允许Kubernetes用户列出/获取命名空间。

Question

我有以下用户清单，我想允许myapp-user获取集群中所有命名空间的列表。我查找了一些资料，发现应该创建一个ClusterRole，但我找不到足够的详细信息。是否有任何apiGroups及其对应资源和动词列表的清单？

apiVersion: v1
kind: ServiceAccount
metadata:
  name: myapp-user
  namespace: myapp

---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: myapp-user-role
  namespace: myapp
rules:
- apiGroups: ["", "extensions", "apps"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["batch"]
  resources:
  - jobs
  - cronjobs
  verbs: ["*"]
- apiGroups: ["networking.k8s.io"]
  resources:
  - ingress
  verbs: ["*"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: myapp-user
  namespace: myapp
subjects:
- kind: ServiceAccount
  name: myapp-suer
  namespace: myapp
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: myapp-user-role

我认为将这部分内容添加到 role.rules 中可能会有所帮助，但不幸的是没有。

- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["GET"]

- MrPsycho

Answer 1

您可以通过API获取资源

kubectl api-resources

NAME                              SHORTNAMES   APIGROUP                       NAMESPACED   KIND
bindings                                                                      true         Binding
componentstatuses                 cs                                          false        ComponentStatus
configmaps                        cm                                          true         ConfigMap
endpoints                         ep                                          true         Endpoints
events                            ev                                          true         Event
limitranges                       limits                                      true         LimitRange
namespaces                        ns                                          false        Namespace
nodes                             no                                          false        Node
persistentvolumeclaims            pvc                                         true         PersistentVolumeClaim
persistentvolumes                 pv                                          false        PersistentVolume

用于创建 clusterrole 和 clusterolebinding 的命令如下所示。

kubectl create clusterrole cr --verb=get,list --resource=namespaces

kubectl create clusterrolebinding crb --clusterrole=cr --serviceaccount=default:default

然后进行测试

kubectl auth can-i get ns --as=system:serviceaccount:default:default
kubectl auth can-i list ns --as=system:serviceaccount:default:default

- Arghya Sadhu

Answer 2

感谢@abhishek-jaisingh和@arghya-sadhu的答案，我能够理解并将命令重写为一个清单文件。

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: myapp-user-cr
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: myapp-user-crb
subjects:
- kind: ServiceAccount
  name: myapp-user
roleRef:
  kind: ClusterRole
  name: myapp-user-cr
  apiGroup: rbac.authorization.k8s.io

- MrPsycho

---

如何将 ClusterRoleBinding 附加到特定的命名空间，请参考文档中的 ClusterRoleBindings 部分 https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding - Kalim

Answer 3

您可以通过以下命令列出集群支持的所有资源种类：

❯❯❯ kubectl api-resources
NAME                              SHORTNAMES   APIGROUP                           NAMESPACED   KIND
bindings                                                                          true         Binding
componentstatuses                 cs                                              false        ComponentStatus
configmaps                        cm                                              true         ConfigMap
endpoints                         ep                                              true         Endpoints
events                            ev                                              true         Event
limitranges                       limits                                          true         LimitRange
namespaces                        ns                                              false        Namespace
nodes                             no                                              false        Node
persistentvolumeclaims            pvc                                             true         PersistentVolumeClaim
persistentvolumes                 pv                                              false        PersistentVolume

要查看这些资源支持的所有操作/动词，您需要查找与您相关的版本的 Kubernetes 参考文档，例如对于 CronJobs，请参考https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#cronjob-v1beta1-batch。

- Abhishek Jaisingh