Kubernetes 集群安全 - 鉴权实战rolebinding和clusterrole

it2026-03-05 2

现在有一组数据库集群，有一组nginx集群。整个公司规模比较大，有两个项目组，一个项目组叫DBA，一个项目组SA，那么就需要做资源的分割。在名称空间下可以限制CPU使用多少核数，内存是多大，也就是不同的名称空间下赋予不同的系统资源。

Dba可以对mysql名称空间下的所有资源进行操作。Sa可以对nginx名称空间下的资源进行操作

实践：创建一个用户只能管理 dev 空间

创建用户

现在有个用户叫devuser，可以管理dev空间下面所有资源。对于k8s来说没有用户的管理，也就是创建用户想要在linux上面创建

[root@k8s-master ~]# useradd devuser [root@k8s-master ~]# passwd devuser Changing password for user devuser. New password: BAD PASSWORD: The password is shorter than 8 characters Retype new password: passwd: all authentication tokens updated successfully.

下载cfssl工具帮我们创建证书

⒈安装CFSSL wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 　　①生成证书　　②利用Json生成证书　　③查看证书信息的工具 ⒉修改权限 chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64 ⒊移动文件 mv cfssl_linux-amd64 /usr/local/bin/cfssl mv cfssljson_linux-amd64 /usr/local/bin/cfssljson mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo ⒋验证指令 cfssl --help

devuser要访问pod那么就要创建访问证书信息，下面创建证书请求，下面是证书请求的json格式

[root@k8s-master ~]# cat /usr/local/cert/devuser/devuser-crs.json { "CN": "devuser", "hosts": [ ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "BeiJing", "ST": "BeiJing", "O": "k8s", "OU": "System" } ] }

生成证书和私钥

[root@k8s-master ~]# ll ca* -rw-r--r-- 1 root root 294 Sep 15 12:49 ca-config.json -rw-r--r-- 1 root root 1001 Sep 15 12:52 ca.csr -rw-r--r-- 1 root root 264 Sep 15 12:29 ca-csr.json -rw------- 1 root root 1675 Sep 15 12:52 ca-key.pem -rw-r--r-- 1 root root 1359 Sep 15 12:52 ca.pem [root@k8s-master ~]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -profile=kubernetes /usr/local/cert/devuser/devuser-crs.json | cfssljson -bare devuser 2020/10/22 16:14:54 [INFO] generate received request 2020/10/22 16:14:54 [INFO] received CSR 2020/10/22 16:14:54 [INFO] generating key: rsa-2048 2020/10/22 16:14:56 [INFO] encoded CSR 2020/10/22 16:14:56 [INFO] signed certificate with serial number 403540224452990814881414641640830816053670285991 2020/10/22 16:14:56 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for websites. For more information see the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org); specifically, section 10.2.3 ("Information Requirements"). [root@k8s-master ~]# ls devuser* devuser.csr devuser-key.pem devuser.pem

指定 ca证书-ca=ca.pem ca私钥 -ca-key=ca-key.pem json文件证书 /usr/local/cert/devuser/devuser-crs.json 输出格式为devuser

