ืืืืขืจ ืึธืืขืจ ืฉืคึผืขืืขืจ, ืืื ืืขืจ ืึธืคึผืขืจืึทืฆืืข ืคืื โโืงืืื ืกืืกืืขื, ืื ืึทืจืืืกืืขืื ืคืื ืืืืขืจืืืึทื ืขืจืืืืึทื: ืื ืฉืืจืื ื ืึธืืขื ืืึทืงืืืฉืึทื, ืฆืขืฉืืืืื ื ืคืื ืจืขืื, ืึทืืึทืืื ื ืืื ืื ืืขืจืข ืืึทืกืงืก. ืฉืืื ืืืฉืืคื ืคึฟืึทืจ Kubernetes , ืืืึธืก ืืึธืื ืืืจ ืฆื ืืขืจืืจืืืื ืืขืกืงืขื ืืื ืกืืึทื ืืึทืจืืก ืืคืืื ืืื ืืืืขืจ ืคืืืขืจื ืื ืืืืืจืึทื ืืึทื ืฅ ... ืืขืจ ืืขืืืืงืขืจ ืืึทืืขืจืืึทื ืืื ืืขืืึทืงืืืืึทื ืฆื ืื ืืงืขืจืืืง ืึทืกืคึผืขืงืฅ ืคืื ืืืืขืจืืืึทื ืืืคึผืืึทืืขื ืึทื ืืื ืื ืืขืืืื-ืืื ืืขืงืึทื ืืืึทืื ืคืื ืื ืง8ืก. ืขืจืฉืืขืจ ืคืื ืึทืืข, ืขืก ืืืขื ืืืื ื ืืฆืืง ืคึฟืึทืจ ืื ืืืืก ืึธื ืืืืื ืฆื ืืึทืงืขื ืขื ืืื ืืื Kubernetes - ืืื ืึท ืกืืึทืจืืื ื ืคืื ื ืคึฟืึทืจ ืืขืจื ืขื ืืืืขืจืืืื-ืคึฟืึทืจืืื ืืขื ืข ืืฉืื.
ืึธืืขื ืืึทืงืืืฉืึทื
ืขืก ืืขื ืขื ืฆืืืื ืืืืคึผืก ืคืื ื ืืฆืขืจืก ืืื Kubernetes:
- ืกืขืจืืืืก ืึทืงืึทืื ืฅ - ืึทืงืึทืื ืฅ ืืขืจืืื ืืืจื ืื Kubernetes API;
- ื ืืฆืขืจืก - "ื ืึธืจืืึทื" ื ืืฆืขืจืก ืืขืจืืื ืืืจื ืคืื ืืจืืืกื ืืืง, ืคืจืืึท ืืึทืืื ืื ืืก.
ืืขืจ ืืืืคึผื ืืืืืง ืฆืืืืฉื ืื ืืืืคึผืก ืืื ืึทื ืคึฟืึทืจ ืกืขืจืืืืก ืึทืงืึทืื ืฅ ืขืก ืืขื ืขื ืกืคึผืขืฆืืขื ืึทืืืืฉืขืงืฅ ืืื ืื Kubernetes API (ืืื ืืขื ืขื ืืขืจืืคื ืึทื - ServiceAccounts), ืืืึธืก ืืขื ืขื ืืืื ืฆื ืึท ื ืึทืืขืกืคึผืึทืกืข ืืื ืึท ืกืืื ืคืื ืืขืจืืืืืขื ืืฉ ืืึทืื ืกืืึธืจื ืืื ืืขื ืงื ืืื ืืื ืึทืืืืฉืขืงืฅ ืคืื ืื ืกืขืงืจืขืฅ ืืืคึผ. ืึทืืึท ื ืืฆืขืจืก (ืกืขืจืืืืก ืึทืงืึทืื ืฅ) ืืขื ืขื ืืคึฟืจื ืืืขื ืฆื ืคืืจื ืึทืงืกืขืก ืจืขืื ืฆื ืื Kubernetes API ืคืื ืคึผืจืึทืกืขืกืึทื ืคืืืกื ืืืง ืืื ืื Kubernetes ืงื ืืื.
ืคึผืจืึธืกื ืืืืขืจื ืืึธื ื ืื ืืึธืื ืืืื ืกื ืืื ืื Kubernetes API: ืืื ืืืื ืืืื ืืขืจืืื ืืืจื ืคืื ืืจืืืกื ืืืง ืืขืงืึทื ืืืึทืื. ืืื ืืขื ืขื ืืืขื ืคึฟืึทืจ ืืขื ืืฉื ืึธืืขืจ ืคึผืจืึทืกืขืกืึทื ืืืึธืก ืืขืื ืึทืจืืืก ืืขื ืงื ืืื.
ืืขืืขืจ ืึทืคึผื ืืขืื ืืื ืคึฟืึทืจืืื ืื ืืื ืึธืืขืจ ืึท ืกืขืจืืืืก ืึทืงืึทืื ื, ืึท ืืึทื ืืฆืขืจ ืึธืืขืจ ืืื ืืขืืืืื ืึทื ืึทื ืึทืืึทืก.
ืืึทื ืืฆืขืจ ืึธืืขื ืืึทืงืืืฉืึทื ืืึทืื ืืืื:
- ื ืืืขื - ื ืืืขื (ืฉืคึผืืจืขืืืืืง ืคึฟืึทืจ ืคืึทื!);
- ืืื - ืึท ืืึทืฉืื-ืืืื ืขืืืืืง ืืึทื ืืฆืขืจ ืืขืืืืืืึทืฆืืข ืฉืืจืืงื ืืืึธืก ืืื "ืืขืจ ืงืึธื ืกืืกืืขื ื ืืื ืืื ืฆืืง ืืื ืื ื ืืืขื";
- ืืจืืคึผืขืก - ืจืฉืืื ืคืื ืืจืืคึผืขืก ืฆื ืืืึธืก ืืขืจ ืืึทื ืืฆืขืจ ืืขืืขืจื;
- ืขืงืกืืจืข - ื ืึธื ืคืขืืืขืจ ืืืึธืก ืงืขื ืขื ืืืื ืืขืืืืื ื ืืืจื ืื ืืขืจืืืืืขื ืืฉ ืืขืงืึทื ืืืึทื.
Kubernetes ืงืขื ืขื ื ืืฆื ืึท ืืจืืืก ื ืืืขืจ ืคืื ืึธืืขื ืืึทืงืืืฉืึทื ืืขืงืึทื ืืืึทืื: X509 ืกืขืจืืืคืืงืึทืฅ, ืืจืขืืขืจ ืืึธืงืขื ืก, ืึธืืขื ืืึทืงืืืืื ื ืคึผืจืึทืงืกื, HTTP Basic Auth. ืืื ืื ืืขืงืึทื ืืืึทืื, ืืืจ ืงืขื ืขื ืื ืกืืจืืืขื ื ืึท ืืจืืืก ื ืืืขืจ ืคืื ืืขืจืืืืืขื ืืฉ ืกืงืืื: ืคึฟืื ืึท ืกืืึทืืืง ืืขืงืข ืืื ืคึผืึทืกืืืขืจืื ืฆื OpenID OAuth2.
ืืขืจืฆื, ืขืก ืืื ืืขืืืขื ืฆื ื ืืฆื ืขืืืขืืข ืืขืจืืืืืขื ืืฉ ืกืงืืื ืกืืืืึทืืืืื ืืึทืกืื. ืืืจื ืคืขืืืงืืึทื, ืืขืจ ืงื ืืื ื ืืฆื:
- ืกืขืจืืืืก ืืฉืืื ืืึธืงืขื ืก - ืคึฟืึทืจ ืกืขืจืืืืก ืึทืงืึทืื ืฅ;
- X509 - ืคึฟืึทืจ ืืืืขืจื.
ืื ืงืฉืื ืืืขืื ืึธื ืคืืจืื ื ืกืขืจืืืืก ืึทืงืึทืื ืฅ ืืื ืืืืึทืืขืจ ืคืื ืืขื ืคืึทืจื ืขื ืคืื ืืขื ืึทืจืืืงื, ืึธืืขืจ ืคึฟืึทืจ ืื ืืืืก ืืืืื ืฆื ืืึทืงืขื ืขื ืืื ืืื ืืขื ืึทืจืืืกืืขืื ืืื ืืขืจ ืืขืืึทื, ืืื ืจืขืงืึธืืขื ืืืจื ืฆื ืึธื ืืืืื ืืื . ืืืจ ืืืขืื ื ืขืืขื ืึท ื ืขืขื ืืขืจ ืงืืง ืืื ืื ืึทืจืืืกืืขืื ืคืื ืืื X509 ืกืขืจืืืคืืงืึทืฅ ืึทืจืืขื.
ืกืขืจืืืคืืงืึทืฅ ืคึฟืึทืจ ืืืืขืจื (X.509)
ืืขืจ ืงืืึทืกืืฉ ืืืขื ืคืื ืืจืืขืื ืืื ืกืขืจืืืคืืงืึทืฅ ืื ืืืึทืืืื:
- ืฉืืืกื ืืืจ:
mkdir -p ~/mynewuser/.certs/ openssl genrsa -out ~/.certs/mynewuser.key 2048 - ืืืฉืขื ืขืจืืืืื ื ืึท ืืึทืืืืึทืื ืืขืื:
openssl req -new -key ~/.certs/mynewuser.key -out ~/.certs/mynewuser.csr -subj "/CN=mynewuser/O=company" - ืคึผืจืึทืกืขืกืื ื ืึท ืืึทืืืืึทืื ืืขืื ื ืืฆื ืื Kubernetes ืงื ืืื CA ืฉืืืกืืขื, ืืึทืงืืืขื ืึท ืืึทื ืืฆืขืจ ืืึทืืืืึทืื (ืฆื ืงืจืืื ืึท ืืึทืืืืึทืื, ืืืจ ืืืื ื ืืฆื ืึท ืืฉืืื ืืืึธืก ืืื ืึทืงืกืขืก ืฆื ืื Kubernetes ืงื ืืื CA ืฉืืืกื, ืืืึธืก ืืืจื ืคืขืืืงืืึทื ืืื ืืืื ืืื
/etc/kubernetes/pki/ca.key):openssl x509 -req -in ~/.certs/mynewuser.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out ~/.certs/mynewuser.crt -days 500 - ืฉืึทืคึฟื ืึท ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข:
- ืงื ืืื ืืึทืฉืจืืึทืืื ื (ืกืคึผืขืฆืืคืืฆืืจื ืื ืึทืืจืขืก ืืื ืึธืจื ืคืื ืื CA ืืึทืืืืึทืื ืืขืงืข ืคึฟืึทืจ ืึท ืกืคึผืขืฆืืคืืฉ ืงื ืืื ืื ืกืืึทืืืจืื ื):
kubectl config set-cluster kubernetes --certificate-authority=/etc/kubernetes/pki/ca.crt --server=https://192.168.100.200:6443 - ืึธืืขืจ ืืื ืงืืืืจืขืงืึทืืขื ืืื ืึธืคึผืฆืืข - ืืืจ ืืึธื ื ืื ืืึธืื ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืื ืืืึธืจืฆื ืืึทืืืืึทืื (ืืขืจื ืึธื kubectl ืืืขื ื ืืฉื ืงืึธื ืืจืึธืืืจื ืื ืงืขืจืขืงืื ืึทืก ืคืื ืื ืึทืคึผื ืกืขืจืืืขืจ ืคืื ืืขื ืงื ืืื):
kubectl config set-cluster kubernetes --insecure-skip-tls-verify=true --server=https://192.168.100.200:6443 - ืึทืืื ื ืึท ืืึทื ืืฆืขืจ ืฆื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข:
kubectl config set-credentials mynewuser --client-certificate=.certs/mynewuser.crt --client-key=.certs/mynewuser.key - ืึทืืื ื ืงืึธื ืืขืงืกื:
kubectl config set-context mynewuser-context --cluster=kubernetes --namespace=target-namespace --user=mynewuser - ืคืขืืืงืืึทื ืงืึธื ืืขืงืกื ืึทืกืืื ืืึทื ื:
kubectl config use-context mynewuser-context
- ืงื ืืื ืืึทืฉืจืืึทืืื ื (ืกืคึผืขืฆืืคืืฆืืจื ืื ืึทืืจืขืก ืืื ืึธืจื ืคืื ืื CA ืืึทืืืืึทืื ืืขืงืข ืคึฟืึทืจ ืึท ืกืคึผืขืฆืืคืืฉ ืงื ืืื ืื ืกืืึทืืืจืื ื):
ื ืึธื ืื ืืืืื ืืึทื ืืคึผืืึทืืืืฉืึทื ื, ืืื ืืขืจ ืืขืงืข .kube/config ืึท ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื ืืึธืก ืืืขื ืืืื ืืืฉืืคื:
apiVersion: v1
clusters:
- cluster:
certificate-authority: /etc/kubernetes/pki/ca.crt
server: https://192.168.100.200:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
namespace: target-namespace
user: mynewuser
name: mynewuser-context
current-context: mynewuser-context
kind: Config
preferences: {}
users:
- name: mynewuser
user:
client-certificate: /home/mynewuser/.certs/mynewuser.crt
client-key: /home/mynewuser/.certs/mynewuser.keyืฆื ืืึทืื ืขืก ืืจืื ืืขืจ ืฆื ืึทืจืืืขืจืคืืจื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืฆืืืืฉื ืึทืงืึทืื ืฅ ืืื ืกืขืจืืืขืจืก, ืขืก ืืื ื ืืฆืืง ืฆื ืจืขืืึทืืืจื ืื ืืืึทืืืขืก ืคืื ืื ืคืืืืขื ืืข ืฉืืืกืืขื:
-
certificate-authority -
client-certificate -
client-key
ืฆื ืืึธื ืืึธืก, ืืืจ ืงืขื ืขื ืขื ืงืึธืื ืื ืืขืงืขืก ืกืคึผืขืกืืคืืขื ืืื ืืื ื ืืฆื base64 ืืื ืคืึทืจืฉืจืืึทืื ืืื ืืื ืื ืงืึธื ืคืื, ืึทืืื ื ืื ืกืึทืคืืงืก ืฆื ืื ื ืึธืืขื ืคืื ืื ืฉืืืกืืขื. -data, ื.ื. ืืืืื ืืืงืืืขื certificate-authority-data ืืื"ื ื
ืกืขืจืืืคืืงืึทืฅ ืืื ืงืืืขืึทืื
ืืื ืืขืจ ืืขืืืื ื ืืจืืขืื ืืื ืกืขืจืืืคืืงืึทืฅ ืืื ืืขืืืืจื ืคืื ืืจืื ืืขืจ ืืึทื ืง ืฆื ืื ืึทืืฃ ืืืขืจืกืืข ืคืื โโืืืึทื ืฉืืืฆื ืืื . ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืึธืก ืืื ืืืึธืก ืืืฉืขื ืขืจืืืืื ื ืึท ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข ืืื ืืึทื ืืฆืขืจ ืฉืืืกืืขื ืงืขื ืืืฆื ืงืืงื ืืื:
kubeadm alpha kubeconfig user --client-name=mynewuser --apiserver-advertise-address 192.168.100.200
NB: ืคืืจืืื ืื ืืขืืื ืึทืืจืขืก ืงืขื ืขื ืืืื ืืขืคึฟืื ืขื ืืื ืื ืึทืคึผื-ืกืขืจืืืขืจ ืงืึทื ืคืืืืขืจืืืฉืึทื, ืืืึธืก ืืืจื ืคืขืืืงืืึทื ืืื ืืืื ืืื /etc/kubernetes/manifests/kube-apiserver.yaml.
ืื ืจืืืึทืืืื ื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืขื ืืืื ืจืขืืืืืึทื ืฆื stdout. ืขืก ืืึทืจืฃ ืฆื ืืืื ืืขืจืืืขืืืขื ืืื ~/.kube/config ืืึทื ืืฆืขืจ ืืฉืืื ืึธืืขืจ ืฆื ืึท ืืขืงืข ืกืคึผืขืกืืคืืขื ืืื ืึท ืกืืืืืืข ืืืึทืืขืืืืืง KUBECONFIG.
ืืจืึธืื ืืืคึผืขืจ
ืคึฟืึทืจ ืื ืืืืก ืืืืื ืฆื ืคึฟืึทืจืฉืืืื ืื ืืฉืื ืืืกืงืจืืืื ืืขืจ ืื ืืืจื:
- ืืืืฃ ืืจืืขืื ืืื ืกืขืจืืืคืืงืึทืฅ ืืื ืืขืจ ืืึทืึทืืืขืจ Kubernetes ืืึทืงืืืืขื ืืืืฉืึทื;
- , ืื ื ืฐืขืื ื ืข ื ืฐืขืจ ื ืืขืจืืจ ื ื ื ืคืจืื ืข ืคื ื ืกืขืจืืืคืืงืื ื ืคื ื ืคืจืืงืืืฉ ื ืคืขืจืกืคืขืงืืืื .
- ืืืืฃ ืึธืืขื ืืึทืงืืืฉืึทื ืืื Kubernetes.
ืืขืจืืืืืขื ืืฉ
ืืขืจ ืคืขืืืงืืึทื ืึธืืขืจืืืื ืืฉืืื ืืื ื ืืฉื ืืึธืื ืจืขืื ืฆื ืึทืจืืขืื ืืืืฃ ืืขื ืงื ืืื. ืฆื ืืขืื ืคึผืขืจืืืฉืึทื ื, Kubernetes ืืืคึผืืึทืืึทื ืฅ ืึท ืืขืจืืืืืขื ืืฉ ืืขืงืึทื ืืืึทื.
ืืืืืขืจ ืืืขืจืกืืข 1.6, Kubernetes ืืขืืืืื ื ืึท ืืขืจืืืืืขื ืืฉ ืืืคึผ ืืขืจืืคื ABAC (ืึทืืืจืืืืื-ืืืืืจื ืึทืงืกืขืก ืงืึธื ืืจืึธื). ืืขืืึทืืืก ืืืขืื ืขืก ืงืขื ืขื ืืืื ืืขืคึฟืื ืขื ืืื . ืืขืจ ืฆืืืึทื ื ืืื ืืขืจืืืืึทื ืืขืจืขืื ื ืืื ืืขืืึทื, ืึธืืขืจ ืืืจ ืงืขื ืขื ื ืึธื ื ืืฆื ืขืก ืฆืืืืืขื ืื ืืขืจืข ืึธืืขื ืืึทืงืืืฉืึทื ืืืืคึผืก.
ืื ืงืจืึทื ื (ืืื ืืขืจ ืคืืขืงืกืึทืืึทื) ืืืขื ืคืื ืืืืืืืืื ื ืึทืงืกืขืก ืจืขืื ืฆื ืึท ืงื ืืื ืืื ืืขืจืืคื RBAC (). ืขืก ืืื ืืขืจืงืืขืจื ืกืืึทืืื ืืื ื ืืืขืจืกืืข . RBAC ืืืคึผืืึทืืึทื ืฅ ืึท ืจืขืื ืืึธืืขื ืืื ืืืึธืก ืึทืืฅ ืืืึธืก ืืื ื ืืฉื ืืคืืจืืฉ ืืขืจืืืืื ืืื ืคึผืจืึธืืืืืึทืืึทื.
