认证、授权与 RBAC

kubectl auth whoami
# ATTRIBUTE   VALUE
# Username    kubernetes-admin
# Groups      [kubeadm:cluster-admins system:authenticated]

kubectl config view --raw -o jsonpath='{.users[0].user.client-certificate-data}' \
  | base64 -d | openssl x509 -noout -subject
# subject=O = kubeadm:cluster-admins, CN = kubernetes-admin

kubectl run sa-demo --image=busybox:1.36 --restart=Never -- sleep 3600
kubectl exec sa-demo -- cat /var/run/secrets/kubernetes.io/serviceaccount/token \
  | cut -d. -f2 | base64 -d 2>/dev/null; echo
# {"aud":["https://kubernetes.default.svc.cluster.local"],"exp":...,
#  "kubernetes.io":{"namespace":"default","pod":{"name":"sa-demo",...},
#  "serviceaccount":{"name":"default",...}},"sub":"system:serviceaccount:default:default"}

apiVersion: v1
kind: Pod
metadata:
  name: no-token
spec:
  automountServiceAccountToken: false
  containers:
    - name: app
      image: nginx:1.27

kubectl create token default --duration=10m

            定义"能做什么"                     定义"谁"获得它
┌───────────────────────────────┐   ┌────────────────────────────────────┐
│ Role         （命名空间内）      │◄──│ RoleBinding        （命名空间内）      │
│ ClusterRole  （集群级 / 可复用） │◄──│ ClusterRoleBinding （全集群生效）      │
└───────────────────────────────┘   └────────────────────────────────────┘
                                         subjects: User / Group / ServiceAccount

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: dev
rules:
  - apiGroups: [""]              # "" 表示 core 组（apiVersion: v1 的资源）
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]          # apiVersion: apps/v1 的资源
    resources: ["deployments"]
    resourceNames: ["web"]       # 只允许操作名为 web 的 Deployment
    verbs: ["get", "patch"]

kubectl api-resources -o wide | grep -E '^NAME|^pods |^deployments |^storageclasses '
# NAME             SHORTNAMES  APIVERSION           NAMESPACED  KIND          VERBS
# pods             po          v1                   true        Pod           [create delete ... watch]
# deployments      deploy      apps/v1              true        Deployment    [...]
# storageclasses   sc          storage.k8s.io/v1    false       StorageClass  [...]

# 把内置 edit 角色授予 dev 命名空间中的 alice
kubectl create rolebinding alice-edit --clusterrole=edit --user=alice -n dev

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: crontabs-view
  labels:
    rbac.authorization.k8s.io/aggregate-to-view: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
  - apiGroups: ["stable.example.com"]
    resources: ["crontabs"]
    verbs: ["get", "list", "watch"]

# 我自己能做什么
kubectl auth can-i create deployments -n dev
kubectl auth can-i --list -n dev

# 模拟其他身份（需要 impersonate 权限，管理员默认有）
kubectl auth can-i list secrets -n dev --as=alice
kubectl auth can-i get pods -n dev --as=system:serviceaccount:dev:ci-bot
kubectl auth can-i create pods --as=bob --as-group=dev-team -n dev

# 反查：谁能删除 dev 里的 Pod（需要安装 kubectl-who-can 插件）
kubectl who-can delete pods -n dev

apiVersion: v1
kind: Namespace
metadata:
  name: sa-management
---
apiVersion: v1
kind: Namespace
metadata:
  name: team-a
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: dev-wang
  namespace: sa-management
---
# 长期 Token：手动创建 service-account-token 类型的 Secret
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  name: dev-wang
  namespace: sa-management
  annotations:
    kubernetes.io/service-account.name: dev-wang
---
# 集群级：只读命名空间列表
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-viewer
rules:
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dev-wang-namespace-viewer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: namespace-viewer
subjects:
  - kind: ServiceAccount
    name: dev-wang
    namespace: sa-management
---
# 命名空间级：复用内置 edit 角色，只在 team-a 生效
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: dev-wang-edit
  namespace: team-a
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: edit
subjects:
  - kind: ServiceAccount
    name: dev-wang
    namespace: sa-management

kubectl apply -f dev-wang.yaml

# 验证权限
SA=system:serviceaccount:sa-management:dev-wang
kubectl auth can-i create deployments -n team-a --as=$SA   # yes
kubectl auth can-i create deployments -n default --as=$SA  # no
kubectl auth can-i list namespaces --as=$SA                # yes
kubectl auth can-i delete nodes --as=$SA                   # no

CLUSTER=$(kubectl config view --minify -o jsonpath='{.clusters[0].name}')
SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
kubectl config view --raw --minify -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' \
  | base64 -d > ca.crt
TOKEN=$(kubectl get secret dev-wang -n sa-management -o jsonpath='{.data.token}' | base64 -d)

export KUBECONFIG=./dev-wang.kubeconfig
kubectl config set-cluster "$CLUSTER" --server="$SERVER" \
  --certificate-authority=ca.crt --embed-certs=true
kubectl config set-credentials dev-wang --token="$TOKEN"
kubectl config set-context dev-wang@"$CLUSTER" --cluster="$CLUSTER" \
  --user=dev-wang --namespace=team-a
kubectl config use-context dev-wang@"$CLUSTER"
unset KUBECONFIG

apiVersion: v1
kind: Config
clusters:
  - name: kind-kind
    cluster:
      certificate-authority-data: LS0tLS1CRUdJTi...   # 不要用 insecure-skip-tls-verify
      server: https://192.168.x.x:6443
contexts:
  - name: dev-wang@kind-kind
    context:
      cluster: kind-kind
      namespace: team-a
      user: dev-wang
current-context: dev-wang@kind-kind
users:
  - name: dev-wang
    user:
      token: eyJhbGciOiJSUzI1NiIs...

kubectl --kubeconfig=dev-wang.kubeconfig create deployment web --image=nginx:1.27
kubectl --kubeconfig=dev-wang.kubeconfig get pods -n kube-system
# Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:sa-management:dev-wang"
# cannot list resource "pods" in API group "" in the namespace "kube-system"