ื ืงืืจืฅ ืืืืึธืจืืึทื ืืืขืื ืืื ืืืจ ืงืขื ืขื ื ืืฆื Keycloak ืฆื ืคืึทืจืืื ืื Kubernetes ืฆื ืืืื LDAP ืกืขืจืืืขืจ ืืื ืงืึทื ืคืืืืขืจ ืื ืึทืจืืึทื ืคืืจ ืคืื ืืืืขืจื ืืื ืืจืืคึผืขืก. ืืึธืก ืืืขื ืืึธืื ืืืจ ืฆื ืงืึทื ืคืืืืขืจ RBAC ืคึฟืึทืจ ืืืื ืืืืขืจื ืืื ื ืืฆื ืึทืื-ืคึผืจืึธืงืกื ืฆื ืืึทืฉืืฆื Kubernetes ืืึทืฉืืึธืจื ืืื ืื ืืขืจืข ืึทืคึผืืึทืงืืืฉืึทื ื ืืืึธืก ืงืขื ืขื ื ืืฉื ืึธืืขื ืืึทืงืืื ืืื.
Keycloak ืื ืกืืึทืืืจืื ื
ืืื ืก ืืืขืจื ืขืืขื ืึทื ืืืจ ืฉืืื ืืึธืื ืึท LDAP ืกืขืจืืืขืจ. ืืึธืก ืงืขื ืืืื Active Directory, FreeIPA, OpenLDAP ืึธืืขืจ ืขืคึผืขืก ืึทื ืืขืจืฉ. ืืืื ืืืจ ืืึธื ื ืื ืืึธืื ืึท LDAP ืกืขืจืืืขืจ, ืืื ืคึผืจืื ืฆืืคึผ ืืืจ ืงืขื ืขื ืฉืึทืคึฟื ืืืืขืจื ืืืืึทื ืืื ืื Keycloak ืฆืืืื ื, ืึธืืขืจ ื ืืฆื ืขืคื ืืืขื ืึธืืืง ืคึผืจืึทืืืืืืขืจื (Google, Github, Gitlab), ืืขืจ ืจืขืืืืืึทื ืืืขื ืืืื ืึผืืขื ืื ืืขืืืข.
ืงืืื ืื ืืืืืจ ืืื ืกืืืืืจื Keycloak ืืืืื, ืื ืืื ืกืืืืืฆืืข ืงืขื ืืขื ืืืจืืคืืจืขื ืกืขืคึผืขืจืื ืืืขืจ ืืืืื ืืื ื Kubernetes ืงื ืืื, ืืกืืจ, ืืืื ืืืจ ืืื ืขืืืืืข Kubernetes ืงืืืกืืขืจื, ืืืืื ืืขืืืขื ืืจืื ืืขืจ ืืืก ืฆื ืืื ืกืืืืืจื ืืืืื ืืขืจ. ืืืืฃ ืื ืื ืืขืจืข ืืึทื ื ืืืจ ืงืขื ืขื ืฉืืขื ืืืง ื ืืฆื ืืื ืื ืกืืึทืืืจื ืขืก ืืืืื ืืื ืืืื ืงื ืืื.
ืฆื ืงืจืึธื Keycloak ืืึทืื ืืืจ ืืึทืจืคึฟื ืึท ืืึทืืึทืืืืก. ืคืขืืืงืืึทื ืืื h2 (ืึทืืข ืืึทืื ืืขื ืขื ืกืืึธืจื ืืึธืืงืึทืื), ืึธืืขืจ ืขืก ืืื ืืืื ืืขืืืขื ืฆื ื ืืฆื postgres, mysql ืึธืืขืจ mariadb.
ืืืื ืืืจ ื ืึธื ืืึทืฉืืืกื ืฆื ืื ืกืืึทืืืจื Keycloak ืกืขืคึผืขืจืึทืืื, ืืืจ ืืืขื ืืขืคึฟืื ืขื ืืขืจ ืืืืืืื ืื ืกืืจืึทืงืฉืึทื ื ืืื .
ืกืขืืึทืคึผ ืคืื ืคืขืืขืจืืืฉืึทื
ืขืจืฉืืขืจ ืคืื ืึทืืข, ืืึธืืืจ ืืึทืื ืึท ื ืืึท ืืขืืืืข. ืืขืืืืข ืืื ืืขืจ ืคึผืืึทืฅ ืคืื ืืื ืืืขืจ ืึทืคึผืืึทืงืืืฉืึทื. ืืขืืขืจ ืึทืคึผืืึทืงืืืฉืึทื ืงืขื ืขื ืืึธืื ืืืื ืืืืืขื ืข ืืขืืืืข ืืื ืคืึทืจืฉืืืขื ืข ื ืืฆืขืจืก ืืื ืืขืจืืืืืขื ืืฉ ืกืขืืืื ืืก. ืื ืืืจ ืืขืืืืข ืืื ืืขื ืืฆื ืืืจื Keycloak ืืื ืืื ืขืก ืืื ืคืึทืืฉ ืฆื ื ืืฆื ืขืก ืคึฟืึทืจ ืขืคึผืขืก ืึทื ืืขืจืฉ.
ืืจืืงื ืืึธ ืืืื ืืขืืืืข
ืืจืืืจืข
ืืืขืจื
ื ืึธืืขื
kubernetes
ืึทืจืืืกืืืืึทืื ื ืึธืืขื
Kubernetes
HTML ืืืืึทื ื ืึธืืขื
<img src="https://kubernetes.io/images/nav_logo.svg" width="400" >
Kubernetes ืืืจื ืคืขืืืงืืึทื ืืฉืขืงืก ืฆื ืืขืจ ืืึทื ืืฆืขืจ ืก E- ืืจืืื ืืื ืืืฉืืขืืืงื ืึธืืขืจ ื ืืฉื. ืืื ื ืืืจ ื ืืฆื ืืื ืืืขืจ ืืืืืขื ืข LDAP ืกืขืจืืืขืจ, ืืขื ืืฉืขืง ืืืขื ืึผืืขื ืฉืืขื ืืืง ืฆืืจืืงืงืืืขื false. ืืึธืืืจ ืืืกืืืืึทื ืื ืคืึทืจืืจืขืืื ื ืคืื ืืขื ืึธืคึผืฆืืข ืืื Kubernetes:
ืงืืืขื ื ืกืงืึธืคึผืขืก -> ืืืืฆืคึผืึธืกื -> ืืึทืคึผืคึผืขืจืก -> Email ืืืขืจืึทืคืืื (ืืขืงื)
ืืืฆื ืืึธืืืจ ืฉืืขืื ืื ืคืขืืขืจืืืฉืึทื; ืฆื ืืึธื ืืึธืก, ืืืื ืฆื:
ืืึทื ืืฆืขืจ ืคืขืืขืจืืืฉืึทื -> ืฆืืืขืื ืฉืคึผืืึทืืขืจโฆ -> ldap
ืืึธ ืก ืึท ืืืืฉืคึผืื ืคืื ืกืขืืืื ืืก ืคึฟืึทืจ FreeIPA:
ืืจืืืจืข
ืืืขืจื
ืงืึทื ืกืึธืื ืืืืึทื ื ืึธืืขื
freeipa.example.org
ืคืึทืจืงืืืคืขืจ
Red Hat Directory Server
UUID LDAP ืึทืืจืืืืื
ipauniqueid
ืคึฟืึทืจืืื ืืื ื URL
ldaps://freeipa.example.org
ืืืืขืจื ืื
cn=users,cn=accounts,dc=example,dc=org
ืืื ืื ืื
uid=keycloak-svc,cn=users,cn=accounts,dc=example,dc=org
ืืื ืื ืงืจืึทืืขื ืืฉืึทื
<password>
ืืึธืื Kerberos ืึธืืขื ืืึทืงืืืฉืึทื:
on
Kerberos ืืขืืืืข:
EXAMPLE.ORG
ืกืขืจืืืืจืขืจ ืืืืคึผื:
HTTP/[email protected]
KeyTab:
/etc/krb5.keytab
ืืึทื ืืฆืขืจ keycloak-svc ืืึทืจืคึฟื ืฆื ืืืื ืืืฉืืคื ืืื ืฉืืืึทืื ืืืืฃ ืืื ืืืขืจ LDAP ืกืขืจืืืขืจ.
