K8S安全控制框架主要由下面3個(gè)階段進(jìn)行控制，每一個(gè)階段都支持插件方式，通過(guò)API Server配置來(lái)啟用插件。
1. Authentication（認(rèn)證）
2. Authorization（授權(quán)）
3. Admission Control（準(zhǔn)入控制）
客戶端（kubectl或curl等）要想訪問(wèn)K8s集群API Server，一般需要證書、Token或者用戶名+密碼。如果Pod訪問(wèn)，需要ServiceAccount。
認(rèn)證（Authentication）
三種客戶端身份認(rèn)證：
HTTPS 證書認(rèn)證：基于CA證書簽名的數(shù)字證書認(rèn)證
HTTP Token認(rèn)證：通過(guò)一個(gè)Token來(lái)識(shí)別用戶
HTTP Base認(rèn)證：用戶名+密碼的方式認(rèn)證
鑒權(quán)（Authentication）
RBAC（Role-Based Access Control，基于角色的訪問(wèn)控制）：負(fù)責(zé)完成授權(quán)（Authorization）工作。 RBAC根據(jù)API請(qǐng)求屬性，決定允許還是拒絕。
比較常見的授權(quán)維度：
? user：用戶名
? group：用戶分組
? 資源，例如pod、deployment
? 資源操作方法：get，list，create，update，patch，watch，delete
? 命名空間
? API組
基于角色的權(quán)限訪問(wèn)控制：RBAC
RBAC（Role-Based Access Control，基于角色的訪問(wèn)控 制），允許通過(guò)Kubernetes API動(dòng)態(tài)配置策略。
角色
? Role：授權(quán)特定命名空間的訪問(wèn)權(quán)限
? ClusterRole：授權(quán) 所有命名空間 的訪問(wèn)權(quán)限
角色綁定
? RoleBinding：將角色綁定到主體（即subject）
? ClusterRoleBinding：將 集群角色綁定到主體
主體（subject）
? User：用戶
? Group：用戶組
? ServiceAccount：服務(wù)賬號(hào)
Kubernetes RBAC 為指定用戶授權(quán)訪問(wèn)不同命名空間權(quán)限_k8s dashbord 用戶授權(quán)-CSDN博客
第一種：客戶端訪問(wèn)
證書
1）ca根證書
[root@k8s-node02 ~]# grep certificate-auth ~/.kube/config | cut -d " " -f 6 |base64 -d>ca.pem2）client-cert
[root@k8s-node02 ~]# grep client-cert ~/.kube/config | cut -d " " -f 6 | base64 -d>client-cert.cert3）client-key
[root@k8s-node02 ~]# grep client-key-data ~/.kube/config | cut -d " " -f 6 |base64 -d>client-key.key4）然后訪問(wèn)集群：
[root@k8s-node02 ~]# curl -k --cert ./client-cert.cert --key ./client-key.key https://rancher.jettech.cn5）訪問(wèn)某個(gè)節(jié)點(diǎn)的監(jiān)控接口：
[root@k8s-node02 ~]# netstat -atunpl |grep kubelet
tcp 0 0 127.0.0.1:10248 0.0.0.0:* LISTEN 4014/kubelet
tcp 0 0 127.0.0.1:42873 0.0.0.0:* LISTEN 4014/kubelet
tcp 0 0 127.0.0.1:36198 127.0.0.1:6443 ESTABLISHED 4014/kubelet
tcp 0 0 127.0.0.1:36179 127.0.0.1:6443 ESTABLISHED 4014/kubelet
tcp 0 0 127.0.0.1:36206 127.0.0.1:6443 ESTABLISHED 4014/kubelet
tcp 0 0 127.0.0.1:36202 127.0.0.1:6443 ESTABLISHED 4014/kubelet
tcp 0 0 127.0.0.1:36204 127.0.0.1:6443 ESTABLISHED 4014/kubelet
tcp6 0 0 :::10250 :::* LISTEN 4014/kubelet
tcp6 0 0 172.16.10.59:10250 10.42.14.65:56272 ESTABLISHED 4014/kubelet
[root@k8s-node02 ~]# curl -k --cert ./client-cert.cert --key ./client-key.key https://localhost:10250/metrics?或用用集群cluster-admin這個(gè)角色，這個(gè)角色權(quán)限最大，找到這個(gè)角色用的用戶然后根據(jù)用戶找到token即可
1）看系統(tǒng)集群角色信息
[root@k8s-node02 ~]# kubectl describe clusterrole cluster-admin
Name: cluster-admin
Labels: kubernetes.io/bootstrapping=rbac-defaults
Annotations: rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
*.* [] [] [*]
[*] [] [*]
[root@k8s-node02 ~]# 2）找到綁定角色的用戶（serviceaccount），namesapce
[root@k8s-node02 ~]# kubectl get clusterrolebinding |grep admin
cattle-admin-binding ClusterRole/cattle-admin 23h
cluster-admin ClusterRole/cluster-admin 23h
globaladmin-user-l5ffv ClusterRole/cluster-admin 23h
job-deployer ClusterRole/cluster-admin 23h
[root@k8s-node02 ~]# kubectl describe clusterrolebinding cattle-admin-binding
Name: cattle-admin-binding
Labels: cattle.io/creator=norman
Annotations: <none>
Role:
Kind: ClusterRole
Name: cattle-admin
Subjects:
Kind Name Namespace
---- ---- ---------
ServiceAccount cattle cattle-system3）通過(guò)用戶seviceaccount找到secret信息，namespace
[root@k8s-node02 ~]# kubectl describe ServiceAccount cattle -n cattle-system
Name: cattle
Namespace: cattle-system
Labels: <none>
Annotations: <none>
Image pull secrets: <none>
Mountable secrets: cattle-token-tb7xx
Tokens: cattle-token-tb7xx
Events: <none>4)通過(guò)secret找到token信息
[root@k8s-node02 ~]# kubectl describe secrets cattle-token-tb7xx -n cattle-system
Name: cattle-token-tb7xx
Namespace: cattle-system
Labels: <none>
Annotations: field.cattle.io/projectId: c-wpz72:p-wkqpb
kubernetes.io/service-account.name: cattle
kubernetes.io/service-account.uid: f2acfe4e-0699-4a1a-a8ff-f97a82ce8a0e
Type: kubernetes.io/service-account-token
Data
====
ca.crt: 1058 bytes
namespace: 13 bytes
token: eyJhbGciOiJSUzI1NiIsImtpZCI6Ijg2aUk3TVVuM1V2cnZ2bHAweTVvOUFUaGp0SEhTUjVZa1RrMmZEaTAwakUifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJjYXR0bGUtc3lzdGVtIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImNhdHRsZS10b2tlbi10Yjd4eCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJjYXR0bGUiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJmMmFjZmU0ZS0wNjk5LTRhMWEtYThmZi1mOTdhODJjZThhMGUiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6Y2F0dGxlLXN5c3RlbTpjYXR0bGUifQ.GY3FWEQKi73HXfOEALGQrGGRB_mOPgVLf5pIIYo1Xsn6_98O5qaw9Gkx-_Yz_LCQcSw7VwxXGyryvY9PbWHhW4pwwKqcpnygrwgE3trXDdzna36rc6SCTGLBIteNgBkK0vtHWxRIau5l6aFKCMmuYoR3kAvziY9pFUpdNyqvnrSvge6MDOILcj0jn4nUbGZkFBzDEXFiotNmAWXiMLUKcS-81UedjKDFUIChLyL6FyCsDkcgqHuk52SjzQ75sWJFEd6x_NX2yQwpWXzvebNd5CfIN7fujUYL2fZ_Cx7dmihqaA2N_MMBXsuPU_DMWM2-NivtaKa8x10-OlHJtpdQwg
[root@k8s-node02 ~]# TOKEN=$(kubectl get secrets cattle-token-tb7xx -n cattle-system -o jsonpath={.data.token} | base64 -d)
或
[root@k8s-node02 ~]# TOKEN=(kubectl describe secrets cattle-token-tb7xx -n cattle-system |grep "token:" |awk '{print $2}')
5)訪問(wèn)：
[root@k8s-node02 ~]# curl https://172.16.10.59:10250/metrics/cadvisor -k -H "Authorization: Bearer $TOKEN"
[root@k8s-node02 ~]# curl https://172.16.10.59:10250/metrics -k -H "Authorization: Bearer $TOKEN"?
上面是用線程的用戶和角色權(quán)限，也可以自定定義權(quán)限，角色，用戶信息
下面就可以
第二種：pod訪問(wèn)
創(chuàng)建k8s的用戶，用戶分為普通用戶和serviceAccount用戶
useraccount：外部用戶
serviceAccount：內(nèi)部集群資源直接訪問(wèn)的用戶
1.serviceAccount用戶的創(chuàng)建：
1.1）創(chuàng)建一個(gè)namespace
[root@k8s-node02 ~]# kubectl create namespace wubo1.2）創(chuàng)建serviceaccount?會(huì)自動(dòng)創(chuàng)建一個(gè)secret資源
apiVersion: v1
kind: ServiceAccount
metadata:
name: wubo-service-account
namespace: wubo
查看serviceaccount?
