Kubernetes控制平面组件：APIServer 基于静态Token 的认证机制

最新推荐文章于 2025-04-23 14:44:59 发布

grahamzhu

最新推荐文章于 2025-04-23 14:44:59 发布

阅读量845

点赞数 27

CC 4.0 BY-SA版权

分类专栏：云原生学习专栏文章标签： kubernetes 认证 authentication 静态Token kubeconfig apiserver Token

本文链接：https://blog.csdn.net/a1369760658/article/details/145775925

云原生学习专栏专栏收录该内容

105 篇文章

订阅专栏

云原生学习路线导航页（持续更新中）

kubernetes学习系列快捷链接

本文主要对kubernetes API Server 认证机制中的静态Token认证进行介绍，包括静态Token的设计理念、认证流程，并给出 Kubernetes 中的认证实操演练

在这里插入图片描述

1.静态Token的认证方式简介

静态 Token 认证（Static Token File）
- 是 Kubernetes 提供的一种基于 Bearer Token 的简单认证方式。
- 通过预定义的 Token 文件实现用户身份认证。
特性
- 需预先在 --token-auth-file 中配置 Token
- Token 以明文形式存储
- 不支持动态管理（需重启 API Server）
- 适用于测试环境，生产环境不推荐

2.实操演练：静态Token的认证

2.1.创建 Token 文件

文件格式（CSV）：

token,username,uid,"group1,group2,..."
# 比如
31ada4fd.ade128006b1723da,devuser,1000,"developers,qa"

创建文件 /etc/kubernetes/pki/tokens.csv：

sudo mkdir -p /etc/kubernetes/pki
echo "31ada4fd.ade128006b1723da,devuser,1000,\"developers,qa\"" | sudo tee /etc/kubernetes/pki/tokens.csv

2.2.配置 API Server

找到 kube-apiserver 静态pod配置：
- 如果是kubeadm启动的kubernetes集群，那么api-server会以静态pod的方式启动
- 静态pod默认路径 /etc/kubernetes/manifests，可以在这里找到 kube-apiserver 的pod配置
修改 kube-apiserver 静态pod配置：
```
  # 文件路径：/etc/kubernetes/manifests/kube-apiserver.yaml
  spec:
    containers:
    - command:
      - kube-apiserver
      - --token-auth-file=/etc/kubernetes/pki/tokens.csv  # 添加此参数
  # 其他参数不用改
```
- 因为我们把token文件放在了 /etc/kubernetes/pki 目录下，该目录默认已经被挂载到 api-server的容器中了，所以我们可以直接在参数中写这个目录，容器可以拿到该文件

2.3.重启 API Server

修改了/etc/kubernetes/manifests/kube-apiserver.yaml，kubelet会自动重启api-server

2.4.验证使用token访问kubernetes集群：直接curl

获取不到pod，因为该token只是通过了认证，但是没有授权，属于正常现象

curl https://<API_SERVER_IP>:6443/api/v1/pods \
  --header "Authorization: Bearer 31ada4fd.ade128006b1723da" \
  --insecure

# 示例
[root@VM-226-235-tencentos ~]# curl https://xxx.xxx.xxx.xxx:6443/api/v1/pods \
> --header "Authorization: Bearer 31ada4fd.ade128006b1723da" \
> --insecure
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {
    
  },
  "status": "Failure",
  "message": "pods is forbidden: User \"devuser\" cannot list resource \"pods\" in API group \"\" at the cluster scope",
  "reason": "Forbidden",
  "details": {
    "kind": "pods"
  },
  "code": 403
}

或者也可以通过 kubectl get pods -v 9 看看正常的get pod curl请求是什么样，加一个header参数即可

从响应最后的json看，apiserver已经知道我是devuser了，但是没有权限访问pod

# 获取真实的curl请求
[root@VM-226-235-tencentos ~]# kubectl get pods -v 9
.......
I0218 22:36:48.698775   29701 round_trippers.go:424] curl -k -v -XGET  -H "Accept: application/json;as=Table;v=v1;g=meta.k8s.io,application/json;as=Table;v=v1beta1;g=meta.k8s.io,application/json" -H "User-Agent: kubectl/v1.19.16 (linux/amd64) kubernetes/e37e4ab" 'https://xxx.xxx.xxx.xxx:6443/api/v1/namespaces/default/pods?limit=500'

# 添加一个header后，发送请求
[root@VM-226-235-tencentos ~]# curl -k -v -XGET -H "Authorization: Bearer 31ada4fd.ade128006b1723da" -H "Accept: application/json;as=Table;v=v1;g=meta.k8s.io,application/json;as=Table;v=v1beta1;g=meta.k8s.io,application/json" -H "User-Agent: kubectl/v1.19.16 (linux/amd64) kubernetes/e37e4ab" 'https://xxx.xxx.xxx.xxx:6443/api/v1/namespaces/default/pods?limit=500'
* About to connect() to xxx.xxx.xxx.xxx port 6443 (#0)
*   Trying xxx.xxx.xxx.xxx...
* Connected to xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx) port 6443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* NSS: client certificate not found (nickname not specified)
* SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate:
*       subject: CN=kube-apiserver
*       start date: Apr 17 08:00:10 2024 GMT
*       expire date: Apr 21 07:13:02 2025 GMT
*       common name: kube-apiserver
*       issuer: CN=kubernetes
> GET /api/v1/namespaces/default/pods?limit=500 HTTP/1.1
> Host: xxx.xxx.xxx.xxx:6443
> Accept: application/json;as=Table;v=v1;g=meta.k8s.io,application/json;as=Table;v=v1beta1;g=meta.k8s.io,application/json
> User-Agent: kubectl/v1.19.16 (linux/amd64) kubernetes/e37e4ab
> Authorization: Bearer 31ada4fd.ade128006b1723da
> 
< HTTP/1.1 403 Forbidden
< Cache-Control: no-cache, private
< Content-Type: application/json
< X-Content-Type-Options: nosniff
< Date: Tue, 18 Feb 2025 14:38:17 GMT
< Content-Length: 252
< 
{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"pods is forbidden: User \"devuser\" cannot list resource \"pods\" in API group \"\" in the namespace \"default\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}
* Connection #0 to host xxx.xxx.xxx.xxx left intact

2.5.验证使用token访问kubernetes集群：配置kubectl

# 基于静态token生成一个user
kubectl config set-credentials devuser --token=31ada4fd.ade128006b1723da
# 为user创建一个context
kubectl config set-context dev-context --cluster=<your-cluster> --user=devuser
# 切换上下文
kubectl config use-context dev-context
# 验证。若显示 "Forbidden"，说明user没有权限，需配置 RBAC 授权
kubectl get pods

[root@VM-226-235-tencentos ~]# kubectl get pods
Error from server (Forbidden): pods is forbidden: User "devuser" cannot list resource "pods" in API group "" in the namespace "default"

上面的操作将会修改到kubeconfig中，可以查看 ~/.kube/config 的内容

......
contexts:
- context:
    cluster: kubernetes
    user: devuser
  name: dev-context
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
- context:
    cluster: kubernetes
    user: myuser
  name: myuser@kubernetes
current-context: dev-context
kind: Config
preferences: {}
users:
- name: devuser
  user:
    token: 31ada4fd.ade128006b1723da
- name: ......

RBAC授权

注意需要先切换回原来的上下文，我们新建的dev-context没有Role权限的

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: default
  name: read-pods
subjects:
- kind: User
  name: devuser
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io