从一次 pods/exec forbidden 聊起：彻底搞懂 K8s RBAC 权限模型

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: dev
  name: pod-reader
rules:
- apiGroups: [""]            # 核心 API 组，用空字符串表示
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
- apiGroups: [""]
  resources: ["pods/log"]    # 子资源也要单独声明
  verbs: ["get"]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-operator
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["pods/exec", "pods/log", "pods/portforward"]
  verbs: ["create", "get"]  # exec 和 portforward 用的 verb 是 create
- apiGroups: [""]
  resources: ["nodes"]      # 非 namespace 资源
  verbs: ["get", "list"]
- nonResourceURLs: ["/healthz", "/healthz/*"]
  verbs: ["get"]            # 非资源 URL

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods-binding
  namespace: dev
subjects:
- kind: ServiceAccount
  name: deployer
  namespace: dev
roleRef:
  kind: Role
  name: pod-reader         # 引用同 namespace 的 Role
  apiGroup: rbac.authorization.k8s.io

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: operate-pods-in-dev
  namespace: dev
subjects:
- kind: User
  name: zhangsan
  apiGroup: rbac.authorization.k8s.io
- kind: Group
  name: dev-team
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: pod-operator       # 引用 ClusterRole，但权限只在 dev namespace 生效
  apiGroup: rbac.authorization.k8s.io

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-admin-binding
subjects:
- kind: User
  name: admin@example.com
  apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
  name: ci-bot
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: cluster-admin      # 内置 ClusterRole，拥有所有权限
  apiGroup: rbac.authorization.k8s.io

$ kubectl get sa -n dev
NAME      SECRETS   AGE
default   0         30d

# 自动创建的 Secret，包含永不过期的 JWT token
apiVersion: v1
kind: Secret
metadata:
  name: deployer-token-x7b2k
  annotations:
    kubernetes.io/service-account.name: deployer
type: kubernetes.io/service-account-token
data:
  token: eyJhbGciOiJSUzI1NiIs...    # 永不过期！
  ca.crt: LS0tLS1CRUdJTi...
  namespace: ZGV2

apiVersion: v1
kind: Pod
metadata:
  name: my-app
spec:
  serviceAccountName: deployer
  containers:
  - name: app
    image: my-app:latest
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access
  volumes:
  - name: kube-api-access
    projected:                    # projected volume 投射卷
      sources:
      - serviceAccountToken:
          expirationSeconds: 3600  # 默认 1 小时过期
          path: token
          audience: api           # 限定受众
      - configMap:
          name: kube-root-ca.crt
          items:
          - key: ca.crt
            path: ca.crt
      - downwardAPI:
          items:
          - path: namespace
            fieldRef:
              fieldPath: metadata.namespace

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-controller
  namespace: app-system

# 在 SA 级别关闭（该 SA 下所有 Pod 默认不挂载）
apiVersion: v1
kind: ServiceAccount
metadata:
  name: web-app
automountServiceAccountToken: false

---
# 或者在 Pod 级别关闭（Pod 级别优先级更高）
apiVersion: v1
kind: Pod
spec:
  serviceAccountName: web-app
  automountServiceAccountToken: false

# 查看内置 ClusterRole
$ kubectl get clusterrole | grep -E '^(cluster-admin|admin|edit|view)\s'
admin          2024-01-01T00:00:00Z
cluster-admin  2024-01-01T00:00:00Z
edit           2024-01-01T00:00:00Z
view           2024-01-01T00:00:00Z

# 检查当前用户权限
$ kubectl auth can-i create pods/exec -n dev
no

# 检查指定 SA 的权限
$ kubectl auth can-i create pods/exec -n dev \
  --as=system:serviceaccount:dev:deployer
no

# 列出所有权限
$ kubectl auth can-i --list -n dev \
  --as=system:serviceaccount:dev:deployer
Resources          Non-Resource URLs   Resource Names   Verbs
pods               []                  []               [get list watch]
pods/log           []                  []               [get]

