[K8s] 인증과 권한 관리 - 인증편

API 접근제어

• API 인증요청
  • User/Group
  • Service Account(Application)
• Authentication
  • user 또는 application이 API에 접근을 허가 받는 과정
  • 인증방식 ; 클라이언트 인증서, 베어러 토큰(bearer token), HTTP 기본인증 지원
• Authoriztion
  • RBAC 모델 기반
  • 요청 ID에 적절한 role이 있는지 확인
• Admission Control
  • 요청이 올바른 형식인지 판별
  • 요청이 처리되기 전에 수정사항을 잠재적으로 적용

<이미지 출처 : https://www.youtube.com/watch?v=kttUVsFEj5A&list=PLApuRlvrZKohLYdvfX-UEFYTE7kfnnY36&index=3 >

 

API 인증

• API 서버에 접근하기 위해서는 인증 작업 필요
  • 일반 사용자(Human User) 또는 그룹(Group)
    • Cluster 외부에서 k8s를 조작하는 사용자로, 다양한 방법으로 인증
    • kubernetes-admin : k8s의 모든 권한을 소유한 유저
    • cat ~/.kube/config 또는 kubectl config view
  • 서비스 계정(Serviceaccount)
    • K8s 내부적으로 관리되며 pod가 k8s API를 다룰 때 사용하는 계정
    • Pod가 실행될 때 특별히 ServiceAccount를 설정하지 않으면 같은 namesapce에 default 라는 ServiceAccount가 할당

다른 유저 생성

• https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/#normal-user 참고
• PKI private key and CSR(인증서 요청 파일) 생성 및 확인

openssl genrsa -out myuser.key 2048
openssl req -new -key myuser.key -out myuser.csr -subj "/CN=myuser"

ls

myuser.csr  myuser.key

• myuser.csr를 baser64로 인코딩

cat myuser.csr | base64 | tr -d "\\n"

LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ1ZqQ0NBVDRDQVFBd0VURVBNQTBHQTFVRUF3d0diWGwxYzJWeU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRgpBQU9DQVE4QU1JSUJDZ0tDQVFFQXN0cnZYQndHQ09MWnNiYjFxS0pReC9MUDduZVI0MTRCd2wzOG1BMnJUZmhUCnp2SHNlUXpzQ2F6eTllSEdCZEdKc21TWnpFZDVua2NhRHlYKzNFKzZ3cnk5dGc1YmdVR0VrSWN0eWNyajdGa0UKeVBEMGRDUXhiUzVENVRkY3Rjck1NWURRR3JhTlJCYTNkRDNJNkhSZGtKMFk1U2paRXFWYTd4Vm51clRXdEx3WQpybEF2VzhCemZFeEl1Y2hjczc2cFR4Tk9TNXo3elpJNndWUXMyaCtsb0hDK1FlUFVQRzR5Z003RStwTU9PalZtCjl1NXFidWVWQmlrZTRSUGprcWpyV2VCdzdWSk52d3BicHZuVUY1YzNXZWgrb1F4Mkt2c3h6Ly9mMGtBd294bFgKSFFLY1dVMW1EbVppY3pNL05iQnBpb3haMU1JSmxwb2ZLWS8vS05JMnZ3SURBUUFCb0FBd0RRWUpLb1pJaHZjTgpBUUVMQlFBRGdnRUJBSGd0cFpNRUxlc20yRFRmNXJibjNhU3k4SVNCNjZXK2pjc1IxbGdFK2wwZnBvMGQvNzU5CndMYy9YREJEcWlZTGpablplZGlQRmJhUzAxeTBsTU1tNW42UjV5bmVwZ3V2OFNzQ214R1NiK2VxNVByVkIwWWUKdDIwL21udkMybmM2Nmt2QmZoWGFJY3JFQXpuQVdxSFBITGt2UHZkQWROK0N5aEhxNG54aUIyRjM0KzQvUlU2MgpnOFRNa1B0V0tzbHExUGd3MzFzVWxKM0NQcWFaRk1TMk9CT1pwZkdFeDFRV1Q1d25JTllnRjF1OUI5alBSaHZUCnIrMm9Bdm9Ld1JJRmliWjA5RlF4UGxJVlF5Lytlb2MyZTlscHhSbDlZaFVVTklraHFHczVOWlBMaWJIcE9MT3QKNlRMUC9Oc21MeEFaUkcyQUJqRGpod1F3ZnViTFljMjZjd1U9Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=

