KUBERNETES超越RBAC – 通过WEBHOOK自定义授权

kind: ClusterapiVersion: kind.x-k8s.io/v1alpha4nodes:- role: control-plane  extraMounts:  - hostPath: /Users/emre.savci/Desktop/kube-authz    containerPath: /fileskubeadmConfigPatches:- |  kind: ClusterConfiguration  apiServer:    extraArgs:      enable-admission-plugins: NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook      authorization-mode: Webhook,RBAC      authorization-webhook-version: v1      authorization-webhook-config-file: /files/authz-webhook.yaml      authorization-webhook-cache-authorized-ttl: 120s      authorization-webhook-cache-unauthorized-ttl: 30s    extraVolumes:    - name: api-server-basic-auth-files      hostPath: "/files"      mountPath: "/files"      readOnly: true

authorization-mode: Webhook, RBAC

authorization-webhook-config-file: /files/authz-webhook.yaml

clusters:- name: my-cluster  cluster:    certificate-authority: /files/webhook.crt    server: https://authz-webhook/authorizeusers:- name: api-server  user:    token: test-tokencurrent-context: my-clustercontexts:- context:    cluster: my-cluster    user: api-server  name: my-cluster

kind create cluster --retain --config kind-cp.yaml

go get "k8s.io/api/authorization/v1"

// SubjectAccessReview checks whether or not a user or group can perform an action.type SubjectAccessReview struct { metav1.TypeMeta `json:",inline"` // Standard list metadata. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata // +optional metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 // Spec holds information about the request being evaluated Spec SubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
 // Status is filled in by the server and indicates whether the request is allowed or not // +optional Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`}

// SubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes// and NonResourceAuthorizationAttributes must be settype SubjectAccessReviewSpec struct {// ResourceAuthorizationAttributes describes information for a resource access request// +optionalResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`// NonResourceAttributes describes information for a non-resource access request// +optionalNonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"`// User is the user you're testing for.// If you specify "User" but not "Groups", then is it interpreted as "What if User were not a member of any groups// +optionalUser string `json:"user,omitempty" protobuf:"bytes,3,opt,name=user"`// Groups is the groups you're testing for.// +optionalGroups []string `json:"groups,omitempty" protobuf:"bytes,4,rep,name=groups"`// Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer// it needs a reflection here.// +optionalExtra map[string]ExtraValue `json:"extra,omitempty" protobuf:"bytes,5,rep,name=extra"`// UID information about the requesting user.// +optionalUID string `json:"uid,omitempty" protobuf:"bytes,6,opt,name=uid"`}// ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interfacetype ResourceAttributes struct {// Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces// "" (empty) is defaulted for LocalSubjectAccessReviews// "" (empty) is empty for cluster-scoped resources// "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview// +optionalNamespace string `json:"namespace,omitempty" protobuf:"bytes,1,opt,name=namespace"`// Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "*" means all.// +optionalVerb string `json:"verb,omitempty" protobuf:"bytes,2,opt,name=verb"`// Group is the API Group of the Resource. "*" means all.// +optionalGroup string `json:"group,omitempty" protobuf:"bytes,3,opt,name=group"`// Version is the API Version of the Resource. "*" means all.// +optionalVersion string `json:"version,omitempty" protobuf:"bytes,4,opt,name=version"`// Resource is one of the existing resource types. "*" means all.// +optionalResource string `json:"resource,omitempty" protobuf:"bytes,5,opt,name=resource"`// Subresource is one of the existing resource types. "" means none.// +optionalSubresource string `json:"subresource,omitempty" protobuf:"bytes,6,opt,name=subresource"`// Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.// +optionalName string `json:"name,omitempty" protobuf:"bytes,7,opt,name=name"`}

// SubjectAccessReviewStatustype SubjectAccessReviewStatus struct {// Allowed is required. True if the action would be allowed, false otherwise.Allowed bool `json:"allowed" protobuf:"varint,1,opt,name=allowed"`// Denied is optional. True if the action would be denied, otherwise// false. If both allowed is false and denied is false, then the// authorizer has no opinion on whether to authorize the action. Denied// may not be true if Allowed is true.// +optionalDenied bool `json:"denied,omitempty" protobuf:"varint,4,opt,name=denied"`// Reason is optional. It indicates why a request was allowed or denied.// +optionalReason string `json:"reason,omitempty" protobuf:"bytes,2,opt,name=reason"`// EvaluationError is an indication that some error occurred during the authorization check.// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.// For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.// +optionalEvaluationError string `json:"evaluationError,omitempty" protobuf:"bytes,3,opt,name=evaluationError"`}

package main
import (  "fmt"
  "github.com/gofiber/fiber/v2"  authorizationv1 "k8s.io/api/authorization/v1")
func main() {  app := fiber.New()  app.Post("/authorize", func(ctx *fiber.Ctx) error {    var req authorizationv1.SubjectAccessReview    ctx.BodyParser(&req)    req.Status.Allowed = true    if req.Spec.User == "system:serviceaccount:default:test-user" {      if req.Spec.ResourceAttributes != nil {        if req.Spec.ResourceAttributes.Verb == "get" || req.Spec.ResourceAttributes.Verb == "list" {          req.Status.Allowed = true        }        if req.Spec.ResourceAttributes.Verb == "delete" {          req.Status.Allowed = false        }      }      if req.Spec.NonResourceAttributes != nil {        if req.Spec.NonResourceAttributes.Verb == "get" || req.Spec.NonResourceAttributes.Verb == "list" {          req.Status.Allowed = true        }        if req.Spec.NonResourceAttributes.Verb == "delete" {          req.Status.Allowed = false        }      }    }    return ctx.JSON(req)  })  app.Get("/healthz", func(ctx *fiber.Ctx) error {    fmt.Println("healthz")    return ctx.SendStatus(200)  })  if err := app.ListenTLS(":443", "/app/webhook.crt", "/app/webhook.key"); err != nil {    fmt.Println(err)  }}

clusters:- name: devx-webhooks  cluster:    certificate-authority: /files/webhook.crt    server: https://devx-webhooks/authorizeusers:- name: api-server  user:    token: test-tokencurrent-context: devx-webhookscontexts:- context:    cluster: devx-webhooks    user: api-server  name: devx-webhooks

docker build -t go-kube-authz .docker run -it -d --name devx-webhooks --network kind -p 443:443 go-kube-authz

openssl genrsa -out webhook.key 2048

[req]default_bits = 2048prompt = nodefault_md = sha256distinguished_name = dnreq_extensions = req_ext
[dn]CN = devx-webhooks
[req_ext]subjectAltName = @alt_names
[alt_names]DNS.1 = devx-webhooks
openssl req -new -key webhook.key -out webhook.csr -config webhook.csr.cnf

authorityKeyIdentifier=keyid,issuerbasicConstraints=CA:FALSEkeyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEnciphermentextendedKeyUsage = serverAuthsubjectAltName = @alt_names
[alt_names]DNS.1 = devx-webhooks
openssl x509 -req -in webhook.csr -signkey webhook.key -out webhook.crt -days 365 -extfile webhook.ext

kubectl auth can-i --list

>kubectl create deployment nginx --image=nginx -n defaultdeployment.apps/nginx created

>kubectl get podsNAME READY STATUS RESTARTS AGEnginx-77b4fdf86c-zjwhr 1/1 Running 0 52m

kubectl create sa test-user

>kubectl auth can-i list pods --as=system:serviceaccount:default:test-useryes
>kubectl auth can-i get pods --as=system:serviceaccount:default:test-useryes

>kubectl auth can-i delete pods --as=system:serviceaccount:default:test-userno