ืฆื ืืขืื RBAC, ืืืจ ืืึทืจืคึฟื ืฆื ืึธื ืืืืื Kubernetes ืึทืคึผื-ืกืขืจืืืขืจ ืืื ืืขื ืคึผืึทืจืึทืืขืืขืจ --authorization-mode=RBAC. ืื ืคึผืึทืจืึทืืขืืขืจืก ืืขื ืขื ืืึทืฉืืืื ืืื ืื ืืึทืฉืืึทืืคึผืขืจืืขื ืืื ืื ืึทืคึผื-ืกืขืจืืืขืจ ืงืึทื ืคืืืืขืจืืืฉืึทื, ืืืึธืก ืืืจื ืคืขืืืงืืึทื ืืื ืืืื ืืืืฃ ืืขื ืืจื /etc/kubernetes/manifests/kube-apiserver.yaml, ืืื ืึธืคึผืืืืืื ื command. ืึธืืขืจ, RBAC ืืื ืฉืืื ืขื ืืืืึทืื ืืืจื ืคืขืืืงืืึทื, ืึทืืื ืจืืึฟ ืืกืชึผืื ืืืจ ืืึธื ื ืืฉื ืืึธืจื ืืืขืื ืืื: ืืืจ ืงืขื ืขื ืืึทืฉืืขืืืงื ืืขื ืืืจื ืื ืืืขืจื authorization-mode (ืืื ืื ืฉืืื ืืขืจืืื ื kube-apiserver.yaml). ืืืจื ืืขื ืืืขื, ืฆืืืืฉื ืื ืืื ืื ืื ืขืก ืงืขื ืืืื ืื ืืขืจืข ืืืืคึผืก ืคืื ืืขืจืืืืืขื ืืฉ (node, webhook, always allow), ืึธืืขืจ ืืืจ ืืืขืื ืืึธืื ืืืืขืจ ืืึทืืจืึทืืืื ื ืึทืจืืืก ืื ืคืึทืจื ืขื ืคืื ืืขื ืืึทืืขืจืืึทื.
ืืืจื ืืขื ืืืขื, ืืืจ ืืึธืื ืฉืืื ืืจืืืก ืืื ืึท ืืึทื ืฅ ืืืืืืื ืืึทืฉืจืืึทืืื ื ืคืื ืื ืคึผืจืื ืกืึทืคึผืึทืื ืืื ืคึฟืขืึดืงืืืื ืคืื ืืจืืขืื ืืื RBAC, ืึทืืื ืืืืึทืืขืจ ืืื ืืืขื ืืึทืืจืขื ืขืฆื ืืื ืฆื ืึท ืงืืจืฅ ืจืฉืืื ืคืื ืื ืืึทืกืืงืก ืืื ืืืืฉืคืืื.
ืื ืคืืืืขื ืืข ืึทืคึผื ืขื ืืืืื ืืขื ืขื ืืขื ืืฆื ืฆื ืงืึธื ืืจืึธืืืจื ืึทืงืกืขืก ืืื Kubernetes ืืืจื RBAC:
-
RoleะธClusterRole- ืจืึธืืขืก ืืืึธืก ืืื ืขื ืฆื ืืึทืฉืจืืึทืื ืึทืงืกืขืก ืจืขืื: -
Roleืึทืืึทืื ืืืจ ืฆื ืืึทืฉืจืืึทืื ืจืขืื ืืื ืึท ื ืึธืืขื ืคึผืืึทืฅ; -
ClusterRole- ืืื ืืขื ืงื ืืื, ืึทืจืืึทื ืืขืจืขืื ื ืฆื ืงื ืืื-ืกืคึผืขืฆืืคืืฉ ืึทืืืืฉืขืงืฅ ืึทืืึท ืืื ื ืึธืืื, ื ืื-ืจืขืกืืจืกื URL ืก (ื"ื ื ืื ืฉืืึทืืืช ืฆื Kubernetes ืจืขืกืืจืกื - ืคึฟืึทืจ ืืืึทืฉืคึผืื,/version,/logs,/api*); -
RoleBindingะธClusterRoleBinding- ืืขื ืืฆื ืคึฟืึทืจ ืืืื ืืื ืRoleะธClusterRoleืฆื ืึท ืืึทื ืืฆืขืจ, ืืึทื ืืฆืขืจ ืืจืืคึผืข ืึธืืขืจ ืกืขืจืืืืก ืึทืงืึทืื ื.
ืื ืจืึธืืข ืืื ืจืึธืืขืืื ืืื ื ืขื ืืืืื ืืขื ืขื ืืืืืืขื ืืืจื ื ืึทืืขืกืคึผืึทืกืข, ื.ืข. ืืืื ืืืื ืืื ืืขืจ ืืขืืืืงืขืจ ื ืึธืืขื ืคึผืืึทืฅ. ืึธืืขืจ, ืึท ืจืึธืืขืืื ืืื ื ืงืขื ืขื ืืขืจืืึธื ืขื ืึท ClusterRole, ืืืึธืก ืึทืืึทืื ืืืจ ืฆื ืฉืึทืคึฟื ืึท ืกืืื ืคืื ืืืฉืึทื ืขืจืืง ืคึผืขืจืืืฉืึทื ื ืืื ืงืึธื ืืจืึธืืืจื ืึทืงืกืขืก ื ืืฆื ืืื.
ืจืึธืืขืก ืืึทืฉืจืืึทืื ืจืขืื ื ืืฆื ืกืขืืึทืื ืคืื ืึผืืืื ืืื:
- ืึทืคึผื ืืจืืคึผืขืก - ืืขื ืืืจื ืึทืคึผืืืจืืคึผืก ืืื ืจืขืืืืืึทื
kubectl api-resources; - ืจืขืกืืจืกื (ืจืขืกืืจืกื:
pod,namespace,deploymentืืื ืืืื ืืืืืืขืจ.); - ืืืขืจืืก (ืืืขืจืื:
set,updateืืื ืืืื ืืืืืืขืจ.). - ืืืื ื ืขืืขื (
resourceNames) - ืคึฟืึทืจ ืื ืคืึทื ืืืขื ืืืจ ืืึทืจืคึฟื ืฆื ืฆืืฉืืขืื ืึทืงืกืขืก ืฆื ืึท ืกืคึผืขืฆืืคืืฉ ืืืื, ืืื ื ืื ืึทืืข ืจืขืกืืจืกื ืคืื ืืขื ืืืคึผ.
ื ืืขืจ ืืืืืืื ืึทื ืึทืืืกืืก ืคืื ืืขืจืืืืืขื ืืฉ ืืื Kubernetes ืงืขื ืขื ืืืื ืืขืคึฟืื ืขื ืืืืฃ ืืขื ืืืึทื . ืึทื ืฉืืึธื (ืึธืืขืจ ืืขืกืขืจ, ืืื ืืขืจืฆื ืฆื ืืขื), ืืื ืืืขื ืืขืื ืืืืฉืคืืื ืืืึธืก ืืืืืกืืจืืจื ืืืจ ืึทืจืืขื.
