LFS258-LAB-Security

認證授權(quán)

1.創(chuàng)建namespace

student@ubuntu:~/helm/linux-amd64$kubectl create namespace development
namespace/development created

2.查看kubectl配置

student@ubuntu:~/helm/linux-amd64$kubectl config get-contexts 
CURRENT   NAME                          CLUSTER      AUTHINFO           NAMESPACE
*         kubernetes-admin@kubernetes   kubernetes   kubernetes-admin   

3.創(chuàng)建新用戶student

student@ubuntu:~/security$openssl genrsa -out student.key 2048
Generating RSA private key, 2048 bit long modulus
...............................+++
..............+++
e is 65537 (0x10001)
student@ubuntu:~/security$openssl req -new -key student.key  -out student.csr -subj "/CN=student/O=school"
student@ubuntu:~/security$ll
total 16
drwxrwxr-x  2 student student 4096 Dec 11 11:35 ./
drwxr-xr-x 18 student student 4096 Dec 11 11:25 ../
-rw-rw-r--  1 student student  911 Dec 11 11:35 student.csr
-rw-rw-r--  1 student student 1679 Dec 11 11:34 student.key

student@ubuntu:~/security$sudo openssl x509 -req -in student.csr \
> -CA /etc/kubernetes/pki/ca.crt \
> -CAkey /etc/kubernetes/pki/ca.key \
> -CAcreateserial \
> -out student.crt -days 45
[sudo] password for student: 
Signature ok
subject=/CN=student/O=school
Getting CA Private Key
student@ubuntu:~/security$ll
total 20
drwxrwxr-x  2 student student 4096 Dec 11 11:37 ./
drwxr-xr-x 18 student student 4096 Dec 11 11:25 ../
-rw-r--r--  1 root    root     997 Dec 11 11:37 student.crt
-rw-rw-r--  1 student student  911 Dec 11 11:35 student.csr
-rw-rw-r--  1 student student 1679 Dec 11 11:34 student.key

student@ubuntu:~/security$kubectl config set-credentials student --client-certificate=./student.crt --client-key=./student.key 
User "student" set.

student@ubuntu:~/security$kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://172.30.81.194:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: student
  user:
    client-certificate: /home/student/security/student.crt
    client-key: /home/student/security/student.key

student@ubuntu:~/security$kubectl config set-context student \
> --cluster=kubernetes \
> --namespace=development \
> --user=student
Context "student" created.

student@ubuntu:~/security$kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://172.30.81.194:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
- context:
    cluster: kubernetes
    --namespace=development
    --user=student
  name: student
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: student
  user:
    client-certificate: /home/student/security/student.crt
    client-key: /home/student/security/student.key

student@ubuntu:~/security$kubectl config get-contexts 
CURRENT   NAME                          CLUSTER                                           AUTHINFO           NAMESPACE
*         kubernetes-admin@kubernetes   kubernetes                                        kubernetes-admin   
          student                       kubernetes--namespace=development--user=student                      

4.測試student用戶

student@ubuntu:~/security$kubectl --context=student get pods
Error from server (Forbidden): pods is forbidden: User "student" cannot list resource "pods" in API group "" in the namespace "development"

5.給student賦予rbac權(quán)限

student@ubuntu:~/security$cat role-student.yaml 
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: development
  name: student
rules:
- apiGroups: ["", "extensions", "apps"]
  resources: ["deployments", "replicasets", "pods"]
  verbs: ["list", "get", "watch", "create", "update", "patch", "delete"]
student@ubuntu:~/security$kubectl create -f role-student.yaml 
role.rbac.authorization.k8s.io/student created


student@ubuntu:~/security$cat rolebind.yaml 
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: student-role-binding
  namespace: development
subjects:
- kind: User
  name: student
  apiGroup: ""
roleRef:
  kind: Role
  name: student
  apiGroup: ""
student@ubuntu:~/security$kubectl create -f rolebind.yaml 
rolebinding.rbac.authorization.k8s.io/student-role-binding created

6.再次測試student

student@ubuntu:~/security$kubectl --context=student get pods
No resources found.

7.添加資源

student@ubuntu:~/security$kubectl --context=student get jobs
Error from server (Forbidden): jobs.batch is forbidden: User "student" cannot list resource "jobs" in API group "batch" in the namespace "development"

student@ubuntu:~/security$kubectl -n development describe role student 
Name:         student
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources               Non-Resource URLs  Resource Names  Verbs
  ---------               -----------------  --------------  -----
  deployments             []                 []              [list get watch create update patch delete]
  pods                    []                 []              [list get watch create update patch delete]
  replicasets             []                 []              [list get watch create update patch delete]
  deployments.apps        []                 []              [list get watch create update patch delete]
  pods.apps               []                 []              [list get watch create update patch delete]
  replicasets.apps        []                 []              [list get watch create update patch delete]
  deployments.extensions  []                 []              [list get watch create update patch delete]
  pods.extensions         []                 []              [list get watch create update patch delete]
  replicasets.extensions  []                 []              [list get watch create update patch delete]



student@ubuntu:~/security$cat role-student.yaml 
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: development
  name: student
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["list", "get", "watch", "create", "update", "patch", "delete"]

