Kubernetes之RBAC角色訪問控制

原創 PassZhang 2021-05-23 12:58

Kubernetes之RBAC角色訪問控制

RBAC

在k8s上我們如何控制訪問權限呢，答案就是Role-based access control (RBAC) - 基於角色（Role）的訪問控制，（RBAC）是一種基於組織中用戶的角色來調節控制對 計算機或網絡資源的訪問的方法。

在早期的K8s版本，RBAC還未出現的時候，整個K8s的安全是較爲薄弱的，有了RBAC後，我們可以對K8s集羣的訪問人員作非常明細化的控制，控制他們能訪問什麼資源，以只讀還是可以讀寫的形式來訪問，目前RBAC是K8s默認的安全授權標準，所以我們非常有必要來掌握RBAC的使用，這樣纔有更有力的保障我們的K8s集羣的安全使用，下面我們將以生產中的實際使用來大家瞭解及掌握RBAC的生產應用。

RBAC裏面的幾種資源關係圖，下面將用下面的資源來演示生產中經典的RBAC應用

                  |--- Role --- RoleBinding                只在指定namespace中生效
ServiceAccount ---|
                  |--- ClusterRole --- ClusterRoleBinding  不受namespace限制，在整個K8s集羣中生效

在我看來，RBAC在K8s上的用途主要分爲兩大類：

第一類是保證在K8s上運行的pod服務具有相應的集羣權限，如gitlab的CI/CD，它需要能訪問除自身以外其他pod，比如gitlab-runner的pod的權限，再比如gitlab-runner的pod需要擁有創建新的臨時pod的權限，用以來構建CI/CD自動化流水線，這裏大家沒用過不懂沒關係，先簡單瞭解下就可以了，在本課程後面基於K8s及gitlab的生產實戰CI/CD內容會給大家作詳細實戰講解；

第二類是創建能訪問K8s相應資源、擁有對應權限的kube-config配置給到使用K8s的人員，來作爲連接K8s的授權憑證

獲取K8s上運行的pod服務具有相應的集羣權限

第一類的實戰這裏先暫時以早期的helm2來作下講解，helm是一個快捷安裝K8s各類資源的管理工具，通過之前給大家講解的，一個較爲完整的服務可能會存在deployment，service，configmap，secret，ingress等資源來組合使用，大家在用的過程中可能會覺得配置使用較爲麻煩，這時候helm就出現了，它把這些資源都打包封裝成它自己能識別的內容，我們在安裝一個服務的時候，就只需要作下簡單的配置，一條命令即可完成上述衆多資源的配置安裝，titller相當於helm的服務端，它是需要有權限在K8s中創建各類資源的，在初始安裝使用時，如果沒有配置RBAC權限，我們會看到如下報錯：

root@node1:~# helm install stable/mysql
Error: no available release name found

這時，我們可以來快速解決這個問題，創建sa關聯K8s自帶的最高權限的ClusterRole（生產中建議不要這樣做，權限太高有安全隱患，這個就和linux的root管理帳號一樣，一般都是建議通過sudo來控制帳號權限）

kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'

創建能訪問K8s相應資源、擁有對應權限的kube-config配置給到使用K8s的人員，來作爲連接K8s的授權憑證

第二類，我這裏就直接以我在生產中實施的完整腳本來做講解及實戰，相信會給大家帶來一個全新的學習感受，並能很快掌握它們：

創建對指定namespace有所有權限的kube-config

#!/bin/bash
#
# This Script based on  https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html
# K8s'RBAC doc:         https://kubernetes.io/docs/reference/access-authn-authz/rbac
# Gitlab'CI/CD doc:     hhttps://docs.gitlab.com/ee/user/permissions.html#running-pipelines-on-protected-branches
#
# In honor of the remarkable Windson

