kubernetes应用越来越广泛,我们kubernetes集群中也会根据业务来划分不同的命名空间,随之而来的就是安全权限问题,我们不可能把集群管理员账号分配给每一个人,有时候可能需要限制某用户对某些特定命名空间的权限,比如开发和测试人员也可能需要登录集群,了解应用的运行情况,查看pod的日志,甚至是修改某些配置。这时候,我们可以通过创建受限的kubeconfig文件,将该config分发给有需要的人员,让他们能通过kubectl命令实现一些允许的操作
第一步:
clusterrole.dev-log.yaml 用于提供对pod的完全权限和其它资源的查看权限.
[root@VM-0-225-centos ~]# vi clusterrole.dev-log.yaml
添加如下内容:
# 提供基本权限
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: dev-log
rules:
- apiGroups:
- ""
resources:
- pods
- pods/exec
verbs:
- create
- get
- list
- watch
- apiGroups:
- ""
resources:
- pods
verbs:
- delete
- apiGroups:
- ""
resources:
- endpoints
- services
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- bindings
- events
- limitranges
- namespaces/status
- pods/log
- pods/status
- replicationcontrollers/status
- resourcequotas
- resourcequotas/status
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
- deployments
- deployments/rollback
- deployments/scale
- statefulsets
verbs:
- get
- list
- watch
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- get
- list
- watch
- apiGroups:
- batch
resources:
- cronjobs
- jobs
- scheduledjobs
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- daemonsets
- deployments
- ingresses
- replicasets
verbs:
- get
- list
- watch
在default命名空间应用配置文件
[root@VM-0-225-centos ~]# kubectl apply -f clusterrole.dev-log.yaml -n default
clusterrole.rbac.authorization.k8s.io/dev-log created(返回该内容表示创建成功)
[root@VM-0-225-centos ~]# kubectl get ClusterRole -n default #查看创建的ClusterRole
创建ServiceAccount后,会自动创建一个绑定的 secret ,后面在kubeconfig文件中,会用到该secret中的token
[root@VM-0-225-centos ~]# kubectl create serviceaccount dev -n default
serviceaccount/dev created
[root@VM-0-225-centos ~]# kubectl get serviceaccount -n default
NAME SECRETS AGE
default 1 104m
dev 1 8s
对需要的namespace进行授权,以下示例为对app命名空间授权
[root@VM-0-225-centos ~]# kubectl create rolebinding rbd-dev --clusterrole=dev-log --serviceaccount=default:dev --namespace=app ###--namespace添加对应环境的namespace名称
rolebinding.rbac.authorization.k8s.io/rbd-dev created
[root@VM-0-225-centos ~]# kubectl get serviceaccounts dev -o yaml ##查看sa详情
apiVersion: v1
kind: ServiceAccount
metadata:
creationTimestamp: "2020-07-22T15:06:16Z"
name: dev
namespace: default
resourceVersion: "181632561"
selfLink: /api/v1/namespaces/default/serviceaccounts/dev
uid: e441b8b8-cc2c-11ea-8e87-ee191d757651
secrets:
- name: xxxxxx ###对应的secret名称为,下一步要使用
[root@VM-0-225-centos ~]# kubectl get secrets dev-token-62fjx -o yaml
apiVersion: v1
data:
ca.crt: xxxxxxxxxx ###内容同一个集群该内容一致,不需要关注
namespace: ZGVmYXVsdA==
token: xxxxxx ##这个就是token后续配置kubeconfig时需要使用 该token是经过base64处理的,需要进行解码处理
kind: Secret
metadata:
annotations:
kubernetes.io/service-account.name: dev
kubernetes.io/service-account.uid: e441b8b8-cc2c-11ea-8e87-ee191d757651
creationTimestamp: "2020-07-22T15:06:16Z"
name: dev-token-62fjx
namespace: default
resourceVersion: "181632560"
selfLink: /api/v1/namespaces/default/secrets/dev-token-62fjx
uid: e443bb42-cc2c-11ea-8e87-ee191d757651
type: kubernetes.io/service-account-token
[root@VM-0-225-centos ~]# echo xxxx |base64 -d ### XXX代表上一步查询到的token 该token是经过base64处理的,需要进行解码处理
本文系转载,前往查看
如有侵权,请联系 cloudcommunity@tencent.com 删除。
本文系转载,前往查看
如有侵权,请联系 cloudcommunity@tencent.com 删除。