ืืืืฉืคืืื ืคืื RBAC ืขื ืืืืื
ืคึผืฉืื Role, ืืืึธืก ืึทืืึทืื ืืืจ ืฆื ืืึทืงืืืขื ืึท ืจืฉืืื ืืื ืกืืึทืืืก ืคืื ืคึผืึธืืก ืืื ืืึธื ืืืึธืจ ืืื ืืื ืื ื ืึทืืขืกืคึผืึทืกืข target-namespace:
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: target-namespace
name: pod-reader
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "watch", "list"]
ืืืึทืฉืคึผืื ClusterRole, ืืืึธืก ืึทืืึทืื ืืืจ ืฆื ืืึทืงืืืขื ืึท ืจืฉืืื ืืื ืกืืึทืืืก ืคืื ืคึผืึธืืก ืืื ืืึธื ืืืึธืจ ืืื ืืืืขืจ ืื ืงื ืืื:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
# ัะตะบัะธะธ "namespace" ะฝะตั, ัะฐะบ ะบะฐะบ ClusterRole ะทะฐะดะตะนััะฒัะตั ะฒะตัั ะบะปะฐััะตั
name: secret-reader
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "watch", "list"]
ืืืึทืฉืคึผืื RoleBinding, ืืืึธืก ืึทืืึทืื ืื ืืึทื ืืฆืขืจ mynewuser "ืืืืขื ืขื" ืคึผืึธืืก ืืื ื ืึธืืขื ืกืคึผืืืก my-namespace:
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: read-pods
namespace: target-namespace
subjects:
- kind: User
name: mynewuser # ะธะผั ะฟะพะปัะทะพะฒะฐัะตะปั ะทะฐะฒะธัะธะผะพ ะพั ัะตะณะธัััะฐ!
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role # ะทะดะตัั ะดะพะปะถะฝะพ ะฑััั โRoleโ ะธะปะธ โClusterRoleโ
name: pod-reader # ะธะผั Role, ััะพ ะฝะฐั
ะพะดะธััั ะฒ ัะพะผ ะถะต namespace,
# ะธะปะธ ะธะผั ClusterRole, ะธัะฟะพะปัะทะพะฒะฐะฝะธะต ะบะพัะพัะพะน
# ั
ะพัะธะผ ัะฐะทัะตัะธัั ะฟะพะปัะทะพะฒะฐัะตะปั
apiGroup: rbac.authorization.k8s.ioืืขืฉืขืขื ืืฉ ืงืึธื ืืจืึธืืืจื
ืกืืฉืขืืึทืืืงืึทืืื, ืื Kubernetes ืึทืจืงืึทืืขืงืืฉืขืจ ืงืขื ืขื ืืืื ืจืขืคึผืจืืืขื ืืื ืืื ืืืื:
ืืขืจ ืฉืืืกื Kubernetes ืงืึธืืคึผืึธื ืขื ื ืคืึทืจืึทื ืืืืึธืจืืืขื ืคึฟืึทืจ ืคึผืจืึทืกืขืกืื ื ืจืืงืืืขืก ืืื ืึทืคึผื-ืกืขืจืืืขืจ. ืึทืืข ืึทืคึผืขืจืืืฉืึทื ื ืืืืฃ ืืขื ืงื ืืื ืืืื ืืืจื ืขืก. ืืืจ ืงืขื ื ืืืืขื ืขื ืืขืจ ืืืขืื ืื ืื ืขืจืืขื ืืขืงืึทื ืืืึทืื ืืื ืืขื ืึทืจืืืงื "'.
ืกืืกืืขื ืึทืืึทืืื ื ืืื ืึท ืืฉืืงืึทืืืข ืฉืืจืื ืืื Kubernetes, ืืืึธืก ืืื ืคืึทืจืงืจืืคึผืื ืืืจื ืคืขืืืงืืึทื. ืขืก ืึทืืึทืื ืืืจ ืฆื ืงืืึธืฅ ืึทืืข ืงืึทืืืก ืฆื ืื Kubernetes API. ืืื ืืืจ ืงืขื ืืจืขืคื, ืึทืืข ืึทืงืฉืึทื ื ืฉืืึทืืืช ืฆื ืืึธื ืืืึธืจืื ื ืืื ืืฉืึทื ืืื ื ืื ืฉืืึทื ืคืื ืื ืงื ืืื ืืขื ืขื ืืืจืืืขืงืึธืื ืืืจื ืืขื ืึทืคึผื. ื ืืืืข ืืึทืฉืจืืึทืืื ื ืคืื ืืืึทื ืงืืืคึผืึทืืืืึทืืื ืงืขื ืขื (ืืื ืืขืืืืื ืืืขื) ืืืื ืืขืคึฟืื ืขื ืืื K8s. ืืืืึทืืขืจ, ืืื ืืืขื ืคึผืจืืืืจื ืฆื ืคืึธืจืฉืืขืื ืื ืืขืืข ืืื ืึท ืกืืืคึผืืขืจ ืฉืคึผืจืึทื.
ืืืื, ืฆื ืืขืื ืึทืืึทืืื ื, ืืืจ ืืึทืจืคึฟื ืฆื ืคืึธืจื ืืจืื ืคืืจืืื ืื ืคึผืึทืจืึทืืขืืขืจืก ืฆื ืืขื ืงืึทื ืืืื ืขืจ ืืื ืึทืคึผื-ืกืขืจืืืขืจ, ืืืึธืก ืืขื ืขื ืืืกืงืจืืืื ืืื ืืขืจ ืืขืืึทื ืืื ืื:
-
--audit-policy-file=/etc/kubernetes/policies/audit-policy.yaml -
--audit-log-path=/var/log/kube-audit/audit.log -
--audit-log-format=json
ืืื ืึทืืืฉืึทื ืฆื ืื ืืจืื ื ืืืืืง ืคึผืึทืจืึทืืขืืขืจืก, ืขืก ืืขื ืขื ืคืืืข ื ืึธื ืกืขืืืื ืืก ืฉืืึทืืืช ืฆื ืึทืืึทืืื ื: ืคึฟืื ืงืืึธืฅ ืจืึธืืืืืฉืึทื ืฆื ืืืขืืืึธืึธืง ืืืกืงืจืืคึผืฉืึทื ื. ืืืึทืฉืคึผืื ืคืื ืงืืึธืฅ ืจืึธืืืืืฉืึทื ืคึผืึทืจืึทืืขืืขืจืก:
-
--audit-log-maxbackup=10 -
--audit-log-maxsize=100 -
--audit-log-maxage=7
ืึธืืขืจ ืืืจ ืืืขืื ื ืืฉื ืืืืื ืขื ืืืืฃ ืืื ืืื ืืขืจ ืืขืืึทื - ืืืจ ืงืขื ืขื ืืขืคึฟืื ืขื ืึทืืข ืื ืืขืืึทืืืก ืืื .