BASEDIR="$(dirname "$0")"
folder="$BASEDIR/kube_config"

echo -e "All namespaces is here: \n$(kubectl get ns|awk 'NR!=1{print $1}')"
echo "endpoint server if local network you can use $(kubectl cluster-info |awk '/Kubernetes/{print $NF}')"

namespace=$1
endpoint=$(echo "$2" | sed -e 's,https\?://,,g')

if [[ -z "$endpoint" || -z "$namespace" ]]; then
    echo "Use "$(basename "$0")" NAMESPACE ENDPOINT";
    exit 1;
fi

if ! kubectl get ns|awk 'NR!=1{print $1}'|grep -w "$namespace";then kubectl create ns "$namespace";else echo "namespace: $namespace was exist." ;fi

echo "---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: $namespace-user
  namespace: $namespace
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: $namespace-user-full-access
  namespace: $namespace
rules:
- apiGroups: ['', 'extensions', 'apps', 'metrics.k8s.io']
  resources: ['*']
  verbs: ['*']
- apiGroups: ['batch']
  resources:
  - jobs
  - cronjobs
  verbs: ['*']
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: $namespace-user-view
  namespace: $namespace
subjects:
- kind: ServiceAccount
  name: $namespace-user
  namespace: $namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: $namespace-user-full-access
---
# https://kubernetes.io/zh/docs/concepts/policy/resource-quotas/
apiVersion: v1
kind: ResourceQuota
metadata:
  name: $namespace-compute-resources
  namespace: $namespace
spec:
  hard:
    pods: "10"
    services: "10"
    persistentvolumeclaims: "5"
    requests.cpu: "1"
    requests.memory: 2Gi
    limits.cpu: "2"
    limits.memory: 4Gi" | kubectl apply -f -
kubectl -n $namespace describe quota $namespace-compute-resources
mkdir -p $folder
tokenName=$(kubectl get sa $namespace-user -n $namespace -o "jsonpath={.secrets[0].name}")
token=$(kubectl get secret $tokenName -n $namespace -o "jsonpath={.data.token}" | base64 --decode)
certificate=$(kubectl get secret $tokenName -n $namespace -o "jsonpath={.data['ca\.crt']}")

echo "apiVersion: v1
kind: Config
preferences: {}
clusters:
- cluster:
    certificate-authority-data: $certificate
    server: https://$endpoint
  name: $namespace-cluster
users:
- name: $namespace-user
  user:
    as-user-extra: {}
    client-key-data: $certificate
    token: $token
contexts:
- context:
    cluster: $namespace-cluster
    namespace: $namespace
    user: $namespace-user
  name: $namespace
current-context: $namespace" > $folder/$namespace.kube.conf

創建對指定namespace有所有權限的kube-config（在已有的namespace中創建）

#!/bin/bash


BASEDIR="$(dirname "$0")"
folder="$BASEDIR/kube_config"

echo -e "All namespaces is here: \n$(kubectl get ns|awk 'NR!=1{print $1}')"
echo "endpoint server if local network you can use $(kubectl cluster-info |awk '/Kubernetes/{print $NF}')"

namespace=$1
endpoint=$(echo "$2" | sed -e 's,https\?://,,g')

if [[ -z "$endpoint" || -z "$namespace" ]]; then
    echo "Use "$(basename "$0")" NAMESPACE ENDPOINT";
    exit 1;
fi


echo "---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: $namespace-user
  namespace: $namespace
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: $namespace-user-full-access
  namespace: $namespace
rules:
- apiGroups: ['', 'extensions', 'apps', 'metrics.k8s.io']
  resources: ['*']
  verbs: ['*']
- apiGroups: ['batch']
  resources:
  - jobs
  - cronjobs
  verbs: ['*']
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: $namespace-user-view
  namespace: $namespace
subjects:
- kind: ServiceAccount
  name: $namespace-user
  namespace: $namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: $namespace-user-full-access" | kubectl apply -f -

mkdir -p $folder
tokenName=$(kubectl get sa $namespace-user -n $namespace -o "jsonpath={.secrets[0].name}")
token=$(kubectl get secret $tokenName -n $namespace -o "jsonpath={.data.token}" | base64 --decode)
certificate=$(kubectl get secret $tokenName -n $namespace -o "jsonpath={.data['ca\.crt']}")

echo "apiVersion: v1
kind: Config
preferences: {}
clusters:
- cluster:
    certificate-authority-data: $certificate
    server: https://$endpoint
  name: $namespace-cluster
users:
- name: $namespace-user
  user:
    as-user-extra: {}
    client-key-data: $certificate
    token: $token
contexts:
- context:
    cluster: $namespace-cluster
    namespace: $namespace
    user: $namespace-user
  name: $namespace
current-context: $namespace" > $folder/$namespace.kube.conf

同上，創建只讀權限的

#!/bin/bash


BASEDIR="$(dirname "$0")"
folder="$BASEDIR/kube_config"

echo -e "All namespaces is here: \n$(kubectl get ns|awk 'NR!=1{print $1}')"
echo "endpoint server if local network you can use $(kubectl cluster-info |awk '/Kubernetes/{print $NF}')"

namespace=$1
endpoint=$(echo "$2" | sed -e 's,https\?://,,g')

if [[ -z "$endpoint" || -z "$namespace" ]]; then
    echo "Use "$(basename "$0")" NAMESPACE ENDPOINT";
    exit 1;
fi


echo "---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: $namespace-user-readonly
  namespace: $namespace
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: $namespace-user-readonly-access
  namespace: $namespace
rules:
- apiGroups: ['', 'extensions', 'apps', 'metrics.k8s.io']
  resources: ['pods', 'pods/log']
  verbs: ['get', 'list', 'watch']
- apiGroups: ['batch']
  resources: ['jobs', 'cronjobs']
  verbs: ['get', 'list', 'watch']
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: $namespace-user-view-readonly
  namespace: $namespace
subjects:
- kind: ServiceAccount
  name: $namespace-user-readonly
  namespace: $namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: $namespace-user-readonly-access" | kubectl apply -f -

mkdir -p $folder
tokenName=$(kubectl get sa $namespace-user-readonly -n $namespace -o "jsonpath={.secrets[0].name}")
token=$(kubectl get secret $tokenName -n $namespace -o "jsonpath={.data.token}" | base64 --decode)
certificate=$(kubectl get secret $tokenName -n $namespace -o "jsonpath={.data['ca\.crt']}")

echo "apiVersion: v1
kind: Config
preferences: {}
clusters:
- cluster:
    certificate-authority-data: $certificate
    server: https://$endpoint
  name: $namespace-cluster-readonly
users:
- name: $namespace-user-readonly
  user:
    as-user-extra: {}
    client-key-data: $certificate
    token: $token
contexts:
- context:
    cluster: $namespace-cluster-readonly
    namespace: $namespace
    user: $namespace-user-readonly
  name: $namespace
current-context: $namespace" > $folder/$namespace-readonly.kube.conf

最後，來一個多個集羣配置融合的創建，這個在多集羣管理方面非常有用，這裏只以創建只讀權限配置作爲演示

#!/bin/bash
# describe: create k8s cluster all namespaces resources with readonly clusterrole, no exec 、delete ...

# look system default to study:
# kubectl describe clusterrole view

# restore all change:
#kubectl -n kube-system delete sa all-readonly-${clustername}
#kubectl delete clusterrolebinding all-readonly-${clustername}
#kubectl delete clusterrole all-readonly-${clustername}


clustername=$1

Help(){
    echo "Use "$(basename "$0")" ClusterName(example: k8s1|k8s2|k8s3|delk8s1|delk8s2|delk8s3|3in1)";
    exit 1;
}

if [[ -z "${clustername}" ]]; then
    Help
fi

case ${clustername} in
    k8s1)
    endpoint="https://x.x.x.x:123456"
    ;;
    k8s2)
    endpoint="https://x.x.x.x:123456"
    ;;
    k8s3)
    endpoint="https://x.x.x.x:123456"
    ;;
    delk8s1)
    kubectl -n kube-system delete sa all-readonly-k8s1
    kubectl delete clusterrolebinding all-readonly-k8s1
    kubectl delete clusterrole all-readonly-k8s1
    echo "${clustername} successful."
    exit 0
    ;;
    delk8s2)
    kubectl -n kube-system delete sa all-readonly-k8s2
    kubectl delete clusterrolebinding all-readonly-k8s2
    kubectl delete clusterrole all-readonly-k8s2
    echo "${clustername} successful."
    exit 0
    ;;
    delk8s3)
    kubectl -n kube-system delete sa all-readonly-k8s3
    kubectl delete clusterrolebinding all-readonly-k8s3
    kubectl delete clusterrole all-readonly-k8s3
    echo "${clustername} successful."
    exit 0
    ;;
    3in1)
    KUBECONFIG=./all-readonly-k8s1.conf:all-readonly-k8s2.conf:all-readonly-k8s3.conf kubectl config view --flatten > ./all-readonly-3in1.conf
    kubectl --kubeconfig=./all-readonly-3in1.conf config use-context "k8s3"
    kubectl --kubeconfig=./all-readonly-3in1.conf config set-context "k8s3" --namespace="default"
    kubectl --kubeconfig=./all-readonly-3in1.conf config get-contexts
    echo -e "\n\n\n"
    cat ./all-readonly-3in1.conf |base64 -w 0
    exit 0
    ;;
    *)
    Help
esac

echo "---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: all-readonly-${clustername}
rules:
- apiGroups:
  - ''
  resources:   #這裏寫到權限針對的對象都有哪些？
  - configmaps
  - endpoints
  - persistentvolumes
  - persistentvolumeclaims
  - pods
  - replicationcontrollers
  - replicationcontrollers/scale
  - serviceaccounts
  - services
  - nodes
  verbs:   #這裏寫到只使用的只讀權限，還可以添加其他例如"create/delete"等權限
  - get
  - list
  - watch
- apiGroups:
  - ''
  resources:
  - bindings
  - events
  - limitranges
  - namespaces/status
  - pods/log
  - pods/status
  - replicationcontrollers/status
  - resourcequotas
  - resourcequotas/status
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ''
  resources:
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - controllerrevisions
  - daemonsets
  - deployments
  - deployments/scale
  - replicasets
  - replicasets/scale
  - statefulsets
  - statefulsets/scale
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - autoscaling
  resources:
  - horizontalpodautoscalers
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - batch
  resources:
  - cronjobs
  - jobs
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  resources:
  - daemonsets
  - deployments
  - deployments/scale
  - ingresses
  - networkpolicies
  - replicasets
  - replicasets/scale
  - replicationcontrollers/scale
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - networkpolicies
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - metrics.k8s.io
  resources:
  - pods
  verbs:
  - get
  - list
  - watch" | kubectl apply -f -

kubectl -n kube-system create sa all-readonly-${clustername}
kubectl create clusterrolebinding all-readonly-${clustername} --clusterrole=all-readonly-${clustername} --serviceaccount=kube-system:all-readonly-${clustername}

tokenName=$(kubectl -n kube-system get sa all-readonly-${clustername} -o "jsonpath={.secrets[0].name}")
token=$(kubectl -n kube-system get secret $tokenName -o "jsonpath={.data.token}" | base64 --decode)
certificate=$(kubectl -n kube-system get secret $tokenName -o "jsonpath={.data['ca\.crt']}")

echo "apiVersion: v1
kind: Config
preferences: {}
clusters:
- cluster:
    certificate-authority-data: $certificate
    server: $endpoint
  name: all-readonly-${clustername}-cluster
users:
- name: all-readonly-${clustername}
  user:
    as-user-extra: {}
    client-key-data: $certificate
    token: $token
contexts:
- context:
    cluster: all-readonly-${clustername}-cluster
    user: all-readonly-${clustername}
  name: ${clustername}
current-context: ${clustername}" > ./all-readonly-${clustername}.conf

上面寫到的均是Shell 腳本彙總的，如果想用哪個角色綁定的權限直接把Shell腳本搬下來執行就可以了。

發表評論
所有評論
還沒有人評論，想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章

HTML 00 Tutorial

  HTML stands for HyperText Markup Language, it is a Standard Markup language for web pages. HTML is used to create cont

emanlee 2024-05-14 14:15:45

HTML 02 - Editors

HTML - Editors To learn HTML we will recommend you to use a text editor like Notepad, because a Notepad will help you to

emanlee 2024-05-14 14:15:45

HTML 01 - Introduction

please install  Visual Studio Code https://code.visualstudio.com/download      HTML - Introduction HTML is a HyperText

emanlee 2024-05-14 14:15:45

HTML 03 - Basic Tags

HTML - Basic Tags   HTML tags are the fundamental elements of HTML used for defining the structure of the document. Thes

emanlee 2024-05-14 14:15:45

HTML 04 - Elements

HTML Elements are building block of a web page. It is used to create component for webpages. HTML documents consist of a

emanlee 2024-05-14 14:15:45

HTML tutorials

HTML 00 tutorials HTML 01 - Introduction HTML 02 - Editors HTML 03 - Basic Tags HTML 04 - Elements HTML 05 - Attributes

emanlee 2024-05-14 14:15:45

HTML 07 - Headings

HTML headings are used to define the hierarchy (levels) and structure of content on a web page. They create a visual hie

emanlee 2024-05-14 14:15:45

HTML 06 - Formatting

  If you use a word processor, you must be familiar with the ability to make text bold, italicized, or underlined; these

emanlee 2024-05-14 14:15:45

HTML 05 - Attributes

HTML 05 - Attributes We have seen few HTML tags and their usage like heading tags <h1>, <h2>, paragraph tag <p> and othe

emanlee 2024-05-14 14:15:45

HTML 08 - Paragraphs

  HTML Paragraphs are a block-level elements, used to structure and format text content on a webpage. A paragraph is bas

emanlee 2024-05-14 14:15:45

使用 Python 旋轉PDF頁面、或調整PDF頁面順序

在將紙質文檔掃描成PDF電子文檔時，有時可能會出現頁面方向翻轉或者頁面順序混亂的情況。爲了確保更好地瀏覽和查看PDF文件，本文將分享一個使用Python來旋轉PDF頁面或者調整PDF頁面順序的解決方案。 要實現Python對PDF頁面進行設

E-iceblue 2024-05-14 14:15:15

Vue3學習（二十四）- 文檔頁面功能開發

寫在前面 這部分真的感覺超級難，其實也不能說難，主要是真的想不到這個思路應該這麼做，或者說他好厲害，他怎麼知道該這麼設計實現。 說下難點吧，我覺得後天邏輯還好，主要是前端部分真的需要點花點時間來思考，比如佈局、交互設計的實現等等。 文檔頁

久曲健 2024-05-14 14:11:15

HarmonyOS 使用關係型數據庫進行增刪改查

HarmonyOS 中的關係型數據庫基於 SQLite 組件，提供了一套完整的對本地數據庫進行管理的機制。它支持事務、索引、視圖、觸發器、外鍵、參數化查詢和預編譯 SQL 語句等特性。關係型數據庫適用於存儲包含複雜關係數據的場景，例如學生信

西北野狼 2024-05-14 14:09:44

java常用異步說明

簡介 異步編程是一種編程範式，允許在等待某些操作（如IO操作）完成的過程中，暫停當前線程的執行，讓出控制權，從而允許其他操作或線程併發執行。在Java中，有多種實現異步編程的方式，包括使用Future和Callable接口、Completa

楚景然 2024-05-14 14:03:23

CSharp: SunCalc for calculating

  using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.Threading.Tasks; n

®Geovin Du Dream Park™ 2024-05-14 14:02:53