{"id":3625,"date":"2022-03-27T21:10:32","date_gmt":"2022-03-27T13:10:32","guid":{"rendered":"\/?p=3625"},"modified":"2022-03-27T21:10:32","modified_gmt":"2022-03-27T13:10:32","slug":"26-k8s%e7%9a%84rbac","status":"publish","type":"post","link":"http:\/\/xinblog.ltd\/?p=3625","title":{"rendered":"26.K8S\u7684RBAC"},"content":{"rendered":"

\u7ecf\u5178\u7684RBAC\u6a21\u578b\u6211\u4eec\u4e0d\u5fc5\u8bf4<\/p>\n

\u7b80\u5355\u6765\u8bf4\u5c31\u662f\u89d2\u8272\u7684\u6743\u9650\u63a7\u5236<\/p>\n

\u6211\u4eec\u521b\u5efa\u4e86\u5bf9\u5e94\u7684\u89d2\u8272\uff0c\u7136\u540e\u7531\u7528\u6237\u7ed1\u5b9a\u89d2\u8272\uff0c\u89d2\u8272\u6307\u5b9a\u6743\u9650\uff0c\u6765\u8fdb\u884c\u6743\u9650\u7684\u8bbf\u95ee\u63a7\u5236<\/p>\n

\u800c\u5728K8S\u4e2d\uff0c\u5b9a\u4e49\u4e86\u56db\u79cd\u89d2\u8272\u76f8\u5173\u5bf9\u8c61\uff0c\u6765\u8fdb\u884c\u89d2\u8272\u63a7\u5236\u548c\u89d2\u8272\u7ed1\u5b9a\uff0c\u5206\u522b\u662fRole\u00a0ClusterRole<\/p>\n

RoleBinding ClusterRoleBinding<\/p>\n

\u5176\u4e2d Role\u662f\u57fa\u4e8e\u540d\u79f0\u7a7a\u95f4\u7684\u89d2\u8272\uff0c\u6765\u64cd\u4f5c\u540d\u79f0\u7a7a\u95f4\u4e0b\u7684\u8d44\u6e90<\/p>\n

RoleBingding\uff0c\u5c06\u4e00\u4e2aRole\u7ed1\u5b9a\u4e00\u4e2a\u89d2\u8272<\/p>\n

ClusterRole\uff1a\u96c6\u7fa4\u7684\u89d2\u8272\uff0c\u6765\u64cd\u4f5c\u96c6\u7fa4\u8d44\u6e90<\/p>\n

ClusterRoleBinding\uff0c\u5c06ClusterRole\u7ed1\u5b9a\u7ed9\u4e00\u4e2a\u7528\u6237<\/p>\n

\u81f3\u4e8e\u4e3a\u4f55\u533a\u5206\u4e86Role\u548cClusterRole\u4e24\u4e2a\u76f8\u5173\u89d2\u8272\u5bf9\u8c61\u5462\uff1f<\/p>\n

\u8fd9\u4e5f\u662f\u6765\u6e90\u4e8eK8S\u96c6\u7fa4\u4e2d\u5206\u4e3a\u4e86\u4e0d\u540c\u7ef4\u5ea6<\/p>\n

\u6bd4\u5982Pod\u00a0Service\u8fd9\u7c7b\u5bf9\u8c61\uff0c\u662f\u5b58\u5728\u4e8e\u540d\u79f0\u7a7a\u95f4\u5185\u7684\uff0c\u90a3\u4e48\u8fd9\u7c7b\u53ef\u4ee5\u4ea4\u7ed9Role\u6765\u505a\uff0c\u800c\u7c7b\u4f3cNode,PV\u8fd9\u7c7b\u4e0d\u5b58\u5728\u4e8e\u4e00\u4e2a\u5355\u4e00\u7684\u547d\u540d\u7a7a\u95f4\uff0c\u800c\u662f\u6574\u4e2a\u96c6\u7fa4\u7684\u8bdd\uff0c\u90a3\u4e48\u5c31\u53ef\u4ee5\u8ba9ClusterRole\u6765\u505a<\/p>\n

\"\u56fe\u7247\"<\/p>\n

\u65e0\u8bba\u662fClusterRole\u8fd8\u662fRole\uff0c\u90fd\u662f\u548c\u89d2\u8272\u505a\u5230\u4e86\u591a\u5bf9\u591a\u7684\u5173\u7cfb\uff0c\u800cRole\u7c7b\u5bf9\u8c61\u548c\u6743\u9650\u5217\u8868\uff0c\u4e5f\u505a\u5230\u4e86\u591a\u5bf9\u591a\u7684\u5173\u7cfb<\/p>\n

\u6211\u4eec\u770b\u4e0b\u5bf9\u5e94\u7684\u4e66\u5199\u793a\u4f8b<\/p>\n

kubectl explain role.rules<\/p>\n\n\n\n
FIELDS:<\/p>\n

apiGroups \u00a0\u00a0\u00a0<[]string><\/p>\n

APIGroups is the name of the APIGroup that contains the resources. If<\/p>\n

multiple API groups are specified, any action requested against one of the<\/p>\n

enumerated resources in any API group will be allowed.<\/p>\n

nonResourceURLs \u00a0\u00a0\u00a0\u00a0\u00a0<[]string><\/p>\n

NonResourceURLs is a set of partial urls that a user should have access to.<\/p>\n

