kubernetes的安全机制，不仅仅再客户端和apisever之间的交互，各pod之间后者跨namespace之间也要以此为基准配合 RBAC来进行。提到另一个账户关系serviceaccount简称sa。
- User accounts are for humans. Service accounts are for processes, which run in pods.
创建一个属于自己的sa
[root@master song]# kubectl create sa lele
serviceaccount/lele created
[root@master song]# kubectl describe sa lele
Name: lele
Namespace: default
Labels: <none>
Annotations: <none>
Image pull secrets: <none>
Mountable secrets: lele-token-7mpr5
Tokens: lele-token-7mpr5
Events: <none>
[root@master song]# kubectl get secrets
NAME TYPE DATA AGE
default-token-tlx48 kubernetes.io/service-account-token 3 30d
lele-token-7mpr5 kubernetes.io/service-account-token 3 39d
创建一个pod使用这个sa
[root@master song]# cat pod-sa.yml
apiVersion: v1
kind: Pod
metadata:
name: pod-sa
namespace: default
labels:
app: myapp
tier: frontend
2sdlfj: dashazi
spec:
containers:
- name: myapp-
image: hub.c..com/library/nginx:1.13
volumeMounts:
- name: song
serviceAccountName: lele
[root@master song]# kubectl create -f pod-sa.yml
[root@master song]# kubectl describe pods pod-sa
Name: pod-sa
Namespace: default
Priority:
PriorityClassName: <none>
Node: k8s-node1/172.20.0.76
Start Time: Thu, Mar :: +
Labels: 2sdlfj=dashazi
app=myapp
tier=frontend
Annotations: <none>
Status: Running
IP: 10.244.2.218
Containers:
myapp-:
Container ID: docker://17df9be1c9e987f2c44ec9aed90e8c499a414da82142c8494a4d8ce640883326
Image: hub.c..com/library/nginx:1.13
Image ID: docker-pullable://hub.c.163.com/library/nginx@sha256:ff094de32a0d3b5efc29cec60daa709c5378cf4e53e4c9fd1d3433b87ac8ec8b
Port: <none>
Host Port: <none>
State: Running
Started: Thu, Mar :: +
Ready: True
Restart Count:
Environment: <none>
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from lele-token-7mpr5 (ro)
Conditions:
Type Status
Initialized True
Ready True
ContainersReady True
PodScheduled True
Volumes:
lele-token-7mpr5:
Type: Secret (a volume populated by a Secret)
SecretName: lele-token-7mpr5
Optional: false
QoS Class: BestEffort
Node-Selectors: <none>
Tolerations: node.kubernetes.io/not-ready:NoExecute for 300s
node.kubernetes.io/unreachable:NoExecute for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Pulled 7h24m kubelet, k8s-node1 Container image "hub.c.163.com/library/nginx:1.13" already present on machine
Normal Created 7h24m kubelet, k8s-node1 Created container
Normal Started 7h24m kubelet, k8s-node1 Started container
Normal Scheduled 15m default-scheduler Successfully assigned default/pod-sa to k8s-node
kubectl config 是客户端连接的配置命令
kubectl 可以定义诸多集群和与之对应的账号密码信息
[root@master song]# kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://172.20.0.91:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kubernetes-admin
name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes 当前使用的用户和集群信息
kind: Config
preferences: {}
users:
- name: kubernetes-admin
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
按照这个思路，我们创建有个自己的证书 和私钥来连接我们的集群
root@master song]# cd /etc/kubernetes/pki/
[root@master pki]# ls
apiserver.crt apiserver-etcd-client.key apiserver-kubelet-client.crt ca.crt etcd front-proxy-ca.key front-proxy-client.key sa.pub
apiserver-etcd-client.crt apiserver.key apiserver-kubelet-client.key ca.key front-proxy-ca.crt front-proxy-client.crt sa.key
[root@master pki]# (umask ;openssl genrsa -out song.key )
Generating RSA private key, bit long modulus
........................+++
.........+++
e is (0x10001)
[root@master pki]# openssl req -new -key song.key -out song.csr -subj "/CN=song"
[root@master pki]# ls
apiserver.crt apiserver-kubelet-client.key front-proxy-ca.key song.csr
apiserver-etcd-client.crt ca.crt front-proxy-client.crt song.key
apiserver-etcd-client.key ca.key front-proxy-client.key
apiserver.key etcd sa.key
apiserver-kubelet-client.crt front-proxy-ca.crt sa.pub
[root@master pki]# openssl x509 -req -in song.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out song.crt -days 3650
Signature ok
subject=/CN=song
Getting CA Private Key
[root@master pki]# kubectl config set-credentials song --client-certificate=./song.crt --client-key=./song.key
User "song" set.
[root@master pki]# kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://172.20.0.91:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kubernetes-admin
name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
- name: song
user:
client-certificate: /etc/kubernetes/pki/song.crt
client-key: /etc/kubernetes/pki/song.key
[root@master pki]# kubectl config set-context song@kubernetes --cluster=kubernetes --user=song
Context "song@kubernetes" created.
[root@master pki]# kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://172.20.0.91:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kubernetes-admin
name: kubernetes-admin@kubernetes
- context:
cluster: kubernetes
user: song
name: song@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
- name: song
user:
client-certificate: /etc/kubernetes/pki/song.crt
client-key: /etc/kubernetes/pki/song.key
由于此用户没有经过rbac 授权
[root@master pki]# kubectl config use-context song@kubernetes
Switched to context "song@kubernetes".
[root@master pki]# kubectl get pods
Error from server (Forbidden): pods is forbidden: User "song" cannot list resource "pods" in API group "" in the namespace "default"
[root@master pki]#
总结 user 和 serviceaccountname 是两种不同的认证suject