ืืื ืฉืืื ืืขืจืืื ื, ืึทืืข ืคึผืึทืจืึทืืขืืขืจืก ืืขื ืขื ืืึทืฉืืืื ืืื ืื ืืึทื ืึทืคืขืกืืืืฉืึทื ืืื ืื ืึทืคึผื-ืกืขืจืืืขืจ ืงืึทื ืคืืืืขืจืืืฉืึทื (ืืืจื ืคืขืืืงืืึทื /etc/kubernetes/manifests/kube-apiserver.yaml), ืืื ืึธืคึผืืืืืื ื command. ืืึธืืืจ ืฆืืจืืงืงืืืขื ืฆื ืื 3 ืคืืจืืื ืื ืคึผืึทืจืึทืืขืืขืจืก ืืื ืึทื ืึทืืืื ืืื:
-
audit-policy-file- ืืจื ืฆื ืื YAML ืืขืงืข ืืืกืงืจืืืืื ื ืื ืงืึธื ืืจืึธืืืจื ืคึผืึธืืืืืง. ืืืจ ืืืขืื ืฆืืจืืงืงืืืขื ืฆื ืืืื ืืื ืืึทืื ืฉืคึผืขืืขืจ, ืึธืืขืจ ืืืฆื ืืื ืืืขื ืืึธื ืึทื ืื ืืขืงืข ืืืื ืืืื ืืืื ืขืืืืืง ืืืจื ืื ืึทืคึผื-ืกืขืจืืืขืจ ืคึผืจืึธืฆืขืก. ืืขืจืืืขืจ, ืขืก ืืื ื ืืืืืง ืฆื ืึธื ืงืืึทืคึผื ืขืก ืื ืืขื ืงืึทื ืืืื ืขืจ, ืคึฟืึทืจ ืืืึธืก ืืืจ ืงืขื ืขื ืืืืื ืื ืคืืืืขื ืืข ืงืึธื ืฆื ืื ืฆืื ืขืืขื ืกืขืงืฉืึทื ื ืคืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื:volumeMounts: - mountPath: /etc/kubernetes/policies name: policies readOnly: true volumes: - hostPath: path: /etc/kubernetes/policies type: DirectoryOrCreate name: policies -
audit-log-path- ืืจื ืฆื ืื ืงืืึธืฅ ืืขืงืข. ืืขืจ ืืจื ืืืื ืืืื ืืืื ืฆืืืจืืืืขื ืฆื ืื ืึทืคึผื-ืกืขืจืืืขืจ ืคึผืจืึธืฆืขืก, ืึทืืื ืืืจ ืืึทืฉืจืืึทืื ืืืึทื ืืึทืื ืืื ื ืืืืฃ ืื ืืขืืืข ืืืขื:volumeMounts: - mountPath: /var/log/kube-audit name: logs readOnly: false volumes: - hostPath: path: /var/log/kube-audit type: DirectoryOrCreate name: logs -
audit-log-format- ืงืึธื ืืจืึธืืืจื ืืึธื ืคึฟืึธืจืืึทื. ืื ืคืขืืืงืืึทื ืืืjson, ืึธืืขืจ ืื ืืขืืึทื ืืขืงืกื ืคึฟืึธืจืืึทื ืืื ืืืื ืื ืืืฆื (legacy).
ืงืึธื ืืจืึธืืืจื ืคึผืึธืืืืืง
ืืืฆื ืืืขืื ืื ืืขืจืืื ื ืืขืงืข ืืืกืงืจืืืืื ื ืื ืืึธืืื ื ืคึผืึธืืืืืง. ืืขืจ ืขืจืฉืืขืจ ืืึทืืจืืฃ ืคืื ืงืึธื ืืจืึธืืืจื ืคึผืึธืืืืืง ืืื level, ืืึธืืื ื ืืืจืื. ืืื ืืขื ืขื ืืื ืืืื:
-
None- ืืึธื ื ืื ืงืืึธืฅ; -
Metadata- ืงืืึธืฅ ืืขืื ืืขืืึทืืึทืืึท: ืืึทื ืืฆืขืจ, ืืขืื ืฆืืื, ืฆืื ืืืื (ืคึผืึธื, ื ืึทืืขืกืคึผืึทืกืข, ืืื"ื ื), ืงืึทืืฃ ืืืคึผ (ืืืขืจื), ืืื"ื ื; -
Request- ืงืืึธืฅ ืืขืืึทืืึทืืึท ืืื ืืขืื ืืืฃ; -
RequestResponse- ืงืืึธืฅ ืืขืืึทืืึทืืึท, ืืขืื ืืืฃ ืืื ืขื ืืคืขืจ ืืืฃ.
ืื ืืขืฆืืข ืฆืืืื ืืขืืืขืืก (Request ะธ RequestResponse) ืืึธื ื ืื ืงืืึธืฅ ืจืืงืืืขืก ืืืึธืก ืืึธืื ื ืืฉื ืึทืงืกืขืก ืจืขืกืืจืกื (ืึทืงืกืขืกืึทื ืฆื ืึทืืื ืืขืจืืคืขื ืข ื ืื-ืจืขืกืืจืกื URL).
ืืืื ืึทืืข ืจืืงืืืขืก ืืืื ืืืจื ืขืืืขืืข ืกืืึทืืขืก:
-
RequestReceived- ืืขืจ ืืื ืข ืืืขื ืื ืืงืฉื ืืื ืืืงืืืขื ืืืจื ืื ืคึผืจืึทืกืขืกืขืจ ืืื ืืื ื ืึธื ื ืืฉื ืืจืึทื ืกืืืืืขื ืืืืึทืืขืจ ืฆืืืืืขื ืื ืงืืื ืคืื ืคึผืจืึทืกืขืกืขืจื; -
ResponseStarted- ืขื ืืคืขืจ ืืขืืขืจื ืืขื ืขื ืืขืฉืืงื, ืึธืืขืจ ืืืืืขืจ ืื ืขื ืืคืขืจ ืืืฃ ืืื ืืขืฉืืงื. ืืืฉืขื ืขืจืืืืึทื ืคึฟืึทืจ ืืึทื ื-ืืืืคื ืคึฟืจืืื (ืืืฉื,watch); -
ResponseComplete- ืืขืจ ืขื ืืคืขืจ ืืืฃ ืืื ืืขืฉืืงื, ืงืืื ืืขืจ ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขื ืืืื ืืขืฉืืงื; -
Panic- ืืขืฉืขืขื ืืฉื ืืขื ืขื ืืืฉืขื ืขืจืืืืึทื ืืืขื ืึท ืึทืื ืึธืจืืึทื ืกืืืืึทืฆืืข ืืื ืืืืขืงืืึทื.
ืฆื ืืึธืคึผืงืขื ืงืืื ืกืืขืคึผืก ืืืจ ืงืขื ืขื ื ืืฆื omitStages.
ืืื ืึท ืคึผืึธืืืืืง ืืขืงืข, ืืืจ ืงืขื ืขื ืืึทืฉืจืืึทืื ืขืืืขืืข ืกืขืงืฉืึทื ื ืืื ืคืึทืจืฉืืืขื ืข ืืึธืืื ื ืืขืืืขืืก. ืืขืจ ืขืจืฉืืขืจ ืืืึธืก ืจืืืื ืืขืจืฉื ืืขืคึฟืื ืขื ืืื ืื ืคึผืึธืืืืืง ืืึทืฉืจืืึทืืื ื ืืืขื ืืืื ืืขืืืขื ืื.
