认证和授权

流程

1. 创建名为 add-<cluster_role>-unauth.yaml 的 YAML 文件，并添加以下内容：

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   metadata:
    annotations:
      rbac.authorization.kubernetes.io/autoupdate: "true"
    name: <cluster_role>access-unauthenticated
   roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: <cluster_role>
   subjects:
    - apiGroup: rbac.authorization.k8s.io
      kind: Group
      name: system:unauthenticated

2. 运行以下命令来应用配置：

   $ oc apply -f add-<cluster_role>.yaml

流程

1. 在 OpenShift Cluster Manager 中，导航到 Cluster List 页面，再选择您需要为其配置身份提供程序的集群。
2. 点 Access control 选项卡。

3. 点 Add identity provider。

   注意

   您还可以点在集群创建后显示的警告信息中的 Add Oauth 配置 链接来配置身份提供程序。

4. 从下拉菜单中选择 GitHub。

5. 输入身份提供程序的唯一名称。之后无法更改此名称。

   • 在提供的字段中自动生成 OAuth 回调 URL。您将使用它来注册 GitHub 应用。

     https://oauth-openshift.apps.<cluster_name>.<cluster_domain>/oauth2callback/<idp_provider_name>

     例如：

     https://oauth-openshift.apps.openshift-cluster.example.com/oauth2callback/github

6. 在 GitHub 上注册应用程序。
7. 返回到 OpenShift Dedicated，然后从下拉菜单中选择映射方法。在大多数情况下推荐使用 声明。
8. 输入 GitHub 提供的客户端 ID 和客户端 secret。
9. 输入一个主机名。在使用托管 GitHub Enterprise 实例时，必须输入一个主机名。
10. 可选： 您可以指定证书颁发机构 (CA) 文件来验证配置的 GitHub Enterprise URL 的服务器证书。点 Browse 找到并附加 CA 文件到身份提供程序。
11. 选择 Use organizations 或 Use teams 以限制对特定 GitHub 组织或 GitHub 团队的访问。
12. 输入您要限制访问权限的机构或团队的名称。点 Add more 指定用户可以成为用户所属的多个机构或团队。
13. 单击 Confirm。

流程

1. 在 OpenShift Cluster Manager 中，导航到 Cluster List 页面，再选择您需要为其配置身份提供程序的集群。
2. 点 Access control 选项卡。

3. 点 Add identity provider。

   注意

   您还可以点在集群创建后显示的警告信息中的 Add Oauth 配置 链接来配置身份提供程序。

4. 从下拉菜单中选择 GitLab。

5. 输入身份提供程序的唯一名称。之后无法更改此名称。

   • 在提供的字段中自动生成 OAuth 回调 URL。您将提供此 URL 到 GitLab。

     https://oauth-openshift.apps.<cluster_name>.<cluster_domain>/oauth2callback/<idp_provider_name>

     例如：

     https://oauth-openshift.apps.openshift-cluster.example.com/oauth2callback/gitlab

6. 在 GitLab 中添加新应用程序。
7. 返回到 OpenShift Dedicated，然后从下拉菜单中选择映射方法。在大多数情况下推荐使用 声明。
8. 输入 GitLab 提供的客户端 ID 和客户端 secret。
9. 输入 GitLab 供应商的 URL。
10. 可选： 您可以使用证书颁发机构 (CA) 文件来验证配置的 GitLab URL 的服务器证书。点 Browse 找到并附加 CA 文件到身份提供程序。
11. 单击 Confirm。

流程

1. 在 OpenShift Cluster Manager 中，导航到 Cluster List 页面，再选择您需要为其配置身份提供程序的集群。
2. 点 Access control 选项卡。

3. 点 Add identity provider。

   注意

   您还可以点在集群创建后显示的警告信息中的 Add Oauth 配置 链接来配置身份提供程序。

4. 从下拉菜单中选择 Google。

5. 输入身份提供程序的唯一名称。之后无法更改此名称。

   • 在提供的字段中自动生成 OAuth 回调 URL。您将为 Google 提供此 URL。

     https://oauth-openshift.apps.<cluster_name>.<cluster_domain>/oauth2callback/<idp_provider_name>

     例如：

     https://oauth-openshift.apps.openshift-cluster.example.com/oauth2callback/google

6. 使用 Google’s OpenID Connect integration 配置 Google 身份提供程序。
7. 返回到 OpenShift Dedicated，然后从下拉菜单中选择映射方法。在大多数情况下推荐使用 声明。
8. 输入注册 Google 项目的客户端 ID，以及 Google 发布的客户端 secret。
9. 输入托管域，将用户限制到 Google Apps 域。
10. 单击 Confirm。

流程

1. 在 OpenShift Cluster Manager 中，导航到 Cluster List 页面，再选择您需要为其配置身份提供程序的集群。
2. 点 Access control 选项卡。

3. 点 Add identity provider。

   注意

   您还可以点在集群创建后显示的警告信息中的 Add Oauth 配置 链接来配置身份提供程序。

4. 从下拉菜单中选择 LDAP。
5. 输入身份提供程序的唯一名称。之后无法更改此名称。
6. 从下拉菜单中选择映射方法。在大多数情况下推荐使用 声明。
7. 输入 LDAP URL 以指定要使用的 LDAP 搜索参数。
8. 可选：输入 绑定 DN 和 绑定密码。

9. 输入将 LDAP 属性映射到身份的属性。

   • 输入 ID 属性，其值应用作用户 ID。点 Add more 来添加多个 ID 属性。
   • 可选：输入一个 Preferred username 属性，其值应用作显示名称。点 Add more 来添加多个首选用户名属性。
   • 可选：输入 Email 属性，其值应用作电子邮件地址。点 Add more 来添加多个电子邮件属性。
10. 可选：点 Show advanced Options 将证书颁发机构 (CA) 文件添加到 LDAP 身份提供程序中，以验证所配置 URL 的服务器证书。点 Browse 找到并附加 CA 文件到身份提供程序。

11. 可选：在高级选项下，您可以选择使 LDAP 供应商不安全。如果您选择这个选项，则无法使用 CA 文件。

    重要

    如果您使用不安全的 LDAP 连接（ldap:// 或端口 389）,则必须在配置向导中检查 Insecure 选项。

12. 单击 Confirm。

流程

1. 在 OpenShift Cluster Manager 中，导航到 Cluster List 页面，再选择您需要为其配置身份提供程序的集群。
2. 点 Access control 选项卡。

3. 点 Add identity provider。

   注意

   您还可以点在集群创建后显示的警告信息中的 Add Oauth 配置 链接来配置身份提供程序。

4. 从下拉菜单中选择 OpenID。

5. 输入身份提供程序的唯一名称。之后无法更改此名称。

   • 在提供的字段中自动生成 OAuth 回调 URL。

     https://oauth-openshift.apps.<cluster_name>.<cluster_domain>/oauth2callback/<idp_provider_name>

     例如：

     https://oauth-openshift.apps.openshift-cluster.example.com/oauth2callback/openid

6. 按照创建授权请求中的步骤，在 OpenID 身份提供程序中注册新的 OpenID Connect 客户端。
7. 返回到 OpenShift Dedicated，然后从下拉菜单中选择映射方法。在大多数情况下推荐使用 声明。
8. 输入 OpenID 提供的客户端 ID 和客户端 secret。
9. 输入 Issuer URL。这是 OpenID 供应商断言为 Issuer 标识符的 URL。它必须使用没有 URL 查询参数或片段的 https 方案。
10. 输入 Email 属性，其值应用作电子邮件地址。点 Add more 来添加多个电子邮件属性。
11. 输入 Name 属性，其值应用作首选用户名。点 Add more 来添加多个首选用户名。
12. 输入 Preferred username 属性，其值应用作显示名称。点 Add more 来添加多个显示名称。
13. 可选：点 Show advanced Options 将证书颁发机构 (CA) 文件添加到 OpenID 身份提供程序中。
14. 可选：在高级选项下，您可以添加 其他范围。默认情况下，请求 OpenID 范围。
15. 单击 Confirm。

流程

1. 在 OpenShift Cluster Manager 中，导航到 Cluster List 页面并选择您的集群。
2. 选择 Access control → Identity provider。
3. 点 Add identity provider。
4. 从 Identity Provider 下拉菜单中选择 HTPasswd。
5. 在身份提供程序的 Name 字段中添加唯一名称。

6. 为静态用户使用推荐的用户名和密码，或者自行创建。

   注意

   在以下步骤中选择 Add 后，此步骤中定义的凭证不可见。如果丢失了凭证，您必须重新创建身份提供程序并再次定义凭证。

7. 选择 Add 来创建 htpasswd 身份提供程序和单一静态用户。

8. 授予静态用户权限来管理集群：

   1. 在 Access control → Cluster Roles and Access 下，选择 Add user。
   2. 输入您在上一步中创建的静态用户的用户 ID。
   3. 选择 Add user 为用户授予管理权限。

流程

1. 在 OpenShift Cluster Manager 中点您要访问的集群。
2. 点 Open Console。
3. 点身份提供程序，并提供您的凭证以登录到集群。
4. 点 Open console 为集群打开 Web 控制台。
5. 点身份提供程序，并提供您的凭证以登录到集群。完成您的供应商提供的任何授权请求。

流程

1. 进入到 OpenShift Cluster Manager 并选择您的集群。
2. 点 Access control 选项卡。
3. 在 Cluster Roles and Access 选项卡中，选择用户旁的 并点 Delete。

流程

1. 进入 github.com 并登录到您的 GitHub 帐户。

2. 从 GitHub 机构或团队中删除该用户：

   • 如果您的身份提供程序配置使用 GitHub 组织，请按照 GitHub 文档中的从您的机构中删除成员的步骤进行操作。
   • 如果您的身份提供程序配置使用 GitHub 机构中的团队，请按照 GitHub 文档中的从团队中删除机构成员的步骤进行操作。

