概述

一般情况，生产kubernetes集群系统按运维职责划分多个命名空间并配置多个维护账户，kubernetes对 这些安全需求场景都有很好支持 。

实现步骤

因为是HA方案三个master节点kubernetes集群，在哪一个master节点执行步骤命令都可以。

• 1、切到linux系统root账户，创建learn账户，并设置密码

useradd learn 
passwd learn 
learn1234

• 2、创建k8s集群普通账号learn相关证书

mkdir -p /root/kubeadm/rbac 
openssl genrsa -out learn.key 2048 
openssl req -new -key learn.key -out learn.csr -subj "/CN=learn/O=learn" 
openssl x509 -req -in learn.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out learn.crt -days 3650 

• 3、创建k8s集群普通账号learn的context

kubectl config set-context learn-context --cluster=kubernetes --namespace=default --user=learn
 # 验证k8s集群context， 包含：kubernetes-admin@kubernetes（集群安装时自动创建）和learn- context 
kubectl config get-contexts 
# 切换到新账号learn创建的k8s集群context 
kubectl config use-context learn-context 
# 验证context 
kubectl config current-context 
# k8s集群普通账号learn证书添加到k8s集群 
kubectl config set-credentials learn --client-certificate=learn.crt --client-key=learn.key 
# 实操提示：删除context命令：
kubectl config delete-context learn-context 
# 验证命令会输出k8s资源没有授权的错误日志 
kubectl get pods --context=learn-context 

• 4、切回root账户，通过yaml文件创建角色和角色绑定
  k8s集群支持授权资源类型较多，生产环境根据运维职责需求分配资源角色权限

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: learn-reader
rules:
- apiGroups: ["","apps","extensions"]
  resources: ["pods", "pods/log", "deployments"]
  verbs: ["get", "watch", "list"]

实操提示：
apiGroups为k8s集群API版本号，如：apps/v1 和 extensions/v1beta1 ;
resources 授权资源 ;
verbs 操作事件，查看(create)、修改(edit)、删除(delete)等。

角色权限绑定

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: learn-role-binding
  namespace: default
subjects:
- kind: User
  name: learn
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: learn-reader
  apiGroup: rbac.authorization.k8s.io

创建集群角色

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cluster-reader
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "watch", "list"]

集群角色权限绑定

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: learn-ClusterRoleBinding
subjects:
- kind: Group
  name: learn
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-reader
  apiGroup: rbac.authorization.k8s.io

切换到k8s集群超级管理员context，并执行创建角色绑定

kubectl config use-context kubernetes-admin@kubernetes
kubectl config current-context

kubectl create -f learn-role.yaml kubectl create -f learn-role-binding.yaml
kubectl create -f learn-cluster-reader.yaml kubectl create -f learn-ClusterRoleBinding.yaml

• 5、将linux系统root账号HOME/.kube下

cp $HOME/.kube/config /home/learn/.kube/ 
chown -R learn:learn /home/learn/ 
cp /root/kubeadm/rbac/learn.crt /home/learn/ 
cp /root/kubeadm/rbac/learn.key /home/learn/ 
chown -R learn:learn /home/learn/ 

# 修改config文件，将learn.crt和learn.key文件地址改为/home/learn/目录下
 vi /home/learn/.kube/config 

• 6、在linux的root账号下，切换到新创建learn账号，验证授权正确
  如果授权正确，切到learn账号后，执行下面kubectl命令输出内容正确（实操提示：learn账号有权限的 资源类型输出均正确，无权限的资源会提示无权限）

kubectl config use-context learn-context 
kubectl config current-context 
kubectl get po -o wide 
kubectl get deploy -o wide 
kubectl get no -o wide 
kubectl get ns -o wide

• 7、在linux的root账号下，验证完成后，可切回k8s集群管理员账号查看集群信息

kubectl config use-context kubernetes-admin@kubernetes 

• 8、在linux的root账号下，变更授权，验证权限

# 新增/删除权限 
kubectl edit role learn-role