[K8s] CKA 취득 연습문제#8 (role, rolebinding)

 

 

2023.06.06

★ kube-apiserver 클러스터에 구성된 인증 모드를 확인합니다.

->  Node, RBAC

controlplane ~ ➜ kubectl get pods -A
NAMESPACE      NAME                                   READY   STATUS    RESTARTS   AGE
blue           blue-app                               1/1     Running   0          3m50s
blue           dark-blue-app                          1/1     Running   0          3m50s
default        red-84c985b67c-ncs4w                   1/1     Running   0          3m51s
default        red-84c985b67c-whbgx                   1/1     Running   0          3m51s
kube-flannel   kube-flannel-ds-fmzvv                  1/1     Running   0          7m12s
kube-system    coredns-787d4945fb-p9td5               1/1     Running   0          7m11s
kube-system    coredns-787d4945fb-qqzl2               1/1     Running   0          7m12s
kube-system    etcd-controlplane                      1/1     Running   0          7m22s
kube-system    kube-apiserver-controlplane            1/1     Running   0          7m24s
kube-system    kube-controller-manager-controlplane   1/1     Running   0          7m27s
kube-system    kube-proxy-r8dbm                       1/1     Running   0          7m12s
kube-system    kube-scheduler-controlplane            1/1     Running   0          7m22s

controlplane ~ ➜  
controlplane ~ ➜  kubectl describe pods -n kube-system kube-apiserver-controlplane | grep authorization
      --authorization-mode=Node,RBAC

controlplane ~ ➜

 

 

★ default 네임스페이스에 몇개의  role이 존재하나요?.

->  0

controlplane ~ ➜  kubectl get role -n default 
No resources found in default namespace.

controlplane ~ ➜

 

 

★ 모든 네임스페이스에 총 몇 개의 role이 존재하나요?

-> 12

controlplane ~ ➜  kubectl get role -A 
NAMESPACE     NAME                                             CREATED AT
blue          developer                                        2023-06-06T05:54:21Z
kube-public   kubeadm:bootstrap-signer-clusterinfo             2023-06-06T05:50:46Z
kube-public   system:controller:bootstrap-signer               2023-06-06T05:50:45Z
kube-system   extension-apiserver-authentication-reader        2023-06-06T05:50:44Z
kube-system   kube-proxy                                       2023-06-06T05:50:48Z
kube-system   kubeadm:kubelet-config                           2023-06-06T05:50:45Z
kube-system   kubeadm:nodes-kubeadm-config                     2023-06-06T05:50:45Z
kube-system   system::leader-locking-kube-controller-manager   2023-06-06T05:50:45Z
kube-system   system::leader-locking-kube-scheduler            2023-06-06T05:50:45Z
kube-system   system:controller:bootstrap-signer               2023-06-06T05:50:44Z
kube-system   system:controller:cloud-provider                 2023-06-06T05:50:44Z
kube-system   system:controller:token-cleaner                  2023-06-06T05:50:45Z

controlplane ~ ➜

 

 

★ kube-system 네임스페이스의 kube-proxy 역할에 액세스 권한이 부여된 리소스에는 어떤 것이 있나요?

->  configmaps

controlplane ~ ➜  kubectl describe role -n kube-system kube-proxy 
Name:         kube-proxy
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources   Non-Resource URLs  Resource Names  Verbs
  ---------   -----------------  --------------  -----
  configmaps  []                 [kube-proxy]    [get]

controlplane ~ ➜

 

★ kube-proxy role은 컨피그맵에서 어떤 권한을 수행할 수 있나요?

-> get

-> kube-proxy 역할은 kube-proxy라는 이름으로만 컨피그맵 오브젝트의 세부 정보를 가져올 수 있다.

controlplane ~ ➜  kubectl describe role -n kube-system kube-proxy 
Name:         kube-proxy
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources   Non-Resource URLs  Resource Names  Verbs
  ---------   -----------------  --------------  -----
  configmaps  []                 [kube-proxy]    [get]

controlplane ~ ➜

 

 

★ 어떤 계정에 kube-proxy 역할이 할당되나요?

-> Group:system:bootstrappers:kubeadm:default-node-token  

controlplane ~ ➜  kubectl describe rolebindings -n kube-system kube-proxy 
Name:         kube-proxy
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  Role
  Name:  kube-proxy
Subjects:
  Kind   Name                                             Namespace
  ----   ----                                             ---------
  Group  system:bootstrappers:kubeadm:default-node-token  

controlplane ~ ➜

 

 

★ 개발 사용자가 기본 네임스페이스에서 파드를 생성, 나열 및 삭제하는 데 필요한 role과 rolebinding을 생성합니다.

-> role 생성

controlplane ~ ➜  kubectl create role developer --namespace=default --verb=list,create,delete --resource=pods
role.rbac.authorization.k8s.io/developer created

controlplane ~ ➜

-> role binding 생성

controlplane ~ ➜  kubectl create rolebinding dev-user-binding --namespace=default --role=developer --user=dev-user
rolebinding.rbac.authorization.k8s.io/dev-user-binding created

controlplane ~ ➜

-> 생성 확인

controlplane ~ ➜  kubectl get role
NAME        CREATED AT
developer   2023-06-06T06:23:29Z

controlplane ~ ➜
controlplane ~ ➜  kubectl get rolebindings
NAME               ROLE             AGE
dev-user-binding   Role/developer   63s

controlplane ~ ➜

-> 상세확인

controlplane ~ ➜  kubectl describe role developer 
Name:         developer
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  pods       []                 []              [list create delete]

controlplane ~ ➜
controlplane ~ ➜  kubectl describe rolebindings dev-user-binding 
Name:         dev-user-binding
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  Role
  Name:  developer
Subjects:
  Kind  Name      Namespace
  ----  ----      ---------
  User  dev-user  

controlplane ~ ➜

 

 

★ dark-blue-app 파드에 developer role을 연동해주세요.

-> 기존에는 Resource Names에 blue-app으로 연동되어있는데 바꿔줘야한다.

controlplane ~ ➜  kubectl describe role -n blue developer 
Name:         developer
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  pods       []                 [blue-app]      [get watch create delete]

controlplane ~ ➜

-> 파드 이름을 수정

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: "2023-06-06T05:54:21Z"
  name: developer
  namespace: blue
  resourceVersion: "3780"
  uid: cf0b171d-870f-4cf8-a585-33d9294ccf95
rules:
- apiGroups:
  - ""
  resourceNames:
  - dark-blue-app
  resources:
  - pods
  verbs:
  - get
  - watch
  - create
  - delete

-> 확인

controlplane ~ ➜  kubectl edit role -n blue developer 
role.rbac.authorization.k8s.io/developer edited

controlplane ~ ➜  

controlplane ~ ➜  

controlplane ~ ➜  kubectl describe role -n blue
Name:         developer
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources  Non-Resource URLs  Resource Names   Verbs
  ---------  -----------------  --------------   -----
  pods       []                 [dark-blue-app]  [get watch create delete]

controlplane ~ ➜

 

 

★ 기존 developer 새 규칙을 추가하여 blue 네임스페이스에서 배포를 만들 수 있는 dev-user 권한을 부여합니다.

-> 기존 role에서 아래 apiGroups 부터 추가 기입

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: "2023-06-06T05:54:21Z"
  name: developer
  namespace: blue
  resourceVersion: "4827"
  uid: cf0b171d-870f-4cf8-a585-33d9294ccf95
rules:
- apiGroups:
  - apps
  resourceNames:
  - dark-blue-app
  resources:
  - pods
  verbs:
  - get
  - watch
  - create
  - delete
- apiGroups:
  - apps
  resources:
  - deployments
  verbs:
  - create

-> edit 완료

controlplane ~ ➜  kubectl edit role -n blue developer 
role.rbac.authorization.k8s.io/developer edited

controlplane ~ ➜

- role 상세 확인

controlplane ~ ➜  kubectl describe role -n blue developer 
Name:         developer
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources         Non-Resource URLs  Resource Names   Verbs
  ---------         -----------------  --------------   -----
  deployments.apps  []                 []               [create]
  pods.apps         []                 [dark-blue-app]  [get watch create delete]

controlplane ~ ➜