HCIE-kubernetes(k8s)-Authentication身份验证
1、远程登录
1、kubeconfig方式
在master上都是以kubeconfig方式登录的，并不是说有一个文件叫kubeconfig。
默认使用的配置文件是~/.kube/config 这个配置文件，而这个配置文件是通过这个文件/etc/kubernetes/admin.conf
如果在node上执行命令，也需要配置该文件，否则报错如下：
[root@node1 ~]# kubectl get node
E1103 15:42:46.225278 129198 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp [::1]:8080: connect: connection refused
E1103 15:42:46.226197 129198 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp [::1]:8080: connect: connection refused
E1103 15:42:46.228511 129198 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp [::1]:8080: connect: connection refused
E1103 15:42:46.230491 129198 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp [::1]:8080: connect: connection refused
E1103 15:42:46.232909 129198 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp [::1]:8080: connect: connection refused
The connection to the server localhost:8080 was refused - did you specify the right host or port?
可以在master拷贝一份/etc/kubernetes/admin.conf到node1
[root@master ~]# cd /etc/kubernetes
[root@master kubernetes]# scp admin.conf 10.1.1.201:~
在node1上执行命令的时候，直接指定该文件运行。
[root@node1 ~]# kubectl get node --kubeconfig=admin.conf
NAME STATUS ROLES AGE VERSION
master Ready control-plane 8d v1.27.0
node1 Ready <none> 8d v1.27.0
node2 Ready <none> 8d v1.27.0
如果不想指定配置文件，可以直接配置环境变量。
[root@node1 ~]# echo 'export KUBECONFIG=admin.conf' >> /etc/profile
[root@node1 ~]# source /etc/profile
[root@node1 ~]# kubectl get node
NAME STATUS ROLES AGE VERSION
master Ready control-plane 8d v1.27.0
node1 Ready <none> 8d v1.27.0
node2 Ready <none> 8d v1.27.0
这样就不需要指定配置文件了。
注意：该admin.conf文件是直接从master上拷贝过来的，所以默认具备admin管理员最大的权限的。
生产环境不建议这样操作，因为权限过大，无法保证安全性。
例如单独创建用户tom授权
1、生成私钥
[root@master kubernetes]# mkdir /ca
[root@master kubernetes]# cd /ca
[root@master ca]# openssl genrsa -out client.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
.....................................+++++
.......+++++
e is 65537 (0x010001)
[root@master ca]# ls
client.key
2、生成tom用户证书请求文件
[root@master ca]# openssl req -new -key client.key -subj "/CN=tom" -out client.csr
[root@master ca]# ls
client.csr client.key
k8s本身使用的一些ca证书，是在/etc/kubernetes/pki/目录下
[root@master ca]# ls /etc/kubernetes/pki/
apiserver.crt apiserver-etcd-client.key apiserver-kubelet-client.crt ca.crt etcd front-proxy-ca.key front-proxy-client.key sa.pub
apiserver-etcd-client.crt apiserver.key apiserver-kubelet-client.key ca.key front-proxy-ca.crt front-proxy-client.crt sa.key
3、为tom用户颁发证书
tom如何将请求发给k8s的ca进行证书颁发呢？使用kubernetes自带的ca为tom颁发证书。
[root@master ca]# openssl x509 -req -in client.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out client.crt -days 3650
Signature ok
subject=CN = tom
Getting CA Private Key
[root@master ca]# ls
client.crt client.csr client.key
拷贝ca证书到当前目录
[root@master ca]# cp /etc/kubernetes/pki/ca.crt .
[root@master ca]# ls
ca.crt client.crt client.csr client.key
4、创建测试命名空间及pod
[root@master ca]# kubectl create namespace hehe
namespace/hehe created
[root@master ca]# kubens hehe
Context "kubernetes-admin@kubernetes" modified.
Active namespace is "hehe".
[root@master ca]# kubectl get pod
No resources found in hehe namespace.
[root@master ca]# kubectl run pod1 --image nginx --image-pull-policy IfNotPresent --dry-run=client -o yaml > pod1.yaml
[root@master ca]# kubectl apply -f pod1.yaml
pod/pod1 created
[root@master ca]# kubectl get pod
NAME READY STATUS RESTARTS AGE
pod1 1/1 Running 0 7s
5、创建角色和授权
创建角色，使其对hehe命名空间具有get/watch/list权限
[root@master ca]# kubectl create role r1 --verb get --verb watch --verb list --resource pods -n hehe
role.rbac.authorization.k8s.io/r1 created
查看角色：[root@master ca]# kubectl get role
NAME CREATED AT
r1 2023-11-03T09:07:10Z
详细查看：[root@master ca]# kubectl describe role r1
Name: r1
Labels: <none>
Annotations: <none>
PolicyRule:Resources Non-Resource URLs Resource Names Verbs--------- ----------------- -------------- -----pods [] [] [get watch list]
6、将角色绑定给tom用户
[root@master ca]# kubectl create rolebinding r1binding --role r1 --user tom -n hehe
rolebinding.rbac.authorization.k8s.io/r1binding created
[root@master ca]# kubectl get rolebindings.rbac.authorization.k8s.io
NAME ROLE AGE
r1binding Role/r1 17s
[root@master ca]# kubectl describe rolebindings.rbac.authorization.k8s.io
Name: r1binding
Labels: <none>
Annotations: <none>
Role:Kind: RoleName: r1
Subjects:Kind Name Namespace---- ---- ---------User tom
7、编辑kuberconfig文件
官网，https://kubernetes.io/zh-cn/docs/concepts/configuration/organize-cluster-access-kubeconfig/
[root@master ca]# vim kubeabc
[root@master ca]# vim kubeabc
[root@master ca]# cat kubeabc
apiVersion: v1
kind: Configclusters:
- cluster:name: dev1users:
- name: tomcontexts:
- context:name: context1namespace: hehe
current-context: "context1"设置集群密钥信息（嵌入集群密钥）
[root@master ca]# kubectl config --kubeconfig=kubeabc set-cluster dev1 --server=https://10.1.1.200:6443 --certificate-authority=ca.crt --embed-certs=true
Cluster "dev1" set.
设置tom用户密钥信息
[root@master ca]# kubectl config --kubeconfig=kubeabc set-credentials tom --client-certificate=client.crt --client-key=client.key --embed-certs=true
User "tom" set.
设置上下文信息
[root@master ca]# kubectl config --kubeconfig=kubeabc set-context context1 --cluster=dev1 --namespace=hehe --user=tom
Context "context1" modified.
8、测试
拷贝至客户端node2并测试
[root@master ca]# scp kubeabc 10.1.1.202:~
[root@node2 ~]# kubectl get pod --kubeconfig=kubeabc
NAME READY STATUS RESTARTS AGE
pod1 1/1 Running 0 24m
这样客户端node2就以tom身份登录到k8s集群中，进行管理操作了。
[root@node2 ~]# export KUBECONFIG=kubeabc
[root@node2 ~]# kubectl get pod
NAME READY STATUS RESTARTS AGE
pod1 1/1 Running 0 26m