{
  "kind": "Event",
  "level": "RequestResponse",
  "verb": "create",
  "resource": "pods",
  "subresource": "exec",
  "user": {
    "username": "system:serviceaccount:dev:deployer"
  },
  "responseStatus": {
    "code": 403,
    "reason": "Forbidden"
  }
}

# 查看某个 RoleBinding 绑定了谁和什么角色
$ kubectl describe rolebinding -n dev

# 查看某个 ClusterRole 有哪些规则
$ kubectl describe clusterrole pod-operator

# 1. 为租户创建 namespace
apiVersion: v1
kind: Namespace
metadata:
  name: tenant-a

---
# 2. 创建租户 SA
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tenant-a-admin
  namespace: tenant-a

---
# 3. RBAC：用 RoleBinding 绑定 edit ClusterRole（权限限定在 tenant-a）
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tenant-a-edit
  namespace: tenant-a
subjects:
- kind: ServiceAccount
  name: tenant-a-admin
  namespace: tenant-a
roleRef:
  kind: ClusterRole
  name: edit
  apiGroup: rbac.authorization.k8s.io

---
# 4. 资源配额
apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-a-quota
  namespace: tenant-a
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    pods: "20"

---
# 5. 网络隔离：默认拒绝所有入站
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: tenant-a
spec:
  podSelector: {}
  policyTypes:
  - Ingress

# 定义一个聚合 ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: monitoring-view
  labels:
    # 这个 label 会被 "view" ClusterRole 聚合
    rbac.authorization.k8s.io/aggregate-to-view: "true"
rules:
- apiGroups: ["monitoring.coreos.com"]
  resources: ["prometheuses", "alertmanagers", "servicemonitors"]
  verbs: ["get", "list", "watch"]

$ kubectl get clusterrole view -o yaml | head -20
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: view
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      rbac.authorization.k8s.io/aggregate-to-view: "true"
rules: []   # rules 由聚合自动填充，不手动维护

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: my-controller-role
rules:
- apiGroups: ["example.com"]
  resources: ["myresources"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["example.com"]
  resources: ["myresources/status"]   # 别忘了 status 子资源
  verbs: ["get", "update", "patch"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: my-controller-rolebinding
subjects:
- kind: ServiceAccount
  name: my-controller
  namespace: controller-system
roleRef:
  kind: ClusterRole
  name: my-controller-role
  apiGroup: rbac.authorization.k8s.io

# ❌ 错误配置：只授权了 pods，没有 pods/exec
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: dev
  name: pod-manager
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["*"]          # 这里的 * 只覆盖 pods 本身

# ✅ 正确配置
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: dev
  name: pod-manager
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["*"]
- apiGroups: [""]
  resources: ["pods/exec", "pods/log", "pods/portforward"]
  verbs: ["create", "get"]

// ❌ 错误做法：一次性读取
token, _ := os.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/token")
// 用这个 token 调 API... 1 小时后就 401

// ✅ 正确做法 1：每次调 API 前重新读取
func getToken() (string, error) {
    token, err := os.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/token")
    return string(token), err
}

// ✅ 正确做法 2：使用官方 client-go，自动处理 token 轮换
import "k8s.io/client-go/rest"
config, _ := rest.InClusterConfig()  // 自动从 projected volume 读取并轮换
clientset, _ := kubernetes.NewForConfig(config)

$ kubectl auth can-i list pods -n dev --as=zhangsan
yes

$ kubectl auth can-i list pods -n staging --as=zhangsan
no

$ kubectl get rolebinding -n dev
NAME              ROLE                AGE
dev-pod-reader    ClusterRole/view    30d

$ kubectl get rolebinding -n staging
No resources found in staging namespace.

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: staging-pod-reader
  namespace: staging       # 新 namespace
subjects:
- kind: User
  name: zhangsan
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: view
  apiGroup: rbac.authorization.k8s.io

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: all-ns-pod-reader
subjects:
- kind: User
  name: zhangsan
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: view
  apiGroup: rbac.authorization.k8s.io