具有对象过滤的kubernetes资源级RBAC_Kubernetes_Rbac

具有对象过滤的kubernetes资源级RBAC

kubernetes

具有对象过滤的kubernetes资源级RBAC,kubernetes,rbac,Kubernetes,Rbac,我正在为k8s自定义对象执行一些资源级别的RBAC，发现使用本机k8s调用很难获取筛选器资源 cluster是我的自定义CRD，用户john只能访问一个CRD实例，而不是使用k8s原生RBAC访问所有CRD实例 ➜ k get clusters NAME AGE aws-gluohfhcwo 3d2h azure-cikivygyxd 3d1h ➜ k get clusters --as=john Error from server (Forbidd

我正在为k8s自定义对象执行一些资源级别的RBAC，发现使用本机k8s调用很难获取筛选器资源

cluster

是我的自定义CRD，用户

john

只能访问一个CRD实例，而不是使用k8s原生RBAC访问所有CRD实例

➜  k get clusters
NAME               AGE
aws-gluohfhcwo     3d2h
azure-cikivygyxd   3d1h

➜  k get clusters --as=john
Error from server (Forbidden): clusters.operator.biqmind.com is forbidden: User "ranbir" cannot list resource "clusters" in API group "operator.biqmind.com" in the namespace "biqmind"

➜  k get clusters --as=john aws-gluohfhcwo
NAME             AGE
aws-gluohfhcwo   3d2h

我已经显式地指定了对象名，以获取用户经过身份验证的对象列表。对如何解决这个问题有什么建议吗

完整的rbac发布在这里

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: biqmind
  name: cluster-admin-aws-gluohfhcwo
rules:
- apiGroups: ["operator.biqmind.com"]
  resources: ["clusters"]
  resourceNames: ["aws-gluohfhcwo"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cluster-admin-aws-gluohfhcwo-binding
  namespace: biqmind
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cluster-admin-aws-gluohfhcwo
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: ranbir

用户“ranbir”无法在命名空间“biqmind”中的API组“operator.biqmind.com”中列出资源“集群”

必须使用动词

list

为指定命名空间中的指定用户添加RBAC权限，以允许该用户

list

进行“群集”

当做

kubectl get clusters --as=john aws-gluohfhcwo

您可以使用RBAC动词

get

，但是要在不指定特定名称的情况下列出，用户还需要获得

list

的权限

给予

列表

权限，而不使用resourceName:的示例：

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: biqmind
  name: cluster-admin-aws-gluohfhcwo
rules:
- apiGroups: ["operator.biqmind.com"]
  resources: ["clusters"]
  resourceNames: ["aws-gluohfhcwo"]
  verbs: ["get", "watch", "create", "update", "patch", "delete"]

- apiGroups: ["operator.biqmind.com"]
  resources: ["clusters"]
  verbs: ["get", "list"]

用户“ranbir”无法在命名空间“biqmind”中的API组“operator.biqmind.com”中列出资源“集群”

必须使用动词

list

为指定命名空间中的指定用户添加RBAC权限，以允许该用户

list

进行“群集”

当做

kubectl get clusters --as=john aws-gluohfhcwo

您可以使用RBAC动词

get

，但是要在不指定特定名称的情况下列出，用户还需要获得

list

的权限

给予

列表

权限，而不使用resourceName:的示例：

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: biqmind
  name: cluster-admin-aws-gluohfhcwo
rules:
- apiGroups: ["operator.biqmind.com"]
  resources: ["clusters"]
  resourceNames: ["aws-gluohfhcwo"]
  verbs: ["get", "watch", "create", "update", "patch", "delete"]

- apiGroups: ["operator.biqmind.com"]
  resources: ["clusters"]
  verbs: ["get", "list"]

在用户端实施在概念上很容易。您可以为单个用户创建角色绑定，但这不是推荐的路径，因为存在操作员精神错乱的高风险

sane RBAC更好的方法是创建用户映射到的对象；该映射的完成方式取决于集群的身份验证器（例如，aws iam authenticator for EKS使用mapRoles将角色ARN映射到一组组）

他们可以访问的组和API最终是根据组织的需要确定的，但是一个通用的阅读器（对于刚刚掌握窍门的新工程师）、编写器（对于您的工程师）和管理员（对于您）角色是一个良好的开端。（嘿，对每个人来说都比管理员好。）

以下是配置文件的示例：

# An example reader ClusterRole – ClusterRole so you’re not worried about namespaces at this time. Remember, we’re talking generic reader/writer/admin roles.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: reader
rules:
– apiGroups: [“*”]
resources:
– deployments
– configmaps
– pods
– secrets
– services
verbs:
– get
– list
– watch
---
# An example reader ClusterRoleBinding that gives read permissions to
# the engineering and operations groups
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: reader-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: reader
subjects:
- kind: Group
  name: umbrella:engineering
- kind: Group
  name: umbrella:operations
---
# An example writer ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: writer
rules:
- apiGroups: [“*”]
resources:
- deployments
- configmaps
- pods
- secrets
- services
verbs:
- create
- delete
- patch
- update
---
# An example writer ClusterRoleBinding that gives write permissions to
# the operations group
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: reader-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: reader
subjects:
- kind: Group
  name: umbrella:operations

以下是确切的解释：

注意默认角色和角色绑定

API服务器创建一组默认的ClusterRole和ClusterRoleBinding对象。其中许多是带有系统前缀的，这表示资源由基础设施“拥有”。对这些资源的修改可能会导致非功能性集群。一个例子是system:node ClusterRole。此角色定义kubelets的权限。如果角色被修改，它会阻止kubelets工作

所有默认集群角色和角色绑定都标有

kubernetes.io/bootstrapping=rbac defaults

记住关于自动对账的内容

在每次启动时，API服务器都会使用任何缺少的权限更新默认集群角色，并使用任何缺少的主题更新默认集群角色绑定。这允许集群修复意外修改，并在新版本中权限和主题更改时使角色和角色索引保持最新

要选择退出此对账，请将默认群集角色或角色绑定上的rbac.authorization.kubernetes.io/autoupdate注释设置为false。请注意，缺少默认权限和主题可能会导致无功能集群

当RBAC授权人处于活动状态时，在Kubernetes版本1.6+中启用自动对账

有用的文章：。

在用户端强制执行在概念上很容易。您可以为单个用户创建角色绑定，但这不是推荐的路径，因为存在操作员精神错乱的高风险

以下是配置文件的示例：

# An example reader ClusterRole – ClusterRole so you’re not worried about namespaces at this time. Remember, we’re talking generic reader/writer/admin roles.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: reader
rules:
– apiGroups: [“*”]
resources:
– deployments
– configmaps
– pods
– secrets
– services
verbs:
– get
– list
– watch
---
# An example reader ClusterRoleBinding that gives read permissions to
# the engineering and operations groups
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: reader-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: reader
subjects:
- kind: Group
  name: umbrella:engineering
- kind: Group
  name: umbrella:operations
---
# An example writer ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: writer
rules:
- apiGroups: [“*”]
resources:
- deployments
- configmaps
- pods
- secrets
- services
verbs:
- create
- delete
- patch
- update
---
# An example writer ClusterRoleBinding that gives write permissions to
# the operations group
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: reader-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: reader
subjects:
- kind: Group
  name: umbrella:operations

以下是确切的解释：

注意默认角色和角色绑定

所有默认集群角色和角色绑定都标有

kubernetes.io/bootstrapping=rbac defaults

记住关于自动对账的内容

在Kubernetes版本1.6+中，当RBAC