ืื ืงืืืขืืขื ืืืืืึทื ืืึธื ืืืึธืจืก ืขื ืืขืจืื ืืขื ืืื ืื ืืึทืฉืืึทืืคึผืขืจืืขื ืืื ืื ืึทืคึผื-ืกืขืจืืืขืจ ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื, ืืืื ืขืก ืืขื ืขื ืืืืขืงืืึทื, ืจืืกืืึทืจื ืืขื ืงืึทื ืืืื ืขืจ ืืื ืึทืคึผื-ืกืขืจืืืขืจ. ืืืขืจ ืขืก ืืื ืึท ืืืืืืืง ืืขืืึทื: ืขื ืืขืจืื ืืขื ืืื ืื ืคึผืึธืืืืืง ืืขืงืข ืืืขื ืืืื ืืืื ืึธืจืืจื ืืืจื ืขืก. ื ืึธื ืขื ืืขืจืื ืืขื ืฆื ืื ืคึผืึธืืืืืง ืืขืงืข, ืืืจ ืืึทืจืคึฟื ืฆื ืจืืกืืึทืจื ืื ืึทืคึผื ืกืขืจืืืขืจ ืืึทื ืืืึทืื. ืืื ื ืึทืคึผื-ืกืขืจืืืขืจ ืืื ืกืืึทืจืืขื ืืื , ืืึทื ืฉืึทืคึฟื kubectl delete ืืืขื ื ืืฉื ืคืึทืจืฉืึทืคื ืขืก ืฆื ืจืืกืืึทืจื. ืืืจ ืืืขื ืืึธืื ืฆื ืืึธื ืขืก ืืึทื ืืืึทืื docker stop ืืืืฃ ืงืืืข-ืืึทืกืืขืจืก, ืืื ืื ืงืึธื ืืจืึธืืืจื ืคึผืึธืืืืืง ืืื ืืขืืืื:
docker stop $(docker ps | grep k8s_kube-apiserver | awk '{print $1}')ืืืขื ืขื ืืืืึทืืื ื ืึทืืึทืืื ื, ืขืก ืืื ืืืืืืืง ืฆื ืืขืืขื ืงืขื ืึทื ืื ืืึทืกืข ืืืืฃ ืงืื-ืึทืคึผืืกืขืจืืืขืจ ืื ืงืจืืกืื. ืืื ืืึทืืื ืืขืจ, ืืืงืึธืจื ืงืึทื ืกืึทืืฉืึทื ืคึฟืึทืจ ืกืืึธืจืื ื ืืขืื ืงืึธื ืืขืงืกื ืื ืงืจืืกืื. ืืึธืืื ื ืืืืื ืืื ืืืืื ื ืึธื ืื ืขื ืืคืขืจ ืืขืืขืจ ืืื ืืขืฉืืงื. ืื ืืึทืกืข ืืืื ืืขืคึผืขื ืืก ืืืืฃ ืื ืงืึธื ืืจืึธื ืคึผืึธืืืืืง ืงืึทื ืคืืืืขืจืืืฉืึทื.
ืืืืฉืคืืื ืคืื ืคึผืึทืืึทืกืื
ืืื ืก ืงืืง ืืื ืื ืกืืจืืงืืืจ ืคืื ืคึผืึธืืืืืง ืืขืงืขืก ื ืืฆื ืืืืฉืคืืื.
ืืึธ ืืื ืึท ืคึผืฉืื ืืขืงืข policyืฆื ืงืืึธืฅ ืึทืืฅ ืืืืฃ ืืขืจ ืืืจืื Metadata:
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Metadata
ืืื ืคึผืึธืืืืืง ืืืจ ืงืขื ืขื ืกืคึผืขืฆืืคืืฆืืจื ืึท ืจืฉืืื ืคืื ื ืืฆืขืจืก (Users ะธ ServiceAccounts) ืืื ืืึทื ืืฆืขืจ ืืจืืคึผืขืก. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืึธืก ืืื ืืื ืืืจ ืืืื ืึธืจืืจื ืกืืกืืขื ื ืืฆืขืจืก, ืึธืืขืจ ืงืืึธืฅ ืึทืืฅ ืึทื ืืขืจืฉ ืืืืฃ ืืขืจ ืืืจืื Request:
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: None
userGroups:
- "system:serviceaccounts"
- "system:nodes"
users:
- "system:anonymous"
- "system:apiserver"
- "system:kube-controller-manager"
- "system:kube-scheduler"
- level: Requestืขืก ืืื ืืืื ืืขืืืขื ืฆื ืืึทืฉืจืืึทืื ืื ืืึทืจืืึทืฅ:
- ื ืึธืืขื ืกืคึผืืืกืึทื (
namespaces); - ืืืขืจืืก (ืืืขืจืื:
get,update,deleteืืื ืื ืืขืจืข); - ืจืขืกืืจืกื (ืจืขืกืืจืกื, ื ืืืืื:
pod,configmapsืืื"ื ื) ืืื ืืืื ืืจืืคึผืขืก (apiGroups).