*s are allowed, but only as the full, final step in the path Since<\/p>\n

non-resource URLs are not namespaced, this field is only applicable for<\/p>\n

ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply<\/p>\n

to API resources (such as “pods” or “secrets”) or non-resource URL paths<\/p>\n

(such as “\/api”), but not both.<\/p>\n

resourceNames \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<[]string><\/p>\n

ResourceNames is an optional white list of names that the rule applies to.<\/p>\n

An empty set means that everything is allowed.<\/p>\n

resources \u00a0\u00a0\u00a0<[]string><\/p>\n

Resources is a list of resources this rule applies to. ResourceAll<\/p>\n

represents all resources.<\/p>\n

verbs \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<[]string> -required-<\/p>\n

Verbs is a list of Verbs that apply to ALL the ResourceKinds and<\/p>\n

AttributeRestrictions contained in this rule. VerbAll represents all kinds.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u4e0a\u9762\u5b57\u6bb5\u4e2d<\/p>\n

ApiGroups, \u662f\u4f20\u5165string\u6570\u7ec4\uff0c\u9ed8\u8ba4\u7559\u7a7a\uff0c\u4f20\u5165\u5c31\u4f20\u5165\u5bf9\u5e94\u5bf9\u8c61\u4e0a\u9762\u7684apiVersion\uff0c\u8fd9\u6837\u5c31\u8868\u660e\u4e86\u9650\u5236\u56fa\u5b9a\u7684apiGroups<\/p>\n

noResourceURLs\uff0c\u80fd\u8bbf\u95ee\u7684url<\/p>\n

resourceNames\uff1a \u80fd\u64cd\u4f5c\u7684\u767d\u540d\u5355\uff0c\u4e5f\u5c31\u662f\u5177\u4f53\u7684Pod\u00a0deployment\u7684\u540d\u5b57<\/p>\n

resources \u64cd\u4f5c\u7684\u5bf9\u8c61\u5217\u8868\uff0c\u6bd4\u5982pod,deployment<\/p>\n

verbs,\u64cd\u4f5c\u52a8\u4f5c,\u53ef\u4ee5\u53c2\u8003 kubectl api-resources -owide\u4e2d\u7684verbs\u5217\u8868<\/p>\n

\u9ed8\u8ba4\u7684yaml\u5982\u4e0b<\/p>\n\n\n\n
apiVersion: rbac.authorization.k8s.io\/v1<\/p>\n

kind: Role<\/p>\n

metadata:<\/p>\n

namespace: default\u00a0#\u540d\u79f0\u7a7a\u95f4<\/p>\n

name: pod-reader\u00a0#\u540d\u79f0<\/p>\n

rules:<\/p>\n

– apiGroups: [“”] # “” \u6807\u660e core API \u7ec4,\u9ed8\u8ba4\u4e0d\u6807\u6ce8\u4e3a\u7a7a\u5b57\u7b26\u4e32<\/p>\n

resources: [“pods”] # \u64cd\u4f5cpod<\/p>\n

verbs: [“get”, “watch”, “list”] #\u53ef\u4ee5\u7684\u64cd\u4f5c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u5229\u7528\u8fd9\u4e2aRole,\u6211\u4eec\u521b\u5efa\u4e86\u4e00\u4e2a\u89d2\u8272,\u5e76\u58f0\u660e\u4e86\u8fd9\u4e2a\u89d2\u8272\u53ef\u4ee5\u7ed1\u5b9a\u7684\u6743\u9650<\/p>\n

\u7136\u540e\u662f\u6574\u4f53\u7684\u6743\u9650\u6d41\u7a0b<\/p>\n

\u9996\u5148\u662f\u9700\u8981\u4e00\u4e2aServiceAccount,\u4f5c\u4e3a\u6574\u4e2a\u6d41\u7a0b\u4e2d\u7684\u7528\u6237,\u7136\u540e\u5229\u7528rolebinding\u6765\u8fdb\u884c\u7ed1\u5b9a\u5173\u7cfb<\/p>\n

\u9996\u5148\u67e5\u770b\u4e00\u4e2arolebinding<\/p>\n

Kubectl get\u00a0rolebinding xxx -oyaml<\/p>\n

\u4f1a\u5728\u5176\u5185\u90e8\u8be6\u60c5\u4e2d\u770b\u5230subjects\u4e00\u680f,\u5176\u4e2d\u58f0\u660e\u4e86<\/p>\n

RoleRef\u6807\u660e\u5bf9\u5e94\u7684Role,subjects\u58f0\u660e\u4e86\u7ed1\u5b9a\u7684\u8d26\u53f7<\/p>\n

