API Server 內部通過使用者認證後，然後進入授權流程。對合法使用者進行授權並且隨後在使用者訪問時進行鑑權，是許可權管理的重要環節。
在 kubernetes 叢集中，各種操作許可權是賦予角色(Role 或者 ClusterRole）的。通過建立 RoleBinding 或者 ClusterBinding 把 使用者(User),使用者組（Group）或服務賬號（Service Account）繫結在 Role 或 ClusterRole 上。這樣使用者，使用者組或者服務賬號就有了相對應的操作許可權。
這裡有個需要注意的地方
ClusterRoleBinding 只能繫結 ClusterRole,而 RoleBinding 可以繫結 Role 或者 ClusterRole。
根據上圖：
1

建立 role

su - klvchen
cd sa/
kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run -o yaml > role-demo.yaml

kubectl apply -f role-demo.yaml 
kubectl get role
kubectl describe role pods-reader
 

建立 rolebinding

kubectl create rolebinding klvchen-read-pods --role=pods-reader --user=klvchen --dry-run -o yaml > rolebinding-demo.yaml
kubectl apply -f rolebinding-demo.yaml
kubectl describe rolebinding klvchen-read-pods

測試賬號

kubectl config use-context [email protected]
kubectl config view
kubectl get pods
 

為了方便測試，建立一個新的使用者 ik8s

useradd ik8s
cp -rf .kube/ /home/ik8s/
chown  -R ik8s. /home/ik8s/
su - ik8s
kubectl config use-context [email protected]
kubectl config view

建立 clusterrole

kubectl create clusterrole cluster-reader --verb=get,list,watch --resource=pods -o yaml --dry-run > clusterrole-demo.yaml

kubectl apply -f clusterrole-demo.yaml 

kubectl get rolebinding

# 刪除 klvchen-read-pods ，解除 role 角色 pods-reader 和 user 使用者 klvchen 的繫結關係
kubectl delete rolebinding klvchen-read-pods

建立 clusterrolebinding

kubectl create clusterrolebinding klvchen-read-all-pods --clusterrole=cluster-reader --user=klvchen --dry-run -o yaml > clusterrolebinding-demo.yaml
kubectl apply -f clusterrolebinding-demo.yaml

kubectl describe clusterrolebinding klvchen-read-all-pods

測試

#切換到 ik8s 賬戶
kubectl get pods -n kube-system
# 所有名稱空間都可以正常顯示 pods

使用 rolebinding 關聯 clusterrole

kubectl delete clusterrolebinding klvchen-read-all-pods
kubectl create rolebinding klvchen-read-pods --clusterrole=cluster-reader --user=klvchen --dry-run -o yaml > rolebinding-clusterrole-demo.yaml
kubectl apply -f rolebinding-clusterrole-demo.yaml 

#測試
#切換到 ik8s 賬戶
kubectl get pods 
# 只有預設的名稱空間可以正常顯示 pods

檢視 k8s 叢集中 admin 擁有的許可權

kubectl get clusterrole admin -o yaml
kubectl get clusterrolebinding cluster-admin -o yaml

[[email protected] ~]# kubectl get clusterrolebinding cluster-admin -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  creationTimestamp: 2018-11-07T10:12:36Z
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: cluster-admin
  resourceVersion: "107"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/cluster-admin
  uid: a6252a77-e275-11e8-8c94-cad98100ca95
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:masters                     # admin 所在的組是 system:masters

# kubernetes-admin 是屬於 system:masters 組
[[email protected] ~]# kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://192.168.0.205:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: klvchen
  name: [email protected]
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: [email protected]
current-context: [email protected]
kind: Config
preferences: {}
users:
- name: klvchen
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED

檢視對應的證書，這裡注意了，證書的有效期為1年

[[email protected] ~]# cd /etc/kubernetes/pki/
[[email protected] pki]# openssl x509 -in ./apiserver-kubelet-client.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3302614080992031284 (0x2dd53e0237bbb234)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=kubernetes
        Validity
            Not Before: Nov  7 10:11:55 2018 GMT
            Not After : Nov  7 10:11:56 2019 GMT
        Subject: O=system:masters, CN=kube-apiserver-kubelet-client
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
...後面資訊忽略