Question

我有一个用户“ A”。我有命名空间X，Y，Z。我为有权访问命名空间“ X”的用户“ A”创建了RBAC用户角色和角色绑定。

我想让用户“ A”访问kubernetes仪表板（这是Kube-System的角色和角色绑定）。但是，当我授予仪表板访问权限时，用户“ A”可以看到所有名称空间。

但是我希望他只看到他有权访问的名称空间X。

我该怎么办？

Answer 1

您的仪表板是什么版本？据我所知，从1.7开始，Dashboard使用了更安全的设置，这意味着，默认情况下，Dashboard具有使Dashboard工作所需的最少特权集。

无论如何，您可以检查Dashboard使用的sa的特权，确保它具有最小的特权，如下所示：

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubernetes-dashboard-minimal
  namespace: kube-system
rules:
  # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create"]
  # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["create"]
  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
  verbs: ["get", "update", "delete"]
  # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups: [""]
  resources: ["configmaps"]
  resourceNames: ["kubernetes-dashboard-settings"]
  verbs: ["get", "update"]
  # Allow Dashboard to get metrics from heapster.
- apiGroups: [""]
  resources: ["services"]
  resourceNames: ["heapster"]
  verbs: ["proxy"]
- apiGroups: [""]
  resources: ["services/proxy"]
  resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
  verbs: ["get"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubernetes-dashboard-minimal
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubernetes-dashboard-minimal
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kube-system

然后，创建RBAC规则以将名称空间X的全部特权授予A：

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: user-A-admin
  namespace: X
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: A

确保用户A没有其他任何RBAC规则。

RBAC for kubernetes仪表板

1 个答案: