概述
一般情况，生产kubernetes集群系统按运维职责划分多个命名空间并配置多个维护账户，kubernetes对 这些安全需求场景都有很好支持 。
实现步骤
因为是HA方案三个master节点kubernetes集群，在哪一个master节点执行步骤命令都可以。
- 1、切到linux系统root账户，创建learn账户，并设置密码
useradd learn
passwd learn
learn1234
- 2、创建k8s集群普通账号learn相关证书
mkdir -p /root/kubeadm/rbac
openssl genrsa -out learn.key 2048
openssl req -new -key learn.key -out learn.csr -subj "/CN=learn/O=learn"
openssl x509 -req -in learn.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out learn.crt -days 3650
- 3、创建k8s集群普通账号learn的context
kubectl config set-context learn-context --cluster=kubernetes --namespace=default --user=learn
# 验证k8s集群context， 包含：kubernetes-admin@kubernetes（集群安装时自动创建）和learn- context
kubectl config get-contexts
# 切换到新账号learn创建的k8s集群context
kubectl config use-context learn-context
# 验证context
kubectl config current-context
# k8s集群普通账号learn证书添加到k8s集群
kubectl config set-credentials learn --client-certificate=learn.crt --client-key=learn.key
# 实操提示：删除context命令：
kubectl config delete-context learn-context
# 验证命令会输出k8s资源没有授权的错误日志
kubectl get pods --context=learn-context
- 4、切回root账户，通过yaml文件创建角色和角色绑定
k8s集群支持授权资源类型较多，生产环境根据运维职责需求分配资源角色权限
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: default
name: learn-reader
rules:
- apiGroups: ["","apps","extensions"]
resources: ["pods", "pods/log", "deployments"]
verbs: ["get", "watch", "list"]
实操提示：
apiGroups为k8s集群API版本号，如：apps/v1 和 extensions/v1beta1 ;
resources 授权资源 ;
verbs 操作事件，查看(create)、修改(edit)、删除(delete)等。
角色权限绑定
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: learn-role-binding
namespace: default
subjects:
- kind: User
name: learn
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: learn-reader
apiGroup: rbac.authorization.k8s.io
创建集群角色
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: cluster-reader
rules:
- apiGroups: [""]
resources: ["nodes"]
verbs: ["get", "watch", "list"]
集群角色权限绑定
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: learn-ClusterRoleBinding
subjects:
- kind: Group
name: learn
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: cluster-reader
apiGroup: rbac.authorization.k8s.io
切换到k8s集群超级管理员context，并执行创建角色绑定
kubectl config use-context kubernetes-admin@kubernetes
kubectl config current-context
kubectl create -f learn-role.yaml kubectl create -f learn-role-binding.yaml
kubectl create -f learn-cluster-reader.yaml kubectl create -f learn-ClusterRoleBinding.yaml
- 5、将linux系统root账号
HOME/.kube下
cp $HOME/.kube/config /home/learn/.kube/
chown -R learn:learn /home/learn/
cp /root/kubeadm/rbac/learn.crt /home/learn/
cp /root/kubeadm/rbac/learn.key /home/learn/
chown -R learn:learn /home/learn/
# 修改config文件，将learn.crt和learn.key文件地址改为/home/learn/目录下
vi /home/learn/.kube/config
- 6、在linux的root账号下，切换到新创建learn账号，验证授权正确
如果授权正确，切到learn账号后，执行下面kubectl命令输出内容正确（实操提示：learn账号有权限的 资源类型输出均正确，无权限的资源会提示无权限）
kubectl config use-context learn-context
kubectl config current-context
kubectl get po -o wide
kubectl get deploy -o wide
kubectl get no -o wide
kubectl get ns -o wide
- 7、在linux的root账号下，验证完成后，可切回k8s集群管理员账号查看集群信息
kubectl config use-context kubernetes-admin@kubernetes
- 8、在linux的root账号下，变更授权，验证权限
# 新增/删除权限
kubectl edit role learn-role
