1、RBAC
1.1、基本简介
1.1.1、简介
RBAC使用rbac.authorization.k8s.io API Group 来实现授权决策,允许管理员通过 KubernetesAPI 动态配置策略。 Kubernetes的基本特性就是它的所有资源对象都是模型化的 API 对象,我们可以基于api-server对各种 资源进行增、删、改、查等操作,但是这些操作涉及到的不仅仅是资源本身和动作,而且还涉及到资源和动作 之间的内容,比如api的分组版本和资源和api的关联即权限授权等。
1.1.2、启用RBAC
要启用RBAC,需要在 apiserver 中添加参数--authorization-mode=RBAC, kubeadm安装的集群默认开启了RBAC,我们可以通过查看 Master 节点上 apiserver 的静态Pod定义文件: master1 ~]# cat /etc/kubernetes/manifests/kube-apiserver.yaml ... spec: containers: - command: - kube-apiserver - --advertise-address=192.168.10.26 - --allow-privileged=true - --authorization-mode=Node,RBAC - --client-ca-file=/etc/kubernetes/pki/ca.crt - --enable-admission-plugins=NodeRestriction - --enable-bootstrap-token-auth=true ...
2、授权
2.1、授权定义
授权指的是,将某些subject对象赋予执行某些资源动作的权限。我们有时候会将其称为 Group(权限组),而这个组其实是有两部分组成:组名和组关联(也称绑定)。 简单来说:所谓的授权,其实是为用户授予xx角色
2.2、RABC&ABAC流程图
2.3、Group(权限组)组成
2.3.1、组名
其实是附加在某些资源上的一系列权限,对于k8s来说,它主要有两类:Role和 clusterRole,其中Role主要是作用于namespace,而clusterRole主要作用于多个 namespace,它们之间是一对多的关系。 我们为了将权限应用和具体权限列表分开描述,我们一般称权限列表为规则-rules
2.3.2、组关联(绑定)
所谓的组关联其实是将我们之前定义的Subject和对应的权限组关联在一起,表示某个Subject具有执行某个资源的一系列动作权限。
它主要涉及到两个RoleBingding和ClusterRoleBingding。
2.4、属性解析
为了更好的解释这四个属性,我们按照其工作的范围将其划分为三类进行描述:namespace级别、cluster级别、混合级别。
2.4.1、namespace级别
术语 解析 rules 规则,是一组属于不同 API Group 资源上的权限操作的集合 role 表示在一个namespace中基于rules使用资源的权限,属于集群内部的 API 资源,主要涉及到操作和对象 RoleBingding 将Subject和Role绑定在一起,表示Subject可以在namespace中使用指定资源的role角色权限
2.4.2、cluster级别
术语 解析 ClusterRole 表示在一个cluster中基于rules使用资源的权限,属于集群内部的 API 资源,一个cluster有多个namespace即有多个role ClusterRoleBingding 将Subject和ClusterRole绑定在一起,表示Subject可以在cluster中使用指定资源的ClusterRole角色权限
2.4.3、混合级别
术语:RoleBingding 解析:将Subject基于RoleBingding与ClusterRole绑定在一起,表示Subject可以使用 所有namespace中指定资源的role角色,从而避免了多次role和user的RoleBingding。 同样的操作,站在ClusterRole的角度,我们可以理解为,用户得到的权限仅是 ClusterRole的权限在Rolebinding所属的名称空间上的一个子集,也就是所谓的"权限降级"
2.4.4、场景举例
多个namespace中的role角色都一致,如果都使用内部的RoleBingding的话,每个namespace都必 须单独创建role,而使用ClusterRole的话,只需要一个就可以了,大大的减轻批量使用namespace中的RoleBingding 操作。
3、namespace级别-Role-实践
3.1、Role属性解析
3.1.1、查看role详细参数
master1 ~]# kubectl explain role apiVersion <string> kind <string> metadata <Object> rules <[]Object> apiGroups <[]string> nonResourceURLs <[]string> resourceNames <[]string> resources <[]string> verbs <[]string> -required 结果显示: 对于role来说,其核心的内容主要是rules的权限规则 在这么多rules属性中,最重要的是verbs就是权限条目,而且所有的属性都是可以以列表的形式累加存在。
3.1.2、通过命令生成role的yaml配置
# 查看pod角色具有get、list权限的role的资源定义文件格式 master1 ~]# kubectl create role pod-reader --verb=get,list --resource=pods --dry-run=client -o yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: creationTimestamp: null # 创建的时间 name: pod-reader # role名字 rules: # 规则 - apiGroups: # api操作的对象 - "" # 默认所有 resources: # 资源对象 - pods verbs: # 资源的权限 - get # 获取-权限 - list # 查看-权限 一个role必备的rules来说,它主要有三部分组成:apiGroup、resources、verbs apiGroups 设定包含资源的api组,如果是多个,表示只要属于api组范围中的任意资源都可以操作 resources 位于apiGroup范围中的某些具体的资源对象 verbs 针对具体资源对象的一些具体操作 关于apiGroups的信息获取,参考官网:https://kubernetes.io/docs/reference/#api-reference
3.2、yaml创建一个role
3.2.1、定义资源配置清单
cat >security-myrole.yml<<'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: myrole rules: - apiGroups: ["", "extensions", "apps"] resources: ["pods", "deployments", "replicasets"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] EOF 属性解析: apiGroups Pod属于 core 的 API Group,在YAML中用空字符就可以 Deployment 属于 apps 的 API Group ReplicaSets属于extensions这个 API Group,所以 rules 下面的 apiGroups 的内容:["", "extensions", "apps"] verbs 是可以对这些资源对象执行的操作,如果是所有动作,也可以使用["*"]来代替。
3.2.2、应用资源配置清单
master1 ]# kubectl apply -f security-myrole.yml role.rbac.authorization.k8s.io/myrole created master1 ]# kubectl get role NAME CREATED AT myrole 2023-03-30T12:51:09Z master1 ]# kubectl describe role myrole Name: myrole Labels: <none> Annotations: <none> PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- deployments [] [] [get list watch create update patch delete] pods [] [] [get list watch create update patch delete] replicasets [] [] [get list watch create update patch delete] deployments.apps [] [] [get list watch create update patch delete] pods.apps [] [] [get list watch create update patch delete] replicasets.apps [] [] [get list watch create update patch delete] deployments.extensions [] [] [get list watch create update patch delete] pods.extensions [] [] [get list watch create update patch delete] replicasets.extensions [] [] [get list watch create update patch delete]
4、namespace级别-rolebinding-实践
4.1、rolebinding属性解析
4.1.1、查看rolebinding详细参数
通过explain的命令来看一下rolebinding的属性信息
master1 ]# kubectl explain rolebinding apiVersion <string> kind <string> metadata <Object> roleRef <Object> -required subjects <[]Object> 对于角色绑定来说,主要涉及到两点:subject和对应的role权限列表,其中roleRef是必选项。
4.1.2、使用命令将user与role绑定并且生成yaml的配置
# 这里cyc的subject来与myrole进行一次模拟绑定查看属性效果 master1 ~]# kubectl create rolebinding cyc-myrole --role=myrole --user=cyc -o yaml --dry-run=client apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: creationTimestamp: null name: cyc-myrole roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: myrole subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: cyc # 对于roleRef和subjects分别写好其对应的资源属性信息即可
# 生成yml配置清单
master1]# kubectl create rolebinding cyc-myrole --role=myrole --user=cyc -o yaml --dry-run=client >security-rolebinding.yml
4.2、创建user与role绑定
4.2.1、使用命令创建关联
kubectl create rolebinding cyc-myrole --role=myrole --user=cyc 注意:如果是多个用户的话,可以多来几个 --user=subject 彼此间使用空格隔开即可
4.2.2、使用yaml创建关联
kubectl apply -f security-rolebinding.yml 注意:如果是多个用户的话,可以多来几个 --user=subject 彼此间使用空格隔开即可
4.2.3、rolebinding结果查询
master1 ]# kubectl get rolebindings NAME ROLE AGE cyc-myrole Role/myrole 62s master1 ]# kubectl describe rolebindings cyc-myrole Name: cyc-myrole Labels: <none> Annotations: <none> Role: Kind: Role Name: myrole Subjects: Kind Name Namespace ---- ---- --------- User cyc # 已经加入到 myrolebinding 角色绑定组中了,这里的namespace没有写,表示默认的default命名空间
4.2.4、验证权限是否生效
