kubernetes - 如何授予对 K8s 仪表板的只读访问权限？

Question

我尝试创建一个只能访问查看 pod 的集群角色，但是，由于某种原因，该帐户仍然可以看到所有内容； secret ，部署，节点等。我还启用了跳过登录，默认情况下匿名用户似乎也没有任何限制。

服务帐号:

apiVersion: v1
kind: ServiceAccount
metadata:
name: sa-example
namespace: default

集群角色:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cr-example
rules:
- apiGroups: [""] 
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

集群角色绑定(bind):

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: crb-example
roleRef:
  apiGroup: rbac.authorization.k8s.io
  name: cr-example
  kind: ClusterRole
subjects:
  - kind: ServiceAccount
    name: sa-example
    namespace: default

上下文:

K8s version: 1.17.3
Dashboard version: v2.0.0-rc5
Cluster type: bare metal
authorization-mode=Node,RBAC

Answer 1

您如何检查它是否有效？

我用下面的 yamls 复制了你的问题

apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-example
  namespace: default

---  

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cr-example
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]        

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: crb-example
roleRef:
  apiGroup: rbac.authorization.k8s.io
  name: cr-example
  kind: ClusterRole
subjects:
  - kind: ServiceAccount
    name: sa-example
    namespace: default

我用了 kubectl auth can-i验证它是否有效

kubectl auth can-i get pods   --as=system:serviceaccount:default:sa-example
yes
kubectl auth can-i get deployment   --as=system:serviceaccount:default:sa-example
no
kubectl auth can-i get secrets   --as=system:serviceaccount:default:sa-example
no
kubectl auth can-i get nodes   --as=system:serviceaccount:default:sa-example
no

似乎一切正常

我的yaml中唯一不同的是

kind: ClusterRole
metadata:
  name: cr-example instead of cr-<role>

所以它实际上匹配 ClusterRoleBinding

我希望它能帮助你解决你的问题。如果您还有其他问题，请告诉我。