k8s权限管理 - 容器相关

#权限认证流程
![](/media//202107/2021-07-02095455558605.png)

##注意：只有用户和授权都验证通过后，才能访问
---
#常规用户认证

---
#ServiceAccount认证
####指定认证的ServiceAccount
	#Pod示例：
	apiVersion: v1
	kind: Pod
	metadata:
	  name: examplepod
	spec:
	  serviceAccountName: [serviceaccount名称]   #指定自定义ServiceAccount认证
	  containers:
	  - name: testcontainer
	    image: docker.io/appropriate/curl
		imagePullPolicy: IfNotPresent
		command: ['sh','-c']
		args: ['echo "test pod for headless service!";sleep 3600']
		
####查询ServiceAccount
	kubectl get serviceaccount -n kube-system

![](/media//202107/2021-07-02102513622865.png)

####查看ServiceAccount详情
	kubectl describe serviceaccount [serviceaccount名称]

![](/media//202107/2021-07-02102559003475.png)

####查看ServiceAccounter认证信息
	kubectl get secret -A	#查看所有secret
	kubectl get secret prometheus-token-t47mc -o yaml	#查看指定secret

![](/media//202107/2021-07-02102818743235.png)

#注意：secret中的信息为Base64加密后的数据，如要使用，先用Base64解密（非常重要）
---
#RBAC授权
####RBAC授权主要分为两个步骤：
	1、角色定义：指定角色名称，定义允许访问哪些资源及允许的访问方式。
	2、角色绑定：将角色与用户（常规用户或ServiceAccount）进行绑定，这样用户就拥有与角色对应的权限

####角色：
####1.普通角色：Role是一组权限的集合，例如Role可以包含列出Pod权限及列出Deployment权限，Role用于给某个NameSpace中的资源进行鉴权。
	#创建普通：
	kind: Role
	apiVersion: rbac.authorization.k8s.io/v1
	metadata:
	  namespace: default	#普通角色要指定命名空间
	  name: podreader	#记住这里，后面角色绑定要用到
	rules:
	- apiGroups: [""]
	  resources: ["pods"]
	  verbs: ["get", "watch", "list"]
---
	#绑定
	kind: RoleBinding
	apiVersion: rbac.authorization.k8s.io/v1
	metadata:
	  namespace: default
	  name: podreaderbinding
	subjects:
	- kind: User   #普通用户绑定
	  name: exampleuser
	  apiGroup: ""
	- kind: ServiceAccount
	  name: exampleserviceaccount
	roleRef:
	  kind: Role
	  name: podreader   #为之前一定的role
	  apiGroup: ""

##查看
	kubectl get role -A	#查看角色
	kubectl get role podreader -n default#查看详情

![](/media//202107/2021-07-02110121572680.png)

kubectl get rolebinding -A #查看角色绑定
	kubectl get rolebinding podreader -n default#查看详情

![](/media//202107/2021-07-02110214020458.png)

---
####2.集群角色：ClusterRole是一组权限的集合，但与Role不同的是，ClusterRole可以在包括所有NameSpce和集群级别的资源或非资源类型进行鉴权。
	#创建自定义ServiceAccount
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: prometheus
      namespace: kube-system
      labels:
        kubernetes.io/cluster-service: "true"
        addonmanager.kubernetes.io/mode: Reconcile
	#创建集群角色
    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRole
    metadata:
      name: prometheus
      labels:
        kubernetes.io/cluster-service: "true"
        addonmanager.kubernetes.io/mode: Reconcile 
    rules:
      - apiGroups:
          - ""
        resources:
          - nodes
          - nodes/metrics
		  - nodes/proxy
          - services
          - endpoints
          - pods
        verbs:
          - get
          - list
          - watch
      - apiGroups:
          - ""
        resources:
          - configmaps
        verbs:
          - get
      - nonResourceURLs:
          - "/metrics"
        verbs:
          - get
	#集群角色绑定
    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRoleBinding
    metadata:
      name: prometheus
      labels:
        kubernetes.io/cluster-service: "true"
        addonmanager.kubernetes.io/mode: Reconcile
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: prometheus
    subjects:
    - kind: ServiceAccount
      name: prometheus
      namespace: kube-system

##查看
	kubectl get clusterrole -A	#查看角色
	kubectl get clusterrole prometheus -o yaml #查看详情

![](/media//202107/2021-07-02110955599175.png)

kubectl get clusterrolebinding -A #查看角色绑定
	kubectl get clusterrolebinding prometheus -o yaml #查看详情

![](/media//202107/2021-07-02110214020458.png)

---
####相关参数
	#Role、ClsuterRole Verbs可配置参数
	"get", "list", "watch", "create", "update", "patch", "delete", "exec"

#Role、ClsuterRole Resource可配置参数
	"services", "endpoints", "pods","secrets","configmaps","crontabs","deployments","jobs","nodes","rolebindings","clusterroles","daemonsets","replicasets","statefulsets","horizontalpodautoscalers","replicationcontrollers","cronjobs"

#Role、ClsuterRole APIGroup可配置参数
	"","apps", "autoscaling", "batch"

##常用操作
####创建用户
	kubectl create serviceaccount admin -n kube-system
####用户授权
	kubectl create clusterrolebinding admin --clusterrole=cluster-admin --serviceaccount=kube-system:admin
 
####查看token
	kubectl describe secrets -n kube-system $(kubectl -n kube-system get secret | awk '/admin/{print $1}')

####测试
	curl --insecure https://172.16.16.168:6443/api/v1/namespaces/default/pods -H "Authorization:Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IlRrT0E3ang1ZFZJdThXZTN3aWoyYk5TM2Z5MTV4dV9pSk5rV1ZjdEZHalkifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJwcm9tZXRoZXVzLXRva2VuLXQ0N21jIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6InByb21ldGhldXMiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiI3NWVlNGRjYy1lZThhLTQwZTMtOTViOC1hMmQyN2UyZTAxNTIiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06cHJvbWV0aGV1cyJ9.KLtAvSSiZyBs9EIOfHAiLMwpeszD8wE_wEhKlezZDjE5L3dH0PE8hGVA_kNLCAYIgBKfHVD93YQ190lYEKi6koFhOM9OksCnvmgmFhDkq_-HuWCV9JQynsWQEIgTTc1eAkEQhxopiqw7lJ-D_oOFbFB3_CHcRpXs6vsXPqqP0bhVMbmv1HZWS4q1veUTVWMDkgSFrv7sVcvJLM-zcV7Vvl-vkl1o2Dln_ArBTa2vcaSOTkhvQcL8MC0H4J7ve8iJijC2l3iucdKctJaCmarq7vf8cXqJi013Y3z9HJqD8i7tK9gLJ83EH3Heg7u2UlYRAIGKhSLWjIZEMTTZ63_vJg"