Kubernetes Authorize：RBAC Rule 解

作者: algebra2k | 来源:发表于2020-10-26 19:53 被阅读0次

Kubernetes Authorize：RBAC Rule 解
Kubernetes RBAC: use one Role in
kubernetes用户权限管理工具permission-man
Kubernetes RBAC 详解
kubernetes RBAC 初探
Kubernetes-RBAC
Kubernetes RBAC授权
kubernetes笔记-RBAC
kube-rbac-proxy
kubernetes使用RBAC验证方式加入TiOps

RBAC Rule 解析器

示例文件

以下示例文件来自于 https://www.notion.so/RBAC-Rule-9081d97205a14f82b0464ffed550fb8a

Role

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""] # "" indicates the core API group
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

ClusterRole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  # "namespace" omitted since ClusterRoles are not namespaced
  name: secret-reader
rules:
- apiGroups: [""]
  #
  # at the HTTP level, the name of the resource for accessing Secret
  # objects is "secrets"
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

RoleBinding

apiVersion: rbac.authorization.k8s.io/v1
# This role binding allows "jane" to read pods in the "default" namespace.
# You need to already have a Role named "pod-reader" in that namespace.
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
# You can specify more than one "subject"
- kind: User
  name: jane # "name" is case sensitive
  apiGroup: rbac.authorization.k8s.io
roleRef:
  # "roleRef" specifies the binding to a Role / ClusterRole
  kind: Role #this must be Role or ClusterRole
  name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to
  apiGroup: rbac.authorization.k8s.io

ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
# This cluster role binding allows anyone in the "manager" group to read secrets in any namespace.
kind: ClusterRoleBinding
metadata:
  name: read-secrets-global
subjects:
- kind: Group
  name: manager # Name is case sensitive
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: secret-reader
  apiGroup: rbac.authorization.k8s.io

AuthorizationRuleResolver接口

AuthorizationRuleResolver 定义了RBAC的解析器需要实现的方法

type AuthorizationRuleResolver interface {
    // GetRoleReferenceRules attempts to resolve the role reference of a RoleBinding or ClusterRoleBinding.  The passed namespace should be the namespace
    // of the role binding, the empty string if a cluster role binding.
    GetRoleReferenceRules(roleRef rbacv1.RoleRef, namespace string) ([]rbacv1.PolicyRule, error)

    // RulesFor returns the list of rules that apply to a given user in a given namespace and error.  If an error is returned, the slice of
    // PolicyRules may not be complete, but it contains all retrievable rules.  This is done because policy rules are purely additive and policy determinations
    // can be made on the basis of those rules that are found.
    RulesFor(user user.Info, namespace string) ([]rbacv1.PolicyRule, error)

    // VisitRulesFor invokes visitor() with each rule that applies to a given user in a given namespace, and each error encountered resolving those rules.
    // If visitor() returns false, visiting is short-circuited.
    VisitRulesFor(user user.Info, namespace string, visitor func(source fmt.Stringer, rule *rbacv1.PolicyRule, err error) bool)
}

GetRoleReferenceRules 方法

GetRoleReferenceRules 通过roleRef rbacv1.RoleRef尝试解析role对Rolebinding或ClusterRoleBinding的引用。

其中namespace 如果为空则表示是集群角色绑定，否则role绑定定义的namespace 。

GetRoleReferenceRules 解析传递的roleRef 返回该角色所有的PolicyRule 。

RulesFor 方法

RulesFor 返回指定user的所有PolicyRule（包括namespace和cluster），如果返回了错误，[]PolicyRule数据不完整，slice仅包含所有可检索的PolicyRule。返回不完整的PolicyRule切片而不是遇到错误终止的原因在于PolicyRule是纯粹的可追加的策略，即使不完整，上层调用者也可以基于这些不完整的规则做出一些决定。

VisitRulesFor 方法

VisitRulesFor调用为每个user在给定namespace中的所有PolicyRule调用visitor()，vistior() 返回错误，遍历应该是短路（short-circuited）操作。

DefaultRuleResolver 实现

DefaultRuleResolver 是对AuthorizationRuleResolver接口的默认实现。

DefaultRuleResolver 数据结构

type DefaultRuleResolver struct {
    roleGetter               RoleGetter
    roleBindingLister        RoleBindingLister
    clusterRoleGetter        ClusterRoleGetter
    clusterRoleBindingLister ClusterRoleBindingLister
}