[root@k8s-node02 ~]# kubectl get sa -n wubo wubo-service-account -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
creationTimestamp: "2024-01-22T04:35:54Z"
name: wubo-service-account
namespace: wubo
resourceVersion: "14544"
uid: 3db644bc-2f2a-4183-a0f2-c8178d288bde
secrets:
- name: wubo-service-account-token-2vxk4?查看secret
[root@k8s-node02 ~]# kubectl get secrets -n wubo wubo-service-account-token-2vxk4 -o yaml
apiVersion: v1
data:
ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM0VENDQWNtZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFTTVJBd0RnWURWUVFERXdkcmRXSmwKTFdOaE1CNFhEVEkwTURFeU1qQXlOVFl3TWxvWERUTTBNREV4T1RBeU5UWXdNbG93RWpFUU1BNEdBMVVFQXhNSAphM1ZpWlMxallUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU1tZDJEOVZxaHdzCjl6aEFMNDYvRzc0UGxHRC9yWkRHNHBHdlg0YWRNNVcxTUlySitXOFIzMzBOL2toazdoWTNTTnBudFRtY1NKQ0kKcm5UMCtMTjZMWTBqaFdtUDhGQTNJZWNRU3FNTmU0Wi9XUnB3bzBDK1lIV3lGMjFyNXhpMGZJOUxZcXQ1VHBWaApMVW43cGMrekhBQUR1RStTeE93QWw1QmNkNFZKK3ZzUkhUSWh5TnU4YmhFUGJqMVFHMDBOd20xMmZJMHNuRkU4CncrMEozb3V6NEVUcXFTSjBLVWpNenZFYnYxZjZ0K1d2d2puakZFNEVWWkJReFRQRGxlNkFqcExXZlBpMnJDRWYKeEhEbVkweUtsNk9FMHlZdjRQT3laSHdKclN1aW5walk1L01oUzh0OXRqVjJ0RGR2aUxKbFJuQi91MmxoZWJxLwpsYWh2dE9nY01FOENBd0VBQWFOQ01FQXdEZ1lEVlIwUEFRSC9CQVFEQWdLa01BOEdBMVVkRXdFQi93UUZNQU1CCkFmOHdIUVlEVlIwT0JCWUVGTDRqZVA0TmdKMnlURUNtZFFvdHVwL1dHVHJuTUEwR0NTcUdTSWIzRFFFQkN3VUEKQTRJQkFRQzQwMUhXYmRqYmthQnBTOE5iVlBvcEdPNFN1dnZFWm55YVlEcHdYZEVCWk5nSTVkS2hJSk9CcHhrNQpPVFh5ZW9adm9pL2lXcUlDOEVLZnFGZGRlU0Z6T0RZcHFsTHo2b1BoZUE2ZDJBbmFjUGJJZEE4VGF4VWpDNWJvCjRBMW1TVk04djVNcjQxSUZuTStVNHBKTXh6OGxuZUxRNkVBWjFWdWxWVWtnZlBiczZHczFpYW9hQXFKS05ZRngKOWZDWW9ub3A4YzB4ZzEvUEZBV0M0Z01zSzEwTTlEM04zbkNxcWlwdFJuekhRMTF1ZFpYUERwS3ZOZHdrSmpiUAo3WTdTMFFFVUF5K2pOVjlmcUswLzJienovWldNY3Q3SENPVnFGRlpMMm1WZU1nYytVY0ZFSlIrMUZROFEyeDJzCllTRUk1c2w0bXdLenhqNk5wc0ViZFlkcDgvTG8KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
namespace: d3Vibw==
token: ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNklqZzJhVWszVFZWdU0xVjJjbloyYkhBd2VUVnZPVUZVYUdwMFNFaFRValZaYTFSck1tWkVhVEF3YWtVaWZRLmV5SnBjM01pT2lKcmRXSmxjbTVsZEdWekwzTmxjblpwWTJWaFkyTnZkVzUwSWl3aWEzVmlaWEp1WlhSbGN5NXBieTl6WlhKMmFXTmxZV05qYjNWdWRDOXVZVzFsYzNCaFkyVWlPaUozZFdKdklpd2lhM1ZpWlhKdVpYUmxjeTVwYnk5elpYSjJhV05sWVdOamIzVnVkQzl6WldOeVpYUXVibUZ0WlNJNkluZDFZbTh0YzJWeWRtbGpaUzFoWTJOdmRXNTBMWFJ2YTJWdUxUSjJlR3MwSWl3aWEzVmlaWEp1WlhSbGN5NXBieTl6WlhKMmFXTmxZV05qYjNWdWRDOXpaWEoyYVdObExXRmpZMjkxYm5RdWJtRnRaU0k2SW5kMVltOHRjMlZ5ZG1salpTMWhZMk52ZFc1MElpd2lhM1ZpWlhKdVpYUmxjeTVwYnk5elpYSjJhV05sWVdOamIzVnVkQzl6WlhKMmFXTmxMV0ZqWTI5MWJuUXVkV2xrSWpvaU0yUmlOalEwWW1NdE1tWXlZUzAwTVRnekxXRXdaakl0WXpneE56aGtNamc0WW1SbElpd2ljM1ZpSWpvaWMzbHpkR1Z0T25ObGNuWnBZMlZoWTJOdmRXNTBPbmQxWW04NmQzVmlieTF6WlhKMmFXTmxMV0ZqWTI5MWJuUWlmUS5Sb3hOVlhBMVdnUXgxYUFiVUdJek5CeGZXVnVIVVRrdjJlVzhuTzFjeEVUY2txZUd3N1kyeWZsVEJwckVocDkzYkxkMjJsZVBFams4NjRXdTM5YmtDWFNQRE1GX09jbUhNUnN0M3ZNZEE1STZ0YVRySTVoSVVMekd2OUQ0Mm5HU1pPcmt5OERweDJ1UHFYcWdfdEZpNzh1SkRXZ283Yl9wS0lmX3pRM1FqNFpQbUlhQXNVczNuNk5OdTgwcUl1d2FaQ0xHaGxLTVR5TF9iSXBpRkhSUGFpa1JSaWNaaEU4bmgtR1hHYlVUVVNTZ2YwRkNDa1FxVXl6eTdubFBYMTFuZjdZYnJqdkJSVjB3bGFDU3dYak5feEI2UDJoQTFHWXhuSC1XLTEtS3RVY1lMVTBtZ1QzUFVXdlh2UUxjSS1wdm5ZZ3JEU0l1c2FGMFFEVjgzdFhWZHc=
kind: Secret
metadata:
annotations:
kubernetes.io/service-account.name: wubo-service-account
kubernetes.io/service-account.uid: 3db644bc-2f2a-4183-a0f2-c8178d288bde
creationTimestamp: "2024-01-22T04:35:54Z"
managedFields:
- apiVersion: v1
fieldsType: FieldsV1
fieldsV1:
f:data:
.: {}
f:ca.crt: {}
f:namespace: {}
f:token: {}
f:metadata:
f:annotations:
.: {}
f:kubernetes.io/service-account.name: {}
f:kubernetes.io/service-account.uid: {}
f:type: {}
manager: kube-controller-manager
operation: Update
time: "2024-01-22T04:35:54Z"
name: wubo-service-account-token-2vxk4
namespace: wubo
resourceVersion: "14543"
uid: 70ae3e2a-1b91-498d-9bc8-56c8522d42b1
type: kubernetes.io/service-account-token?此時(shí)就可以獲取token了和ca.crt
[root@k8s-node02 ~]# kubectl get secret -n wubo wubo-service-account-token-2vxk4 -o jsonpath={.data.token} | base64 -d?namespace：
[root@k8s-node02 ~]# kubectl get secret -n wubo wubo-service-account-token-2vxk4 -o jsonpath={.data.namespace} |base64 -dca.crt
[root@k8s-node02 ~]# kubectl get secret -n wubo wubo-service-account-token-2vxk4 -o jsonpath={.data.ca\\.crt} |base64 -d?1.3)創(chuàng)建全局的資源權(quán)限ClusterRole是全局的，不分namespace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: wubo-cluster-role
rules:
- apiGroups:
- ""
resources:
- '*'
#- ["pods","pods/log","pods/exec", "pods/attach", "pods/status","services","nodes/metrics","nodes/stats","nodes/proxy",]
verbs:
#- ["get", "watch", "list", "create", "update", "patch", "delete","exec"]
- '*'1.4）創(chuàng)建綁定? 用戶和集群角色綁定文章來(lái)源：http://www.zghlxwxcb.cn/news/detail-821443.html
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: wubo-cluster-role-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: wubo-cluster-role
subjects:
- kind: ServiceAccount
name: wubo-service-account
namespace: wuboall文件：?文章來(lái)源地址http://www.zghlxwxcb.cn/news/detail-821443.html
[root@k8s-node02 ~]# cat auth.yaml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: wubo-cluster-role
rules:
- apiGroups:
- ""
resources:
- '*'
#- ["pods","pods/log","pods/exec", "pods/attach", "pods/status","services","nodes/metrics","nodes/stats","nodes/proxy",]
verbs:
#- ["get", "watch", "list", "create", "update", "patch", "delete","exec"]
- '*'
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: wubo-service-account
namespace: wubo
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: wubo-cluster-role-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: wubo-cluster-role
subjects:
- kind: ServiceAccount
name: wubo-service-account
namespace: wubo到了這里，關(guān)于通過(guò)curl訪問(wèn)k8s集群獲取證書或token的方式的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
