为Kubernetes dashboard访问用户添加权限控制
为Kubernetes dashboard访问用户添加权限控制1. 需求在开发环境给开发人员创建应用部署管理权限，可以使用dashboard的token和kubeconfig文件登录，并在开发人员机器上安装kubectl命令，可以使用kubectl port-forward命令。2. 方案因为我们用到了dashboard和kubeapps，所以他们的rbac权限都要分配。
创建namespace：dev
创建ServiceAccount：dev-user1
给相应权限，并绑定ServiceAccount。3. 实现3.1 分配dashboard权限kubectl apply -f dev-user1.yaml---# ServiceAccountapiVersion: v1kind: ServiceAccountmetadata:name: dev-user1namespace: dev---# rolekind: RoleapiVersion: rbac.authorization.k8s.io/v1metadata:namespace: devname: role-dev-user1rules:- apiGroups: [""]resources: ["pods"]verbs: ["get", "list", "watch", "delete", "update", "patch"]- apiGroups: [""]resources: ["pods/portforward", "pods/proxy"]verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]- apiGroups: [""]resources: ["pods/log"]verbs: ["get", "list", "watch", "delete"]- apiGroups: ["extensions", "apps"]resources: ["deployments"]verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]- apiGroups: [""]resources: ["namespaces"]verbs: ["get", "watch", "list"]- apiGroups: [""]resources: ["events"]verbs: ["get", "watch", "list"]- apiGroups: ["apps", "extensions"]resources: ["replicasets"]verbs: ["get", "watch", "list", "create", "update", "pathch", "delete"]- apiGroups: [""]resources: ["configmaps"]verbs: ["get", "watch", "list", "create", "update", "pathch", "delete"]- apiGroups: [""]resources: ["persistentvolumeclaims"]verbs: ["get", "watch", "list"]- apiGroups: [""]resources: ["secrets"]verbs: ["get", "watch", "list"]- apiGroups: [""]resources: ["services"]verbs: ["get", "watch", "list", "create", "update", "pathch", "delete"]- apiGroups: ["extensions"]resources: ["ingresses"]verbs: ["get", "watch", "list"]- apiGroups: ["apps"]resources: ["daemonsets"]verbs: ["get", "watch", "list"]- apiGroups: ["batch"]resources: ["jobs"]verbs: ["get", "watch", "list"]- apiGroups: ["batch"]resources: ["cronjobs"]verbs: ["get", "watch", "list"]- apiGroups: [""]resources: ["replicationcontrollers"]verbs: ["get", "watch", "list"]- apiGroups: ["apps"]resources: ["statefulsets"]verbs: ["get", "watch", "list"]- apiGroups: [""]resources: ["endpoints"]verbs: ["get", "watch", "list"]---# role bindkind: RoleBindingapiVersion: rbac.authorization.k8s.io/v1metadata:name: role-bind-dev-user1namespace: devsubjects:- kind: ServiceAccountname: dev-user1namespace: devroleRef:kind: Rolename: role-dev-user1apiGroup: rbac.authorization.k8s.io#---## clusterrole#kind: ClusterRole#apiVersion: rbac.authorization.k8s.io/v1#metadata:#namespace: dev#name: clusterrole-dev-user1#rules:#- apiGroups: [""]#resources: ["namespaces"]#verbs: ["get", "watch", "list"]##---## clusterrole bind#kind: ClusterRoleBinding#apiVersion: rbac.authorization.k8s.io/v1#metadata:#name: clusterrole-bind-dev-user1#namespace: dev#subjects:#- kind: ServiceAccount#name: dev-user1#namespace: dev#roleRef:#kind: ClusterRole#name: clusterrole-dev-user1#apiGroup: rbac.authorization.k8s.io3.2 分配kubeapps权限kubectl apply -f