\u5176\u6b21\u662f\u5bf9\u5e94\u7684serviceAccount<\/p>\n

\u67e5\u770b\u53ef\u4ee5\u53d1\u73b0\u5176\u4e2d\u7ed1\u5b9a\u4e86token<\/p>\n

\u8fd9\u4e2atoken\u5c31\u662f\u6211\u4eec\u8fdc\u7aef\u767b\u5f55k8s\u96c6\u7fa4\u7684\u9a8c\u8bc1\u65b9\u5f0f<\/p>\n

\"\u56fe\u7247\"<\/p>\n

\u6545\u4e00\u4e2a\u8d26\u53f7\u4f7f\u7528\u6d41\u7a0b\u4e5f\u5c31\u662f<\/p>\n

\u4e00\u4e2a\u8d26\u53f7\u5e26\u7740\u4e00\u4e2a\u4ee4\u724c<\/p>\n

\u5f53\u4ee4\u724c\u88ab\u4f7f\u7528\u767b\u5f55\u7684\u65f6\u5019<\/p>\n

\u4f1a\u5e26\u7740\u8fd9\u4e2a\u4ee4\u724c\u627e\u5230\u8d26\u53f7<\/p>\n

\u8d26\u53f7\u627e\u5230\u6240\u6709\u7ed1\u5b9a\u7684\u89d2\u8272<\/p>\n

\u7136\u540e\u6839\u636e\u6240\u6709\u7684\u89d2\u8272\u83b7\u53d6\u6240\u6709\u7684\u6743\u9650\u5217\u8868<\/p>\n

\u5982\u679c\u60f3\u8981\u6700\u5927\u7684\u6743\u9650,\u53ef\u4ee5\u8003\u8651\u53c2\u8003clusterAdmin<\/p>\n

\"\u56fe\u7247\"<\/p>\n

\u800c\u63a5\u4e0b\u6765,\u6211\u4eec\u770b\u4e00\u4e0b\u521b\u5efa\u7684\u5168\u6d41\u7a0b<\/p>\n

\u9996\u5148\u662f\u521b\u5efa\u4e00\u4e2aServiceAccount<\/p>\n\n\n\n
apiVersion: v1<\/p>\n

kind: ServiceAccount<\/p>\n

metadata:<\/p>\n

name: \u00a0test<\/p>\n

namespace: default<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u7136\u540e\u521b\u5efa\u4e00\u4e2aClusterRole\u53ca ClusterRoleBin\u53bb\u58f0\u660e\u4f7f\u7528<\/p>\n\n\n\n
apiVersion: rbac.authorization.k8s.io\/v1<\/p>\n

kind: ClusterRole<\/p>\n

metadata:<\/p>\n

name: test-role<\/p>\n

rules:<\/p>\n

– apiGroups: [“”]<\/p>\n

resources: [“namespaces”]<\/p>\n

verbs: [“get”, “watch”, “list”]<\/p>\n

—<\/p>\n

apiVersion: rbac.authorization.k8s.io\/v1<\/p>\n

kind: RoleBinding<\/p>\n

metadata:<\/p>\n

name: test-role-binding<\/p>\n

subjects:<\/p>\n

– kind: ServiceAccount<\/p>\n

name: test\u00a0# ‘name’ \u662f\u533a\u5206\u5927\u5c0f\u5199\u7684<\/p>\n

apiGroup: “”<\/p>\n

roleRef:<\/p>\n

kind: ClusterRole<\/p>\n

name: test-role<\/p>\n

apiGroup: rbac.authorization.k8s.io<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u8fd9\u6837,\u6211\u4eec\u5c31\u505a\u5230\u4e86\u5229\u7528RBAC\u53bb\u7b80\u5355\u7ba1\u7406\u96c6\u7fa4\u6743\u9650\u7684\u6d41\u7a0b<\/p>\n

\u6700\u540e\u4e00\u4e2a\u5c0f\u6269\u5c55<\/p>\n

\u5982\u4f55\u4f7f\u7528RestAPI\u53bb\u8bbf\u95eeK8S\u96c6\u7fa4<\/p>\n

\u521b\u5efaServiceAccount \u5173\u8054\u4e00\u4e2a\u6743\u9650<\/p>\n

\u7136\u540e\u5c31\u53ef\u4ee5\u5229\u7528\u5b98\u65b9\u63d0\u4f9b\u7684api\u52a0\u4e0aServiceAccount\u7684token\u8fdb\u884c\u8bbf\u95ee\u5373\u53ef<\/p>\n","protected":false},"excerpt":{"rendered":"

\u7ecf\u5178\u7684RBAC\u6a21\u578b\u6211\u4eec\u4e0d\u5fc5\u8bf4 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[],"_links":{"self":[{"href":"http:\/\/xinblog.ltd\/index.php?rest_route=\/wp\/v2\/posts\/3625"}],"collection":[{"href":"http:\/\/xinblog.ltd\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/xinblog.ltd\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/xinblog.ltd\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/xinblog.ltd\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3625"}],"version-history":[{"count":0,"href":"http:\/\/xinblog.ltd\/index.php?rest_route=\/wp\/v2\/posts\/3625\/revisions"}],"wp:attachment":[{"href":"http:\/\/xinblog.ltd\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3625"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/xinblog.ltd\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3625"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/xinblog.ltd\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3625"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}