设置集群参数

[root@k8s-master devuser]# export KUBE_APISERVER="https://192.168.179.99:6443" [root@k8s-master ~]# cd /usr/local/cert/devuser/ [root@k8s-master devuser]# kubectl config set-cluster kubernetes \ > --certificate-authority=/root/ca.pem \ > --embed-certs=true \ > --server=${KUBE_APISERVER} \ > --kubeconfig=devuser.kubeconfig Cluster "kubernetes" set. --certificate-authority=/root/ca.pem 指定ca证书 --embed-certs=true 指定是否要加密 --server=${KUBE_APISERVER} 指定服务器信息 --kubeconfig=devuser.kubeconfig 创建出来devuser.kubeconfig文件 [root@k8s-master devuser]# ls devuser-crs.json devuser.kubeconfig 这里指定了集群信息和证书 [root@k8s-master devuser]# cat devuser.kubeconfig apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUR2akNDQXFhZ0F3SUJBZ0lVQjJQTFcyZW85aG1iWTZDUUpQR1N4YVZlUTBvd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1pURUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbAphV3BwYm1jeEREQUtCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByCmRXSmxjbTVsZEdWek1CNFhEVEl3TURreE5UQTBORGN3TUZvWERUSTFNRGt4TkRBME5EY3dNRm93WlRFTE1Ba0cKQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbGFXcHBibWN4RERBSwpCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByZFdKbGNtNWxkR1Z6Ck1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBdG5uMlVsRE5GTEZ1Q3ZlR1ppMWYKSjRpcGNxRWtDeEFRQUUycTRmaVdrL0dSazRrcWJNU0g2Z0RyR1RTTkdpdjhLSi9EdGZmVmd5QjNJNDE1ekVSbgpLRzBORlFya2ZZRnpWdE1GMTZBdno5c0JNRmVLNld6cWh1YmpHWGdVaktRRWs4b2VOWHNPUWZlU2NOWlVKT0h5CnBoN0dFS1paSFZtVFRjLzI1S1RPNXV1UVBBVk9lRElDbzJyWXZPUU5NNHZ2WHFWWElSQ09HOFNYMHVQUEdjRUUKTWx1K1VKSjNIOVJKc2dWUHhPUnoxMThPd0cyNmhhWSswTC84WUJQM1pWSWErVUkzUVVXbFdFMkdYTW1hRWJpVApxTlBiMWJoaXlJKzJTbElJM1YrSENacWhJSTIzb1NvK0xEd0lYclFpNmRIN0hRSWg2TWJMaU5ybGQ5Z0JVSGIrCkt3SURBUUFCbzJZd1pEQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCL3dJQkFqQWQKQmdOVkhRNEVGZ1FVNXR3YXdqZVpnZExkLzM5aVhLMjZabEVFc0ZFd0h3WURWUjBqQkJnd0ZvQVU1dHdhd2plWgpnZExkLzM5aVhLMjZabEVFc0ZFd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFMQU1aSThvWVNjYjRaYzJIMGVRCndRc25RTE9pdG9SQ3llL2tNdHFuMTZLWEtiM2wzMVRmaFlCNURuTUNqL29jckxpMy9FVU56U0oxR0VMUDMvYTMKcHFCeXI5OE10eGFDT1JuekZFL2lhOGoreWk0VHlFelpyRGt0RGxzWG1Eb3UxOU8xOUN5ek5IOS9YRDRqcFNXRAoreGVSam55U1c4QTlGNTFwZUVXSnJOYTJReURMb2lVaTZVeWFnUktRSEIxK3oxaTVjOEViL3NTamd0RTFMVTdUCmhCQkZVRFpKMzJuSGdPRTNzK2xlN1EvZkpaYWdyQkp6bHp6Q2hxdFB0U2NrRmxBbHVnQVdmMDBQcXRVRGhwRFYKTS9TbVlxV0RqL3RXaURzTk9vTGhQeU5IU2RhYVE5d203blNOWXhZNldzbTFYQVZYWGlTeWVDVndVVk5mZ1BJNApRaUk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://192.168.179.99:6443 name: kubernetes contexts: null current-context: "" kind: Config preferences: {} users: null