RoleGetter, 接口，用于获取Role
RoleBindingLister，接口，用户获取Role的[]RoleBinding
ClusterRoleGetter，接口，集群Role
ClusterRoleBindingLister，接口，集群Role的[]ClusterRoleBinding

GetRoleReferenceRules 实现

func (r *DefaultRuleResolver) GetRoleReferenceRules(roleRef rbacv1.RoleRef, bindingNamespace string) ([]rbacv1.PolicyRule, error) {
    switch roleRef.Kind {
    case "Role":
        role, err := r.roleGetter.GetRole(bindingNamespace, roleRef.Name)
        if err != nil {
            return nil, err
        }
        return role.Rules, nil

    case "ClusterRole":
        clusterRole, err := r.clusterRoleGetter.GetClusterRole(roleRef.Name)
        if err != nil {
            return nil, err
        }
        return clusterRole.Rules, nil

    default:
        return nil, fmt.Errorf("unsupported role reference kind: %q", roleRef.Kind)
    }
}

首先对roleRef.Kind断言，以判断是namespace级别还是Cluster级别的Role

Namespace Role

根据roleRef引用的role name 以及绑定的namespace，使用roleGetter获取Role资源对象
返回Role定义的Rules

Cluster Role

根据roleRef引用的role name ，使用clusterRoleGetter获取ClusterRole资源对象
返回ClusterRole定义的Rules

VisitRulesFor 实现

VisitRulesFor 接收user、namespace（可为空）和visitor 函数，VisitRulesFor仅执行遍历操作，真正的业务逻辑由visitor函数处理。

func (r *DefaultRuleResolver) VisitRulesFor(user user.Info, namespace string, visitor func(source fmt.Stringer, rule *rbacv1.PolicyRule, err error) bool) {
    if clusterRoleBindings, err := r.clusterRoleBindingLister.ListClusterRoleBindings(); err != nil {
        if !visitor(nil, nil, err) {
            return
        }
    } else {
        // sourceDescriber 建立 ClusterRoleBinding 和subjects数据结构,
        // 并将该结构转化为一个可描述string类型
        sourceDescriber := &clusterRoleBindingDescriber{}
        // 遍历所有的 ClusterRoleBinding
        // Note: 时间复杂度 O(N)
        for _, clusterRoleBinding := range clusterRoleBindings {
            // 查找 ClusterRoleBinding下的 Subject 是否有和该user匹配的
            // Note: 时间复杂度 O(N)
            subjectIndex, applies := appliesTo(user, clusterRoleBinding.Subjects, "")
            // 没有匹配继续查找下一个 ClusterRoleBinding 
            if !applies {
                continue
            }
            
            // 到这里说明在 ClusterRoleBinding 中找到了和 user 匹配的 subject, 即这个 ClusterRoleBinding 的 Subject
            // 作用于该 user, 因此查找这个 ClusterRoleBinding 引用的 Role 中 定义的所有的 PolicyRules
            rules, err := r.GetRoleReferenceRules(clusterRoleBinding.RoleRef, "")
            if err != nil {
                if !visitor(nil, nil, err) {
                    return
                }
                continue
            }
            
            // 保存该user 匹配的 binding 和  subject 数据结构
            sourceDescriber.binding = clusterRoleBinding
            sourceDescriber.subject = &clusterRoleBinding.Subjects[subjectIndex]
            
            // 遍历所有的 Rules
            // Note: 时间复杂度O(N)
            for i := range rules {
                // 将Rule传入visitor函数, 执行相关的业务逻辑, sourceDescriber 实现了String
                // 接口, 可以打印 binding 和 subject 的信息
                if !visitor(sourceDescriber, &rules[i], nil) {
                    return
                }
            }
        }
    }