ืืึทืฆืึธืื ืืคืืขืจืงืืึทืืงืืึทื! ืจืขืกืึธืืจืกืขืก ืืื ืืืื ืืจืืคึผืขืก (ืึทืคึผื ืืจืืคึผืขืก, ื"ื ืึทืคึผืืืจืึธืืคึผืก), ืืื ืืขืืื ื ืืื ืืืืขืจ ืืืขืจืกืืขืก ืืื ืกืืึทืืืจื ืืื ืืขื ืงื ืืื, ืงืขื ืขื ืืืื ืืืงืืืขื ืืื ืื ืงืึทืืึทื ืื:
kubectl api-resources
kubectl api-versionsืื ืคืืืืขื ืืข ืงืึธื ืืจืึธืืืจื ืคึผืึธืืืืืง ืืื ืฆืืืขืฉืืขืื ืืื ืึท ืืขืืึทื ืกืืจืืืฉืึทื ืคืื ืืขืกืืขืจ ืคึผืจืึทืงืืืกืื ืืื :
apiVersion: audit.k8s.io/v1beta1
kind: Policy
# ะะต ะปะพะณะธัะพะฒะฐัั ััะฐะดะธั RequestReceived
omitStages:
- "RequestReceived"
rules:
# ะะต ะปะพะณะธัะพะฒะฐัั ัะพะฑััะธั, ััะธัะฐััะธะตัั ะผะฐะปะพะทะฝะฐัะธัะตะปัะฝัะผะธ ะธ ะฝะต ะพะฟะฐัะฝัะผะธ:
- level: None
users: ["system:kube-proxy"]
verbs: ["watch"]
resources:
- group: "" # ััะพ api group ั ะฟััััะผ ะธะผะตะฝะตะผ, ะบ ะบะพัะพัะพะผั ะพัะฝะพััััั
# ะฑะฐะทะพะฒัะต ัะตััััั Kubernetes, ะฝะฐะทัะฒะฐะตะผัะต โcoreโ
resources: ["endpoints", "services"]
- level: None
users: ["system:unsecured"]
namespaces: ["kube-system"]
verbs: ["get"]
resources:
- group: "" # core
resources: ["configmaps"]
- level: None
users: ["kubelet"]
verbs: ["get"]
resources:
- group: "" # core
resources: ["nodes"]
- level: None
userGroups: ["system:nodes"]
verbs: ["get"]
resources:
- group: "" # core
resources: ["nodes"]
- level: None
users:
- system:kube-controller-manager
- system:kube-scheduler
- system:serviceaccount:kube-system:endpoint-controller
verbs: ["get", "update"]
namespaces: ["kube-system"]
resources:
- group: "" # core
resources: ["endpoints"]
- level: None
users: ["system:apiserver"]
verbs: ["get"]
resources:
- group: "" # core
resources: ["namespaces"]
# ะะต ะปะพะณะธัะพะฒะฐัั ะพะฑัะฐัะตะฝะธั ะบ read-only URLs:
- level: None
nonResourceURLs:
- /healthz*
- /version
- /swagger*
# ะะต ะปะพะณะธัะพะฒะฐัั ัะพะพะฑัะตะฝะธั, ะพัะฝะพัััะธะตัั ะบ ัะธะฟั ัะตััััะพะฒ โัะพะฑััะธัโ:
- level: None
resources:
- group: "" # core
resources: ["events"]
# ะ ะตััััั ัะธะฟะฐ Secret, ConfigMap ะธ TokenReview ะผะพะณัั ัะพะดะตัะถะฐัั ัะตะบัะตัะฝัะต ะดะฐะฝะฝัะต,
# ะฟะพััะพะผั ะปะพะณะธััะตะผ ัะพะปัะบะพ ะผะตัะฐะดะฐะฝะฝัะต ัะฒัะทะฐะฝะฝัั
ั ะฝะธะผะธ ะทะฐะฟัะพัะพะฒ
- level: Metadata
resources:
- group: "" # core
resources: ["secrets", "configmaps"]
- group: authentication.k8s.io
resources: ["tokenreviews"]
# ะะตะนััะฒะธั ัะธะฟะฐ get, list ะธ watch ะผะพะณัั ะฑััั ัะตััััะพัะผะบะธะผะธ; ะฝะต ะปะพะณะธััะตะผ ะธั
- level: Request
verbs: ["get", "list", "watch"]
resources:
- group: "" # core
- group: "admissionregistration.k8s.io"
- group: "apps"
- group: "authentication.k8s.io"
- group: "authorization.k8s.io"
- group: "autoscaling"
- group: "batch"
- group: "certificates.k8s.io"
- group: "extensions"
- group: "networking.k8s.io"
- group: "policy"
- group: "rbac.authorization.k8s.io"
- group: "settings.k8s.io"
- group: "storage.k8s.io"
# ะฃัะพะฒะตะฝั ะปะพะณะธัะพะฒะฐะฝะธั ะฟะพ ัะผะพะปัะฐะฝะธั ะดะปั ััะฐะฝะดะฐััะฝัั
ัะตััััะพะฒ API
- level: RequestResponse
resources:
- group: "" # core
- group: "admissionregistration.k8s.io"
- group: "apps"
- group: "authentication.k8s.io"
- group: "authorization.k8s.io"
- group: "autoscaling"
- group: "batch"
- group: "certificates.k8s.io"
- group: "extensions"
- group: "networking.k8s.io"
- group: "policy"
- group: "rbac.authorization.k8s.io"
- group: "settings.k8s.io"
- group: "storage.k8s.io"
# ะฃัะพะฒะตะฝั ะปะพะณะธัะพะฒะฐะฝะธั ะฟะพ ัะผะพะปัะฐะฝะธั ะดะปั ะฒัะตั
ะพััะฐะปัะฝัั
ะทะฐะฟัะพัะพะฒ
- level: Metadataืื ืื ืืขืจ ืืื ืืืึทืฉืคึผืื ืคืื ืงืึธื ืืจืึธืืืจื ืคึผืึธืืืืืง ืืื .
ืฆื ืืขืฉืืืื ื ืจืืกืคึผืึทื ื ืฆื ืงืึธื ืืจืึธืืืจื ืืขืฉืขืขื ืืฉื, ืขืก ืืื ืืขืืืขื ืืึทืฉืจืืึทืื ืืืขืืืึธืึธืง. ืืขื ืึทืจืืืกืืขืื ืืื ืืืืขืงื ืืื , ืืื ืืืขื ืืึธืื ืขืก ืึทืจืืืก ืื ืคืึทืจื ืขื ืคืื ืืขื ืึทืจืืืงื.
ืจืขืืืืืึทืื ืคืื
ืืขืจ ืึทืจืืืงื ืืื ืึทื ืืืืขืจืืืืง ืคืื ืืงืขืจืืืง ืืืืขืจืืืื ืืขืงืึทื ืืืึทืื ืืื Kubernetes ืงืืึทืกืืขืจื, ืืืึธืก ืืึธืื ืืืจ ืฆื ืฉืึทืคึฟื ืคืขืจืืขื ืืืืขื ืืึทื ืืฆืขืจ ืึทืงืึทืื ืฅ, ืืึทืืื ืืขืจ ืืืืขืจ ืจืขืื ืืื ืจืขืงืึธืจืืืจื ืืืืขืจ ืึทืงืฉืึทื ื. ืืื ืืึธืคึฟื ืขืก ืืืขื ืืืื ื ืืฆืืง ืคึฟืึทืจ ืื ืืืืก ืืขื ืขื ืคืืืกื ืืื ืึทืืึท ืืฉืื ืืื ืืขืึธืจืืข ืึธืืขืจ ืืื ืคืืจ. ืืื ืืืื ืจืขืงืึธืืขื ืืืจื ืืืจ ืืืืขื ืขื ืื ืจืฉืืื ืคืื ืื ืืขืจืข ืืึทืืขืจืืึทืืก ืืืืฃ ืืขืจ ืืขืืข ืคืื โโืืืืขืจืืืื ืืื Kubernetes, ืืืึธืก ืืื ืืขืืขืื ืืื "ืคึผืก" - ืืึธืืขืจ ืฆืืืืฉื ืืื ืืืจ ืืืขื ืืขืคึฟืื ืขื ืื ื ืืืืืง ืืขืืึทืืืก ืืืขืื ืื ืคึผืจืึธืืืขืืก ืืืึธืก ืืขื ืขื ืืึทืืืึทืืืง ืคึฟืึทืจ ืืืจ.
ืคึผืก
ืืืืขื ืขื ืืืื ืืืืฃ ืืื ืืืขืจ ืืืึธื:
- ยซ";
- ยซ";
- ยซ";
- ยซ";
- ยซ'.
ืืงืืจ: www.habr.com