使用 NGINX Ingress 进行 Kubernetes 角色管理

Question

I have a Kubernetes Cluster running on Azure (AKS) with NGINX Ingress in front.

I'm a little bit confused how to seperate access on the diffrent ressources for multiple Users.

The users should work on the apps. That's why it is fine if they can read logs, descriptions and exec some commands inside of the pods. But they should never adjust some Ingress ressources.

Microsoft provide a very good tutorial how to handle cases like that on AKS: https://docs.microsoft.com/en-us/azure/aks/azure-ad-rbac

There is an example how to add permissions to a group to the whole namespace.

My Question is now, how can I add permissions for a group to specific ressources inside of a namespace.

For example I have following ressources:

ressource              type        namespace     

ingress-controller     pod         nginx-ingress
ingress-service        service     nginx-ingress
ingress-nginx          ingress     nginx-ingress
app1-service           service     nginx-ingress
app1                   pod         nginx-ingress
app2-service           service     nginx-ingress
app2                   pod         nginx-ingress

From my understanding I need to deploy all of them in the same namespace, otherwise the ingress can't forward the requests. But how I can grant read, write, execute permissions to group1 for app1 and app1-service, and read to the rest?

Answer 1

You can specify specific resources by name in RBAC roles with the resourceNames field.

Create a Role that allows full access to app1 and app1-service :

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: app1-admin
rules:
- apiGroups:
  - ""
  resourceNames:
  - app1
  - app1-service
  resources:
  - pods
  - pods/exec
  - service
  verbs:
  - get
  - list
  - watch
  - create

Create Role that allows read access to all other Pods and Services:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: read-all
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - service
  verbs:
  - get
  - list
  - watch

Create two RoleBindings that bind both of these Roles to the group1 group:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app1-admin-group1
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: app1-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: group1

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-all-group1
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: read-all
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: group1

Now, members of group1 should have full access to Pod app1 and Service app1-service , but only read access to all other resources.

Answer 2

I dont think thats true at all, you can have ingress resources in different namespaces. also, you can actually refer to resource names in rbac.

https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources