进行绑定,从而实现将对用户进行授权的目的。主体分为用户、组和服务帐户。角色绑定也分为角色普通角色绑定和集群角色绑定。角色绑定只能引用同一个命名空间下的角色。
角色绑定也可以通过引用集群角色授予访问权限,当主体对资源的访问仅限与本命名空间,这就允许管理员定义整个集群的公共角色集合,然后在多个命名空间中进行复用。
集群角色可以被用来在集群层面和整个命名空间进行授权。

3、资源

在Kubernets中,主要的资源包括:Pods、Nodes、Services、Deployment、Replicasets、Statefulsets、Namespace、Persistents、Secrets和ConfigMaps等。另外,有些资源下面存在子资源,例如:Pod下就存在log子资源

4、主体

RBAC授权中的主体可以是组,用户或者服务帐户。用户通过字符串表示,比如“alice”、 “bob@example.com”等,具体的形式取决于管理员在认证模块中所配置的用户名。system:被保留作为用来Kubernetes系统使用,因此不能作为用户的前缀。组也有认证模块提供,格式与用户类似。

第二章、简单示例

1、使用RoleBanding将用户绑定到Role上

查看命令帮助及格式

[root@k8s-master01 ~]# kubectl create role -h  #查看创建role的命令帮助,以及一些简单的示例
[root@k8s-master01 RBAC]# kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run -o yaml  #通过 -o参数导出yaml格式,可以大致看到Role是如何定义的
[root@k8s-master01 RBAC]# cat role-demo.yaml  #最后完成的yaml文件如下 
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pods-reader
  namespace: default  #名称空间名称
rules:
- apiGroups:
  - ""
  resources:  #包含哪些资源
  - pods
  verbs:       #对以上资源允许进行哪些操作
  - get
  - list
  - watch

创建role

[root@k8s-master01 RBAC]# kubectl apply -f role-demo.yaml 
role.rbac.authorization.k8s.io "pods-reader" created
[root@k8s-master01 RBAC]# kubectl get role   #查看role的信息
NAME          AGE
pods-reader   8s
[root@k8s-master01 RBAC]# kubectl describe role pods-reader  #查看pods-reader 的详细信息
Name:         pods-reader
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"annotations":{},"name":"pods-reader","namespace":"default"},"rules":[{"apiGroup...
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------     -----------------         --------------          -----
  pods          []                            []                         [get list watch]
#
Resources:资源类别,表示对该资源类别下的所有资源进行操作
Non-Resource URLs:非资源URL,对某些资源进行某种特殊操作的存在
Resource Names:对资源类别下某个或多个资源进行操作
Verbs:操作的类型  

 创建一个RoleBinding,将用户qiangungun(该用户在上一章节serviceaccount中已经被创建)绑定到pods-reader 这个role上去

[root@k8s-master01 ~]# kubectl create rolebinding -h  #查看命令帮助
 kubectl create rolebinding  qiangungun-read-pods --role=pods-reader --user=qiangungun  --dry-run -o yaml  #创建名称为qiangungun-read-pods的rolebinding,绑定到名称为pods-reader的role上
[root@k8s-master01 RBAC]# cat rolebinding-demo.yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: qiangungun-read-pods
roleRef:   #role引用,表示引用哪个role
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pods-reader
subjects:  #动作的执行主题
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: qiangungun
[root@k8s-master01 RBAC]# kubectl describe rolebinding qiangungun-read-pods 
Name:         qiangungun-read-pods
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"rbac.authorization.k8s.io/v1","kind":"RoleBinding","metadata":{"annotations":{},"name":"qiangungun-read-pods","namespace":"default"},"ro...
Role:
  Kind:  Role
  Name:  pods-reader
Subjects:
  Kind  Name        Namespace
  ----  ----        ---------
  User  qiangungun   