1、查看当前namespace:default中资源效果 master1 ]# kubectl get pod --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf NAME READY STATUS RESTARTS AGE pod-sa-admin 1/1 Running 0 7h39m 2、查看default命名空间中,非pod、deployment、rs之外的资源 master1 ]# kubectl get secrets --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf Error from server (Forbidden): secrets is forbidden: User "cyc" cannot list resource "secrets" in API group "" in the namespace "default" # 在我们role之外的内容我们都没有权限查看 3、查看非当前namespace中的资源 master1 security]# kubectl -n kube-system get pod --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf Error from server (Forbidden): pods is forbidden: User "cyc" cannot list resource "pods" in API group "" in the namespace "kube-system" # 在当前role权限范围内容,其它namespace中的资源,我们生效不了,因为role只是针对某个具体的ns
4.3、创建serviceaccounts(SA)与role绑定
4.3.1、命令格式介绍
# 查看SA的角色绑定格式 kubectl create rolebinding NAME --role=NAME [--serviceaccount=namespace:serviceaccountname] 属性解析:我们在基于服务账号进行关联的时候,需要关注一下该SA所属的namespace信息。
4.3.2、将sa与myrole进行绑定
# 相关的创建serviceaccount帐号教程: https://www.cnblogs.com/ygbh/p/17270653.html#_lab2_5_3 # 1、我们的自建的sa是admin而且是属于default空间 master1 ]# kubectl get sa admin -o yaml | grep namespace {"apiVersion":"v1","kind":"ServiceAccount","metadata":{"annotations":{},"name":"admin","namespace":"default"}} namespace: default # 2、我们先将admin和myrole进行绑定,查看一下效果 master1 ]# kubectl create rolebinding myrolebinding-sa-admin --role=myrole --serviceaccount=default:admin rolebinding.rbac.authorization.k8s.io/myrolebinding-sa-admin created master1 ]# kubectl describe rolebindings myrolebinding-sa-admin Name: myrolebinding-sa-admin Labels: <none> Annotations: <none> Role: Kind: Role Name: myrole Subjects: Kind Name Namespace ---- ---- --------- ServiceAccount admin default # 我们的admin加入到了myrolebinding1的绑定组中了,而且显示了特定的命名空间
5、集群绑定-clusterRole、ClusterRoleBingding-实践
5.1、简介
5.1.1、简介说明
所谓的cluster级别的实践主要涉及到clusterRole和ClusterRoleBingding之间的操作,也就是说我们可以操作多个namespace空间的资源。
5.1.2、属性解析
kubectl explain clusterrole aggregationRule <Object> apiVersion <string> kind <string> metadata <Object> rules <[]Object> apiGroups <[]string> nonResourceURLs <[]string> resourceNames <[]string> resources <[]string> verbs <[]string> -required结果显示:
clusterrole相对于role的属性多了一个集中控制器的属性aggregationRule,而这是一个可选的属性
5.1.3、创建clusterrole命令使用
master1 ~]# kubectl create clusterrole myclusterrole --verb=get,list --resource=pods -o yaml --dry-run=client apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: creationTimestamp: null name: myclusterrole rules: - apiGroups: - "" resources: - pods verbs: - get - list 单从模板的资源配置样式来说,他的配置信息与role的配置信息几乎一样
5.2、角色创建
5.2.1、创建资源配置清单
cat >security-myclusterrole.yml<<'EOF' apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: myclusterrole rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch"] EOF
5.2.2、应用资源配置清单
kubectl apply -f security-myclusterrole.yml master1 ]# kubectl get clusterrole | grep -E 'my|NAME' NAME CREATED AT myclusterrole 2023-03-30T14:25:20Z master1 ~]# kubectl describe clusterrole myclusterrole Name: myclusterrole Labels: <none> Annotations: <none> PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- pods [] [] [get list watch] # 在myclasterrole仅仅有pod资源的三种权限
5.3、角色绑定
5.3.1、命令格式
命令格式 kubectl create clusterrolebinding NAME --clusterrole=NAME [--user=username] ...
