overview

• kube apiserver : first line of defense
• who can access?
  • static token
  • certificate
  • external authentication provideers (LDAP)
  • service account
• what can they do?
  • RBAC Auth
  • ABAC Auth
  • Node Auth
  • Webhook mode
• TLS Certification
• Network Policies

Authentication

• User : Admins, Developers
• Bots
• Service Accounts : used by pods to interact with kube-api

  kubectl create serviceaccount sa1
  

• flow : kube-apiserver -> authenticate user -> process request
• kube-api
  • static token

    secrettoken123,admin-user,1000,"system:masters"
    another-token,read-only-user,1001,"view-group"
    

    curl -k -H "Authorization: Bearer secrettoken123" \
     https://<API-SERVER-IP>:6443/api/v1/namespaces/default/pods
    

  • certificates
  • identity services (LDAP, OIDC)

TLS

STEP

• ca create

openssl genrsa -out ca.key 2048
openssl req -new -key ca.key -subj "/CN=KUBERNETES-CA" -out ca.csr
openssl x509 -req -in ca.csr -signkey ca.key -out ca.crt

• admin create

openssl genrsa -out admin.key 2048
openssl req -new -key admin.key -subj "/CN=kube-admin" -out admin.csr
openssl x509 -req -in admin.csr -CA ca.crt -CAkey ca.key -out admin.crt

• kube-config.yaml

apiVersion: v1
clusers:
- cluster:
    certificate-authority: ca.crt
    server: https://kube-apiserver:6443
  name: kubernetes
kind: Config
users:
- name: kubernetes-admin
  user:
    client-certificate: admin.crt
    client-key: admin.key

• call kubeapi (–cert, –key : default kube-config.yaml )

curl -k --cert admin.crt --key admin.key \
https://kube-apiserver:6443/api/v1/namespaces/default/pods

1. connection request : client submit admin.crt, server verify with ca.crt
2. server send random number
3. client encrypt number with admin.key and submit
4. server decrypt with public key in admin.crt and compare

• record in etcd : etcd auth + peer auth
• kube-api Server

openssl genrsa -out apiserver.key 2048
openssl req -new -key apiserver.key -subj "/CN=kube-apiserver" -out apiserver.csr -config openssl.cnf

• now, kube-apiserver certificate sign by ca.crt
• kube-apiserver now uses ca.crt as the client-ca-file.
• Certificates are generated for each node. (CN : system:node:node01)

CertificateSigningRequest

• kube-api server request CSR
• cat jane.csr | base64 | tr -d “\n”

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
    name: jane-csr
spec:
    expirationSeconds: 86400
    usages:
    - digital signature
    - key encipherment
    - server auth
    request: <base64-encoded-csr>

• 발급은 controller-manager

kubectl certificate approve <certificate-signing-request-name>

kubeconfig

kubectl config view

• category : cluster, user, context
• default env : KUBECONFIG

apiVersion: v1
kind: Config
preferences: {}

clusters:
  - cluster:
    name: development
  - cluster:
    name: test

users:
  - name: developer
  - name: experimenter

contexts:
  - context:
    name: dev-frontend
  - context:
    name: dev-storage
  - context:
    name: exp-test

kubectl config --kubeconfig=config-demo use-context dev-frontend

Control Authorization

k get roles

• /etc/kubernetes/manifests/kube-apiserver.yaml > –authorization-mode=RBAC
• ABAC : Attribute Based Access Control (not recommended)
• RBAC : Role Based Access Control (recommended)

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
    name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "create", "list"]

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: jane # "name" is case sensitive
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role #this must be Role or ClusterRole
  name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to
  apiGroup: rbac.authorization.k8s.io

• namespace scope
• api-server –authorization-mode=RBAC, ABAC, Node, Webhook…
• test : k auth can-i

Cluster Roles

• Cluster Scope : node, pv, clusterrole, clusterrolebinding, namespace, certificatesigningrequest
• clusterroles + clusterrolebindings : cluster-wide auth control

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
    name: pod-reader
rules:
    - apiGroups: [""]
      resources: ["pods"]
      verbs: ["get", "create", "list"]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
    name: read-pods-global
subjects:
    - kind: User
      name: jane
      apiGroup: rbac.authorization.k8s.io
roleRef:
    kind: ClusterRole
    name: pod-reader
    apiGroup: rbac.authorization.k8s.io

• not hard role

• tags :
• Cka