角色綁定將角色映射到一個用戶或者一組用戶，把角色在命名空間中對資源的權限授權給這些用戶。ClusterRoleBinding（集群角色綁定）允許授權用戶ClusterRole的在整個集群中的授權訪問。

RBAC API定義了四個資源對象用于描述角色和權限、角色和用戶的關系：

• Role
• ClusterRole
• RoleBinding
• ClusterRoleBinding

Role 和 ClusterRole

描述角色和權限的關系

Roles 是限定在某個Namespace下的
kubectl get roles --all-namespaces

ClusterRole 是整個集群范圍的
kubectl get clusterroles

資源示例

一條規(guī)則由 apiGroups、resources、verbs 共同組成，結構如下

kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""] # "" indicates the core API group
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

ClusterRole 在資源結構上類似

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  # 不能有"namespace"
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

RoleBinding 和 ClusterRoleBinding

描述 subjects （包含users, groups, service accounts）和 角色的關系

RoleBinding 是限定在某個Namespace下的
kubectl get rolebinding --all-namespaces

ClusterRoleBinding 是整個集群范圍的
kubectl get clusterrolebinding

資源示例

# This role binding allows "jane" to read pods in the "default" namespace.
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

# This cluster role binding allows anyone in the "manager" group to read secrets in any namespace.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: read-secrets-global
subjects:
- kind: Group
  name: manager
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: secret-reader
  apiGroup: rbac.authorization.k8s.io

subjects 使用示例

subjects 是訪問api 的主體
之前提到 subjects 包含users, groups, service accounts 三種類型，下面展示下具體寫法

subjects:
- kind: User
  name: "alice@example.com"
  apiGroup: rbac.authorization.k8s.io
- kind: Group
  name: "frontend-admins"
  apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
  name: default
  namespace: kube-system

按照現(xiàn)有環(huán)境配置，k8s 組件訪問 apiserver 使用基于證書的認證方式，apiserver 接受請求時會從client 證書中提取
CN、O字段，分別作為 subjects 中的 User 和 Group

下面是kube-proxy證書配置的示例，配內容可以查閱文檔

{
    "CN": "system:kube-proxy",
    "hosts": [""],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "O": "system:nodes"
        }
    ]
}

至于集群內訪問 apiserver 均使用service accounts 來表示身份

Kubernetes中默認的Role和RoleBinding

可以使用以下兩個指令查看默認的權限設置
kubectl get clusterrole -l kubernetes.io/bootstrapping=rbac-defaults

kubectl get clusterrolebinding -l kubernetes.io/bootstrapping=rbac-defaults

啟動集群時需要按照文檔內的user 、group 給各個組件配置相應權限

創(chuàng)建clusterrolebinding例子

kubectl create clusterrolebinding admin \
--clusterrole=cluster-admin \
--user=system:kube-controller-manager \
--user=system:kube-scheduler \
--group=system:kube-controller-manager