验证操作

[root@k8s-master01 RBAC]# kubectl config use-context qiangungun@kubernetes #前后当前上下文到qiangungun用户
Switched to context "qiangungun@kubernetes".
[root@k8s-master01 RBAC]# kubectl get pods    #获取当前名称空间的pod信息,可以看到能够正常显示
NAME                             READY     STATUS    RESTARTS   AGE
myapp-deploy-5cfd895984-262kz    1/1       Running   0          3d
myapp-deploy-5cfd895984-7whdn    1/1       Running   0          3d
myapp-deploy-5cfd895984-lg8sh    1/1       Running   0          3d
myapp-deploy-5cfd895984-m7h5j    1/1       Running   0          3d
myapp-deploy-5cfd895984-zd9cm    1/1       Running   0          3d
[root@k8s-master01 RBAC]# kubectl get pods -n kube-system    #查看其它空间pod的信息,可以看到提示没有权限,即验证RoleBanding的权限只对当前的名称空间生效
Error from server (Forbidden): pods is forbidden: User "qiangungun" cannot list pods in the namespace "kube-system"

2、使用ClusterRoleBanding将用户绑定到ClusterRole上

创建一个ClusterRole

[root@k8s-master01 RBAC]# kubectl config use-context kubernetes-admin@kubernetes #切换上下文
Switched to context "kubernetes-admin@kubernetes".
[root@k8s-master01 RBAC]# kubectl create clusterrole -h
[root@k8s-master01 RBAC]# kubectl create clusterrole cluster-reader --verb=get,list,watch --resource=pods -o yaml --dry-run
[root@k8s-master01 RBAC]# cat clusterrole-cluster.yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-reader #ClusterRole属于集群级别,所有不可以定义namespace
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
[root@k8s-master01 RBAC]# kubectl apply -f clusterrole-cluster.yaml 
[root@k8s-master01 RBAC]# useradd admin
[root@k8s-master01 RBAC]# cp -rp ~/.kube/ /home/admin
[root@k8s-master01 RBAC]# chown -R admin:admin /home/admin
[root@k8s-master01 RBAC]# su - admin
[admin@k8s-master01 ~]$ kubectl config use-context qiangungun@kubernetes
[admin@k8s-master01 ~]$ kubectl config view  

创建一个ClusterRoleBinding,将用户qiangungun绑定到cluster-reader这个ClusterRole上面去

[root@k8s-master01 RBAC]# kubectl delete rolebinding qiangungun-read-pods   #root用户
[admin@k8s-master01 ~]$ kubectl get pods   #admin用户下验证
Error from server (Forbidden): pods is forbidden: User "qiangungun" cannot list pods in the namespace "default"
[root@k8s-master01 RBAC]# kubectl create clusterrolebinding -h
[root@k8s-master01 RBAC]# kubectl create clusterrolebinding qiangungun-read-all-pods --clusterrole=cluster-reader --user=qiangungun --dry-run -o yaml #创建名称为qiangungun-read-all-pods的才clusterrolebinding,将名称为cluster-reader的clusterrole绑定到用户名称为qiangungun上
[root@k8s-master01 RBAC]# cat clusterrolebinding-demo.yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: null
  name: qiangungun-read-all-pods
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: qiangungun
[root@k8s-master01 RBAC]# kubectl apply -f clusterrolebinding-demo.yaml 
[root@k8s-master01 RBAC]# kubectl describe clusterrolebinding qiangungun-read-all-pods   

验证

#切换到admin用户终端下
[admin@k8s-master01 ~]$ kubectl get pods  #可以查看当前名称空间pod信息
NAME                             READY     STATUS    RESTARTS   AGE
myapp-deploy-5cfd895984-262kz    1/1       Running   0          3d
myapp-deploy-5cfd895984-7whdn    1/1       Running   0          3d
myapp-deploy-5cfd895984-lg8sh    1/1       Running   0          3d
myapp-deploy-5cfd895984-m7h5j    1/1       Running   0          3d
myapp-deploy-5cfd895984-zd9cm    1/1       Running   0          3d
[admin@k8s-master01 ~]$ kubectl get pods -n ingress-nginx  #可以查看其他空间的pod信息
NAME                                        READY     STATUS    RESTARTS   AGE
default-http-backend-66c4fbf5b4-m8d6j       1/1       Running   0          24d
nginx-ingress-controller-64bcff8657-6j4tq   1/1       Running   0          24d
[admin@k8s-master01 ~]$ kubectl delete pod myapp-deploy-5cfd895984-262kz  #无法删除pod
Error from server (Forbidden): pods "myapp-deploy-5cfd895984-262kz" is forbidden: User "qiangungun" cannot delete pods in the namespace "default"

3、使用RoleBinding绑定ClusterRole 

创建一个RoleBinding(ClusterRole使用以及存在的),并将用户绑定到ClusterRole上

[root@k8s-master01 RBAC]# kubectl delete clusterrolebinding qiangungun-read-all-pods #为了避免冲突,先将之前的clusterrolebinding删除
clusterrolebinding.rbac.authorization.k8s.io "qiangungun-read-all-pods" deleted
[root@k8s-master01 RBAC]#kubectl create rolebinding qiangungun-read-pods --clusterrole=cluster-reader --user=qiangungun --dry-run -o yam
[root@k8s-master01 RBAC]# cat rolebinding-cluster-demo.yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: qiangungun-read-pods
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: qiangungun
[root@k8s-master01 RBAC]# kubectl apply -f rolebinding-cluster-demo.yaml 
rolebinding.rbac.authorization.k8s.io "qiangungun-read-pods" created
[root@k8s-master01 RBAC]# kubectl describe rolebinding qiangungun-read-pods   

验证:

#admin用户终端下
[admin@k8s-master01 ~]$ kubectl get pods  #可以获取当前名称空间的pod信息
NAME                             READY     STATUS    RESTARTS   AGE
myapp-deploy-5cfd895984-262kz    1/1       Running   0          3d
myapp-deploy-5cfd895984-7whdn    1/1       Running   0          3d
myapp-deploy-5cfd895984-lg8sh    1/1       Running   0          3d
myapp-deploy-5cfd895984-m7h5j    1/1       Running   0          3d
myapp-deploy-5cfd895984-zd9cm    1/1       Running   0          3d
[admin@k8s-master01 ~]$ kubectl get pods -n ingress-nginx   #不可用获取其他名称空间的信息
Error from server (Forbidden): pods is forbidden: User "qiangungun" cannot list pods in the namespace "ingres

4、使用RoleBinding绑定集群自带的ClusterRole  

[root@k8s-master01 RBAC]# kubectl get clusterrole  #查看当前集群存在的clusterrole
[root@k8s-master01 RBAC]# kubectl create rolebinding default-ns-admin --clusterrole=admin --user=qiangungun  --dry-run -o yaml #将qiangungun用户绑定到名称为admin的clusterrole上,可以使用get查看admin的配置
[root@k8s-master01 RBAC]# cat rolebinding-cluster-admin-demo.yaml
piVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: default-ns-admin
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: qiangungun
[root@k8s-master01 RBAC]# kubectl apply -f rolebinding-cluster-admin-demo.yaml
[root@k8s-master01 RBAC]# kubectl describe rolebinding default-ns-admin   

验证

#admin用户终端下
[admin@k8s-master01 ~]$ kubectl get pods  #可以获取当前名称空间的pod信息
NAME                             READY     STATUS    RESTARTS   AGE
myapp-deploy-5cfd895984-262kz    1/1       Running   0          3d
myapp-deploy-5cfd895984-7whdn    1/1       Running   0          3d
myapp-deploy-5cfd895984-lg8sh    1/1       Running   0          3d
myapp-deploy-5cfd895984-m7h5j    1/1       Running   0          3d
myapp-deploy-5cfd895984-zd9cm    1/1       Running   0          3d
......
[admin@k8s-master01 ~]$ kubectl delete pod myapp-deploy-5cfd895984-262kz   #可以删除当前名称空间的pod
pod "myapp-deploy-5cfd895984-262kz" deleted
[admin@k8s-master01 ~]$ kubectl get deploy  #可以查看名称空间中的其他资源,如deployment
NAME              DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
nginx-deploy    5               5              5                   5                 3d
[admin@k8s-master01 ~]$ kubectl delete deployment nginx-deploy  #可以删除当前名称空间的其他资源,如deployment
deployment.extensions "nginx-deploy" deleted
[admin@k8s-master01 ~]$ kubectl get pods -n kube-system  #对其名称空间没有任何权限
Error from server (Forbidden): pods is forbidden: User "qiangungun" cannot list pods in the namespace "kube-system"

第三章、Role、CluseterRole、RoleBinding、ClusterRoleBinding在系统的相关联系

[root@k8s-master01 RBAC]# kubectl get clusterrolebinding #查看集群中的clusterrolebingding
NAME                                                   AGE
cluster-admin                                          31d
......
[root@k8s-master01 RBAC]# kubectl get clusterrolebinding cluster-admin -o yaml  #获取名称为cluster-admin的clusterrolebingding配置信息
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  creationTimestamp: 2018-10-30T02:32:22Z
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: cluster-admin
  resourceVersion: "103"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/cluster-admin
  uid: 07b1d436-dbec-11e8-8969-5254001b07db
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group   #类型是一个组
  name: system:masters   #这个组中包含了kubernetes-admin这个用户,而这个用户是默认的当前使用用户
[root@k8s-master01 RBAC]# kubectl config view 
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: REDACTED
    server: https://172.16.150.212:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin  #默认使用的当前用户
  name: kubernetes-admin@kubernetes
- context:
    cluster: kubernetes
    user: qiangungun
  name: qiangungun@kubernetes
current-context: kubernetes-admin@kubernetes  #当前的使用sa
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: qiangungun
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
[root@k8s-master01 RBAC]# cd /etc/kubernetes/pki/
[root@k8s-master01 pki]# openssl x509  -in ./apiserver-kubelet-client.crt -text -noout #查看证书签发的内容
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3187679453637891293 (0x2c3ce992f3e5d4dd)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=kubernetes
        Validity
            Not Before: Oct 30 02:32:03 2018 GMT
            Not After : Oct 30 02:32:03 2019 GMT
        Subject: O=system:masters, CN=kube-apiserver-kubelet-client  #kubernetes-admin用户之所以属于system:master这个组,是因为在它的的证书中定义的,O表示组,如果以后我们想一次授权多个用户,可以将这些用户添加至一个组内,然后给这个组授权即可
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
              .....

#如果RoleBinding或者ClusterRoleBinding的对象是serviceaccount,,那么任意一个pod(spec.serviceAcountName中定义)如果启动时以这个serviceaccount name作为它是以的serviceaccount,那么pod中的应用程序也同时拥有了这个serviceaccount的权限,也就是拥有该serviceaccount绑定的Role或者ClusterRole的权限。系统上一下特殊的pod可能需要做这样的设置,下面我就以集群创建时使用的flannel网络插件为示例讲解

查看flannel的配置

[root@k8s-master01 kubernetes]# cat kube-flannel.yml   #flannel的配置文件
---
kind: ClusterRole    #定义一个ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: flannel
rules:
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - nodes/status
    verbs:
      - patch
---
kind: ClusterRoleBinding  #定义了一个ClusterRoleBinding 
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: flannel
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: flannel
subjects:
- kind: ServiceAccount
  name: flannel
  namespace: kube-system
---
apiVersion: v1 
kind: ServiceAccount   #定义了一个ServiceAccount
metadata:
  name: flannel
  namespace: kube-system
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: kube-flannel-cfg
  namespace: kube-system
  labels:
    tier: node
    app: flannel
data:
  cni-conf.json: |
    {
      "name": "cbr0",
      "plugins": [
        {
          "type": "flannel",
          "delegate": {
            "hairpinMode": true,
            "isDefaultGateway": true
          }
        },
        {
          "type": "portmap",
          "capabilities": {
            "portMappings": true
          }
        }
      ]
    }
  net-conf.json: |
    {
      "Network": "10.244.0.0/16",
      "Backend": {
        "Type": "vxlan"
      }
    }
---
......(以下省略)  

