1、基本說明
在生產環境使用k8s以后，大部分應用都實現了高可用，不僅降低了維護成本，也簡化了很多應用的部署成本，但是同時也帶來了諸多問題。比如開發可能需要查看自己的應用狀態、連接信息、日志、執行命令等。
使用k8s后，業務應用以Pod為單位，不像之前的以服務器為單位，可以直接通過登錄服務器進行相關操作。當業務應用使用k8s部署后，k8s官方的dashboard雖然可以進行查看日志、執行命令等基本操作，但是作為運維人員，不想讓開發操作或查看自己范圍之外的Pod，此時就要使用RBAC進行相關的權限配置。
本文章主要講解兩方面的問題：
- 使用用戶名密碼登錄Dashboard
- 對已登錄用戶進行權限配置，實現只能操作自己Namespace的Pod，不能進入到未授權的其他Namespace
2、更改Dashboard認證方式
為了方便開發和運維人員登錄Dashboard，需要將Dashboard登錄方式用戶名密碼認證（用戶名密碼和Token可以同時開啟）。
使用Ratel將kubernetes-dashboard的deployment的--authentication-mode改成basic即可，未安裝Ratel的可以使用kubectl edit進行更改，更改完成會自動重啟。
之后更改kube-apiserver配置添加--basic-auth-file=/etc/kubernetes/basic_auth_file
basic_auth_file為存儲賬號密碼的文件，格式如下：
xxx1_2019,xxx1,3,"system:authentication" xxx2_2019,xxx2,4,"system:authentication" xxx3_2019,xxx3,5,"system:authentication" xxx4_2019,xxx4,6,"system:authentication"
依次是密碼、用戶名、ID號、用戶組，因為下面會為已登錄的用戶進行授權，所以把組設置成了system:authentication，按需更改。
3、添加默認權限
首先配置一個system:authentication組允許查詢namespace列表（因為進入到指定namespace，必須能list該集群的namespace）:
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: annotations: rbac.authorization.kubernetes.io/autoupdate: "true" labels: kubernetes.io/bootstrapping: rbac-defaults rbac.authorization.k8s.io/aggregate-to-edit: "true" name: ratel-namespace-readonly rules: - apiGroups: - "" resources: - namespaces verbs: - get - list - watch - apiGroups: - metrics.k8s.io resources: - pods verbs: - get - list - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: ratel-namespace-readonly roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: ratel-namespace-readonly subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: system:authentication
創建查看namespace資源的權限
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ratel-resource-readonly rules: - apiGroups: - "" resources: - configmaps - endpoints - persistentvolumeclaims - pods - replicationcontrollers - replicationcontrollers/scale - serviceaccounts - services verbs: - get - list - watch - apiGroups: - "" resources: - bindings - events - limitranges - namespaces/status - pods/log - pods/status - replicationcontrollers/status - resourcequotas - resourcequotas/status verbs: - get - list - watch - apiGroups: - "" resources: - namespaces verbs: - get - list - watch - apiGroups: - apps resources: - controllerrevisions - daemonsets - deployments - deployments/scale - replicasets - replicasets/scale - statefulsets - statefulsets/scale verbs: - get - list - watch - apiGroups: - autoscaling resources: - horizontalpodautoscalers verbs: - get - list - watch - apiGroups: - batch resources: - cronjobs - jobs verbs: - get - list - watch - apiGroups: - extensions resources: - daemonsets - deployments - deployments/scale - ingresses - networkpolicies - replicasets - replicasets/scale - replicationcontrollers/scale verbs: - get - list - watch - apiGroups: - policy resources: - poddisruptionbudgets verbs: - get - list - watch - apiGroups: - networking.k8s.io resources: - networkpolicies verbs: - get - list - watch - apiGroups: - metrics.k8s.io resources: - pods verbs: - get - list - watch
創建Pod執行權限
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ratel-pod-exec rules: - apiGroups: - "" resources: - pods - pods/log verbs: - get - list - apiGroups: - "" resources: - pods/exec verbs: - create
創建Pod刪除權限
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ratel-pod-delete rules: - apiGroups: - "" resources: - pods verbs: - get - list - delete
上述權限創建完成后，只需要將對應的用戶綁定對應的權限即可實現不同的用戶在不同的namespace實現不同的權限。
對RBAC不熟悉的可以參考https://www.cnblogs.com/dukuan/p/9948063.html
或者參考書籍《再也不踩坑的Kubernetes實戰指南》第二章。
4、配置權限
案例：假設有一個用戶叫java7，需要訪問default命名空間下的資源，可以在容器執行命令和查看日志
添加權限之前是不能查看任何信息的:
配置權限：
方式一：使用Ratel一鍵配置，選擇對應的集群、Namespace、用戶名、勾選權限點擊創建即可。 
創建成功后再次登錄，即可查看該Namespace的信息
查看日志：
執行命令：
同時也不能查看其他namespace的資源
方式二：使用yaml文件配置
使用Ratel進行權限配置，在配置權限后在對應的namespace下創建對應的RoleBinding，如下：
[root@k8s-master01 ~]# kubectl get rolebinding NAME AGE gitlab 112d ratel-pod-delete-java7 11m ratel-pod-exec-java7 11m ratel-resource-readonly-java7 11m
內容如下：
ource-readonly-java7 -o yaml apiVersion: v1 items: - apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: creationTimestamp: "2019-12-03T07:34:24Z" name: ratel-pod-delete-java7 namespace: default resourceVersion: "35887290" selfLink: /apis/rbac.authorization.k8s.io/v1/namespaces/default/rolebindings/ratel-pod-delete-java7 uid: 547f5d42-159f-11ea-b1b5-001e674e3dd6 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: ratel-pod-delete subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: java7 - apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: creationTimestamp: "2019-12-03T07:34:24Z" name: ratel-pod-exec-java7 namespace: default resourceVersion: "35887289" selfLink: /apis/rbac.authorization.k8s.io/v1/namespaces/default/rolebindings/ratel-pod-exec-java7 uid: 547c5768-159f-11ea-b1b5-001e674e3dd6 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: ratel-pod-exec subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: java7 - apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: creationTimestamp: "2019-12-03T07:34:24Z" name: ratel-resource-readonly-java7 namespace: default resourceVersion: "35887288" selfLink: /apis/rbac.authorization.k8s.io/v1/namespaces/default/rolebindings/ratel-resource-readonly-java7 uid: 5476577f-159f-11ea-b1b5-001e674e3dd6 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: ratel-resource-readonly subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: java7 kind: List metadata: resourceVersion: "" selfLink: ""
在沒有安裝Ratel的情況下，可以使用上述yaml內容直接創建至對應的namespace下即可完成權限配置。
上述只是實現了對常用資源的權限控制，其他權限控制類似。
Kubernetes多集群資源管理平台Ratel安裝可以參考：https://github.com/dotbalo/ratel-doc
