Gke Kubernetes RBAC将默认角色绑定到我有限的习俗中

Question

我正在使用g我想创建一个仅访问特定名称空间的自定义用户，我使用了此YAML：

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: develop-user
  namespace: develop
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: develop-user-full-access
  namespace: develop
rules:
- apiGroups: rbac.authorization.k8s.io
  resources:
  - services
  verbs: ["get"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: develop-user-view
  namespace: develop
subjects:
- kind: ServiceAccount
  name: develop-user
  namespace: develop
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: develop-user-full-access

因此，在将上下文切换到此新服务帐户之后，我获得了证书并添加到了Kube配置中，并确定我仍然可以访问所有内容:(
为什么会发生以及如何修复？

我的kubeconfig（pastebin副本：https：//pastebin.com/s5nd6dnn）：

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: %certificate-data%
    server: https://animeheaven.nyah
  name: anime-cluster-develop
contexts:
- context:
    cluster: anime-cluster-develop
    namespace: develop
    user: develop-user
  name: anime-develop
current-context: anime-develop
kind: Config
preferences: {}
users:
- name: develop-user
  user:
    client-key-data: %certdata%
    token: %tokenkey%

Answer 1

https://medium.com/uppime-99/making-sense-of-kubernetes-rbac-and-iam--------------------er-on-on-gke-914131b01922
https://medium.com/@managdkube/kubernetes-rbac-port-forward-4c7eb3951e28

这两篇文章最终帮助了我！由于这些愚蠢的事情，我几乎感到沮丧，这要归功于Uptime-99和ManagedKube我做到了！是的！

关键是在gcloud中创建kubernetes-viewer用户，然后为他创建角色这是一个提示！

---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: develop
  name: allow-developer-port-forward
rules:
- apiGroups: [""]
  resources: ["pods", "pods/portforward"]
  verbs: ["get", "list", "create"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: anime-developer-port-access
  namespace: develop
subjects:
- kind: User
  name: [e-mail]
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: allow-developer-port-forward
  apiGroup: ""

然后

kubectly应用-f accessconfig.yaml

多数民众赞成在！
祝您有美好的一天！

Answer 2

这是一篇关于如何设置的好文章：https：//jeremievallee.com/2018/05/05/28/kubernetes-rbac-namespace-pace-pace-user.html。

通常，您的配置很好，我更改的是- apiGroups: rbac.authorization.k8s.io行更改为：

- apiGroups: ["", "extensions", "apps"]

然后，应用以下步骤：

1. 创建develop名称空间

$ kubectl create namespace develop

2. 从您的配置创建RBAC。

$ kubectl apply -f rbac.yaml

3. 阅读集群IP，令牌和CA证书。

$ kubectl cluster-info
$ kubectl get secret develop-user-token-2wsnb -o jsonpath={.data.token} -n develop | base64 --decode
$ kubectl get secret develop-user-token-2wsnb -o "jsonpath={.data['ca.crt']}" -n develop

4. 填写~/.kube/config文件（如链接指南中所述）
5. 将上下文更改为develop
6. 用户只能访问develop名称空间中的服务。

$ kubectl get service my-service -n mynamespace
Error from server (Forbidden): services "my-service" is forbidden: User "system:serviceaccount:develop:develop-user" cannot get services in the namespace "mynamespace"
$ kubectl get service my-service -n develop
hError from server (NotFound): services "my-service" not found