[root@master master]# oc whoami system:admin [root@master master]# oc whoami -t error: no token is currently in use for this session [root@master master]#
System users：OKD 平台自动创建，用于 API 安全访问。系统用户包括集群管理员(具有所有访问权限)，routers 和 registries 使用的用户，系统匿名用户(用于非授权的请求)。 示例：system:admin system:openshift-registry system:node:node1.example.com
1 2 3 4
[root@master student]# oc get user NAME UID FULL NAME IDENTITIES admin 3300d7da-da70-11ed-a5c3-52540000fa0a htpasswd_auth:admin liruilong b0cb659b-da74-11ed-a5c3-52540000fa0a htpasswd_auth:liruilong
Service accounts：与项目关联的特殊系统用户，有些是随项目创建时自劢创建。 项目管理员可以根据需要创建服务账户，用于管理项目资源。 换句话讲，给集群中的pod 访问容器的权限。每个项目会创建一个默认的 sa 账户。
1 2 3 4 5 6 7 8
[root@master student]# oc get sa NAME SECRETS AGE builder 2 19h default 3 19h deployer 2 19h registry 3 19h router 2 19h [root@master student]#
在 OKD 中,每个项目都需要 sa 账户执行 build、deployment 和创建其他 pod, master-config.yml 参数 managedNames 定义了每个项目默认 sa 账户。
[root@master master]# htpasswd -b /etc/origin/master/htpasswd liruilong redhat Adding password for user liruilong [root@master master]# cat /etc/origin/master/htpasswd admin:$apr1$4ZbKL26l$3eKL/6AQM8O94lRwTAu611 developer:$apr1$4ZbKL26l$3eKL/6AQM8O94lRwTAu611 liruilong:$apr1$TEsPZeVC$mTKI3oehZBZrZUU74UhLn1
交互式创建
1 2 3 4 5 6 7 8 9 10
[root@master master]# htpasswd /etc/origin/master/htpasswd liruilong New password: Re-type new password: Updating password for user liruilong [root@master master]# cat /etc/origin/master/htpasswd admin:$apr1$4ZbKL26l$3eKL/6AQM8O94lRwTAu611 developer:$apr1$4ZbKL26l$3eKL/6AQM8O94lRwTAu611 liruilong:$apr1$RhuXyaXn$xMo1M9CBBA2IftxBdtyHr1 [root@master master]#
也可以通过配置文件的方式来创建用户
SA 服务账号创建
sa 创建之后会生成一个默认的 token ，某些面板工具可以通过 token 来实现认证登录。但是需要对 sa 做授权
1 2 3 4 5
[root@master student]# oc create sa liruilong serviceaccount "liruilong" created [root@master student]# oc get sa liruilong NAME SECRETS AGE liruilong 2 9s
查看 sa 的详细信息
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
[root@master student]# oc describe sa liruilong Name: liruilong Namespace: default Labels: <none> Annotations: <none> Image pull secrets: liruilong-dockercfg-2bpbm Mountable secrets: liruilong-token-rl57k liruilong-dockercfg-2bpbm Tokens: liruilong-token-j5v87 liruilong-token-rl57k Events: <none> [root@master student]# oc get secret liruilong-token-rl57k NAME TYPE DATA AGE liruilong-token-rl57k kubernetes.io/service-account-token 4 59s [root@master student]#
You don't have any projects. You can try to create a new project, by running oc new-project <projectname> [root@master student]# oc whoami liruilong [root@master student]#
[root@master student]# oc get user NAME UID FULL NAME IDENTITIES admin 3300d7da-da70-11ed-a5c3-52540000fa0a htpasswd_auth:admin liruilong b0cb659b-da74-11ed-a5c3-52540000fa0a htpasswd_auth:liruilong
[root@master student]# oc get identity NAME IDP NAME IDP USER NAME USER NAME USER UID htpasswd_auth:admin htpasswd_auth admin admin 3300d7da-da70-11ed-a5c3-52540000fa0a htpasswd_auth:liruilong htpasswd_auth liruilong liruilong b0cb659b-da74-11ed-a5c3-52540000fa0a [root@master student]#
组 (group)的信息的来源有两个，一是后端的 Indentity Provider ，二是通过用户在 Open Shift 中定义 。 通过 oadm groups 命令，可以在 OpenShift 中对组及组的成员进行管理。
添加组
1 2 3
[root@master student]# oc adm groups new devops NAME USERS devops
在组中添加用户
1 2
[root@master student]# oc adm groups add-users devops liruilong group "devops" added: "liruilong"
查看组
1 2 3 4 5 6 7
[root@master student]# kubectl get group NAME USERS devops liruilong [root@master student]# oc get group NAME USERS devops liruilong [root@master student]#
删除组
1 2 3 4 5 6 7 8 9 10 11 12 13
[root@master student]# oc adm policy remove-group devops Groups [devops] were not bound to roles in project default. [root@master student]# kubectl get groups NAME USERS devops [root@master student]# oc get group NAME USERS devops [root@master student]# kubectl delete group devops group "devops" deleted [root@master student]# oc get group No resources found. [root@master student]#
policy： 若干个 Role 组成一个 策略policy ,策略分为 集群级别 Clusterpolicy和命名空间Policy 级别.
