Kubernetes自定义权限 - 云原生基站

1 创建账号#

1.1 创建私钥,一定要用 root 用户#

(umask 077; openssl genrsa -out test.key 2048)

1.2 基于私钥生成证书,由 k8s 集群的 ca.crt 签署#

CN 为账号名称，OU 为组

openssl req -new -key test.key -out test.csr -subj "/CN=test"

ca.crt 与 ca.key 是 k8s 的秘钥

openssl x509 -req -in test.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out test.crt -days 365

1.3 查看证书#

openssl x509 -in test.csr -text -noout

1.4 k8s 创建用户,并使用证书认证#

kubectl config set-credentials test --client-certificate=test.crt --client-key=test.key --embed-certs=true

1.5 查看集群#

kubectl config get-contexts

1.6 设置上下文,用户访问哪个集群#

kubectl config set-context test@kubernetes --cluster=kubernetes --user=test

1.7 查看配置#

kubectl config view

2 配置权限#

2.1 使用系统角色#

—clusterrole=view 是系统只读权限

kubectl create clusterrolebinding test-rolebinding --clusterrole=view --user=test

2.2 自定义角色#

2.2.1 创建 role#

kubectl create clusterrole test-clusterrole --verb=get,list,watch --resource=pods,deploy,svc --dry-run=client -o yaml > test/clusterrole.yaml

编辑 test/clusterrole.yaml

1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: ClusterRole
3
metadata:
4
  name: rongxin-cluster-role
5
rules:
6
- apiGroups:
7
  - ""
8
  resources:
9
  - pods
10
  - services
11
  - pods/log
12
  verbs:
13
  - get
14
  - list
15
  - watch
16
- apiGroups:
17
  - ""
18
  resources:
19
  - pods/exec
20
  verbs:
21
  - create
22
- apiGroups:
23
  - apps
24
  resources:
25
  - deployments
26
  verbs:
27
  - get
28
  - list
29
  - watch

kubectl apply -f test/clusterrole.yaml

2.2.2 查看 role#

kubectl describe clusterrole test-cluster-role

2.2.3 创建 rolebinding#

我习惯备份下,也可以参考上面命令直接运行

kubectl create rolebinding test-dev-rolebinding --clusterrole=test-cluster-role --user=test --dry-run=client -o yaml > test/test-dev-rolebinding.yaml

kubectl apply -f test/test-dev-rolebinding.yaml

2.2.4 查看 rolebinding#

kubectl get rolebinding -n dev

kubectl describe rolebinding test-dev-rolebinding -n dev

2.3 查看集群#

kubectl config get-contexts

3 导出配置#

1
kubectl config set-context test \
2
--cluster=kubernetes \
3
--user=test \
4
--current-context=test \
5
--kubeconfig=test.config
6

7
kubectl config set-cluster kubernetes \
8
--certificate-authority=/data/server/certs/ca/k8s/master/ca.pem \ #与上面的ca.crt是同一个文件
9
--embed-certs=true \
10
--server=https://10.1.1.1:7443 \
11
--kubeconfig=test.config
12

13
kubectl config set-credentials test \
14
--client-certificate=./test.crt  --client-key=test.key  --embed-certs=true \
15
--kubeconfig=test.config
16

17
vim test.config
18
contexts:
19
- context:
20
    cluster: kubernetes
21
    user: test
22
  name: test@kubernetes
23
current-context: read-ccops # 修改这里,要不然会报 The connection to the server localhost:8080......

3.1 测试 kubeconfig#

1
kubectl get pods --kubeconfig=test.config -n kube-system
2
NAME                                         READY   STATUS    RESTARTS   AGE
3
csi-rbdplugin-5vfrd                          3/3     Running   0          79m
4
kubectl delete pods --kubeconfig=test.config -n kube-system csi-rbdplugin-5vfrd
5
Error from server (Forbidden): pods "csi-rbdplugin-5vfrd" is forbidden: User "test" cannot delete resource "pods" in API group "" in the namespace "kube-system"