用户账户和用户组
Kubernetes 并不会存储由认证插件从客户端请求中提取出的用户及所属组的信息,它们仅仅用于检验用户是否有权限执行其所请求的操作。客户端访问API服务的途径通常有三种:kubectl、客户端库或者直接使用 REST接口进行请求。而可以执行此类请求的主体也被 Kubernetes 分为两类:现实中的“人”和 Pod 对象, 它们的用户身份分别对应于常规用户 (User Account )和服务账号 ( Service Account) 。Use Account(用户账号):一般是指由独立于Kubernetes之外的其他服务管理的用 户账号,例如由管理员分发的密钥、Keystone一类的用户存储(账号库)、甚至是包 含有用户名和密码列表的文件等。Kubernetes中不存在表示此类用户账号的对象, 因此不能被直接添加进 Kubernetes 系统中 。Service Account(服务账号):是指由Kubernetes API 管理的账号,用于为Pod 之中的服务进程在访问Kubernetes API时提供身份标识( identity ) 。Service Account通常要绑定于特定的命名空间,它们由 API Server 创建,或者通过 API 调用于动创建 ,附带着一组存储为Secret的用于访问API Server的凭据。
Kubernetes 有着以下几个内建的用于特殊目的的组 。system:unauthenticated :未能通过任何一个授权插件检验的账号,即未通过认证测 试的用户所属的组 。system :authenticated :认证成功后的用户自动加入的一个组,用于快捷引用所有正常通过认证的用户账号。system : serviceaccounts :当前系统上的所有 Service Account 对象。system :serviceaccounts :<namespace>:特定命名空间内所有的 Service Account 对象。
下面我们来创建一个User Account,测试访问某些我们授权的资源:
创建k8s User Account
一、创建证书
- 创建user私钥
root@k8s-master:/etc/kubernetes/pki# (umask 077;openssl genrsa -out cbmljs.key 2048)
Generating RSA private key, 2048 bit long modulus
.......................+++
...........................................+++
e is 65537 (0x10001)
root@k8s-master:/etc/kubernetes/pki#
- 创建证书签署请求
O=组织信息,CN=用户名
root@k8s-master:/etc/kubernetes/pki# openssl req -new -key cbmljs.key -out cbmljs.csr -subj "/O=k8s/CN=cbmljs"
root@k8s-master:/etc/kubernetes/pki#
签署证书
root@k8s-master:/etc/kubernetes/pki# openssl x509 -req -in cbmljs.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out cbmljs.crt -days 365
Signature ok
subject=/O=k8s/CN=cbmljs
Getting CA Private Key
root@k8s-master:/etc/kubernetes/pki#
二、创建配置文件
创建配置文件主要有以下几个步骤:
kubectl config set-cluster --kubeconfig=/PATH/TO/SOMEFILE #集群配置
kubectl config set-credentials NAME --kubeconfig=/PATH/TO/SOMEFILE #用户配置
kubectl config set-context #context配置
kubectl config use-context #切换context
* --embed-certs=true的作用是不在配置文件中显示证书信息。
* --kubeconfig=/root/cbmljs.conf用于创建新的配置文件,如果不加此选项,则内容会添加到家目录下.kube/config文件中,可以使用use-context来切换不同的用户管理k8s集群。
* context简单的理解就是用什么用户来管理哪个集群,即用户和集群的结合。
创建集群配置
root@k8s-master:/etc/kubernetes/pki# kubectl config set-cluster k8s --server=https://192.168.253.136:6443 --certificate-authority=ca.crt --embed-certs=true --kubeconfig=/root/cbmljs.conf
Cluster "k8s" set.
root@k8s-master:/etc/kubernetes/pki# kubectl config view --kubeconfig=/root/cbmljs.conf
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://192.168.253.136:6443
name: k8s
contexts: []
current-context: ""
kind: Config
preferences: {}
users: []
root@k8s-master:/etc/kubernetes/pki#
创建用户配置
root@k8s-master:/etc/kubernetes/pki# kubectl config set-credentials cbmljs --client-certificate=cbmljs.crt --client-key=cbmljs.key --embed-certs=true --kubeconfig=/root/cbmljs.conf
User "cbmljs" set.
root@k8s-master:/etc/kubernetes/pki# kubectl config view --kubeconfig=/root/cbmljs.conf
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://192.168.253.136:6443
name: k8s
contexts: []
current-context: ""
kind: Config
preferences: {}
users:
- name: cbmljs
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
root@k8s-master:/etc/kubernetes/pki#
创建context配置
root@k8s-master:/etc/kubernetes/pki# kubectl config set-context cbmljs@k8s --cluster=k8s --user=cbmljs --kubeconfig=/root/cbmljs.conf
Context "cbmljs@k8s" created.