• CertificateSigningRequest 생성
  • request : myuser.csr를 base64로 인코딩한 값 첨부

cat > csr-myuser.yaml << EOF
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: myuser
spec:
  request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ1ZqQ0NBVDRDQVFBd0VURVBNQTBHQTFVRUF3d0diWGwxYzJWeU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRgpBQU9DQVE4QU1JSUJDZ0tDQVFFQXN0cnZYQndHQ09MWnNiYjFxS0pReC9MUDduZVI0MTRCd2wzOG1BMnJUZmhUCnp2SHNlUXpzQ2F6eTllSEdCZEdKc21TWnpFZDVua2NhRHlYKzNFKzZ3cnk5dGc1YmdVR0VrSWN0eWNyajdGa0UKeVBEMGRDUXhiUzVENVRkY3Rjck1NWURRR3JhTlJCYTNkRDNJNkhSZGtKMFk1U2paRXFWYTd4Vm51clRXdEx3WQpybEF2VzhCemZFeEl1Y2hjczc2cFR4Tk9TNXo3elpJNndWUXMyaCtsb0hDK1FlUFVQRzR5Z003RStwTU9PalZtCjl1NXFidWVWQmlrZTRSUGprcWpyV2VCdzdWSk52d3BicHZuVUY1YzNXZWgrb1F4Mkt2c3h6Ly9mMGtBd294bFgKSFFLY1dVMW1EbVppY3pNL05iQnBpb3haMU1JSmxwb2ZLWS8vS05JMnZ3SURBUUFCb0FBd0RRWUpLb1pJaHZjTgpBUUVMQlFBRGdnRUJBSGd0cFpNRUxlc20yRFRmNXJibjNhU3k4SVNCNjZXK2pjc1IxbGdFK2wwZnBvMGQvNzU5CndMYy9YREJEcWlZTGpablplZGlQRmJhUzAxeTBsTU1tNW42UjV5bmVwZ3V2OFNzQ214R1NiK2VxNVByVkIwWWUKdDIwL21udkMybmM2Nmt2QmZoWGFJY3JFQXpuQVdxSFBITGt2UHZkQWROK0N5aEhxNG54aUIyRjM0KzQvUlU2MgpnOFRNa1B0V0tzbHExUGd3MzFzVWxKM0NQcWFaRk1TMk9CT1pwZkdFeDFRV1Q1d25JTllnRjF1OUI5alBSaHZUCnIrMm9Bdm9Ld1JJRmliWjA5RlF4UGxJVlF5Lytlb2MyZTlscHhSbDlZaFVVTklraHFHczVOWlBMaWJIcE9MT3QKNlRMUC9Oc21MeEFaUkcyQUJqRGpod1F3ZnViTFljMjZjd1U9Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=
  signerName: kubernetes.io/kube-apiserver-client
  usages:
  - client auth
EOF

• myuser의 인증서를 kubectl를 통해서 kubernetes cluster에 등록 및 확인
  • pending 상태 확인

kubectl apply -f csr-myuser.yaml

kubectl get csr

NAME        AGE     SIGNERNAME                                    REQUESTOR                 REQUESTEDDURATION   CONDITION
csr-njbzr   2d16h   kubernetes.io/kube-apiserver-client-kubelet   system:bootstrap:v08tp5   <none>              Approved,Issued
myuser      39s     kubernetes.io/kube-apiserver-client           kubernetes-admin          <none>              Pending

• CSR 승인 요청 및 확인
  • approved상태 확인

kubectl certificate approve myuser

kubectl get csr

NAME        AGE     SIGNERNAME                                    REQUESTOR                 REQUESTEDDURATION   CONDITION
csr-njbzr   2d16h   kubernetes.io/kube-apiserver-client-kubelet   system:bootstrap:v08tp5   <none>              Approved,Issued
myuser      100s    kubernetes.io/kube-apiserver-client           kubernetes-admin          <none>              Approved,Issued

• myuser의 csr 정보를 출력하여 myuser.crt 파일 생성 및 확인

kubectl get csr myuser -o jsonpath='{.status.certificate}'| base64 -d > myuser.crt

cat myuser.crt

-----BEGIN CERTIFICATE-----
MIIC9jCCAd6gAwIBAgIQG6g/7FRA4pbcvF2XQEnnYTANBgkqhkiG9w0BAQsFADAV
MRMwEQYDVQQDEwprdWJlcm5ldGVzMB4XDTIyMDYyMDAwMjAzMVoXDTIzMDYyMDAw
MjAzMVowETEPMA0GA1UEAxMGbXl1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAstrvXBwGCOLZsbb1qKJQx/LP7neR414Bwl38mA2rTfhTzvHseQzs
Cazy9eHGBdGJsmSZzEd5nkcaDyX+3E+6wry9tg5bgUGEkIctycrj7FkEyPD0dCQx
bS5D5TdctcrMMYDQGraNRBa3dD3I6HRdkJ0Y5SjZEqVa7xVnurTWtLwYrlAvW8Bz
fExIuchcs76pTxNOS5z7zZI6wVQs2h+loHC+QePUPG4ygM7E+pMOOjVm9u5qbueV
Bike4RPjkqjrWeBw7VJNvwpbpvnUF5c3Weh+oQx2Kvsxz//f0kAwoxlXHQKcWU1m
DmZiczM/NbBpioxZ1MIJlpofKY//KNI2vwIDAQABo0YwRDATBgNVHSUEDDAKBggr
BgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFM/x1oOTQd1llVUr8Mai
huB7hkwuMA0GCSqGSIb3DQEBCwUAA4IBAQBZmz6fANKkWWSE589xEttQ9x+aMrs0
q5iTO0oxlVBIeArdsIw5w9ZYTGtzGqtkdK3t7XPb9nfsGH9mujNMNDw3oNnxdFyv
3gjK3hqTE1u42SxlAqDMCB9YhnXu8yMBbPdVp74TDSIZouk+ouXJw6vzEMN2OOZy
HuNRA30F8Ye4Mlsd1ONk5lYKAqFrnI0Gcf/CIJiENSfdxAf4Zh5gye942A20g3P/
YpA/bzsEyTCXoy6ZGwsrNhaL1WbdpkzwH3OpAgCArQtej/14nucWR0gQWcJggZ+M
4a4tdUiN4WNaKhlK1gzCcQfvHcbo2wt2oX2poOUS63XCTQxOmpXatPOp
-----END CERTIFICATE-----

Service account 생성

• https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ 참고
• Serciveaccount 생성 및 확인
  • Kubernetes 1.24부터 secret 자동 생성 안됨

kubectl create serviceaccount pod-viewer

kubectl get serviceaccounts

NAME         SECRETS   AGE
default      0         3d16h
pod-viewer   0         16s

• Serviceaccount 삭제

kubectl delete serviceaccounts pod-viewer

 

 

참고 :

https://www.youtube.com/watch?v=kttUVsFEj5A&list=PLApuRlvrZKohLYdvfX-UEFYTE7kfnnY36&index=3