认证与授权 #

API请求安全流程
    │
    ├── 1. 认证 (Authentication)
    │       └── 验证用户身份
    │
    ├── 2. 授权 (Authorization)
    │       └── 检查操作权限
    │
    ├── 3. 准入控制 (Admission Control)
    │       └── 验证和修改请求
    │
    └── 4. 执行操作

认证方式
    │
    ├── 证书认证
    │   └── X.509客户端证书
    │
    ├── Token认证
    │   ├── 静态Token
    │   ├── Bootstrap Token
    │   └── OIDC Token
    │
    ├── Webhook认证
    │   └── 外部认证服务
    │
    └── 匿名认证
        └── 未认证请求

# 创建用户证书
openssl genrsa -out user.key 2048
openssl req -new -key user.key -out user.csr -subj "/CN=admin/O=system:masters"
openssl x509 -req -in user.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out user.crt -days 365

# 配置kubeconfig
kubectl config set-credentials admin --client-certificate=user.crt --client-key=user.key
kubectl config set-context admin-context --cluster=kubernetes --user=admin
kubectl config use-context admin-context

# 静态Token文件
apiVersion: v1
kind: Secret
metadata:
  name: admin-token
  namespace: kube-system
type: Opaque
data:
  token: YWRtaW4tdG9rZW4=

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
  namespace: default

# 创建ServiceAccount
kubectl create serviceaccount my-sa

# 查看ServiceAccount
kubectl get sa

# 查看ServiceAccount Token
kubectl describe sa my-sa

apiVersion: v1
kind: Pod
metadata:
  name: sa-pod
spec:
  serviceAccountName: my-sa
  containers:
  - name: app
    image: nginx

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-sa
automountServiceAccountToken: false

RBAC组件
    │
    ├── Role
    │   └── 命名空间级别角色
    │
    ├── ClusterRole
    │   └── 集群级别角色
    │
    ├── RoleBinding
    │   └── 命名空间角色绑定
    │
    └── ClusterRoleBinding
        └── 集群角色绑定

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: default
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get"]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-reader
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "watch"]

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
  name: my-sa
  namespace: default
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-nodes
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: node-reader
  apiGroup: rbac.authorization.k8s.io

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: readonly
rules:
- apiGroups: [""]
  resources: ["pods", "services", "configmaps", "secrets"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources: ["deployments", "statefulsets", "daemonsets"]
  verbs: ["get", "list", "watch"]

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: developer
rules:
- apiGroups: [""]
  resources: ["pods", "services", "configmaps", "secrets"]
  verbs: ["get", "list", "watch", "create", "update", "delete"]
- apiGroups: ["apps"]
  resources: ["deployments", "statefulsets", "daemonsets"]
  verbs: ["get", "list", "watch", "create", "update", "delete"]
- apiGroups: ["batch"]
  resources: ["jobs", "cronjobs"]
  verbs: ["get", "list", "watch", "create", "update", "delete"]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-admin
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]

# 查看Role
kubectl get roles -n <namespace>

# 查看ClusterRole
kubectl get clusterroles

# 查看RoleBinding
kubectl get rolebindings -n <namespace>

# 查看ClusterRoleBinding
kubectl get clusterrolebindings

# 检查用户权限
kubectl auth can-i list pods --as jane

# 检查ServiceAccount权限
kubectl auth can-i list pods --as=system:serviceaccount:default:my-sa

# 检查特定命名空间权限
kubectl auth can-i list pods --as jane -n development

# 只授予必要的权限
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list"]

# 不同命名空间使用不同Role
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: dev-access
  namespace: development
subjects:
- kind: User
  name: developer
roleRef:
  kind: Role
  name: developer

# 查看所有绑定
kubectl get rolebindings,clusterrolebindings -A

# 查看用户权限
kubectl auth can-i --list --as jane