kubernetes - 如何添加或介绍kubernetes普通用户？

Question

我在offical doc上看到了它，但是我不知道如何在kubernetes集群之外对add or introduce进行normal user编码。我在kubernetes中搜索了很多有关普通用户的信息，但没有任何用处。

我知道它与serviceaccount不同，我们无法通过Kubernetes API添加普通用户。

关于如何向kubernetes集群添加或引入普通用户的任何想法以及普通用户的用途是什么？

Answer 1

参见Comparing Kubernetes Authentication Methods的“Etienne Dilocker”

可能的解决方案是x509 client certs:

Advantages

operating the Kubernetes cluster and issuing user certificates is decoupled much more secure than basic authentication

Disadvantages

x509 certificates tend to have a very long lifetime (months or years). So, revoking user access is nearly impossible. If we instead choose to issue short-lived certificates, the user experience drops, because replacing certificates involves some effort.

但是Etienne建议使用 OpenID:

Wouldn’t it be great if we could have short-lived certificates or tokens, that are issued by a third-party, so there is no coupling to the operators of the K8s cluster.
And at the same time all of this should be integrated with existing enterprise infrastructure, such as LDAP or Active Directory.

This is where OpenID Connect (OIDC) comes in.

For my example, I’ve used Keycloak as a token issuer. Keycloak is both a token issuer and an identity provider out-of-the box and quite easy to spin up using Docker.

将RBAC与这种身份验证一起使用不是直截了当的，而是可能的。
参见“ issue 118; Security, auth and logging in”

With 1.3 I have SSO into the dashboard working great with a reverse proxy and OIDC/OAuth2. I wouldn't create an explicit login screen, piggy back off of the RBAC model and the Auth model that is already supported. It would be great to have something that says who the logged in user is though.

请注意，从1.3开始，可能会有更简单的解决方案。

同一线程包括:

I have a prototype image working that will do what I think you're looking for: https://hub.docker.com/r/mlbiam/openunison-k8s-dashboard/

I removed all the requirements for user provisioning and stripped it down to just:

• reverse proxy
• integration with openid connect
• display the user's access token
• simple links page

它 includes the role binding:

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: admin-role
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
  nonResourceURLs: ["*"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: admin-binding
subjects:
- kind: Group
  name: admin
- kind: ServiceAccount
  name: default
  namespace: kube-system
- kind: ServiceAccount
  name: openunison
  namespace: default
roleRef:
  kind: ClusterRole
  name: admin-role

同样，这是特定于仪表板RBAC访问的，此后已通过 PR 2206 Add log in mechanism (to dashboard)进行了改进。

它仍然可以为您提供一些线索，以将普通用户链接到kubernetes RBAC。