为用户签发证书与 kubeconfig：证书用户与 ServiceAccount token 认证实践

openssl genrsa -out devuser.key 2048
# CN 为用户名，O 为组（可多个 -subj "/CN=devuser/O=dev-team/O=qa-team"）
openssl req -new -key devuser.key -out devuser.csr -subj "/CN=devuser/O=dev-team"

cat <<EOT | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: devuser
spec:
  request: $(base64 < devuser.csr | tr -d '\n')
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 7776000        # 90 天；最小 600 秒，实际上限受 CA 与签名者配置约束
  usages:
  - client auth
EOT

kubectl certificate approve devuser
kubectl get csr devuser -o jsonpath='{.status.certificate}' | base64 -d > devuser.crt

APISERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d > ca.crt

kubectl config set-cluster kubernetes \
  --server="$APISERVER" --certificate-authority=ca.crt --embed-certs=true \
  --kubeconfig=devuser.kubeconfig

kubectl config set-credentials devuser \
  --client-certificate=devuser.crt --client-key=devuser.key --embed-certs=true \
  --kubeconfig=devuser.kubeconfig

kubectl config set-context devuser@kubernetes \
  --cluster=kubernetes --user=devuser --namespace=dev \
  --kubeconfig=devuser.kubeconfig

kubectl config use-context devuser@kubernetes --kubeconfig=devuser.kubeconfig

kubectl create rolebinding devuser-admin --clusterrole=admin --user=devuser --namespace=dev
kubectl create rolebinding devuser-admin --clusterrole=admin --user=devuser --namespace=test

# 以 devuser 身份查看权限
kubectl --kubeconfig=devuser.kubeconfig auth whoami
kubectl --kubeconfig=devuser.kubeconfig auth can-i list pods -n dev        # yes
kubectl --kubeconfig=devuser.kubeconfig auth can-i list pods -n default    # no

# 管理员也可以模拟用户检查
kubectl auth can-i create deployments -n test --as devuser

Error from server (Forbidden): pods is forbidden: User "devuser" cannot list resource "pods" in API group "" in the namespace "default"

apiVersion: v1
kind: ServiceAccount
metadata:
  name: dev-deployer
  namespace: dev
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: dev-deployer-admin
  namespace: dev
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin
subjects:
- kind: ServiceAccount
  name: dev-deployer
  namespace: dev
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: dashboard-admin
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dashboard-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: dashboard-admin
  namespace: kube-system

kubectl -n dev create token dev-deployer --duration=1h
kubectl -n kube-system create token dashboard-admin --duration=24h

kubectl -n dev apply -f - <<EOT
apiVersion: v1
kind: Secret
metadata:
  name: dev-deployer-token
  annotations:
    kubernetes.io/service-account.name: dev-deployer
type: kubernetes.io/service-account-token
EOT

kubectl -n dev get secret dev-deployer-token -o jsonpath='{.data.token}' | base64 -d

kubectl config set-credentials dev-deployer --token="$(kubectl -n dev create token dev-deployer --duration=8h)" --kubeconfig=deployer.kubeconfig
kubectl config set-cluster kubernetes --server="$APISERVER" --certificate-authority=ca.crt --embed-certs=true --kubeconfig=deployer.kubeconfig
kubectl config set-context deployer --cluster=kubernetes --user=dev-deployer --namespace=dev --kubeconfig=deployer.kubeconfig
kubectl config use-context deployer --kubeconfig=deployer.kubeconfig