Role Binding: 角色绑定关系，定义了角色于具体的用户以及组的关联关系，
Policy Binding: 若干 Role Binding组成的集合将构成一个 Policy Binding (策略绑定关系)。该对象类型同样分为集群与项目两个级别 。
关于 RBAC 以及对应的资源对象，这个不多做说明，简单来看一下当前 集群内置的一些角色
权限对象关系Demo
角色管理
k8s 中的 集群相关的资源有两个 role 和 clusterrole,OKD 中，也是一样的，角色一般用于处理命令空间，也就是okd 中的项目的资源，而 集群角色用于整个集群的角色控制。集群级别的 Clusterrole 和项目级别的 Role 。
查看当前集群的角色和集群角色
1 2 3 4 5 6 7 8 9
[root@master student]# oc get clusterrole | head -n 5 NAME admin asb-access asb-auth basic-user [root@master student]# oc get role No resources found. [root@master student]#
[root@master student]# oc get clusterrolebinding admin NAME ROLE USERS GROUPS SERVICE ACCOUNTS SUBJECTS admin /admin openshift-infra/template-instance-controller [root@master student]#
Run As User Strategy: MustRunAsRange:则表示容器必须以指定的用户 ID 运行。具体来说，MustRunAsRange 策略要求容器的用户 ID 必须在指定的范围内。这个范围由 RunAsUser 和 RunAsGroup 字段指定。如果容器的用户 ID 不在指定的范围内，容器将无法启动。
pod 以哪个用户身份执行，如果没有明确挃定，则由 pod 使用的 scc 确定。明确指定方法，下面为 K8s官网的一个Demo。
[root@master student]# oc new-app --name=nginx --docker-image=registry.lab.example.com/nginx --> Found Docker image c825216 (4 years old) from registry.lab.example.com for"registry.lab.example.com/nginx"
* An image stream will be created as "nginx:latest" that will track this image * This image will be deployed in deployment config "nginx" * Port 80/tcp will be load balanced by service "nginx" * Other containers can access this service through the hostname "nginx" * WARNING: Image "registry.lab.example.com/nginx" runs as the 'root' user which may not be permitted by your cluster administrator
--> Creating resources ... imagestream "nginx" created deploymentconfig "nginx" created service "nginx" created --> Success Application is not exposed. You can expose services to the outside world by executing one or more of the commands below: 'oc expose svc/nginx' Run 'oc status' to view your app.
[root@master student]# kubectl get pods NAME READY STATUS RESTARTS AGE docker-registry-1-drmbk 1/1 Running 2 1d nginx-1-deploy 1/1 Running 0 45s nginx-1-h5zx8 0/1 CrashLoopBackOff 2 42s registry-console-1-dg4h9 1/1 Running 2 1d router-1-27wtd 1/1 Running 2 1d router-1-lvmvk 1/1 Running 2 1d
可以看到 pod 一直创建失败。
1 2 3 4
[root@master student]# kubectl get pods --selector=app=nginx NAME READY STATUS RESTARTS AGE nginx-1-h5zx8 0/1 CrashLoopBackOff 6 6m [root@master student]#
在最前面的 Pod 创建的时候,我们看到一个告警，提示提示，以root 的方式运行不被集群管理员所允许。所以 Pod 状态一直是 CrashLoopBackOff.
1
* WARNING: Image "registry.lab.example.com/nginx" runs as the 'root' user which may not be permitted by your cluster administrator
1 2 3 4 5 6 7 8 9 10 11 12
[root@master student]# oc describe pods nginx-1-h5zx8 | grep -i -A 20 event Events: Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 13m default-scheduler Successfully assigned nginx-1-h5zx8 to node2.lab.example.com Normal SuccessfulMountVolume 13m kubelet, node2.lab.example.com MountVolume.SetUp succeeded for volume "default-token-bmctn" Normal Pulled 12m (x4 over 13m) kubelet, node2.lab.example.com Successfully pulled image "registry.lab.example.com/nginx@sha256:4ffd9758ea9ea360fd87d0cee7a2d1cf9dba630bb57ca36b3108dcd3708dc189" Normal Created 12m (x4 over 13m) kubelet, node2.lab.example.com Created container Normal Started 12m (x4 over 13m) kubelet, node2.lab.example.com Started container Normal Pulling 11m (x5 over 13m) kubelet, node2.lab.example.com pulling image "registry.lab.example.com/nginx@sha256:4ffd9758ea9ea360fd87d0cee7a2d1cf9dba630bb57ca36b3108dcd3708dc189" Warning BackOff 3m (x46 over 13m) kubelet, node2.lab.example.com Back-off restarting failed container [root@master student]#
这个时候，我们可以修改默认的 SCC 相关的权限，或者通过创建新的 SA 的方式，创建服务帐户；将特定 SCC(如 anyuid)添加给用户；修改 dc 使用创建的 sa 用户身份运行。