root@k8s-master:/etc/kubernetes/pki# kubectl config view --kubeconfig=/root/cbmljs.conf
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://192.168.253.136:6443
name: k8s
contexts:
- context:
cluster: k8s
user: cbmljs
name: cbmljs@k8s
current-context: ""
kind: Config
preferences: {}
users:
- name: cbmljs
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
root@k8s-master:/etc/kubernetes/pki#
切换context
root@k8s-master:/etc/kubernetes/pki# kubectl config use-context cbmljs@k8s --kubeconfig=/root/cbmljs.conf
Switched to context "cbmljs@k8s".
root@k8s-master:/etc/kubernetes/pki# kubectl config view --kubeconfig=/root/cbmljs.conf
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://192.168.253.136:6443
name: k8s
contexts:
- context:
cluster: k8s
user: cbmljs
name: cbmljs@k8s
current-context: cbmljs@k8s
kind: Config
preferences: {}
users:
- name: cbmljs
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
root@k8s-master:/etc/kubernetes/pki#
创建系统用户
root@k8s-master:~# mkdir -p /home/cbmljs/.kube
root@k8s-master:~# cp cbmljs.conf /home/cbmljs/.kube/config
root@k8s-master:~# chown cbmljs.cbmljs -R /home/cbmljs/
root@k8s-master:~# su - cbmljs
k8s验证文件
cbmljs@k8s-master:~$ kubectl get pod
Error from server (Forbidden): pods is forbidden: User "cbmljs" cannot list resource "pods" in API group "" in the namespace "default"
cbmljs@k8s-master:~$
#默认新用户是没有任何权限的。
创建Role
此role只有pod的get、list、watch权限
root@k8s-master:~# cat pods-reader.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: pods-reader
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
root@k8s-master:~#
创建Rolebinding
用户cbmljs和role pods-reader的绑定
root@k8s-master:~# cat cbmljs-pods-reader.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: cbmljs-pods-reader
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: pods-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: cbmljs
root@k8s-master:~#
验证结果
如果没有指定命名空间的话,默认就是default命名空间。
cbmljs@k8s-master:~$ kubectl get pod
NAME READY STATUS RESTARTS AGE
callous-poodle-mychart-66d44dfd76-8xp27 2/2 Running 2 23h
flaskapp-v1-b5c74d74c-js2rt 2/2 Running 0 47h
flaskapp-v2-687794745-8664j 2/2 Running 0 47h
musty-scorpion-mysql-5f45d5647-dhbnj 0/2 Pending 0 23h
sleep-v1-5b99774dcf-ccjzp 2/2 Running 2 2d22h
sleep-v2-b88548576-zgmc2 2/2 Running 1 2d22h
cbmljs@k8s-master:~$
cbmljs@k8s-master:~$ kubectl get pod -n kube-system
Error from server (Forbidden): pods is forbidden: User "cbmljs" cannot list resource "pods" in API group "" in the namespace "kube-system"
cbmljs@k8s-master:~$
所以我们是可以查看查看default命名空间的pod,但是其他空间的pod是无法查看的。
创建ClusterRole
root@k8s-master:~# cat cluster-reader.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cluster-reader
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
root@k8s-master:~#
创建ClusterRoleBinding
root@k8s-master:~# cat cbmljs-read-all-pod.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: billy-read-all-pods
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: cbmljs
root@k8s-master:~#
验证结果
创建了ClusterRole和ClusterRoleBinding后就可以看到所有命名空间的pod了。
cbmljs@k8s-master:~$ kubectl get pod
NAME READY STATUS RESTARTS AGE
callous-poodle-mychart-66d44dfd76-8xp27 2/2 Running 2 23h
flaskapp-v1-b5c74d74c-js2rt 2/2 Running 0 47h
flaskapp-v2-687794745-8664j 2/2 Running 0 47h
musty-scorpion-mysql-5f45d5647-dhbnj 0/2 Pending 0 24h
sleep-v1-5b99774dcf-ccjzp 2/2 Running 2 2d22h
sleep-v2-b88548576-zgmc2 2/2 Running 1 2d22h
cbmljs@k8s-master:~$ kubectl get pod -n kube-system
NAME READY STATUS RESTARTS AGE
coredns-5644d7b6d9-chmhn 1/1 Running 7 6d22h
coredns-5644d7b6d9-qxd4h 1/1 Running 7 6d22h
etcd-k8s-master 1/1 Running 3 6d22h
kube-apiserver-k8s-master 1/1 Running 11 6d22h
kube-controller-manager-k8s-master 1/1 Running 20 6d22h
kube-flannel-ds-amd64-l9g62 1/1 Running 0 6d22h
kube-flannel-ds-amd64-nxtr9 1/1 Running 1 6d22h
kube-proxy-p8k57 1/1 Running 0 6d22h
kube-proxy-s4n7b 1/1 Running 1 6d22h
kube-scheduler-k8s-master 1/1 Running 21 6d22h
tiller-deploy-684c9f98f5-6ld5z 1/1 Running 14 3d3h
cbmljs@k8s-master:~$
参考: