16.kubernetes的RBAC
2024-02-17 04:51:04
role 分为clsterrole和role
我们从普通的role 开始理解起
[root@master ~]# kubectl create role pod-read --verb=get,list,watch --resource=pods --dry-run -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
creationTimestamp: null
name: pod-read
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
[root@master ~]# kubectl create rolebinding song-pod-read --role=pod-read --user=song --dry-run -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
creationTimestamp: null
name: song-pod-read
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: pod-read
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: song
[root@master ~]# kubectl create role pod-read --verb=get,list,watch --resource=pods
role.rbac.authorization.k8s.io/pod-read created
[root@master ~]# kubectl create rolebinding song-pod-read --role=pod-read --user=song
rolebinding.rbac.authorization.k8s.io/song-pod-read created
再次切换我们的song用户，发现他可以再default 命名空间中来查看pod了
[root@master ~]# kubectl config use-context song@kubernetes
Switched to context "song@kubernetes".
[root@master ~]# kubectl get pods
NAME READY STATUS RESTARTS AGE
debian-869994669d-226qq / Running 21d
filebeat-ds-msmst / Running 23d
filebeat-ds-qkpd9 / Running 23d
haproxy-598b6697db-d7h6w / Running 22d
myapp-deploy-7769f49474-c7w49 / Running 21d
myapp-deploy-7769f49474-r6xjr / Running 21d
myapp-deploy-7769f49474-rwhfc / Running 24d
myapp-deploy-7769f49474-vgshx / Running 24d
myapp-deploy-7769f49474-xcf9m / Running 24d
mysqlxx-784fdd7b55-x9czr-69b97d59d4-slspx / Running 21d
pod-demo / Running 19d
pod-sa / Running 37h
redis-85b846ff9c-h7j72 / Running 23d
redis-state- / CrashLoopBackOff 11d
redis-state- / CrashLoopBackOff 10d
tomcat-test-76789745c5-42c5d / Running 30d
tomcat-test-76789745c5-5wzl7 / Running
在全局还是没有权限。
[root@master ~]# kubectl get pod --all-namespaces
Error from server (Forbidden): pods is forbidden: User "song" cannot list resource "pods" in API group "" at the cluster scope
使用clusterrole给用户授予跨命名空间的大权限
[root@master ~]# kubectl config use-context kubernetes-admin@kubernetes
Switched to context "kubernetes-admin@kubernetes".
[root@master ~]# kubectl delete rolebindings.rbac.authorization.k8s.io song-pod-read
rolebinding.rbac.authorization.k8s.io "song-pod-read" deleted
[root@master ~]# kubectl create clusterrole all-pod-read --verb=get,list,watch --resource=pods
clusterrole.rbac.authorization.k8s.io/all-pod-read created
[root@master ~]# kubectl create clusterrolebinding song-all-pod-read --clusterrole=all-pod-read --user=song
clusterrolebinding.rbac.authorization.k8s.io/song-all-pod-read created
[root@master ~]# kubectl config use-context song@kubernetes
Switched to context "song@kubernetes".
[root@master ~]# kubectl get pod --all-namespaces
NAMESPACE NAME READY STATUS RESTARTS AGE
default debian-869994669d-226qq / Running 21d
default filebeat-ds-msmst / Running 23d
default filebeat-ds-qkpd9 / Running 23d
default haproxy-598b6697db-d7h6w / Running 22d
default myapp-deploy-7769f49474-c7w49 / Running 21d
default myapp-deploy-7769f49474-r6xjr / Running 21d
default myapp-deploy-7769f49474-rwhfc / Running 24d
default myapp-deploy-7769f49474-vgshx / Running 24d
default myapp-deploy-7769f49474-xcf9m / Running 24d
default mysqlxx-784fdd7b55-x9czr-69b97d59d4-slspx / Running 21d
default pod-demo / Running 19d
default pod-sa / Running 37h
default redis-85b846ff9c-h7j72 / Running 23d
default redis-state- / CrashLoopBackOff 11d
default redis-state- / CrashLoopBackOff 10d
default tomcat-test-76789745c5-42c5d / Running 30d
default tomcat-test-76789745c5-5wzl7 / Running 21d
ingress-nginx nginx-ingress-controller-797b884cbc-zcqsv / Running 20d
kube-system coredns-86c58d9df4-gs9x7 / Running 32d
kube-system coredns-86c58d9df4-srzb9 / Running 32d
kube-system etcd-master / Running 32d
kube-system kube-apiserver-master / Running 32d
kube-system kube-controller-manager-master / Running 32d
kube-system kube-flannel-ds-amd64-2fkc8 / Running 31d
kube-system kube-flannel-ds-amd64-cmjjg / Running 31d
kube-system kube-flannel-ds-amd64-t4b42 / Running 32d
kube-system kube-proxy-mdmp5 / Running 31d
kube-system kube-proxy-qjvhv / Running 31d
kube-system kube-proxy-rkh97 / Running 32d
kube-system kube-scheduler-master / Running 32d
kube-system kubernetes-dashboard-57df4db6b-fw58v / ImagePullBackOff 18d
一般 clusterRoleBinding 用来绑定clsterRole roleBinding 用来绑定 role
但是 roleBinding可以绑定 clusterRole 但是会造成 权限缩小到此命名空间
[root@master ~]# kubectl delete clusterrolebindings.rbac.authorization.k8s.io song-all-pod-read
clusterrolebinding.rbac.authorization.k8s.io "song-all-pod-read" deleted
[root@master ~]# kubectl create rolebinding song-all-pod-read --clusterrole=all-pod-read --user=song
rolebinding.rbac.authorization.k8s.io/song-all-pod-read created
[root@master ~]# kubectl config use-context song@kubernetes
Switched to context "song@kubernetes".
[root@master ~]# kubectl get pod --all-namespaces
Error from server (Forbidden): pods is forbidden: User "song" cannot list resource "pods" in API group "" at the cluster scope
集群最高权限查看
[root@master ~]# kubectl describe clusterrole admin
Name: admin
Labels: kubernetes.io/bootstrapping=rbac-defaults
Annotations: rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
rolebindings.rbac.authorization.k8s.io [] [] [create delete deletecollection get list patch update watch]
roles.rbac.authorization.k8s.io [] [] [create delete deletecollection get list patch update watch]
configmaps [] [] [create delete deletecollection patch update get list watch]
endpoints [] [] [create delete deletecollection patch update get list watch]
persistentvolumeclaims [] [] [create delete deletecollection patch update get list watch]
pods [] [] [create delete deletecollection patch update get list watch]
replicationcontrollers/scale [] [] [create delete deletecollection patch update get list watch]
replicationcontrollers [] [] [create delete deletecollection patch update get list watch]
services [] [] [create delete deletecollection patch update get list watch]
daemonsets.apps [] [] [create delete deletecollection patch update get list watch]
deployments.apps/scale [] [] [create delete deletecollection patch update get list watch]
deployments.apps [] [] [create delete deletecollection patch update get list watch]
replicasets.apps/scale [] [] [create delete deletecollection patch update get list watch]
replicasets.apps [] [] [create delete deletecollection patch update get list watch]
statefulsets.apps/scale [] [] [create delete deletecollection patch update get list watch]
statefulsets.apps [] [] [create delete deletecollection patch update get list watch]
horizontalpodautoscalers.autoscaling [] [] [create delete deletecollection patch update get list watch]
cronjobs.batch [] [] [create delete deletecollection patch update get list watch]
jobs.batch [] [] [create delete deletecollection patch update get list watch]
daemonsets.extensions [] [] [create delete deletecollection patch update get list watch]
deployments.extensions/scale [] [] [create delete deletecollection patch update get list watch]
deployments.extensions [] [] [create delete deletecollection patch update get list watch]
ingresses.extensions [] [] [create delete deletecollection patch update get list watch]
networkpolicies.extensions [] [] [create delete deletecollection patch update get list watch]
replicasets.extensions/scale [] [] [create delete deletecollection patch update get list watch]
replicasets.extensions [] [] [create delete deletecollection patch update get list watch]
replicationcontrollers.extensions/scale [] [] [create delete deletecollection patch update get list watch]
networkpolicies.networking.k8s.io [] [] [create delete deletecollection patch update get list watch]
poddisruptionbudgets.policy [] [] [create delete deletecollection patch update get list watch]
deployments.apps/rollback [] [] [create delete deletecollection patch update]
deployments.extensions/rollback [] [] [create delete deletecollection patch update]
localsubjectaccessreviews.authorization.k8s.io [] [] [create]
pods/attach [] [] [get list watch create delete deletecollection patch update]
pods/exec [] [] [get list watch create delete deletecollection patch update]
pods/portforward [] [] [get list watch create delete deletecollection patch update]
pods/proxy [] [] [get list watch create delete deletecollection patch update]
secrets [] [] [get list watch create delete deletecollection patch update]
services/proxy [] [] [get list watch create delete deletecollection patch update]
bindings [] [] [get list watch]
events [] [] [get list watch]
limitranges [] [] [get list watch]
namespaces/status [] [] [get list watch]
namespaces [] [] [get list watch]
pods/log [] [] [get list watch]
pods/status [] [] [get list watch]
replicationcontrollers/status [] [] [get list watch]
resourcequotas/status [] [] [get list watch]
resourcequotas [] [] [get list watch]
controllerrevisions.apps [] [] [get list watch]
serviceaccounts [] [] [impersonate create delete deletecollection patch update get list watch]
[root@master ~]# kubectl describe clusterrole cluster-admin
Name: cluster-admin
Labels: kubernetes.io/bootstrapping=rbac-defaults
Annotations: rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
*.* [] [] [*]
[*] [] [*]
最新文章
- C语言dsPIC / PIC24 serial bootloader和C#语言bootloader PC端串口通信程序
- ccc 正态分布
- 淘宝开放平台Session Key有效期
- Struts2 - Check Login Interceptor
- javaWEB邮件测试
- 崩溃信息：Message from debugger: Terminated due to signal 9
- maven 依赖排除
- SPRING IN ACTION 第4版笔记-第五章BUILDING SPRING WEB APPLICATIONS-002-Controller的requestMapping、model
- IOS 创建App的最佳捷径
- 一个Java项目的学习
- 10步完成Abp(.net core)+Vue的Demo？
- fs模块练习
- 如何使用Python读取大文件
- DML数据操作语言之复杂查询
- Lua中的#
- 软件工程导论课后习题Github作业（把一个英文句子中的单词次序逆序，单词中字母正常排列）
- angular开发控制器之间的通信
- iOS自动化-- 常用iOS命令
- python的N个小功能(找到符合要求的图片，重命名，改格式，缩放，进行随机分配)
- 安装与配置ironic
热门文章
- O(n*logn)级别的算法之二（快速排序）的三种实现方法详解及其与归并排序的对比
- 2019-01-28 [日常]Beyond的歌里最多是"唏嘘"吗? - Python分词+词频
- Fragment与Activity的接口回调
- C#从SqlServer数据库读写文件源码
- iOS 防止UIButton重复点击
- 持续代码质量管理-SonarQube Scanner部署
- Java11新特性！
- django 模型层（2）
- 【Teradata】变更viewpoint web登录地址
- Business Intelligence Tools We Recommend 1/4 – Metabase