https://raw.githubusercontent.com/kubeapps/kubeapps/master/docs/user/manifests/kubeapps-applications-read.yamlkubectl create -n dev rolebinding dev-user1-view \--clusterrole=kubeapps-applications-read \--serviceaccount dev:dev-user1export KUBEAPPS_NAMESPACE=kubeappskubectl apply -n $KUBEAPPS_NAMESPACE -f https://raw.githubusercontent.com/kubeapps/kubeapps/master/docs/user/manifests/kubeapps-repositories-read.yamlkubectl create -n dev rolebinding dev-user1-edit \--clusterrole=edit \--serviceaccount dev:dev-user1kubectl create -n $KUBEAPPS_NAMESPACE rolebinding dev1-user1-kubeapps-repositories-read \--role=kubeapps-repositories-read \--serviceaccount dev:dev-user1token获取：kubectl get -n dev secret $(kubectl get -n dev serviceaccount dev-user1 -o jsonpath='{.secrets[].name}') -o jsonpath='{.data.token}' | base64 --decode3.3 生成kubeconfig通过token方式访问kube-apiserver# 创建 kubectl config 文件# 设置集群参数kubectl config set-cluster kubernetes \--insecure-skip-tls-verify=true \--server="https://192.168.105.99:8443"# 设置客户端认证参数kubectl config set-credentials dev-user1 \--token='上文中获取到的token' # 设置上下文参数kubectl config set-context kubernetes \--cluster=kubernetes \--user=dev-user1\--namespace=dev # 设置默认上下文kubectl config use-context kubernetes注意
配置kubeconfig时指定路径，以免覆盖已有配置，--kubeconfig=configpath也可以直接创建文件config，修改内容即可。apiVersion: v1clusters:- cluster: insecure-skip-tls-verify: true server: https://192.168.105.99:8443name: kubernetescontexts:- context: cluster: kubernetes namespace: dev user: dev-user1name: kubernetescurrent-context: kuberneteskind: Configpreferences: {}users:- name: dev-user1user: token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZXYiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlY3JldC5uYW1lIjoiZGV2LXVzZXIxLXRva2VuLTJsbDlnIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZX291bnQubmFtZSI6ImRldi11c2VyMSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjdiY2Q4N2E1LWM0NGEtMTFlOC1iY2I5LTAwMGMyOWVhM2UzMCIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZXY6ZGV2LXVzZXIxIn0.1M84CPHY-GoyeaRFyBcD49GTwG5o0HMhN8lVsH9GDiqdui-1ppyi3JMONRJ9aWdswEF7-wsb5d4MQEk-9z5yiVh2r8SMP0EhcUR5ierntzD1bwwwuYzDxE4vHAuPB1tTxM0fOL3H-BOjt68iBKmOtRJumx8LzSUleQiNBBqR1B_yRLqrO6yslw44WC432O5g1v4. 测试验证windows kubectl命令安装命令下载：
https://storage.googleapis.com/kubernetes-release/release/v1.12.0/bin/windows/amd64/kubectl.exe然后将其放至系统PATH目录下，比如c:\Windows
命令使用时，可使用cmd、powershell或者其它命令提示行工具。推荐使用Git Bash，因为安装过Git，则安装了此工具。kubeconfig文件
kubeconfig文件，即上文件中生成的config文件。
文件名为config，文件放到 ~/.kube/下（~为用户家目录），因为kubectl命令默认读取此文件，否则每次使用kubectl命令，需要用参数--kubeconfig=configpath指定。kubectl get pod -n devkubectl port-forward svc/dev-mysql-mysqlha 3306:3306 -n dev参考资料：
https://kubernetes.io/docs/reference/access-authn-authz/rbac/
https://blog.qikqiak.com/post/add-authorization-for-kubernetes-dashboard/
https://github.com/kubeapps/kubeapps/blob/master/docs/user/access-control.md
https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#config
https://kubernetes.io/docs/tasks/tools/install-kubectl/#configure-kubectl
页:
[1]