属性解析 对于clusterrolebinding来说,仅仅允许集群角色进行和其进行绑定,对于普通的role来说就无效了
5.3.2、生成cyc用户和myclasterrole进行角色绑定的yaml【只做配置清单时用到】
master1 ~]# kubectl create clusterrolebinding myclusterrolebing --clusterrole=myclusterrole --user=cyc -o yaml --dry-run W0330 22:30:27.161658 107064 helpers.go:663] --dry-run is deprecated and can be replaced with --dry-run=client. apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: creationTimestamp: null name: myclusterrolebing roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: myclusterrole subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: cyc 属性解析: 这里的属性配置与我们之前的role和rolebinding的方法几乎一样 区别就是kind和--clusterrole的不同
5.3.3、确定cluserrolebinding绑定cyc用户
master1 ~]# kubectl create clusterrolebinding myclusterrolebing --clusterrole=myclusterrole --user=cyc clusterrolebinding.rbac.authorization.k8s.io/myclusterrolebing created
5.3.4、查询绑定结果
master1 ~]# kubectl get clusterrolebindings.rbac.authorization.k8s.io | grep -E 'NAME|my' NAME ROLE AGE myclusterrolebing ClusterRole/myclusterrole 26s master1 ~]# kubectl describe clusterrolebindings myclusterrolebing Name: myclusterrolebing Labels: <none> Annotations: <none> Role: Kind: ClusterRole Name: myclusterrole Subjects: Kind Name Namespace ---- ---- --------- User cyc # 我们将cyc的账号,赋予了操作集群角色的权限
5.3.5、切换账号查看效果
master1 ~]# kubectl get pod --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf NAME READY STATUS RESTARTS AGE pod-sa-admin 1/1 Running 0 9h master1 ~]# kubectl -n kube-system get pod --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf NAME READY STATUS RESTARTS AGE coredns-75c9cf9bd7-55d6h 1/1 Running 0 7d7h ... kube-scheduler-master3 1/1 Running 5 (24h ago) 14d ... 对于clusterrolebinding来说,绑定后的user account不但可以看到当前namespace中的资源对象,还能看到其他namespace中的资源对象
6、RBAC-混合级别
6.1、基础知识
6.1.1、功能需求
所谓的cluster级别的实践主要涉及到clusterRole和rolebinding之间的操作,也就是说虽然我们可以 操作很大范围的权限,但是由于某个特殊的场景我们需要避免大的权限,采用rolebinding的方式来主动降 低可行的执行权限,即,在混合级别实践的场景中,无论我们的用户是哪一个,我们只需要关联同一个 clusterrole,那么这个用户只能在指定的namespace空间中进行响应的操作。
6.1.2、准备工作
# 还原环境 kubectl delete rolebinding myrolebinding kubectl delete rolebinding myrolebinding1 kubectl delete clusterrolebinding myclusterrolebinding 当前subject和clusterrole现状 ]$ kubectl get clusterrole | egrep 'NA|my' NAME CREATED AT myclasterrole 2021-10-06T23:28:08Z ]$ kubectl config get-contexts CURRENT NAME CLUSTER AUTHINFO NAMESPACE * kubernetes-admin@kubernetes kubernetes kubernetes-admin
6.2、命令介绍
kubectl create rolebinding NAME --clusterrole=NAME|--role=NAME [--user=username] 属性解析: 对于rolebinding来说,我可以基于clusterrole和role两种角色进行绑定操作。
6.3、user、rolebinding、clusterrole-角色绑定
6.3.1、命令生成资源配置清单
master1 ~]# kubectl create rolebinding merge-role --clusterrole=myclusterrole --user=cyc -o yaml --dry-run=client apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: creationTimestamp: null name: merge-role roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: mycluster subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: cyc master1 ]# kubectl create rolebinding merge-role --clusterrole=myclusterrole --user=cyc -o yaml --dry-run=client >security-merge-binding.yml
6.3.2、修改资源配置清单
master1 ]# vi security-merge-binding.yml creationTimestamp: null apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: namespace: default name: merge-role roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: myclusterrole subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: cyc
# 我们将自动生成的配置文件中的时间戳删除,然后给其设定了一个namespace的权限范围属性
6.3.3、应用资源配置清单
master1 ]# kubectl apply -f security-merge-binding.yml rolebinding.rbac.authorization.k8s.io/merge-role created master1 ]# kubectl get rolebindings.rbac.authorization.k8s.io NAME ROLE AGE merge-role ClusterRole/mycluster 86s master1 ~]# kubectl describe rolebindings merge-role Name: merge-role Labels: <none> Annotations: <none> Role: Kind: ClusterRole Name: myclusterrole Subjects: Kind Name Namespace ---- ---- --------- User cyc # 我们已经将cyc采用rolebinding的方式赋予其clusterrole的角色权限