设置客户端认证参数

[root@k8s-master ~]# cd /usr/local/cert/devuser/ [root@k8s-master devuser]# ls devuser-crs.json devuser.kubeconfig [root@k8s-master devuser]# kubectl config set-credentials devuser \ > --client-certificate=/root/devuser.pem \ > --client-key=/root/devuser-key.pem \ > --embed-certs=true \ > --kubeconfig=devuser.kubeconfig User "devuser" set. --client-certificate=/root/devuser.pem 指定客户端证书 --client-key=/root/devuser-key.pem 指定客户端私钥 --embed-certs=true 开启认证方式 [root@k8s-master devuser]# cat devuser.kubeconfig apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUR2akNDQXFhZ0F3SUJBZ0lVQjJQTFcyZW85aG1iWTZDUUpQR1N4YVZlUTBvd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1pURUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbAphV3BwYm1jeEREQUtCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByCmRXSmxjbTVsZEdWek1CNFhEVEl3TURreE5UQTBORGN3TUZvWERUSTFNRGt4TkRBME5EY3dNRm93WlRFTE1Ba0cKQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbGFXcHBibWN4RERBSwpCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByZFdKbGNtNWxkR1Z6Ck1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBdG5uMlVsRE5GTEZ1Q3ZlR1ppMWYKSjRpcGNxRWtDeEFRQUUycTRmaVdrL0dSazRrcWJNU0g2Z0RyR1RTTkdpdjhLSi9EdGZmVmd5QjNJNDE1ekVSbgpLRzBORlFya2ZZRnpWdE1GMTZBdno5c0JNRmVLNld6cWh1YmpHWGdVaktRRWs4b2VOWHNPUWZlU2NOWlVKT0h5CnBoN0dFS1paSFZtVFRjLzI1S1RPNXV1UVBBVk9lRElDbzJyWXZPUU5NNHZ2WHFWWElSQ09HOFNYMHVQUEdjRUUKTWx1K1VKSjNIOVJKc2dWUHhPUnoxMThPd0cyNmhhWSswTC84WUJQM1pWSWErVUkzUVVXbFdFMkdYTW1hRWJpVApxTlBiMWJoaXlJKzJTbElJM1YrSENacWhJSTIzb1NvK0xEd0lYclFpNmRIN0hRSWg2TWJMaU5ybGQ5Z0JVSGIrCkt3SURBUUFCbzJZd1pEQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCL3dJQkFqQWQKQmdOVkhRNEVGZ1FVNXR3YXdqZVpnZExkLzM5aVhLMjZabEVFc0ZFd0h3WURWUjBqQkJnd0ZvQVU1dHdhd2plWgpnZExkLzM5aVhLMjZabEVFc0ZFd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFMQU1aSThvWVNjYjRaYzJIMGVRCndRc25RTE9pdG9SQ3llL2tNdHFuMTZLWEtiM2wzMVRmaFlCNURuTUNqL29jckxpMy9FVU56U0oxR0VMUDMvYTMKcHFCeXI5OE10eGFDT1JuekZFL2lhOGoreWk0VHlFelpyRGt0RGxzWG1Eb3UxOU8xOUN5ek5IOS9YRDRqcFNXRAoreGVSam55U1c4QTlGNTFwZUVXSnJOYTJReURMb2lVaTZVeWFnUktRSEIxK3oxaTVjOEViL3NTamd0RTFMVTdUCmhCQkZVRFpKMzJuSGdPRTNzK2xlN1EvZkpaYWdyQkp6bHp6Q2hxdFB0U2NrRmxBbHVnQVdmMDBQcXRVRGhwRFYKTS9TbVlxV0RqL3RXaURzTk9vTGhQeU5IU2RhYVE5d203blNOWXhZNldzbTFYQVZYWGlTeWVDVndVVk5mZ1BJNApRaUk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://192.168.179.99:6443 name: kubernetes contexts: null current-context: "" kind: Config preferences: {} users: - name: devuser user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQxRENDQXJ5Z0F3SUJBZ0lVVHdQVzkySWIzNnVUM0JEdHQ1Rm5LNjkzdHNJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1pURUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbAphV3BwYm1jeEREQUtCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByCmRXSmxjbTVsZEdWek1CNFhEVEl3TVRBeU1qRXhNalF3TUZvWERUSXhNVEF5TWpFeE1qUXdNRm93WWpFTE1Ba0cKQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFVcHBibWN4RURBT0JnTlZCQWNUQjBKbGFVcHBibWN4RERBSwpCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUkF3RGdZRFZRUURFd2RrWlhaMWMyVnlNSUlCCklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFzVjR5KzUxSWFTS202SmNWU3ZZK2c1MlUKRkpXK0hoL3RFMCtzSnFyenhvd1lRcDVqamRITzVQQWlvVHFic3ZJbVMzRXZQUTZWS2YvN3k1d0lKVzZRSUczaApmYVRQMlZWN1c5bEoyTXJENHZGa2p0OHRTblYySVJHbXVzL3E0cXhmbFFIZ1Q0