万字长文 | 使用 RBAC 限制对 Kubernetes 资源的访问

apiVersion: v1
kind: Pod
metadata:
name: my-pod
spec:
containers:
- name: sise
  image: learnk8s/app:1.0.0
  ports:
  - containerPort: 8080

| User | Permission | Resource |
| ----- | ---------- | -------- |
| Bob   | read+write |   app1   |
| Alice |   read   |   app2   |
| Mo   |   read   |   app2   |

| User     | Permission | Resource |
| --------- | ---------- | -------- |
| Bob       | read+write |   app1   |
| Alice     |   read   |   app2   |
| Mo       |   read   |   app2   |
| Alice     |   read   |   app1   |
| Mo       |   read   |   app1   |

| Role     | Permission | Resource |
| -------- | ---------- | -------- |
| admin1   | read+write |   app1   |
| reviewer |   read   |   app2   |

| User |   Roles |
| ----- | -------- |
| Bob   | admin1 |
| Alice | reviewer |
| Mo   | reviewer |

| User |       Roles       |
| ----- | ------------------- |
| Bob   |       admin1       |
| Alice |       reviewer     |
| M

kube-apiserver --authorization-mode=Example,RBAC --<其他选项> --<其他选项>

apiVersion: v1
kind: ServiceAccount
metadata:
name: serviceaccount:app1
namespace: demo-namespace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: role:viewer
namespace: demo-namespace
rules:          # Authorization rules for this role
- apiGroups:  # 1st API group
    - ''      # An empty string designates the core API group.
  resources:
    - services
    - pods
  verbs:
    - get
    - list
- apiGroups: # 2nd API group
    - apiextensions.k8s.io
  resources:
    - customresourcedefinitions
  verbs:
    - list
- apiGroups: # 3rd API group
    - cilium.io
  resources:
    - ciliumnetworkpolicies
    - ciliumnetworkpolicies/status
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: rolebinding:app1-viewer
namespace: demo-namespace
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: role:viewer
subjects:
- kind: ServiceAccount
  name: serviceaccount:app1
  namespace: demo-namespace

# 1. Kubernetes builtin resources
/api/v1/namespaces/{namespace}/services
/api/v1/namespaces/{namespace}/pods

# 2. A specific API extention provided by cilium.io
/apis/cilium.io/v2/namespaces/{namespace}/ciliumnetworkpolicies
/apis/cilium.io/v2/namespaces/{namespace}/ciliumnetworkpolicies/status

type User struct {
   name string   // unique for each user
   ...           // other fields
}

apiVersion: v1
kind: ServiceAccount
metadata:
name: sa:app1             # arbitrary but unique string
namespace: demo-namespace

/api/v1/namespaces/{namespace}/pods/{name}
/api/v1/namespaces/{namespace}/pods/{name}/log
/api/v1/namespaces/{namespace}/serviceaccounts/{name}

resources:
- /api/v1/namespaces/{namespace}/pods/{name}
- /api/v1/namespaces/{namespace}/pods/{name}/log
- /api/v1/namespaces/{namespace}/serviceaccounts/{name}
verbs:
- get
- list
- watch

resources:
- pods
- pods/logs
- serviceaccounts
verbs:
- get
- list
- watch

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: ciliumendpoints.cilium.io
spec:
group: cilium.io
names:
  kind: CiliumEndpoint
scope: Namespaced
# truncated...

$ kubectl get ciliumendpoints.cilium.io -n demo-namespace
NAME   ENDPOINT ID   IDENTITY ENDPOINT STATE   IPV4
IPV6
app1   2773         1628124 ready           10.6.7.54
app2   3568         1624494 ready           10.6.7.94
app3   3934         1575701 ready           10.6.4.24
$

/apis/cilium.io/v2/namespaces/{namespace}/ciliumendpoints
/apis/cilium.io/v2/namespaces/{namespace}/ciliumendpoints/{name}

resources:
- ciliumnetworkpolicies  
- ciliumnetworkpolicies/status
verbs:
- get

apiGroups:
- cilium.io     # APIGroup name
resources:
- ciliumnetworkpolicies  
- ciliumnetworkpolicies/status
verbs:
- get

apiGroups:
- '' # Built-in objects
resources:
- pods  
- pods/logs  
- serviceaccounts
verbs:
- get  
- list  
- watch

rules:
- rule 1  
- rule 2

rules: # Authorization rules
- apiGroups: # 1st API group
    - '' # An empty string designates the core API group.
  resources:
    - pods
    - pods/logs
    - serviceaccounts
  verbs:
    - get
    - list
    - watch
- apiGroups: # another API group
    - cilium.io # Custom APIGroup
  resources:
    - ciliumnetworkpolicies
    - ciliumnetworkpolicies/status
  verbs:
    - get

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: viewer
rules: # Authorization rules
- apiGroups: # 1st API group
    - '' # An empty string designates the core API group.
  resources:
    - pods
    - pods/logs
    - serviceaccounts
  verbs:
    - get
    - list
    - watch
- apiGroups: # another API group
    - cilium.io # Custom APIGroup
  resources:
    - ciliumnetworkpolicies
    - ciliumnetworkpolicies/status
  verbs:
    - get