1. 选中集群范围的“allow”规则。
2. 选中本地绑定的“allow”规则。
3. 默认为拒绝。

流程

1. 查看集群角色及其关联的规则集：

   $ oc describe clusterrole.rbac

   输出示例

   Name:         admin
   Labels:       kubernetes.io/bootstrapping=rbac-defaults
   Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
   PolicyRule:
     Resources                                                  Non-Resource URLs  Resource Names  Verbs
     ---------                                                  -----------------  --------------  -----
     .packages.apps.redhat.com                                  []                 []              [* create update patch delete get list watch]
     imagestreams                                               []                 []              [create delete deletecollection get list patch update watch create get list watch]
     imagestreams.image.openshift.io                            []                 []              [create delete deletecollection get list patch update watch create get list watch]
     secrets                                                    []                 []              [create delete deletecollection get list patch update watch get list watch create delete deletecollection patch update]
     buildconfigs/webhooks                                      []                 []              [create delete deletecollection get list patch update watch get list watch]
     buildconfigs                                               []                 []              [create delete deletecollection get list patch update watch get list watch]
     buildlogs                                                  []                 []              [create delete deletecollection get list patch update watch get list watch]
     deploymentconfigs/scale                                    []                 []              [create delete deletecollection get list patch update watch get list watch]
     deploymentconfigs                                          []                 []              [create delete deletecollection get list patch update watch get list watch]
     imagestreamimages                                          []                 []              [create delete deletecollection get list patch update watch get list watch]
     imagestreammappings                                        []                 []              [create delete deletecollection get list patch update watch get list watch]
     imagestreamtags                                            []                 []              [create delete deletecollection get list patch update watch get list watch]
     processedtemplates                                         []                 []              [create delete deletecollection get list patch update watch get list watch]
     routes                                                     []                 []              [create delete deletecollection get list patch update watch get list watch]
     templateconfigs                                            []                 []              [create delete deletecollection get list patch update watch get list watch]
     templateinstances                                          []                 []              [create delete deletecollection get list patch update watch get list watch]
     templates                                                  []                 []              [create delete deletecollection get list patch update watch get list watch]
     deploymentconfigs.apps.openshift.io/scale                  []                 []              [create delete deletecollection get list patch update watch get list watch]
     deploymentconfigs.apps.openshift.io                        []                 []              [create delete deletecollection get list patch update watch get list watch]
     buildconfigs.build.openshift.io/webhooks                   []                 []              [create delete deletecollection get list patch update watch get list watch]
     buildconfigs.build.openshift.io                            []                 []              [create delete deletecollection get list patch update watch get list watch]
     buildlogs.build.openshift.io                               []                 []              [create delete deletecollection get list patch update watch get list watch]
     imagestreamimages.image.openshift.io                       []                 []              [create delete deletecollection get list patch update watch get list watch]
     imagestreammappings.image.openshift.io                     []                 []              [create delete deletecollection get list patch update watch get list watch]
     imagestreamtags.image.openshift.io                         []                 []              [create delete deletecollection get list patch update watch get list watch]
     routes.route.openshift.io                                  []                 []              [create delete deletecollection get list patch update watch get list watch]
     processedtemplates.template.openshift.io                   []                 []              [create delete deletecollection get list patch update watch get list watch]
     templateconfigs.template.openshift.io                      []                 []              [create delete deletecollection get list patch update watch get list watch]
     templateinstances.template.openshift.io                    []                 []              [create delete deletecollection get list patch update watch get list watch]
     templates.template.openshift.io                            []                 []              [create delete deletecollection get list patch update watch get list watch]
     serviceaccounts                                            []                 []              [create delete deletecollection get list patch update watch impersonate create delete deletecollection patch update get list watch]
     imagestreams/secrets                                       []                 []              [create delete deletecollection get list patch update watch]
     rolebindings                                               []                 []              [create delete deletecollection get list patch update watch]
     roles                                                      []                 []              [create delete deletecollection get list patch update watch]
     rolebindings.authorization.openshift.io                    []                 []              [create delete deletecollection get list patch update watch]
     roles.authorization.openshift.io                           []                 []              [create delete deletecollection get list patch update watch]
     imagestreams.image.openshift.io/secrets                    []                 []              [create delete deletecollection get list patch update watch]
     rolebindings.rbac.authorization.k8s.io                     []                 []              [create delete deletecollection get list patch update watch]
     roles.rbac.authorization.k8s.io                            []                 []              [create delete deletecollection get list patch update watch]
     networkpolicies.extensions                                 []                 []              [create delete deletecollection patch update create delete deletecollection get list patch update watch get list watch]
     networkpolicies.networking.k8s.io                          []                 []              [create delete deletecollection patch update create delete deletecollection get list patch update watch get list watch]
     configmaps                                                 []                 []              [create delete deletecollection patch update get list watch]
     endpoints                                                  []                 []              [create delete deletecollection patch update get list watch]
     persistentvolumeclaims                                     []                 []              [create delete deletecollection patch update get list watch]
     pods                                                       []                 []              [create delete deletecollection patch update get list watch]
     replicationcontrollers/scale                               []                 []              [create delete deletecollection patch update get list watch]
     replicationcontrollers                                     []                 []              [create delete deletecollection patch update get list watch]
     services                                                   []                 []              [create delete deletecollection patch update get list watch]
     daemonsets.apps                                            []                 []              [create delete deletecollection patch update get list watch]
     deployments.apps/scale                                     []                 []              [create delete deletecollection patch update get list watch]
     deployments.apps                                           []                 []              [create delete deletecollection patch update get list watch]
     replicasets.apps/scale                                     []                 []              [create delete deletecollection patch update get list watch]
     replicasets.apps                                           []                 []              [create delete deletecollection patch update get list watch]
     statefulsets.apps/scale                                    []                 []              [create delete deletecollection patch update get list watch]
     statefulsets.apps                                          []                 []              [create delete deletecollection patch update get list watch]
     horizontalpodautoscalers.autoscaling                       []                 []              [create delete deletecollection patch update get list watch]
     cronjobs.batch                                             []                 []              [create delete deletecollection patch update get list watch]
     jobs.batch                                                 []                 []              [create delete deletecollection patch update get list watch]
     daemonsets.extensions                                      []                 []              [create delete deletecollection patch update get list watch]
