权限精细化分配—通过sa和自建角色实现权限精细化分配

1.新建sa

kubectl create sa lishanbin -n planck

2.建立一个角色，并将该角色绑定到sa上

角色role-sa 具有的权限仅仅是namespace planck内的所有pod的查看权限，以及deployment的查看权限，无权删除修改这些资源

[root@k8s-master ~]# cat sa-role-binding.yaml 
#k8s 1.22.10
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:name: role-sanamespace: planck                         #指定 Namespace
rules:                                      #权限分配- apiGroups: [""]resources: ["pods"]verbs: ["get", "watch", "list"]- apiGroups: [""]resources: ["pods/log"]verbs: ["get","list","watch"]- apiGroups: [""]resources: ["pods/attach"]verbs: ["get","list","watch"]- apiGroups: [""]resources: ["pods/exec"]verbs: ["get","list","watch"]- apiGroups: [""]resources: ["pods/status"]verbs: ["get","list","watch"]- apiGroups: [""]resources: ["podtemplates"]verbs: ["get","list","watch"]- apiGroups: ["extensions", "apps"]resources: ["deployments","statefulsets"]verbs: ["get", "list", "watch"]- apiGroups: [""]resources: ["configmaps"]verbs: ["get", "list", "watch"]- apiGroups: [""]resources: ["endpoints"]verbs: ["get", "list", "watch"]- apiGroups: [""]resources: ["events"]verbs: ["get", "list", "watch"]- apiGroups: [""]resources: ["replicationcontrollers"]verbs: ["get", "list", "watch"]- apiGroups: [""]resources: ["replicationcontrollers/status"]verbs: ["get"]- apiGroups: [""]resources: ["services"]verbs: ["get", "list", "watch"]- apiGroups: [""]resources: ["services/status"]verbs: ["get", "list", "watch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:name: rbac-role-bindingnamespace: planck                 #指定 Namespace
subjects:- kind: ServiceAccountname: lishanbin                 #指定 ServiceAccountnamespace: planck              #指定 Namespace
roleRef:kind: Rolename: role-saapiGroup: rbac.authorization.k8s.io

3.授权namespace的权限,设置ClusterRole和ClusterRolebinding

为什么要授权是因为sa内的secrets里的token只有在dashboard内使用，而上面的角色和角色绑定都是dev这个namespace内的，这样绑定后，拿到token才可以登录到dashboard的首页，否则都无法选择namespace。

cat rbac-cluster-role-binding.yaml 
#k8s 1.22.10
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:name: rbac-namespace-role
rules:- apiGroups: [""]                     #配置权限，配置其只用于 namespace 的 list 权限resources: ["namespaces"]verbs: ["list"]- apiGroups: [""]resources: ["namespaces/status"]verbs: ["get"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:name: rbac-default-role-binding
subjects:- kind: ServiceAccountname: lishanbin                     #配置为自定义的 ServiceAccountnamespace: planck                  #指定为服务账户所在的 Namespace
roleRef:kind: ClusterRolename: rbac-namespace-role             #配置上面的 RoleapiGroup: rbac.authorization.k8s.iokubectl -n planck describe secret $(kubectl get secret -n planck | grep lishanbin | awk '{print $1}')

kubernetes的dashboard提供Token和kubeconfig两种认证方式，因此上面拿到token以后可以通过token进行访问planck这个ns下的资源了。