查看flannel创建的pod信息

[root@k8s-master01 kubernetes]# kubectl get pod -n kube-system 
NAME                                   READY     STATUS    RESTARTS   AGE
etcd-k8s-master01                      1/1       Running   0          32d
kube-apiserver-k8s-master01            1/1       Running   0          32d
kube-controller-manager-k8s-master01   1/1       Running   0          7d
kube-dns-86f4d74b45-72kdh              3/3       Running   0          32d
kube-flannel-ds-amd64-847wt            1/1       Running   0          32d
kube-flannel-ds-amd64-9v9t6            1/1       Running   0          32d
kube-flannel-ds-amd64-k4blq            1/1       Running   0          32d
kube-proxy-8l9tf                       1/1       Running   0          32d
kube-proxy-m6pqm                       1/1       Running   0          32d
kube-proxy-scj8n                       1/1       Running   0          32d
kube-scheduler-k8s-master01            1/1       Running   0          32d
[root@k8s-master01 kubernetes]# kubectl get pod kube-flannel-ds-amd64-847wt -n kube-system  -o yaml
......(省略)
  serviceAccount: flannel
  serviceAccountName: flannel  #表示当前的pod在启动容器时,运行的进程与APIserver进行通讯的时候,会以serviceAccountName的账号与APIserver进行连接,从而获得该serviceaccount的权限
.....(省略) 

下面是一张我个人总结的关于user绑定到不同的Role和Binding时所拥有的权限边界

User

Binding 类型

Role 类型

权限

RoleBinding

Role

namespace

ClusterRoleBinding

ClusterRole

Cluster

RoleBinding

ClusterRole

namespace

参考文档:https://www.kubernetes.org.cn/4062.html  

posted @ 2018-12-01 13:50  百衲本  阅读(2482)  评论(0编辑  收藏
博客园首页联系管理订阅订阅随笔- 144 文章- 19 评论- 4 博客园自动生成目录 阅读目录 前言 页面定制 博客侧边栏 页首代码 页脚代码 博客园自动生成目录 回到顶部 前言 样式如本博客,其中js需要申请 回到顶部 页面定制 #cnblogs_post_body { color: black; font: 0.875em/1.5em "微软雅黑" , "PTSans" , "Arial" ,sans-serif; font-size: 15px; } #cnblogs_post_body h1 { text-align:center; background: #333366; border-radius: 6px 6px 6px 6px; box-shadow: 0 0 0 1px #5F5A4B, 1px 1px 6px 1px rgba(10, 10, 0, 0.5); color: #FFFFFF; font-family: "微软雅黑" , "宋体" , "黑体" ,Arial; font-size: 23px; font-weight: bold; height: 25px; line-height: 25px; margin: 18px 0 !important; padding: 8px 0 5px 5px; text-shadow: 2px 2px 3px #222222; } #cnblogs_post_body h2 { text-align:center; background: #006699; border-radius: 6px 6px 6px 6px; box-shadow: 0 0 0 1px #5F5A4B, 1px 1px 6px 1px rgba(10, 10, 0, 0.5); color: #FFFFFF; font-family: "微软雅黑" , "宋体" , "黑体" ,Arial; font-size: 20px; font-weight: bold; height: 25px; line-height: 25px; margin: 18px 0 !important; padding: 8px 0 5px 5px; text-shadow: 2px 2px 3px #222222; } #cnblogs_post_body h3 { background: #2B6695; border-radius: 6px 6px 6px 6px; box-shadow: 0 0 0 1px #5F5A4B, 1px 1px 6px 1px rgba(10, 10, 0, 0.5); color: #FFFFFF; font-family: "微软雅黑" , "宋体" , "黑体" ,Arial; font-size: 18px; font-weight: bold; height: 25px; line-height: 25px; margin: 18px 0 !important; padding: 8px 0 5px 5px; text-shadow: 2px 2px 3px #222222; } 回到顶部 博客侧边栏 回到顶部 页首代码 回到顶部 页脚代码