15.service认证机制

kubernetes的安全机制，不仅仅再客户端和apisever之间的交互，各pod之间后者跨namespace之间也要以此为基准配合 RBAC来进行。提到另一个账户关系serviceaccount简称sa。

• User accounts are for humans. Service accounts are for processes, which run in pods.

创建一个属于自己的sa

[root@master song]# kubectl create sa lele
serviceaccount/lele created

[root@master song]# kubectl describe sa lele
Name:                lele
Namespace:           default
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   lele-token-7mpr5
Tokens:              lele-token-7mpr5
Events:              <none>
[root@master song]# kubectl get secrets
NAME                  TYPE                                  DATA   AGE
default-token-tlx48   kubernetes.io/service-account-token   3      30d
lele-token-7mpr5      kubernetes.io/service-account-token   3      39d

创建一个pod使用这个sa

[root@master song]# cat pod-sa.yml
apiVersion: v1
kind: Pod
metadata:
  name: pod-sa
  namespace: default
  labels:
    app: myapp
    tier: frontend
    2sdlfj: dashazi
spec:
  containers:
  - name: myapp-
    image: hub.c..com/library/nginx:1.13
    volumeMounts:
    - name: song
  serviceAccountName: lele
[root@master song]# kubectl create -f pod-sa.yml
[root@master song]# kubectl describe pods pod-sa
Name:               pod-sa
Namespace:          default
Priority:
PriorityClassName:  <none>
Node:               k8s-node1/172.20.0.76
Start Time:         Thu,  Mar  :: +
Labels:             2sdlfj=dashazi
                    app=myapp
                    tier=frontend
Annotations:        <none>
Status:             Running
IP:                 10.244.2.218
Containers:
  myapp-:
    Container ID:   docker://17df9be1c9e987f2c44ec9aed90e8c499a414da82142c8494a4d8ce640883326
    Image:          hub.c..com/library/nginx:1.13
    Image ID:       docker-pullable://hub.c.163.com/library/nginx@sha256:ff094de32a0d3b5efc29cec60daa709c5378cf4e53e4c9fd1d3433b87ac8ec8b
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Thu,  Mar  :: +
    Ready:          True
    Restart Count:
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from lele-token-7mpr5 (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  lele-token-7mpr5:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  lele-token-7mpr5
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type    Reason     Age    From                Message
  ----    ------     ----   ----                -------
  Normal  Pulled     7h24m  kubelet, k8s-node1  Container image "hub.c.163.com/library/nginx:1.13" already present on machine
  Normal  Created    7h24m  kubelet, k8s-node1  Created container
  Normal  Started    7h24m  kubelet, k8s-node1  Started container
  Normal  Scheduled  15m    default-scheduler   Successfully assigned default/pod-sa to k8s-node

kubectl config 是客户端连接的配置命令

kubectl 可以定义诸多集群和与之对应的账号密码信息

[root@master song]# kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://172.20.0.91:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes          当前使用的用户和集群信息
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED

按照这个思路，我们创建有个自己的证书 和私钥来连接我们的集群

root@master song]# cd /etc/kubernetes/pki/
[root@master pki]# ls
apiserver.crt              apiserver-etcd-client.key  apiserver-kubelet-client.crt  ca.crt  etcd                front-proxy-ca.key      front-proxy-client.key  sa.pub
apiserver-etcd-client.crt  apiserver.key              apiserver-kubelet-client.key  ca.key  front-proxy-ca.crt  front-proxy-client.crt  sa.key

[root@master pki]# (umask ;openssl genrsa -out song.key )
Generating RSA private key,  bit long modulus
........................+++
.........+++
e is  (0x10001)
[root@master pki]# openssl req -new -key song.key -out song.csr -subj "/CN=song"
[root@master pki]# ls
apiserver.crt                 apiserver-kubelet-client.key  front-proxy-ca.key      song.csr
apiserver-etcd-client.crt     ca.crt                        front-proxy-client.crt  song.key
apiserver-etcd-client.key     ca.key                        front-proxy-client.key
apiserver.key                 etcd                          sa.key
apiserver-kubelet-client.crt  front-proxy-ca.crt            sa.pub

[root@master pki]# openssl x509 -req -in song.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out song.crt -days 3650
  Signature ok
  subject=/CN=song
  Getting CA Private Key

[root@master pki]# kubectl config set-credentials  song --client-certificate=./song.crt --client-key=./song.key
User "song" set.
[root@master pki]# kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://172.20.0.91:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: song
  user:
    client-certificate: /etc/kubernetes/pki/song.crt
    client-key: /etc/kubernetes/pki/song.key
[root@master pki]# kubectl config set-context song@kubernetes --cluster=kubernetes --user=song
Context "song@kubernetes" created.
[root@master pki]# kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://172.20.0.91:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
- context:
    cluster: kubernetes
    user: song
  name: song@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: song
  user:
    client-certificate: /etc/kubernetes/pki/song.crt
    client-key: /etc/kubernetes/pki/song.key

由于此用户没有经过rbac 授权

[root@master pki]# kubectl config use-context song@kubernetes
Switched to context "song@kubernetes".
[root@master pki]# kubectl get pods
Error from server (Forbidden): pods is forbidden: User "song" cannot list resource "pods" in API group "" in the namespace "default"
[root@master pki]# 

总结 user 和 serviceaccountname 是两种不同的认证suject