ืืื ืืขื ืคืึทื ืคืื ืึทืงืืืื Directory, ืืืจ ื ืึธืจ ืืึทืจืคึฟื ืฆื ืกืขืืขืงืืืจื ืคืึทืจืงืืืคืขืจ: ืึทืงืืืืืข Directory ืืื ืื ื ืืืืืง ืกืขืืืื ืืก ืืืขื ืืืืืึธืืึทืืืฉ ืึทืจืืึทื ืื ืคืึธืจืขื.
ืืจืืงื ืืึธ ืฉืคึผืึธืจื
ืืืฆื ืืืืืจ ืืืื ืืืืืืขืจ:
ืืึทื ืืฆืขืจ ืคืขืืขืจืืืฉืึทื -> freeipa.example.org -> ืืึทืคึผืคึผืขืจืก -> ืขืจืฉืืข ื ืืืขื
ืืจืืืจืข
ืืืขืจื
Ldap ืึทืืจืืืืื
givenName
ืืืฆื ืืึธืื ืืื ืื ืืขืื ืืจืืคึผืข ืืึทืคึผืื ื:
ืืึทื ืืฆืขืจ ืคืขืืขืจืืืฉืึทื -> freeipa.example.org -> ืืึทืคึผืคึผืขืจืก -> ืืึทืื
ืืจืืืจืข
ืืืขืจื
ื ืึธืืขื
groups
ืืืคึผ ืืึทืคึผืขืจ
group-ldap-mapper
LDAP ืืจืืคึผืขืก ืื
cn=groups,cn=accounts,dc=example,dc=org
ืืึทื ืืฆืขืจ ืืจืืคึผืขืก ืฆืืจืืงืงืจืืื ืกืืจืึทืืขืืืข
GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE
ืืืฆื ืึทื ืื ืคืขืืขืจืืืฉืึทื ืกืขืืึทืคึผ ืืื ืืึทื ืฅ, ืืึธืื ืืื ืื ืืึทื ืืืืฃ ืฆื ืืึทืฉืืขืืืงื ืืขื ืงืืืขื ื.
ืงืืืขื ื ืกืขืืึทืคึผ
ืืึธืืืจ ืฉืึทืคึฟื ืึท ื ืืึทืข ืงืืืขื ื (ืึท ืึทืคึผืืึทืงืืืฉืึทื ืืืึธืก ืืืขื ืืึทืงืืืขื ื ืืฆืขืจืก ืคึฟืื Keycloak). ืืืืืจ ืืืืืืขืจ ืืืื:
ืงืืืืึทื ืฅ -> ืืึทืื
ืืจืืืจืข
ืืืขืจื
ืงืืืขื ื ืฉืืึทื
kubernetes
ืึทืงืกืขืก ืืืคึผ
confidenrial
ืืืึธืจืฆื URL
http://kubernetes.example.org/
ืืืืืืง ืจืืืขืจืขืงื URIs
http://kubernetes.example.org/*
ืึทืืืื URL
http://kubernetes.example.org/
ืืึธืืืจ ืืืื ืืึทืื ืึท ืคืึทืจื ืขื ืคึฟืึทืจ ืืจืืคึผืขืก:
ืงืืืขื ื ืกืงืึธืคึผืขืก -> ืืึทืื
ืืจืืืจืข
ืืืขืจื
ืืืกืืขืจ
No template
ื ืึธืืขื
groups
ืืึทื ืฅ ืืจืืคึผืข ืืจื
false
ืืื ืฉืืขืื ืึท ืืึทืคึผืคึผืขืจ ืคึฟืึทืจ ืืื:
ืงืืืขื ื ืกืงืึธืคึผืขืก -> ืืจืืคึผืขืก -> ืืึทืคึผืคึผืขืจืก -> ืืึทืื
ืืจืืืจืข
ืืืขืจื
ื ืึธืืขื
groups
ืืึทืคึผืขืจ ืืืคึผ
Group membership
ืืึธืงืขื ืคืึธืืขืจื ื ืึธืืขื
groups
ืืืฆื ืืืจ ืืึทืจืคึฟื ืฆื ืืขืื ืืึทืคึผืื ื ืืจืืคึผืข ืืื ืืื ืืืขืจ ืงืืืขื ื ืคืึทืจื ืขื:
ืงืืืืึทื ืฅ -> kubernetes -> ืงืืืขื ื ืกืงืึธืคึผืขืก -> ืคืขืืืงืืึทื ืงืืืขื ื ืกืงืึธืคึผืขืก
ืงืืืึทืื ืืจืืคึผืขืก ะฒ ืื ืืืฆื ืงืืืขื ื ืกืงืึธืคึผืขืก, ืืจืืงื ืืืื ืืืืกืืขืงืืืื
ืืืฆื ืืึธืื ืืื ืื ืงืึทื ืคืืืืขืจ ืื ืึธืืขื ืืึทืงืืืฉืึทื ืคืื ืืื ืืืขืจ ืึทืคึผืืึทืงืืืฉืึทื, ืืืื ืฆื:
ืงืืืืึทื ืฅ -> kubernetes
ืืจืืืจืข
ืืืขืจื
ืืขืจืืืืืขื ืืฉ ืขื ืืืืึทืื
ON
ืืืืืจ ืืจืืงื ืฉืคึผืึธืจื ืืื ืืื ืืขื ืื ืงืืืขื ื ืกืขืืึทืคึผ ืืื ืืขืขื ืืืงื, ืืืฆื ืืืืฃ ืื ืงืืืืื
ืงืืืืึทื ืฅ -> kubernetes -> ืงืจืขืืขื ืืืึทืืก
ืืืจ ืงืขื ืขื ืืึทืงืืืขื ืกืึธื ืืืึธืก ืืืจ ืืืขืื ื ืืฆื ืืืืึทืืขืจ.
ืงืึทื ืคืืืืขืจืื ื Kubernetes
ืืึทืฉืืขืืืงื Kubernetes ืคึฟืึทืจ OIDC ืืขืจืืืืืขื ืืฉ ืืื ืืึทื ืฅ ื ืืฉืืืง ืืื ื ืืฉื ืืืืขืจ ืงืึธืืคึผืืืฆืืจื. ืื ืืืจ ืืึทืจืคึฟื ืฆื ืืึธื ืืื ืฉืืขืื ืื CA ืืึทืืืืึทืื ืคืื ืืืื ืึธืืืง ืกืขืจืืืขืจ /etc/kubernetes/pki/oidc-ca.pem ืืื ืืืืื ืื ื ืืืืืง ืึธืคึผืฆืืขืก ืคึฟืึทืจ kube-apiserver.
ืฆื ืืึธื ืืึธืก, ืืขืจืืืึทื ืืืงื /etc/kubernetes/manifests/kube-apiserver.yaml ืืืืฃ ืึทืืข ืืืื ืืืจื:
...
spec:
containers:
- command:
- kube-apiserver
...
- --oidc-ca-file=/etc/kubernetes/pki/oidc-ca.pem
- --oidc-client-id=kubernetes
- --oidc-groups-claim=groups
- --oidc-issuer-url=https://keycloak.example.org/auth/realms/kubernetes
- --oidc-username-claim=email
...ืืืื ืืขืจืืืึทื ืืืงื ืื kubeadm ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื ืืขื ืงื ืืื ืึทืืื ื ืืฉื ืฆื ืคืึทืจืืืจื ืื ืกืขืืืื ืืก ืืืขื ืึทืคึผืืืืืื ื:
kubectl edit -n kube-system configmaps kubeadm-config...
data:
ClusterConfiguration: |
apiServer:
extraArgs:
oidc-ca-file: /etc/kubernetes/pki/oidc-ca.pem
oidc-client-id: kubernetes
oidc-groups-claim: groups
oidc-issuer-url: https://keycloak.example.org/auth/realms/kubernetes
oidc-username-claim: email
...ืืึธืก ืงืึทืืคึผืืืฅ ืื Kubernetes ืงืึทื ืคืืืืขืจืืืฉืึทื. ืืืจ ืงืขื ืขื ืืืืขืจืืืจื ืื ืกืืขืคึผืก ืึทืจืืืขืจ ืึทืืข ืืืื Kubernetes ืงืืึทืกืืขืจื.
ืขืจืฉื ืืขืจืืืืืขื ืืฉ
ื ืึธื ืื ืกืืขืคึผืก, ืืืจ ืืืขื ืฉืืื ืืึธืื ืึท Kubernetes ืงื ืืื ืืื ืงืึทื ืคืืืืขืจื ืึธืืืง ืืขืจืืืืืขื ืืฉ. ืืขืจ ืืืืื ืืึทื ืืื ืึทื ืืืื ืืืืขืจื ืืึธืื ื ืืฉื ื ืึธื ืึท ืงืึทื ืคืืืืขืจื ืงืืืขื ื ืึธืืขืจ ืืืืขืจ ืืืืืขื ืข kubeconfig. ืฆื ืกืึธืืืืข ืืขื ืคึผืจืึธืืืขื, ืืืจ ืืึทืจืคึฟื ืฆื ืงืึทื ืคืืืืขืจ ืึธืืึทืืึทืืืง ืคืึทืจืฉืคึผืจืืืืื ื ืคืื kubeconfig ืฆื ืืืืขืจื ื ืึธื ืึท ืืขืจืึธืื ืืขืจืืืืืขื ืืฉ.
ืฆื ืืึธื ืืึธืก, ืืืจ ืงืขื ืขื ื ืืฆื ืกืคึผืขืฆืืขื ืืืขื ืึทืคึผืืึทืงืืืฉืึทื ื ืืืึธืก ืืึธืื ืืืจ ืฆื ืึธืืขื ืืึทืงืืื ืืขื ืืึทื ืืฆืขืจ ืืื ืืึทื ืืจืืคืงืืคืืข ืื ืคืึทืจืืืง kubeconfig. ืืืื ืขืจ ืคืื ืื ืืขืจืกื ืืึทืงืืืขื ืืื , ืขืก ืึทืืึทืื ืืืจ ืฆื ืืึทืฉืจืืึทืื ืึทืืข Kubernetes ืงืืึทืกืืขืจื ืืื ืืืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื ืืืืื ืืึทืฉืืืืขื ืฆืืืืฉื ืืื.
ืฆื ืงืึทื ืคืืืืขืจ Kuberos, ื ืึธืจ ืืึทืฉืจืืึทืื ืื ืืืกืืขืจ ืคึฟืึทืจ kubeconfig ืืื ืืืืคื ืขืก ืืื ืื ืคืืืืขื ืืข ืคึผืึทืจืึทืืขืืขืจืก:
kuberos https://keycloak.example.org/auth/realms/kubernetes kubernetes /cfg/secret /cfg/templateืคึฟืึทืจ ืืขืจ ืืืืืืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืขื ืืืืฃ ืืืืืื.
ืขืก ืืื ืืืื ืืขืืืขื ืฆื ื ืืฆื ืืืื ืืืจ ืืืืื ืฆื ืึธืืขืจืืื ืืืืึทื ืืืืฃ ืื ืืึทื ืืฆืขืจ 'ืก ืงืึธืืคึผืืืืขืจ. ืืื ืืขื ืคืึทื, ืืขืจ ืืึทื ืืฆืขืจ ืืืขื ืขืคืขื ืขื ืึท ืืืขืืขืจืขืจ ืืื ืึท ืืขืจืืืืืขื ืืฉ ืคืึธืจืขื ืืืืฃ ืืึธืงืึทืืืึธืกื.
