我正在使用G我想创建一个只能访问特定命名空间的自定义用户,我使用了这个yaml:
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: develop-user
namespace: develop
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: develop-user-full-access
namespace: develop
rules:
- apiGroups: rbac.authorization.k8s.io
resources:
- services
verbs: ["get"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: develop-user-view
namespace: develop
subjects:
- kind: ServiceAccount
name: develop-user
namespace: develop
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: develop-user-full-access
所以我获得了一个证书,并添加到我的kube配置,我切换上下文到这个新的服务帐户,并发现我仍然可以访问所有内容:( 为什么会发生这种情况以及如何解决?
我的kubeconfig(pastebin copy:https://pastebin.com/s5Nd6Dnn):
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: %certificate-data%
server: https://animeheaven.nyah
name: anime-cluster-develop
contexts:
- context:
cluster: anime-cluster-develop
namespace: develop
user: develop-user
name: anime-develop
current-context: anime-develop
kind: Config
preferences: {}
users:
- name: develop-user
user:
client-key-data: %certdata%
token: %tokenkey%
https://medium.com/uptime-99/making-sense-of-kubernetes-rbac-and-iam-roles-on-gke-914131b01922 https://medium.com/@ManagedKube/kubernetes-rbac-port-forward-4c7eb3951e28
这两篇文章终于帮助了我!由于这个愚蠢的东西,我几乎感到沮丧,多亏了正常时间-99和ManagedKube我做到了!好极了!
关键是在gcloud中创建kubernetes-viewer用户,然后为他创建一个角色,这是一个提示!
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: develop
name: allow-developer-port-forward
rules:
- apiGroups: [""]
resources: ["pods", "pods/portforward"]
verbs: ["get", "list", "create"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: anime-developer-port-access
namespace: develop
subjects:
- kind: User
name: [email protected]
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: allow-developer-port-forward
apiGroup: ""
然后
kubectly apply -f accessconfig.yaml
而已! 祝你今天愉快!
这是一篇关于如何设置它的好文章:https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html。
一般来说,你的配置很好,我改变的是- apiGroups: rbac.authorization.k8s.io
改为:
- apiGroups: ["", "extensions", "apps"]
然后,应用以下步骤:
develop
名称空间$ kubectl create namespace develop
$ kubectl apply -f rbac.yaml
$ kubectl cluster-info
$ kubectl get secret develop-user-token-2wsnb -o jsonpath={.data.token} -n develop | base64 --decode
$ kubectl get secret develop-user-token-2wsnb -o "jsonpath={.data['ca\.crt']}" -n develop
~/.kube/config
文件(如linked guide中所述)develop
develop
命名空间中的检查服务。$ kubectl get service my-service -n mynamespace
Error from server (Forbidden): services "my-service" is forbidden: User "system:serviceaccount:develop:develop-user" cannot get services in the namespace "mynamespace"
$ kubectl get service my-service -n develop
hError from server (NotFound): services "my-service" not found