Week 05: 身份认证与精细化访问控制 (RBAC/OIDC)

# 以 developer 用户身份执行
kubectl get pods --as=developer --as-group=dev-team

# API 请求头
# Impersonate-User: developer
# Impersonate-Group: dev-team

{
  "aud": ["https://kubernetes.default.svc"],
  "exp": 1706000000,
  "iat": 1705996400,
  "iss": "https://kubernetes.default.svc",
  "kubernetes.io": {
    "namespace": "default",
    "pod": {"name": "my-pod", "uid": "xxx"},
    "serviceaccount": {"name": "my-sa", "uid": "yyy"}
  },
  "nbf": 1705996400,
  "sub": "system:serviceaccount:default:my-sa"
}

# 使用 kubectl 创建 Token
kubectl create token my-sa --duration=1h --audience=my-service

# API 调用
POST /api/v1/namespaces/default/serviceaccounts/my-sa/token
{
  "apiVersion": "authentication.k8s.io/v1",
  "kind": "TokenRequest",
  "spec": {
    "audiences": ["my-service"],
    "expirationSeconds": 3600
  }
}

# 命令行测试
kubectl auth can-i create pods --as=developer -n default

# API 调用
POST /apis/authorization.k8s.io/v1/subjectaccessreviews
{
  "apiVersion": "authorization.k8s.io/v1",
  "kind": "SubjectAccessReview",
  "spec": {
    "user": "developer",
    "groups": ["dev-team"],
    "resourceAttributes": {
      "namespace": "default",
      "verb": "create",
      "resource": "pods"
    }
  }
}

rules:
- nonResourceURLs:
  - /healthz
  - /metrics
  - /api*
  verbs: ["get"]

rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]

# Role: 仅限 default namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""] # core API group
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
---
# ClusterRole: 集群级别
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-reader
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["metrics.k8s.io"]
  resources: ["nodes"]
  verbs: ["get", "list"]

# RoleBinding: 绑定到 Namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: developer
  apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
  name: my-sa
  namespace: default
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io
---
# ClusterRoleBinding: 全局生效
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-nodes-global
subjects:
- kind: Group
  name: developers
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: node-reader
  apiGroup: rbac.authorization.k8s.io

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: monitoring-view
  labels:
    rbac.example.com/aggregate-to-monitoring: "true"
rules:
- apiGroups: [""]
  resources: ["pods", "services"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: monitoring
aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      rbac.example.com/aggregate-to-monitoring: "true"
rules: [] # 自动填充

# /etc/kubernetes/audit-policy.yaml
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
# 不记录健康检查
- level: None
  users: ["system:kube-proxy"]
  verbs: ["watch"]
  resources:
  - group: ""
    resources: ["endpoints", "services"]

# 记录 Secret 访问 (敏感)
- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]

# 记录所有其他请求的元数据
- level: Metadata
  resources:
  - group: ""
    resources: ["*"]

kube-apiserver \
  --audit-policy-file=/etc/kubernetes/audit-policy.yaml \
  --audit-log-path=/var/log/kubernetes/audit.log \
  --audit-log-maxage=30 \
  --audit-log-maxbackup=10 \
  --audit-log-maxsize=100

# 查找所有 Secret 读取操作
jq 'select(.objectRef.resource == "secrets" and .verb == "get")' /var/log/kubernetes/audit.log

# 查找特定用户的操作
jq 'select(.user.username == "developer")' /var/log/kubernetes/audit.log

apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-quota
  namespace: tenant-a
spec:
  hard:
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    pods: "50"
    persistentvolumeclaims: "10"
    services.loadbalancers: "2"

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: tenant-a
spec:
  limits:
  - type: Container
    default:
      cpu: 500m
      memory: 512Mi
    defaultRequest:
      cpu: 100m
      memory: 128Mi
    max:
      cpu: "2"
      memory: 4Gi
    min:
      cpu: 50m
      memory: 64Mi

# 1. 创建测试 Pod
kubectl run test-pod --image=busybox --command -- sleep 3600

# 2. 进入 Pod 查看 Token
kubectl exec -it test-pod -- sh
cat /var/run/secrets/kubernetes.io/serviceaccount/token

# 3. 解码 JWT (Base64)
# 在 https://jwt.io 解析 Token, 查看 claims

# 安装 kubectl-who-can
kubectl krew install who-can

# 查找可以创建 Pod 的用户
kubectl who-can create pods

# 查找可以读取 Secret 的用户
kubectl who-can get secrets -n kube-system