[英]GKE Kubernetes RBAC bind default role to my limited custom
I'm using GI want to create a custom user that have only access to specific namespace, I used this yaml: 我正在使用GI来创建一个只能访问特定名称空间的自定义用户,我使用了以下yaml:
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: develop-user
namespace: develop
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: develop-user-full-access
namespace: develop
rules:
- apiGroups: rbac.authorization.k8s.io
resources:
- services
verbs: ["get"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: develop-user-view
namespace: develop
subjects:
- kind: ServiceAccount
name: develop-user
namespace: develop
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: develop-user-full-access
so I get a certificate and added to my kube config, after I switched context to this new service account and figured out that I still have access to everything :( 所以当我将上下文切换到这个新服务帐户并发现我仍然可以访问所有内容后,我得到了证书并添加到我的kube配置中。
Why did it happen and how to fix? 为什么会发生以及如何解决?
my kubeconfig (pastebin copy: https://pastebin.com/s5Nd6Dnn ): 我的kubeconfig(astebin副本: https ://pastebin.com/s5Nd6Dnn):
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: %certificate-data%
server: https://animeheaven.nyah
name: anime-cluster-develop
contexts:
- context:
cluster: anime-cluster-develop
namespace: develop
user: develop-user
name: anime-develop
current-context: anime-develop
kind: Config
preferences: {}
users:
- name: develop-user
user:
client-key-data: %certdata%
token: %tokenkey%
https://medium.com/uptime-99/making-sense-of-kubernetes-rbac-and-iam-roles-on-gke-914131b01922 https://medium.com/uptime-99/making-sense-of-kubernetes-rbac-and-iam-roles-on-gke-914131b01922
https://medium.com/@ManagedKube/kubernetes-rbac-port-forward-4c7eb3951e28 https://medium.com/@ManagedKube/kubernetes-rbac-port-forward-4c7eb3951e28
these two articles helped me finally! 这两篇文章终于对我有所帮助! I almost felt into depression because of this stupid stuff, thanks to uptime-99 and ManagedKube I did it! 由于这些愚蠢的东西,我几乎感到沮丧,这要归功于uptime-99和ManagedKube我做到了! yay! 好极了!
the key is to create kubernetes-viewer user in gcloud and then create a role for him here is a hint! 关键是在gcloud中创建kubernetes-viewer用户,然后为他创建一个角色,这是一个提示!
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: develop
name: allow-developer-port-forward
rules:
- apiGroups: [""]
resources: ["pods", "pods/portforward"]
verbs: ["get", "list", "create"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: anime-developer-port-access
namespace: develop
subjects:
- kind: User
name: ANIMEDEVERLOP@gmail.com
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: allow-developer-port-forward
apiGroup: ""
then 然后
kubectly apply -f accessconfig.yaml kubectly应用-f accessconfig.yaml
thats it! 而已!
have a nice day! 祝你今天愉快!
Here's a good article on how to set it up: https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html . 这是一篇有关如何设置它的好文章: https : //jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html 。
In general, your configuration is fine, what I changed is the line - apiGroups: rbac.authorization.k8s.io
changed to: 通常,您的配置很好,我更改的是以下行- apiGroups: rbac.authorization.k8s.io
更改为:
- apiGroups: ["", "extensions", "apps"]
Then, applied the following steps: 然后,应用以下步骤:
develop
namespace 创建develop
命名空间 $ kubectl create namespace develop
$ kubectl apply -f rbac.yaml
$ kubectl cluster-info
$ kubectl get secret develop-user-token-2wsnb -o jsonpath={.data.token} -n develop | base64 --decode
$ kubectl get secret develop-user-token-2wsnb -o "jsonpath={.data['ca\.crt']}" -n develop
~/.kube/config
file (as described in the linked guide ) 填充~/.kube/config
文件(如链接指南中所述 ) develop
改变环境develop
develop
namespace. 用户只能访问develop
名称空间中的检查服务。 $ kubectl get service my-service -n mynamespace
Error from server (Forbidden): services "my-service" is forbidden: User "system:serviceaccount:develop:develop-user" cannot get services in the namespace "mynamespace"
$ kubectl get service my-service -n develop
hError from server (NotFound): services "my-service" not found
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.