Y3ZsQ0tLZjByN2prTnRjUE5LCjdGSlRCc21SMnFhRTg5d2g2M2NZZzYzS01MRXFkTWhZTWxtK2x1WDQ1SU1FM0tMN1dEWVNTQ2NYV28xWUt1RzQKU0JPK2F4clVnK3Y0TEY5d2xLUWN5TmR2VXBQQUxwbjNoS21zajJPRURheG4vZ2F5UTlYbzJVc1ZIazQ0VkFBNgpLNndqcXN3ZHFGekl1ZnJOejFKa0hFUlhnU0FqRnJqNmhOaGN4OHF3SEhZcnM4b050ZEI1UXNMTUR3K0xCd0lECkFRQUJvMzh3ZlRBT0JnTlZIUThCQWY4RUJBTUNCYUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0cKQVFVRkJ3TUNNQXdHQTFVZEV3RUIvd1FDTUFBd0hRWURWUjBPQkJZRUZGSWdNMFFMVkFPVmZIem01dHd4L2pyago1MHFRTUI4R0ExVWRJd1FZTUJhQUZPYmNHc0kzbVlIUzNmOS9ZbHl0dW1aUkJMQlJNQTBHQ1NxR1NJYjNEUUVCCkN3VUFBNElCQVFCTFR3MGpodmZsbHpyY0thSEdTMjN5WmRzWWVRQ3NrazUxRmhCSnk0cFQ5U0ZFbWRsSnNyYXAKZmhLa01RVU1VNkYzbUlIeEVDOEhNRFJxaE16dHM4SHRqOUVVLzR5dzFxNnR3c29PMGhodnpUTHM0SEpTdW8wcwpDcWlVOEQ0Z1gyaDBVbWNxZnl3OWhvQjBINWRNbUUvQjBEdUl6cU1EZVNpM0RJampVa21PRHhqK0NMK0NiVURsCjV1QmV4TzI1OE96UXg3U1J4RWRvcHdvTUIvMVZYL1phT1RyWDhQc1FXdTRWYW5VcE5kQ3gvR3BzY0ovcWl5S2IKR0VYUzFRbWdnVUhVV1VnbGlBcTFCYzJXWDhxQ2haR3BTVE9WdXRZY01FNXFTaWRidG00Tkw1bTJ6ZDhjaWZjWgpCZ05vVnVXYWpBWEI1UjRDc2JPRTdITHFyc3dIaTBsRgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBc1Y0eSs1MUlhU0ttNkpjVlN2WStnNTJVRkpXK0hoL3RFMCtzSnFyenhvd1lRcDVqCmpkSE81UEFpb1RxYnN2SW1TM0V2UFE2VktmLzd5NXdJSlc2UUlHM2hmYVRQMlZWN1c5bEoyTXJENHZGa2p0OHQKU25WMklSR211cy9xNHF4ZmxRSGdUNGN2bENLS2Ywcjdqa050Y1BOSzdGSlRCc21SMnFhRTg5d2g2M2NZZzYzSwpNTEVxZE1oWU1sbStsdVg0NUlNRTNLTDdXRFlTU0NjWFdvMVlLdUc0U0JPK2F4clVnK3Y0TEY5d2xLUWN5TmR2ClVwUEFMcG4zaEttc2oyT0VEYXhuL2dheVE5WG8yVXNWSGs0NFZBQTZLNndqcXN3ZHFGekl1ZnJOejFKa0hFUlgKZ1NBakZyajZoTmhjeDhxd0hIWXJzOG9OdGRCNVFzTE1EdytMQndJREFRQUJBb0lCQUFUY1ZBRlpPaGJIZ0ZOMwpjSG54YlowbHdGMGdEV205N2oxTlBhYUJvTlNjR2o0WklSbE4ycUdqZ3c5d0Q3eERycEQ2dFJTelJaczFESzF6CnhUVmhaa205T1NTOFU0WGROZGc2aUMrTXZ2bUZMQUJPVld0bzlLZkxXQXBla0UxTjlBQ2RZSXhOWkJ4bkpleC8KSFkyMGcxZEpFNUNPWVFBYW5naWo3NWpQTzQ2OFZSSXFzMEJEVkVndUZvOXkwVGI1eXJvdm5CZkVESFQ0bVpwTgpjZTdrNExYc1JOVE1TbmN4cnNFRWdhUzFCeVdwMDFvWnF4WW5QbGt3WnFFN0pObk5qMTZ1OUhmdGVpN1RyR05qClVPNUI0Qlh5cUFMTUI2c3U3V09Fc0hIenRuUkVZQVU5R2pVNDhNN215b0grbEs0dUcxdFlYMFpUUUU0anQxeXkKVzJsZnFvRUNnWUVBNkxTZ3VkUEdBQWplWmg3M2RPREJWVTk2dnFZeGFYWlAxZHNwN2xBZGhmMDk5ZnhsTU0wQgp0ZFU2SWxZNEFNanpmS1JLQUk1K0p3ZUtSeGlpb1hMdUFtcTl3UlNWS0UzMElPY1NCaHRZN1pINXRKZURJdWlHCkV3UkVhaGsvK1lCM3dVeHBKbmdwenA3K2NXMjBLQm4vUDVQNUtPbjFzSnVsdE01bXJDaitpWGNDZ1lFQXd4OTUKd3ZnMEVXZVZ2ZmoxM1NCVmJmMmJucTBFRVhPMVorbjlJSENxQ0lPWDlwa1FKNklSYmg2TTkwMkJpc2VQYVdzYgpPM296dnJpaEdzNzdWL0orZGpMWnJWZkd3dTdHaG9NVnFkNmpiUDRTTjBLZlBuS200dk9lN29BMVd0NGhTMWthCmpzZUVBbU5DbWhWR21xRGFuVjVWM2VuMzZKZVpLZUlucDZKWmJ2RUNnWUVBeXBoZmlnbHV5NTd0Q1JtU3RVWHIKNi9yN1VUcGRzSVNac3dWUTl6TDIwUzJPSVRmeFhWQk9XZUZlOElBQjErVWIzdnNsbG1CNFFrQ1ZTWnFRRkdGOApCOHlva1kzNjRoRWtKdlVsd3YxU0tkczUrOWtoQ1daSlBBc3VDUFVjdG5yN1IrWGZjZWVSOWxxRUNYcktLMU9lCjN0cFVSU09UaklPbCs4anFxSjQwSkxjQ2dZQmxoUkRqQWlTRkViSDFQMzBjYWVCSTgvUnQ0SE1IYVg1dTdHMUkKM1pWNkRJMmFQaFVMcWVVTHVGVjdyaFhDVVFZcXdSRlFKc3FaWnBKYjBta3ZYdm14SWMvandwR2xobnBBTGgrdApYQ3NIWUVHMkFyRzcyZ2MrZWFhdFRJTjJIYkNROVhFOTdFeWd1V2hEcHVJdlBaWEEzdjRxRWJ0c2hzT242UVRjCjBUbGE0UUtCZ0grK3ZmaXhPMGgzekJBWG5vZys1YkpuWXQweTNmTmNCQU9aVHFhMzhiSm5tME4vT3VSN3BWSVAKY1VWV1BNc2xLeERVdmZ0bEFiaUx5YUMxN2NSRW5LbmFOZkp4NWhGbG1Wc3BsVnJOUzczTDFWTUFCYTVCUWJmcApwSGRCd0ozRHJXZ3VYUEJjekJkN2ZBSVI1Wi9ybUYzdGxRL3NrNkl2TmMrcCtlSm9FWTJtCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== 这里多出了客户的信息，如私钥信息

设置上下文（就是绑定名称空间）

[root@k8s-master devuser]# kubectl create namespace dev namespace/dev created [root@k8s-master devuser]# kubectl config set-context kubernetes \ > --cluster=kubernetes \ > --user=devuser \ > --namespace=dev \ > --kubeconfig=devuser.kubeconfig Context "kubernetes" created. [root@k8s-master devuser]# kubectl create namespace dev namespace/dev created [root@k8s-master devuser]# kubectl config set-context kubernetes \ > --cluster=kubernetes \ > --user=devuser \ > --namespace=dev \ > --kubeconfig=devuser.kubeconfig Context "kubernetes" created. [root@k8s-master devuser]# cat devuser.kubeconfig apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUR2akNDQXFhZ0F3SUJBZ0lVQjJQTFcyZW85aG1iWTZDUUpQR1N4YVZlUTBvd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1pURUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbAphV3BwYm1jeEREQUtCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByCmRXSmxjbTVsZEdWek1CNFhEVEl3TURreE5UQTBORGN3TUZvWERUSTFNRGt4TkRBME5EY3dNRm93WlRFTE1Ba0cKQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbGFXcHBibWN4RERBSwpCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByZFdKbGNtNWxkR1Z6Ck1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBdG5uMlVsRE5GTEZ1Q3ZlR1ppMWYKSjRpcGNxRWtDeEFRQUUycTRmaVdrL0dSazRrcWJNU0g2Z0RyR1RTTkdpdjhLSi9EdGZmVmd5QjNJNDE1ekVSbgpLRzBORlFya2ZZRnpWdE1GMTZBdno5c0JNRmVLNld6cWh1YmpHWGdVaktRRWs4b2VOWHNPUWZlU2NOWlVKT0h5CnBoN0dFS1paSFZtVFRjLzI1S1RPNXV1UVBBVk9lRElDbzJyWXZPUU5NNHZ2WHFWWElSQ09HOFNYMHVQUEdjRUUKTWx1K1VKSjNIOVJKc2dWUHhPUnoxMThPd0cyNmhhWSswTC84WUJQM1pWSWErVUkzUVVXbFdFMkdYTW1hRWJpVApxTlBiMWJoaXlJKzJTbElJM1YrSENacWhJSTIzb1NvK0xEd0lYclFpNmRIN0hRSWg2TWJMaU5ybGQ5Z0JVSGIrCkt3SURBUUFCbzJZd1pEQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCL3dJQkFqQWQKQmdOVkhRNEVGZ1FVNXR3YXdqZVpnZExkLzM5aVhLMjZabEVFc0ZFd0h3WURWUjBqQkJnd0ZvQVU1dHdhd2plWgpnZExkLzM5aVhLMjZabEVFc0ZFd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFMQU1aSThvWVNjYjRaYzJIMGVRCndRc25RTE9pdG9SQ3llL2tNdHFuMTZLWEtiM2wzMVRmaFlCNURuTUNqL29jckxpMy9FVU56U0oxR0VMUDMvYTMKcHFCeXI5OE10eGFDT1JuekZFL2lhOGoreWk0VHlFelpyRGt0RGxzWG1Eb3UxOU8xOUN5ek5IOS9YRDRqcFNXRAoreGVSam55U1c4QTlGNTFwZUVXSnJOYTJReURMb2lVaTZVeWFnUktRSEIxK3oxaTVjOEViL3NTamd0RTFMVTdUCmhCQkZVRFpKMzJuSGdPRTNzK2xlN1EvZkpaYWdyQkp6bHp6Q2hxdFB0U2NrRmxBbHVnQVdmMDBQcXRVRGhwRFYKTS9TbVlxV0RqL3RXaURzTk9vTGhQeU5IU2RhYVE5d203blNOWXhZNldzbTFYQVZYWGlTeWVDVndVVk5mZ1BJNApRaUk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://192.168.179.99:6443 