     deployments.extensions/scale                               []                 []              [create delete deletecollection patch update get list watch]
     deployments.extensions                                     []                 []              [create delete deletecollection patch update get list watch]
     ingresses.extensions                                       []                 []              [create delete deletecollection patch update get list watch]
     replicasets.extensions/scale                               []                 []              [create delete deletecollection patch update get list watch]
     replicasets.extensions                                     []                 []              [create delete deletecollection patch update get list watch]
     replicationcontrollers.extensions/scale                    []                 []              [create delete deletecollection patch update get list watch]
     poddisruptionbudgets.policy                                []                 []              [create delete deletecollection patch update get list watch]
     deployments.apps/rollback                                  []                 []              [create delete deletecollection patch update]
     deployments.extensions/rollback                            []                 []              [create delete deletecollection patch update]
     catalogsources.operators.coreos.com                        []                 []              [create update patch delete get list watch]
     clusterserviceversions.operators.coreos.com                []                 []              [create update patch delete get list watch]
     installplans.operators.coreos.com                          []                 []              [create update patch delete get list watch]
     packagemanifests.operators.coreos.com                      []                 []              [create update patch delete get list watch]
     subscriptions.operators.coreos.com                         []                 []              [create update patch delete get list watch]
     buildconfigs/instantiate                                   []                 []              [create]
     buildconfigs/instantiatebinary                             []                 []              [create]
     builds/clone                                               []                 []              [create]
     deploymentconfigrollbacks                                  []                 []              [create]
     deploymentconfigs/instantiate                              []                 []              [create]
     deploymentconfigs/rollback                                 []                 []              [create]
     imagestreamimports                                         []                 []              [create]
     localresourceaccessreviews                                 []                 []              [create]
     localsubjectaccessreviews                                  []                 []              [create]
     podsecuritypolicyreviews                                   []                 []              [create]
     podsecuritypolicyselfsubjectreviews                        []                 []              [create]
     podsecuritypolicysubjectreviews                            []                 []              [create]
     resourceaccessreviews                                      []                 []              [create]
     routes/custom-host                                         []                 []              [create]
     subjectaccessreviews                                       []                 []              [create]
     subjectrulesreviews                                        []                 []              [create]
     deploymentconfigrollbacks.apps.openshift.io                []                 []              [create]
     deploymentconfigs.apps.openshift.io/instantiate            []                 []              [create]
     deploymentconfigs.apps.openshift.io/rollback               []                 []              [create]
     localsubjectaccessreviews.authorization.k8s.io             []                 []              [create]
     localresourceaccessreviews.authorization.openshift.io      []                 []              [create]
     localsubjectaccessreviews.authorization.openshift.io       []                 []              [create]
     resourceaccessreviews.authorization.openshift.io           []                 []              [create]
     subjectaccessreviews.authorization.openshift.io            []                 []              [create]
     subjectrulesreviews.authorization.openshift.io             []                 []              [create]
     buildconfigs.build.openshift.io/instantiate                []                 []              [create]
     buildconfigs.build.openshift.io/instantiatebinary          []                 []              [create]
     builds.build.openshift.io/clone                            []                 []              [create]
     imagestreamimports.image.openshift.io                      []                 []              [create]
     routes.route.openshift.io/custom-host                      []                 []              [create]
     podsecuritypolicyreviews.security.openshift.io             []                 []              [create]
     podsecuritypolicyselfsubjectreviews.security.openshift.io  []                 []              [create]
     podsecuritypolicysubjectreviews.security.openshift.io      []                 []              [create]
     jenkins.build.openshift.io                                 []                 []              [edit view view admin edit view]
     builds                                                     []                 []              [get create delete deletecollection get list patch update watch get list watch]
     builds.build.openshift.io                                  []                 []              [get create delete deletecollection get list patch update watch get list watch]
     projects                                                   []                 []              [get delete get delete get patch update]
     projects.project.openshift.io                              []                 []              [get delete get delete get patch update]
     namespaces                                                 []                 []              [get get list watch]
     pods/attach                                                []                 []              [get list watch create delete deletecollection patch update]
     pods/exec                                                  []                 []              [get list watch create delete deletecollection patch update]
     pods/portforward                                           []                 []              [get list watch create delete deletecollection patch update]
     pods/proxy                                                 []                 []              [get list watch create delete deletecollection patch update]
     services/proxy                                             []                 []              [get list watch create delete deletecollection patch update]
     routes/status                                              []                 []              [get list watch update]
     routes.route.openshift.io/status                           []                 []              [get list watch update]
     appliedclusterresourcequotas                               []                 []              [get list watch]
     bindings                                                   []                 []              [get list watch]
     builds/log                                                 []                 []              [get list watch]
     deploymentconfigs/log                                      []                 []              [get list watch]
     deploymentconfigs/status                                   []                 []              [get list watch]
     events                                                     []                 []              [get list watch]
     imagestreams/status                                        []                 []              [get list watch]
     limitranges                                                []                 []              [get list watch]
     namespaces/status                                          []                 []              [get list watch]
     pods/log                                                   []                 []              [get list watch]
     pods/status                                                []                 []              [get list watch]
     replicationcontrollers/status                              []                 []              [get list watch]
     resourcequotas/status                                      []                 []              [get list watch]
     resourcequotas                                             []                 []              [get list watch]
     resourcequotausages                                        []                 []              [get list watch]
     rolebindingrestrictions                                    []                 []              [get list watch]
     deploymentconfigs.apps.openshift.io/log                    []                 []              [get list watch]
     deploymentconfigs.apps.openshift.io/status                 []                 []              [get list watch]
     controllerrevisions.apps                                   []                 []              [get list watch]
     rolebindingrestrictions.authorization.openshift.io         []                 []              [get list watch]
     builds.build.openshift.io/log                              []                 []              [get list watch]
     imagestreams.image.openshift.io/status                     []                 []              [get list watch]
     appliedclusterresourcequotas.quota.openshift.io            []                 []              [get list watch]
     imagestreams/layers                                        []                 []              [get update get]
     imagestreams.image.openshift.io/layers                     []                 []              [get update get]
     builds/details                                             []                 []              [update]
     builds.build.openshift.io/details                          []                 []              [update]
   