6.3.4、检查效果
master1 ]# kubectl -n default get pod --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf NAME READY STATUS RESTARTS AGE pod-sa-admin 1/1 Running 0 9h master1 ]# kubectl -n kube-system get pod --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf Error from server (Forbidden): pods is forbidden: User "cyc" cannot list resource "pods" in API group "" in the namespace "kube-system" # 对于rolebinding的clusterrole来说,我们只能访问指定的default空间中的资源了
6.4、权限-实践
6.4.1、简介
# 我们知道对于自定义的myclusterrole来说,它对于pod只有查看的权限查询如下: master1 ~]# kubectl describe clusterrole myclusterrole Name: myclusterrole Labels: <none> Annotations: <none> PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- pods [] [] [get list watch] # 没有删除的权限,我们无法对dafault命名空间的pod资源做权限之外的事情。 master1 ~]# kubectl delete pod pod-sa-admin --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf Error from server (Forbidden): pods "pod-sa-admin" is forbidden: User "cyc" cannot delete resource "pods" in API group "" in the namespace "default"
6.4.2、隐患
我们知道官方也给default空间提供了很多权限,admin的权限就是极大,admin的clusterrole它是在default命名空间中的,而且对pod有各种操作权限
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
master1 ~]# kubectl get clusterrole admin -o yaml aggregationRule: clusterRoleSelectors: - matchLabels: rbac.authorization.k8s.io/aggregate-to-admin: "true" apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: annotations: rbac.authorization.kubernetes.io/autoupdate: "true" creationTimestamp: "2023-03-16T12:07:00Z" labels: kubernetes.io/bootstrapping: rbac-defaults name: admin resourceVersion: "321" uid: 71822188-84e5-4783-b2d3-d8836134b47c rules: - apiGroups: - "" resources: - pods/attach - pods/exec - pods/portforward - pods/proxy - secrets - services/proxy verbs: - get - list - watch - apiGroups: - "" resources: - serviceaccounts verbs: - impersonate - apiGroups: - "" resources: - pods - pods/attach - pods/exec - pods/portforward - pods/proxy verbs: - create - delete - deletecollection - patch - update - apiGroups: - "" resources: - pods/eviction verbs: - create - apiGroups: - "" resources: - configmaps - events - persistentvolumeclaims - replicationcontrollers - replicationcontrollers/scale - secrets - serviceaccounts - services - services/proxy verbs: - create - delete - deletecollection - patch - update - apiGroups: - "" resources: - serviceaccounts/token verbs: - create - apiGroups: - apps resources: - daemonsets - deployments - deployments/rollback - deployments/scale - replicasets - replicasets/scale - statefulsets - statefulsets/scale verbs: - create - delete - deletecollection - patch - update - apiGroups: - autoscaling resources: - horizontalpodautoscalers verbs: - create - delete - deletecollection - patch - update - apiGroups: - batch resources: - cronjobs - jobs verbs: - create - delete - deletecollection - patch - update - apiGroups: - extensions resources: - daemonsets - deployments - deployments/rollback - deployments/scale - ingresses - networkpolicies - replicasets - replicasets/scale - replicationcontrollers/scale verbs: - create - delete - deletecollection - patch - update - apiGroups: - policy resources: - poddisruptionbudgets verbs: - create - delete - deletecollection - patch - update - apiGroups: - networking.k8s.io resources: - ingresses - networkpolicies verbs: - create - delete - deletecollection - patch - update - apiGroups: - coordination.k8s.io resources: - leases verbs: - create - delete - deletecollection - get - list - patch - update - watch - apiGroups: - "" resources: - configmaps - endpoints - persistentvolumeclaims - persistentvolumeclaims/status - pods - replicationcontrollers - replicationcontrollers/scale - serviceaccounts - services - services/status verbs: - get - list - watch - apiGroups: - "" resources: - bindings - events - limitranges - namespaces/status - pods/log - pods/status - replicationcontrollers/status - resourcequotas - resourcequotas/status verbs: - get - list - watch - apiGroups: - "" resources: - namespaces verbs: - get - list - watch - apiGroups: - discovery.k8s.io resources: - endpointslices verbs: - get - list - watch - apiGroups: - apps resources: - controllerrevisions - daemonsets - daemonsets/status - deployments - deployments/scale - deployments/status - replicasets - replicasets/scale - replicasets/status - statefulsets - statefulsets/scale - statefulsets/status verbs: - get - list - watch - apiGroups: - autoscaling resources: - horizontalpodautoscalers - horizontalpodautoscalers/status verbs: - get - list - watch - apiGroups: - batch resources: - cronjobs - cronjobs/status - jobs - jobs/status verbs: - get - list - watch - apiGroups: - extensions resources: - daemonsets - daemonsets/status - deployments - deployments/scale - deployments/status - ingresses - ingresses/status - networkpolicies - replicasets - replicasets/scale - replicasets/status - replicationcontrollers/scale verbs: - get - list - watch - apiGroups: - policy resources: - poddisruptionbudgets - poddisruptionbudgets/status verbs: - get - list - watch - apiGroups: - networking.k8s.io resources: - ingresses - ingresses/status - networkpolicies verbs: - get - list - watch - apiGroups: - authorization.k8s.io resources: - localsubjectaccessreviews verbs: - create - apiGroups: - rbac.authorization.k8s.io resources: - rolebindings - roles verbs: - create - delete - deletecollection - get - list - patch - update - watchkubectl get clusterrole admin -o yaml
6.4.3、使用cyc用户具备命令空间:default 删除pod的权限
# 关联admin clusterrole master1 ~]# kubectl create rolebinding default-ns-admin --clusterrole=admin --user=cyc rolebinding.rbac.authorization.k8s.io/default-ns-admin created # 删除原来关联 master1 ~]# kubectl delete rolebindings merge-role rolebinding.rbac.authorization.k8s.io "merge-role" deleted # 查询设置 master1 ~]# kubectl describe rolebindings default-ns-admin Name: default-ns-admin Labels: <none> Annotations: <none> Role: Kind: ClusterRole Name: admin Subjects: Kind Name Namespace ---- ---- --------- User cyc # 使用cyc用户,获取pod master1 ~]# kubectl get pod --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf NAME READY STATUS RESTARTS AGE pod-sa-admin 1/1 Running 0 10h # 使用cyc用户,删除pod master1 ~]# kubectl delete pod pod-sa-admin --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf pod "pod-sa-admin" deleted # 查询命令空间:kube-system,没有权限 master1 ~]# kubectl -n kube-system get pod --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf Error from server (Forbidden): pods is forbidden: User "cyc" cannot list resource "pods" in API group "" in the namespace "kube-system" # 我们只能管理当前命名空间的资源,其他命名空间的资源是管理不了的。
6.4.4、为什么绑定admin,只能管理default呢?
# 原因是rolebindings命令空间配置default,所以只能管理default master1 ~]# kubectl get rolebindings default-ns-admin -o yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: creationTimestamp: "2023-03-30T15:35:45Z" name: default-ns-admin namespace: default resourceVersion: "1001958" uid: 8e374dff-323a-4ab1-a848-e1281c8240ec roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: admin subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: cyc
6.4.5、指定命名空间rolebinding
# 删原来的配置 kubectl delete rolebinding default-ns-admin; # 指定命令空间创建 kubectl create rolebinding default-ns-admin --clusterrole=admin --user=cyc --namespace=kube-system; # 此时cyc用户,可以的管理kube-system权限 master1 ~]# kubectl -n kube-system get pod --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf NAME READY STATUS RESTARTS AGE coredns-75c9cf9bd7-55d6h 1/1 Running 0 7d9h #此时命令空间:default,也不能被cyc用户管理 master1 ~]# kubectl -n default get pod --context=cyc@mycluster --kubeconfig=/tmp/cyc.conf Error from server (Forbidden): pods is forbidden: User "cyc" cannot list resource "pods" in API group "" in the namespace "default"
标签:cyc,kubectl,38,get,--,rolebinding,cluster,role,master1 From: https://www.cnblogs.com/ygbh/p/17273838.html