student@ubuntu:~/security$kubectl -n development describe role student 
Name:         student
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  *.*        []                 []              [list get watch create update patch delete]

student@ubuntu:~/security$kubectl --context=student get pods
No resources found.
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者
  • 序言:七十年代末汽烦,一起剝皮案震驚了整個濱河市甚牲,隨后出現(xiàn)的幾起案子找御,更是在濱河造成了極大的恐慌摊溶,老刑警劉巖份帐,帶你破解...
    沈念sama閱讀 222,104評論 6 515
  • 序言:濱河連續(xù)發(fā)生了三起死亡事件傻寂,死亡現(xiàn)場離奇詭異雇初,居然都是意外死亡硝清,警方通過查閱死者的電腦和手機,發(fā)現(xiàn)死者居然都...
    沈念sama閱讀 94,816評論 3 399
  • 文/潘曉璐 我一進店門脚囊,熙熙樓的掌柜王于貴愁眉苦臉地迎上來龟糕,“玉大人,你說我怎么就攤上這事悔耘〗菜辏” “怎么了?”我有些...
    開封第一講書人閱讀 168,697評論 0 360
  • 文/不壞的土叔 我叫張陵,是天一觀的道長缓艳。 經(jīng)常有香客問我校摩,道長,這世上最難降的妖魔是什么阶淘? 我笑而不...
    開封第一講書人閱讀 59,836評論 1 298
  • 正文 為了忘掉前任衙吩,我火速辦了婚禮,結(jié)果婚禮上溪窒,老公的妹妹穿的比我還像新娘坤塞。我一直安慰自己,他們只是感情好霉猛,可當我...
    茶點故事閱讀 68,851評論 6 397
  • 文/花漫 我一把揭開白布尺锚。 她就那樣靜靜地躺著,像睡著了一般惜浅。 火紅的嫁衣襯著肌膚如雪瘫辩。 梳的紋絲不亂的頭發(fā)上,一...
    開封第一講書人閱讀 52,441評論 1 310
  • 那天坛悉,我揣著相機與錄音伐厌,去河邊找鬼。 笑死裸影,一個胖子當著我的面吹牛挣轨,可吹牛的內(nèi)容都是我干的。 我是一名探鬼主播轩猩,決...
    沈念sama閱讀 40,992評論 3 421
  • 文/蒼蘭香墨 我猛地睜開眼卷扮,長吁一口氣:“原來是場噩夢啊……” “哼!你這毒婦竟也來了均践?” 一聲冷哼從身側(cè)響起晤锹,我...
    開封第一講書人閱讀 39,899評論 0 276
  • 序言:老撾萬榮一對情侶失蹤,失蹤者是張志新(化名)和其女友劉穎彤委,沒想到半個月后鞭铆,有當?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體,經(jīng)...
    沈念sama閱讀 46,457評論 1 318
  • 正文 獨居荒郊野嶺守林人離奇死亡焦影,尸身上長有42處帶血的膿包…… 初始之章·張勛 以下內(nèi)容為張勛視角 年9月15日...
    茶點故事閱讀 38,529評論 3 341
  • 正文 我和宋清朗相戀三年车遂,在試婚紗的時候發(fā)現(xiàn)自己被綠了。 大學時的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片斯辰。...
    茶點故事閱讀 40,664評論 1 352
  • 序言:一個原本活蹦亂跳的男人離奇死亡舶担,死狀恐怖,靈堂內(nèi)的尸體忽然破棺而出彬呻,到底是詐尸還是另有隱情衣陶,我是刑警寧澤回梧,帶...
    沈念sama閱讀 36,346評論 5 350
  • 正文 年R本政府宣布,位于F島的核電站祖搓,受9級特大地震影響,放射性物質(zhì)發(fā)生泄漏湖苞。R本人自食惡果不足惜拯欧,卻給世界環(huán)境...
    茶點故事閱讀 42,025評論 3 334
  • 文/蒙蒙 一、第九天 我趴在偏房一處隱蔽的房頂上張望财骨。 院中可真熱鬧镐作,春花似錦、人聲如沸隆箩。這莊子的主人今日做“春日...
    開封第一講書人閱讀 32,511評論 0 24
  • 文/蒼蘭香墨 我抬頭看了看天上的太陽捌臊。三九已至杨蛋,卻和暖如春,著一層夾襖步出監(jiān)牢的瞬間理澎,已是汗流浹背逞力。 一陣腳步聲響...
    開封第一講書人閱讀 33,611評論 1 272
  • 我被黑心中介騙來泰國打工, 沒想到剛下飛機就差點兒被人妖公主榨干…… 1. 我叫王不留糠爬,地道東北人寇荧。 一個月前我還...
    沈念sama閱讀 49,081評論 3 377
  • 正文 我出身青樓,卻偏偏與公主長得像执隧,于是被迫代替她去往敵國和親揩抡。 傳聞我的和親對象是個殘疾皇子,可洞房花燭夜當晚...
    茶點故事閱讀 45,675評論 2 359

推薦閱讀更多精彩內(nèi)容