    // 存在namespace, 收集属于namespace的 RoleBinding
    if len(namespace) > 0 {
        // 获取该namespace的所有 RoleBinding
        if roleBindings, err := r.roleBindingLister.ListRoleBindings(namespace); err != nil {
            if !visitor(nil, nil, err) {
                return
            }
        } else {
            sourceDescriber := &roleBindingDescriber{}
            for _, roleBinding := range roleBindings {
                subjectIndex, applies := appliesTo(user, roleBinding.Subjects, namespace)
                if !applies {
                    continue
                }
                rules, err := r.GetRoleReferenceRules(roleBinding.RoleRef, namespace)
                if err != nil {
                    if !visitor(nil, nil, err) {
                        return
                    }
                    continue
                }
                sourceDescriber.binding = roleBinding
                sourceDescriber.subject = &roleBinding.Subjects[subjectIndex]
                for i := range rules {
                    if !visitor(sourceDescriber, &rules[i], nil) {
                        return
                    }
                }
            }
        }
    }
}

VisitRulesFor 整体流程为：

visitor获取所有的ClusterRoleBinding
遍历ClusterRoleBinding
筛选ClusterRoleBinding和user，筛选条件通过 subject 声明做匹配
根据roleRef查找ClusterRoleBinding的Role，然后获取该Role的所有PolicyRules
遍历所有的PolicyRules
调用visitor传入每个PolicyRule，然后执行特定的业务逻辑
当namespace存在时，执行RoleBinding的筛选算法，和ClusterRoleBinding一致

注意：VisitRulesFo算法的时间复杂度为 O(N^2), N^2 = (ClusterRoleBindings + RoleBindings) * (ClusterRoleBinding Subjects + RoleBinding Subjects)

appliesTo

VisitRulesFor 会调用appliesTo 判断user是否和某个Binding下的Subjects匹配

// Note: O(N)
func appliesTo(user user.Info, bindingSubjects []rbacv1.Subject, namespace string) (int, bool) {
    // 遍历某个binding (可以是RoleBinding或者ClusterRoleBinding) 的所有Subject
    for i, bindingSubject := range bindingSubjects {
        //  判断user是否和subject匹配, 及这个binding是否作用于该user
        if appliesToUser(user, bindingSubject, namespace) {
            return i, true
        }
    }
    return 0, false
}

appliesTo遍历所有的Subjects，执行匹配的是appliesToUser

appliesToUser

func appliesToUser(user user.Info, subject rbacv1.Subject, namespace string) bool {
    switch subject.Kind {
    case rbacv1.UserKind:
        return user.GetName() == subject.Name

    case rbacv1.GroupKind:
        return has(user.GetGroups(), subject.Name)

    case rbacv1.ServiceAccountKind:
        // default the namespace to namespace we're working in if its available.  This allows rolebindings that reference
        // SAs in th local namespace to avoid having to qualify them.
        saNamespace := namespace
        if len(subject.Namespace) > 0 {
            saNamespace = subject.Namespace
        }
        if len(saNamespace) == 0 {
            return false
        }
        // use a more efficient comparison for RBAC checking
        return serviceaccount.MatchesUsername(saNamespace, subject.Name, user.GetName())
    default:
        return false
    }
}

ruleAccumulator

在VisitRulesFor 中会调用visitor函数，ruleAccumulator 是 DefaultRuleResolver 的实现

type ruleAccumulator struct {
    rules  []rbacv1.PolicyRule
    errors []error
}

func (r *ruleAccumulator) visit(source fmt.Stringer, rule *rbacv1.PolicyRule, err error) bool {
    if rule != nil {
        r.rules = append(r.rules, *rule)
    }
    if err != nil {
        r.errors = append(r.errors, err)
    }
    return true
}

具体实现也很简单，ruleAccumulator 用两个slice用于保存遍历过程中所有的 PolicyRule和error

ruleAccumulator 总是返回true

clusterRoleBindingDescriber

visitor 函数需要传入一个 fmt.Stringer 接口，clusterRoleBindingDescriber 是其实现

 type roleBindingDescriber struct {
    binding *rbacv1.RoleBinding
    subject *rbacv1.Subject
}

func (d *roleBindingDescriber) String() string {
    return fmt.Sprintf("RoleBinding %q of %s %q to %s",
        d.binding.Name+"/"+d.binding.Namespace,
        d.binding.RoleRef.Kind,
        d.binding.RoleRef.Name,
        describeSubject(d.subject, d.binding.Namespace),
    )
}

clusterRoleBindingDescriber 数据结构中保存binding和subject信息，然后Strig()方法将其转换为一个string。

describeSubject根据subject和namespace返回一个string

func describeSubject(s *rbacv1.Subject, bindingNamespace string) string {
    switch s.Kind {
    case rbacv1.ServiceAccountKind:
        // namespace存在, 输出sa绑定的namespace
        if len(s.Namespace) > 0 {
            return fmt.Sprintf("%s %q", s.Kind, s.Name+"/"+s.Namespace)
        }
        // namespace不存在, 输出sa默认绑定的namespace
        return fmt.Sprintf("%s %q", s.Kind, s.Name+"/"+bindingNamespace)
    default:
        // 其他kind情况
        return fmt.Sprintf("%s %q", s.Kind, s.Name)
    }
}

