15.kubernetes認證及serviceaccount

kubernetes認證及serviceaccount

認證

受權：
RBAC（目前的主流受權方式）

准入控制：
瞭解便可

 

--> 認證
受權 准入控制


客戶端 --》api-server:
user: username,uid
group:
extra:

API
Request path


serviceaccount

k8s的資源若是支持create 那麼能夠使用--dry-run來生成清單配置
--dry-run

獲取單個pod的清單配置
[root@k8s-master ~]# kubectl get pods pod-cm-nginx-3 -o yaml --export

[root@k8s-master ~]# kubectl get sa
NAME SECRETS AGE
default 1 6d17h
[root@k8s-master ~]# kubectl create serviceaccount admin
serviceaccount/admin created

 

kubernetes集羣有兩類認證值的用戶帳號
1.useraccount 用戶，人的帳號
2.serviceaccount 服務帳號，pod等資源想訪問k8s中apiservice時候裏面須要用到的認證信息，包括用戶名，密碼等

爲pod獲取私有鏡像images的兩種方式：
1.使用imagepullsecreit字段指定
2.使用sa（serviceaccount）

kubectl 是怎麼認證
kubectl config

kubeconfig

[root@k8s-master ~]# kubectl config view

 

 

鏈接apiserver

[root@k8s-master pki]# (umask 077 ; openssl genrsa -out magedu.key 2048)
Generating RSA private key, 2048 bit long modulus
............+++
.......+++
e is 65537 (0x10001)

[root@k8s-master pki]# openssl req -new -key magedu.key -out magedu.csr -subj "/CN=magedu"

[root@k8s-master pki]# openssl x509 -req -in magedu.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out magedu.crt -days 365
Signature ok
subject=/CN=magedu
Getting CA Private Key

添加到k8s集羣能夠認證：
[root@k8s-master pki]# kubectl config set-credentials magedu --client-certificate=./magedu.crt --client-key=./magedu.key --embed-certs=true
User "magedu" set.

[root@k8s-master pki]# kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://10.250.0.89:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kubernetes-admin
name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
- name: magedu
user:
client-certificate-data: REDACTED
client-key-data: REDACTED

 

[root@k8s-master pki]# kubectl config set-context magedu@kubernetes --cluster=kubernetes --user=magedu
Context "magedu@kubernetes" created.

[root@k8s-master pki]# kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://10.250.0.89:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kubernetes-admin
name: kubernetes-admin@kubernetes
- context:
cluster: kubernetes
user: magedu
name: magedu@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
- name: magedu
user:
client-certificate-data: REDACTED
client-key-data: REDACTED

切換上下文：
[root@k8s-master pki]# kubectl config use-context magedu@kubernetes
Switched to context "magedu@kubernetes".

[root@k8s-master pki]# kubectl get pods
Error from server (Forbidden): pods is forbidden: User "magedu" cannot list resource "pods" in API group "" in the namespace "default"

切換回admin
[root@k8s-master pki]# kubectl config use-context kubernetes-admin@kubernetes
Switched to context "kubernetes-admin@kubernetes".

 

定義集羣：
[root@k8s-master pki]# kubectl config set-cluster mycluster --kubeconfig=/tmp/test.conf --server="https://172.20.0.70:6443" --certificate-authority=/etc/kubernetes/pki/ca.crt --embed-certs=true
Cluster "mycluster" set.
[root@k8s-master pki]# kubectl config view --kubeconfig=/tmp/test.conf
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://172.20.0.70:6443
name: mycluster
contexts: []
current-context: ""
kind: Config
preferences: {}
users: []

 

經過magedu去訪問k8s集羣