name: kubernetes contexts: - context: cluster: kubernetes namespace: dev user: devuser name: kubernetes current-context: "" kind: Config preferences: {} users: - name: devuser user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQxRENDQXJ5Z0F3SUJBZ0lVVHdQVzkySWIzNnVUM0JEdHQ1Rm5LNjkzdHNJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1pURUxNQWtHQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFXcHBibWN4RURBT0JnTlZCQWNUQjBKbAphV3BwYm1jeEREQUtCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUk13RVFZRFZRUURFd3ByCmRXSmxjbTVsZEdWek1CNFhEVEl3TVRBeU1qRXhNalF3TUZvWERUSXhNVEF5TWpFeE1qUXdNRm93WWpFTE1Ba0cKQTFVRUJoTUNRMDR4RURBT0JnTlZCQWdUQjBKbGFVcHBibWN4RURBT0JnTlZCQWNUQjBKbGFVcHBibWN4RERBSwpCZ05WQkFvVEEyczRjekVQTUEwR0ExVUVDeE1HVTNsemRHVnRNUkF3RGdZRFZRUURFd2RrWlhaMWMyVnlNSUlCCklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFzVjR5KzUxSWFTS202SmNWU3ZZK2c1MlUKRkpXK0hoL3RFMCtzSnFyenhvd1lRcDVqamRITzVQQWlvVHFic3ZJbVMzRXZQUTZWS2YvN3k1d0lKVzZRSUczaApmYVRQMlZWN1c5bEoyTXJENHZGa2p0OHRTblYySVJHbXVzL3E0cXhmbFFIZ1Q0Y3ZsQ0tLZjByN2prTnRjUE5LCjdGSlRCc21SMnFhRTg5d2g2M2NZZzYzS01MRXFkTWhZTWxtK2x1WDQ1SU1FM0tMN1dEWVNTQ2NYV28xWUt1RzQKU0JPK2F4clVnK3Y0TEY5d2xLUWN5TmR2VXBQQUxwbjNoS21zajJPRURheG4vZ2F5UTlYbzJVc1ZIazQ0VkFBNgpLNndqcXN3ZHFGekl1ZnJOejFKa0hFUlhnU0FqRnJqNmhOaGN4OHF3SEhZcnM4b050ZEI1UXNMTUR3K0xCd0lECkFRQUJvMzh3ZlRBT0JnTlZIUThCQWY4RUJBTUNCYUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0cKQVFVRkJ3TUNNQXdHQTFVZEV3RUIvd1FDTUFBd0hRWURWUjBPQkJZRUZGSWdNMFFMVkFPVmZIem01dHd4L2pyago1MHFRTUI4R0ExVWRJd1FZTUJhQUZPYmNHc0kzbVlIUzNmOS9ZbHl0dW1aUkJMQlJNQTBHQ1NxR1NJYjNEUUVCCkN3VUFBNElCQVFCTFR3MGpodmZsbHpyY0thSEdTMjN5WmRzWWVRQ3NrazUxRmhCSnk0cFQ5U0ZFbWRsSnNyYXAKZmhLa01RVU1VNkYzbUlIeEVDOEhNRFJxaE16dHM4SHRqOUVVLzR5dzFxNnR3c29PMGhodnpUTHM0SEpTdW8wcwpDcWlVOEQ0Z1gyaDBVbWNxZnl3OWhvQjBINWRNbUUvQjBEdUl6cU1EZVNpM0RJampVa21PRHhqK0NMK0NiVURsCjV1QmV4TzI1OE96UXg3U1J4RWRvcHdvTUIvMVZYL1phT1RyWDhQc1FXdTRWYW5VcE5kQ3gvR3BzY0ovcWl5S2IKR0VYUzFRbWdnVUhVV1VnbGlBcTFCYzJXWDhxQ2haR3BTVE9WdXRZY01FNXFTaWRidG00Tkw1bTJ6ZDhjaWZjWgpCZ05vVnVXYWpBWEI1UjRDc2JPRTdITHFyc3dIaTBsRgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBc1Y0eSs1MUlhU0ttNkpjVlN2WStnNTJVRkpXK0hoL3RFMCtzSnFyenhvd1lRcDVqCmpkSE81UEFpb1RxYnN2SW1TM0V2UFE2VktmLzd5NXdJSlc2UUlHM2hmYVRQMlZWN1c5bEoyTXJENHZGa2p0OHQKU25WMklSR211cy9xNHF4ZmxRSGdUNGN2bENLS2Ywcjdqa050Y1BOSzdGSlRCc21SMnFhRTg5d2g2M2NZZzYzSwpNTEVxZE1oWU1sbStsdVg0NUlNRTNLTDdXRFlTU0NjWFdvMVlLdUc0U0JPK2F4clVnK3Y0TEY5d2xLUWN5TmR2ClVwUEFMcG4zaEttc2oyT0VEYXhuL2dheVE5WG8yVXNWSGs0NFZBQTZLNndqcXN3ZHFGekl1ZnJOejFKa0hFUlgKZ1NBakZyajZoTmhjeDhxd0hIWXJzOG9OdGRCNVFzTE1EdytMQndJREFRQUJBb0lCQUFUY1ZBRlpPaGJIZ0ZOMwpjSG54YlowbHdGMGdEV205N2oxTlBhYUJvTlNjR2o0WklSbE4ycUdqZ3c5d0Q3eERycEQ2dFJTelJaczFESzF6CnhUVmhaa205T1NTOFU0WGROZGc2aUMrTXZ2bUZMQUJPVld0bzlLZkxXQXBla0UxTjlBQ2RZSXhOWkJ4bkpleC8KSFkyMGcxZEpFNUNPWVFBYW5naWo3NWpQTzQ2OFZSSXFzMEJEVkVndUZvOXkwVGI1eXJvdm5CZkVESFQ0bVpwTgpjZTdrNExYc1JOVE1TbmN4cnNFRWdhUzFCeVdwMDFvWnF4WW5QbGt3WnFFN0pObk5qMTZ1OUhmdGVpN1RyR05qClVPNUI0Qlh5cUFMTUI2c3U3V09Fc0hIenRuUkVZQVU5R2pVNDhNN215b0grbEs0dUcxdFlYMFpUUUU0anQxeXkKVzJsZnFvRUNnWUVBNkxTZ3VkUEdBQWplWmg3M2RPREJWVTk2dnFZeGFYWlAxZHNwN2xBZGhmMDk5ZnhsTU0wQgp0ZFU2SWxZNEFNanpmS1JLQUk1K0p3ZUtSeGlpb1hMdUFtcTl3UlNWS0UzMElPY1NCaHRZN1pINXRKZURJdWlHCkV3UkVhaGsvK1lCM3dVeHBKbmdwenA3K2NXMjBLQm4vUDVQNUtPbjFzSnVsdE01bXJDaitpWGNDZ1lFQXd4OTUKd3ZnMEVXZVZ2ZmoxM1NCVmJmMmJucTBFRVhPMVorbjlJSENxQ0lPWDlwa1FKNklSYmg2TTkwMkJpc2VQYVdzYgpPM296dnJpaEdzNzdWL0orZGpMWnJWZkd3dTdHaG9NVnFkNmpiUDRTTjBLZlBuS200dk9lN29BMVd0NGhTMWthCmpzZUVBbU5DbWhWR21xRGFuVjVWM2VuMzZKZVpLZUlucDZKWmJ2RUNnWUVBeXBoZmlnbHV5NTd0Q1JtU3RVWHIKNi9yN1VUcGRzSVNac3dWUTl6TDIwUzJPSVRmeFhWQk9XZUZlOElBQjErVWIzdnNsbG1CNFFrQ1ZTWnFRRkdGOApCOHlva1kzNjRoRWtKdlVsd3YxU0tkczUrOWtoQ1daSlBBc3VDUFVjdG5yN1IrWGZjZWVSOWxxRUNYcktLMU9lCjN0cFVSU09UaklPbCs4anFxSjQwSkxjQ2dZQmxoUkRqQWlTRkViSDFQMzBjYWVCSTgvUnQ0SE1IYVg1dTdHMUkKM1pWNkRJMmFQaFVMcWVVTHVGVjdyaFhDVVFZcXdSRlFKc3FaWnBKYjBta3ZYdm14SWMvandwR2xobnBBTGgrdApYQ3NIWUVHMkFyRzcyZ2MrZWFhdFRJTjJIYkNROVhFOTdFeWd1V2hEcHVJdlBaWEEzdjRxRWJ0c2hzT242UVRjCjBUbGE0UUtCZ0grK3ZmaXhPMGgzekJBWG5vZys1YkpuWXQweTNmTmNCQU9aVHFhMzhiSm5tME4vT3VSN3BWSVAKY1VWV1BNc2xLeERVdmZ0bEFiaUx5YUMxN2NSRW5LbmFOZkp4NWhGbG1Wc3BsVnJOUzczTDFWTUFCYTVCUWJmcApwSGRCd0ozRHJXZ3VYUEJjekJkN2ZBSVI1Wi9ybUYzdGxRL3NrNkl2TmMrcCtlSm9FWTJtCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== 这里又多了绑定信息namespace,集群名称

创建角色绑定

[root@k8s-master devuser]# kubectl create rolebinding devuser-admin-binding --clusterrole=admin --user=devuser --namespace=dev rolebinding.rbac.authorization.k8s.io/devuser-admin-binding created

在集群当中已经有了ClusterRole的角色admin，admin角色是一个ClusterRole，这个集群角色可以在集群当中为所欲为，将集群角色进行角色绑定至用户devuser，代表用户devuser可以在dev下面为所欲为。

[root@k8s-master devuser]# cp devuser.kubeconfig /home/devuser/.kube/ [root@k8s-master devuser]# chown devuser:devuser /home/devuser/.kube/devuser.kubeconfig [root@k8s-master devuser]# mv /home/devuser/.kube/devuser.kubeconfig /home/devuser/.kube/config

现在还是不能访问集群的，因为还要切换上下文，切换上下文就是让Kubect读取到kubeconfig 的信息

[devuser@k8s-master ~]$ whoami devuser [devuser@k8s-master ~]$ kubectl config use-context kubernetes --kubeconfig=.kube/config Switched to context "kubernetes". [devuser@k8s-master ~]$ kubectl get pod No resources found in dev namespace. [root@k8s-master devuser]# kubectl get rolebinding -n dev NAME ROLE AGE devuser-admin-binding ClusterRole/admin 14m [root@k8s-master devuser]# kubectl get rolebinding devuser-admin-binding -o yaml -n dev apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding ....................................................... roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: admin subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: devuser

最新回复(0)

Kubernetes 集群安全 - 鉴权 实战rolebinding和clusterrole