RulesFor 实现

func (r *DefaultRuleResolver) RulesFor(user user.Info, namespace string) ([]rbacv1.PolicyRule, error) {
    visitor := &ruleAccumulator{}
    r.VisitRulesFor(user, namespace, visitor.visit)
    return visitor.rules, utilerrors.NewAggregate(visitor.errors)
}

分析了前面VisitRulesFor后，RulesFor实现其实很简单，创建一个ruleAccumulator 对象，然后调用VisitRulesFor，之后返回所有的PolicyRule，不过error使用了 NewAggregate 做了一下聚合。

总结

AuthorizationRuleResolver 接口定义了解析一个user和相关的PolicyRule的基本操作方法
DefaultRuleResolver是AuthorizationRuleResolver的默认实现，其中比较重要的是VisitRulesFor的实现，可以看做是一个通用的RoleBinding 和 ClusterRolebinding 遍历算法。
VisitRulesFor要求传入一个visitor() 函数，这种设计可以让算法和业务逻辑分离
VisitRulesFor的实现复杂度是O(N^2)的
RulesFor 实现了将user所有可检测的PolicyRule收集的功能，不过如果发生错误，则PolicyRule是不完整的

Kubernetes Authorize：RBAC Rule 解
RBAC Rule 解析器示例文件以下示例文件来自于 https://www.notion.so/RBAC-R...
Kubernetes RBAC: use one Role in
https://medium.com/faun/kubernetes-rbac-use-one-role-in-m...
kubernetes用户权限管理工具permission-man
Permission Manager Permission Manager是一个为Kubernetes RBAC和...
Kubernetes RBAC 详解
原文链接：Kubernetes RBAC 详解前面两节课我们学习了Kubernetes中的两个用于配置信息的重要资...
kubernetes RBAC 初探
角色绑定将角色映射到一个用户或者一组用户，把角色在命名空间中对资源的权限授权给这些用户。ClusterRoleBi...
Kubernetes-RBAC
RBAC 在互联网级别的大规模集群中，Kubernetes内置的编排对象，很难做到满足所有需求。所以，很多实际的容...
Kubernetes RBAC授权
RBAC（Role-Based Access Control，基于角色的访问控制）在Kubernetes v1.5...
kubernetes笔记-RBAC
什么是RBAC？基于角色的访问控制，广泛使用于各种计算机系统怎么在k8s中使用RBAC？ apiserver启...
kube-rbac-proxy
小型的http代理服务, 可以使用SubjectAccessReview对Kubernetes API执行RBAC...
kubernetes使用RBAC验证方式加入TiOps
kubernetes的RBAC功能在1.5版本时，虽然还不是稳定版本，但是已经可以使用了。一、kubernetes...

Kubernetes Authorize：RBAC Rule 解

RBAC Rule 解析器

示例文件

Role

ClusterRole

RoleBinding

ClusterRoleBinding

AuthorizationRuleResolver接口

GetRoleReferenceRules 方法

RulesFor 方法

VisitRulesFor 方法

DefaultRuleResolver 实现

DefaultRuleResolver 数据结构

GetRoleReferenceRules 实现

VisitRulesFor 实现

appliesTo

appliesToUser

ruleAccumulator

clusterRoleBindingDescriber

RulesFor 实现

总结

相关文章

Kubernetes Authorize：RBAC Rule 解

Kubernetes RBAC: use one Role in

kubernetes用户权限管理工具permission-man

Kubernetes RBAC 详解

kubernetes RBAC 初探

Kubernetes-RBAC

Kubernetes RBAC授权

kubernetes笔记-RBAC

kube-rbac-proxy

kubernetes使用RBAC验证方式加入TiOps

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读