ืื ืจืืืึทืืืื ื kubeconfig ืงืขื ืขื ืืืื ืึธืคึผืืขืฉืืขืื ืืืืฃ ืืขืจ ืืืขืืืืืื . ื ืึธืจ ื ืึธืืืึทืื ืื ืืืขืจื users[].user.auth-provider.config.id-token ืคืื ืืืื kubeconfig ืฆื ืื ืคืึธืจืขื ืืืืฃ ืื ืืืขืืืืืื ืืื ืืืืื ืืึทืงืืืขื ืึท ืืจืึทื ืกืงืจืืคึผื.
ืืึทืฉืืขืืืงื RBAC
ืืืขื ืงืึทื ืคืืืืขืจืื ื RBAC, ืืืจ ืงืขื ืขื ืึธืคึผืฉืืงื ืฆื ืืืืืข ืื ื ืืืขื (ืคืขืื name ืืื ืื jwt token), ืืื ืคึผืขืจ ืืึทื ืืฆืขืจ ืืจืืคึผืข (ืคืขืื groups ืืื jwt token). ืืึธ ืืื ืึท ืืืืฉืคึผืื ืคืื ืืึทืฉืืขืืืงื ืจืขืื ืคึฟืึทืจ ืึท ืืจืืคึผืข kubernetes-default-namespace-admins:
kubernetes-default-namespace-admins.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: default-admins
namespace: default
rules:
- apiGroups:
- '*'
resources:
- '*'
verbs:
- '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: kubernetes-default-namespace-admins
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: default-admins
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: kubernetes-default-namespace-adminsืืขืจ ืืืืฉืคืืื ืคึฟืึทืจ RBAC ืงืขื ืขื ืืืื ืืขืคึฟืื ืขื ืืื
ืืึทืฉืืขืืืงื ืึทืื-ืคึผืจืึธืงืกื
ืขืก ืืื ืึท ืืืื ืืขืจืืขื ืคึผืจืืืขืงื , ืืืึธืก ืึทืืึทืื ืืืจ ืฆื ืืึทืฉืืฆื ืงืืื ืึทืคึผืืึทืงืืืฉืึทื ืืืจื ืฆืืฉืืขืื ืื ืืึทื ืืฆืขืจ ืื ืคืืืืงืืื ืฆื ืึธืืขื ืืึทืงืืื ืฆื ืื OIDC ืกืขืจืืืขืจ. ืืื ืืืขื ืืืืึทืื ืืืจ ืืื ืฆื ืงืึทื ืคืืืืขืจ ืขืก ืืื Kubernetes Dashboard ืืื ืึท ืืืึทืฉืคึผืื:
dashboard-proxy.yaml
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: kubernetes-dashboard-proxy
spec:
replicas: 1
template:
metadata:
labels:
app: kubernetes-dashboard-proxy
spec:
containers:
- args:
- --listen=0.0.0.0:80
- --discovery-url=https://keycloak.example.org/auth/realms/kubernetes
- --client-id=kubernetes
- --client-secret=<your-client-secret-here>
- --redirection-url=https://kubernetes-dashboard.example.org
- --enable-refresh-tokens=true
- --encryption-key=ooTh6Chei1eefooyovai5ohwienuquoh
- --upstream-url=https://kubernetes-dashboard.kube-system
- --resources=uri=/*
image: keycloak/keycloak-gatekeeper
name: kubernetes-dashboard-proxy
ports:
- containerPort: 80
livenessProbe:
httpGet:
path: /oauth/health
port: 80
initialDelaySeconds: 3
timeoutSeconds: 2
readinessProbe:
httpGet:
path: /oauth/health
port: 80
initialDelaySeconds: 3
timeoutSeconds: 2
---
apiVersion: v1
kind: Service
metadata:
name: kubernetes-dashboard-proxy
spec:
ports:
- port: 80
protocol: TCP
targetPort: 80
selector:
app: kubernetes-dashboard-proxy
type: ClusterIPืืงืืจ: www.habr.com