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: role-binding-for-app1
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: viewer
subjects:
- kind: ServiceAccount
  name: sa-for-app1
  namespace: kube-system

subjects:
- kind: Group
  name: system:serviceaccounts
  apiGroup: rbac.authorization.k8s.io
   # when the namespace field is not specified, this targets all service accounts in all namespace

subjects:
- kind: Group
  name: system:authenticated # for all authenticated users
  apiGroup: rbac.authorization.k8s.io
- kind: Group
  name: system:unauthenticated # for all unauthenticated users
  apiGroup: rbac.authorization.k8s.io

/api/v1/namespaces/{namespace}/pods/{name}
/api/v1/namespaces/{namespace}/pods/{name}/log
/api/v1/namespaces/{namespace}/serviceaccounts/{name}

/api/v1/nodes/{name}
/api/v1/persistentvolume/{name}

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: viewer
rules: # Authorization rules
- apiGroups: # 1st API group
    - '' # An empty string designates the core API group.
  resources:
    - persistentvolumes
    - nodes
  verbs:
    - get
    - list
    - watch

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: viewer
rules:          # Authorization rules
- apiGroups:  # 1st API group
    - ''      # An empty string designates the core API group.
  resources:
    - persistentvolumes
    - nodes
  verbs:
    - get
    - list
    - watch

$ kubectl get roles -n kube-system | grep "^system:"
NAME
system::leader-locking-kube-controller-manager
system::leader-locking-kube-scheduler
system:controller:bootstrap-signer
system:controller:cloud-provider
system:controller:token-cleaner
# truncated output...

$ kubectl get clusterroles -n kube-system | grep "^system:"
NAME
system:aggregate-to-admin
system:aggregate-to-edit
system:aggregate-to-view
system:discovery
system:kube-apiserver
system:kube-controller-manager
system:kube-dns
system:kube-scheduler
# truncated output...

$ kubectl get role <role> -n kube-system -o yaml
# or
$ kubectl get clusterrole <clusterrole> -n kube-system -o yaml

$ minikube start
😄 minikube v1.24.0
✨ Automatically selected the docker driver
👍 Starting control plane node in cluster
🚜 Pulling base image ...
🔥 Creating docker container (CPUs=2, Memory=4096MB) ...
🐳 Preparing Kubernetes v1.22.3 on Docker 20.10.8 ...
  ▪ Generating certificates and keys ...
  ▪ Booting up control plane ...
  ▪ Configuring RBAC rules ...
🔎 Verifying Kubernetes components...
  ▪ Using image gcr.io/k8s-minikube/storage-provisioner:v5
🌟 Enabled addons: storage-provisioner, default-storageclass
🏄 Done! kubectl is now configured to use the cluster and "default" namespace by default

$ kubectl create namespace test
namespace/test created
$ kubectl create namespace test2
namespace/test2 created
$ kubectl create namespace test3
namespace/test3 created
$ kubectl create namespace test4
namespace/test4 created

apiVersion: v1
kind: ServiceAccount
metadata:
name: myaccount
namespace: test

$ kubectl apply -f service-account.yaml
serviceaccount/myaccount created

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: testadmin
namespace: test
rules:
- apiGroups: ['*']
  resources: ['*']
  verbs: ['*']
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: testadminbinding
namespace: test
subjects:
- kind: ServiceAccount
  name: myaccount
  namespace: test
roleRef:
kind: Role
name: testadmin
apiGroup: rbac.authorization.k8s.io

$ kubectl apply -f scenario1.yaml
role.rbac.authorization.k8s.io/testadmin createdrolebinding.rbac.authorization.k8s.io/testadminbinding created

$ kubectl auth can-i get pods -n test --as=system:serviceaccount:test:myaccount
yes

--as=system:serviceaccount:{namespace}:{service-account-name}
    ^^^^^^^^^^^^^^^^^^^^^
    This should always be included for Service Accounts.

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: test2
name: testadmin
rules:
- apiGroups: ['*']
  resources: ['*']
  verbs: ['*']
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: testadminbinding
namespace: test2
subjects:
- kind: ServiceAccount
  name: myaccount
  namespace: test
roleRef:
kind: Role
name: testadmin
apiGroup: rbac.authorization.k8s.io

$ kubectl apply -f scenario2.yaml
role.rbac.authorization.k8s.io/testadmin created
rolebinding.rbac.authorization.k8s.io/testadminbinding created

$ kubectl auth can-i get pods -n test2 --as=system:serviceaccount:test:myaccount
yes

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: testadminbinding
namespace: test2
subjects:
- kind: ServiceAccount
  name: myaccount
  namespace: test
roleRef:
kind: Role
name: testadmin
apiGroup: rbac.authorization.k8s.io

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: testadminclusterbinding
subjects:
- kind: ServiceAccount
  name: myaccount
  namespace: test
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io

$ kubectl get secret demo-sa-token-hrfq2 -o yaml
apiVersion: v1
data:
ca.crt: (APISERVER'S CA BASE64 ENCODED)
namespace: ZGVmYXVsdA==
token: (BEARER TOKEN BASE64 ENCODED)
kind: Secret
metadata:
# truncated output ...
type: kubernetes.io/service-account-token

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: role-grantor
rules:
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["rolebindings"]
verbs: ["create"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources: ["clusterroles"]
verbs: ["bind"]
 # 忽略 resourceNames 意味着允许绑定任何 ClusterRole
resourceNames: ["admin","edit","view"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: role-grantor-binding
namespace: user-1-namespace
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: role-grantor
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: user-1