OpenShift 4 Hands-on Lab (11) 用户身份认证和资源访问限制_oc annotate clusterrolebinding.rbac self-provision-CSDN博客

本文链接：https://blog.csdn.net/weixin_43902588/article/details/104470294

本文详细介绍如何在OpenShift4.x环境中配置权限，包括增加HTPasswd身份认证、管理员用户、用户/组项目访问权限及分级授权。通过修改RBAC实现普通用户创建项目限制，并演示如何使集群管理员仍保留此权限。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

《OpenShift 4.x HOL教程汇总》
说明：本文已经在OpenShift 4.6环境中验证

1.《OpenShift 4 - 增加 HTPasswd方式的身份认证》

2.《OpenShift 4 - 增加管理员用户》

3.《OpenShift 4 - 设置用户/组对项目的访问权限》

4.《OpenShift 4 - 访问权限分级授权》

5. 限制普通用户创建项目

查看名为self-provisioners的RBAC。

$ oc get clusterrolebinding.rbac self-provisioners -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  creationTimestamp: "2019-12-12T06:53:34Z"
  name: self-provisioners
  resourceVersion: "5348"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/self-provisioners
  uid: 1d825ddb-1cac-11ea-b776-525400e21483
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: self-provisioner
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:authenticated:oauth

执行以下 2 个命令之一，删除self-provisioners中的项目。然后再次查看名为self-provisioners的RBAC，确认subjects已经没有项目了。

$ oc adm policy remove-cluster-role-from-group self-provisioner system:authenticated:oauth
$ oc patch clusterrolebinding.rbac self-provisioners -p '{"subjects": null}'
clusterrolebinding.rbac.authorization.k8s.io/self-provisioners patched
 
$ oc get clusterrolebinding.rbac self-provisioners -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  creationTimestamp: "2019-12-12T06:53:34Z"
  name: self-provisioners
  resourceVersion: "230271"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/self-provisioners
  uid: 1d825ddb-1cac-11ea-b776-525400e21483
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: self-provisioner

分别用集群管理员和一般用户创建项目，确认一般用户无法创建新项目，而集群管理员还可创建新项目。
集群管理员可以使用以下命令替 USERXX 创建 USERXX-PROJECT 项目。

$ oc new-project USERXX-PROJECT --as=USERXX  --as-group=system:authenticated --as-group=system:authenticated:oauth

集群管理员执行命令，编辑self-provisioners。

$ oc edit clusterrolebinding.rbac self-provisioners -o yaml

将下面的yaml内容追加到最后，然后保存退出即可。

subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:authenticated:oauth

分别用集群管理员和一般用户创建项目，确认一般用户和集群管理员都可创建新项目了。

参考

https://docs.openshift.com/container-platform/latest/applications/projects/configuring-project-creation.html