   
   Name:         basic-user
   Labels:       <none>
   Annotations:  openshift.io/description: A user that can get basic information about projects.
   	              rbac.authorization.kubernetes.io/autoupdate: true
   PolicyRule:
   	Resources                                           Non-Resource URLs  Resource Names  Verbs
   	  ---------                                           -----------------  --------------  -----
   	  selfsubjectrulesreviews                             []                 []              [create]
   	  selfsubjectaccessreviews.authorization.k8s.io       []                 []              [create]
   	  selfsubjectrulesreviews.authorization.openshift.io  []                 []              [create]
   	  clusterroles.rbac.authorization.k8s.io              []                 []              [get list watch]
   	  clusterroles                                        []                 []              [get list]
   	  clusterroles.authorization.openshift.io             []                 []              [get list]
   	  storageclasses.storage.k8s.io                       []                 []              [get list]
   	  users                                               []                 [~]             [get]
   	  users.user.openshift.io                             []                 [~]             [get]
   	  projects                                            []                 []              [list watch]
   	  projects.project.openshift.io                       []                 []              [list watch]
   	  projectrequests                                     []                 []              [list]
   	  projectrequests.project.openshift.io                []                 []              [list]
   
   Name:         cluster-admin
   Labels:       kubernetes.io/bootstrapping=rbac-defaults
   Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
   PolicyRule:
   Resources  Non-Resource URLs  Resource Names  Verbs
   ---------  -----------------  --------------  -----
   *.*        []                 []              [*]
              [*]                []              [*]
   
   ...

2. 查看当前的集群角色绑定集合，这显示绑定到不同角色的用户和组：

   $ oc describe clusterrolebinding.rbac

   输出示例

   Name:         alertmanager-main
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  alertmanager-main
   Subjects:
     Kind            Name               Namespace
     ----            ----               ---------
     ServiceAccount  alertmanager-main  openshift-monitoring
   
   
   Name:         basic-users
   Labels:       <none>
   Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
   Role:
     Kind:  ClusterRole
     Name:  basic-user
   Subjects:
     Kind   Name                  Namespace
     ----   ----                  ---------
     Group  system:authenticated
   
   
   Name:         cloud-credential-operator-rolebinding
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  cloud-credential-operator-role
   Subjects:
     Kind            Name     Namespace
     ----            ----     ---------
     ServiceAccount  default  openshift-cloud-credential-operator
   
   
   Name:         cluster-admin
   Labels:       kubernetes.io/bootstrapping=rbac-defaults
   Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
   Role:
     Kind:  ClusterRole
     Name:  cluster-admin
   Subjects:
     Kind   Name            Namespace
     ----   ----            ---------
     Group  system:masters
   
   
   Name:         cluster-admins
   Labels:       <none>
   Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
   Role:
     Kind:  ClusterRole
     Name:  cluster-admin
   Subjects:
     Kind   Name                   Namespace
     ----   ----                   ---------
     Group  system:cluster-admins
     User   system:admin
   
   
   Name:         cluster-api-manager-rolebinding
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  cluster-api-manager-role
   Subjects:
     Kind            Name     Namespace
     ----            ----     ---------
     ServiceAccount  default  openshift-machine-api
   
   ...

流程

1. 查看当前本地角色绑定集合，这显示绑定到当前项目的不同角色的用户和组：

   $ oc describe rolebinding.rbac

2. 要查其他项目的本地角色绑定，请向命令中添加 -n 标志：

   $ oc describe rolebinding.rbac -n joe-project

   输出示例

   Name:         admin
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  admin
   Subjects:
     Kind  Name        Namespace
     ----  ----        ---------
     User  kube:admin
   
   
   Name:         system:deployers
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows deploymentconfigs in this namespace to rollout pods in
                   this namespace.  It is auto-managed by a controller; remove
                   subjects to disa...
   Role:
     Kind:  ClusterRole
     Name:  system:deployer
   Subjects:
     Kind            Name      Namespace
     ----            ----      ---------
     ServiceAccount  deployer  joe-project
   
   
   Name:         system:image-builders
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows builds in this namespace to push images to this
                   namespace.  It is auto-managed by a controller; remove subjects
                   to disable.
   Role:
     Kind:  ClusterRole
     Name:  system:image-builder
   Subjects:
     Kind            Name     Namespace
     ----            ----     ---------
     ServiceAccount  builder  joe-project
   
   
   Name:         system:image-pullers
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows all pods in this namespace to pull images from this
                   namespace.  It is auto-managed by a controller; remove subjects
                   to disable.
   Role:
     Kind:  ClusterRole
     Name:  system:image-puller
   Subjects:
     Kind   Name                                Namespace
     ----   ----                                ---------
     Group  system:serviceaccounts:joe-project

流程

1. 向指定项目中的用户添加角色：

   $ oc adm policy add-role-to-user <role> <user> -n <project>

   例如，您可以运行以下命令，将 admin 角色添加到 joe 项目中的 alice 用户：

   $ oc adm policy add-role-to-user admin alice -n joe

   提示

   您还可以应用以下 YAML 向用户添加角色：

   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     name: admin-0
     namespace: joe
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: admin
   subjects:
   - apiGroup: rbac.authorization.k8s.io
     kind: User
     name: alice

2. 查看本地角色绑定，并在输出中验证添加情况：

   $ oc describe rolebinding.rbac -n <project>

   例如，查看 joe 项目的本地角色绑定：

   $ oc describe rolebinding.rbac -n joe

   输出示例

   Name:         admin
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  admin
   Subjects:
     Kind  Name        Namespace
     ----  ----        ---------
     User  kube:admin
   
   
   Name:         admin-0
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  admin
   Subjects:
     Kind  Name   Namespace
     ----  ----   ---------
     User  alice 1
   
   
   Name:         system:deployers
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows deploymentconfigs in this namespace to rollout pods in
                   this namespace.  It is auto-managed by a controller; remove
                   subjects to disa...
   Role:
     Kind:  ClusterRole
     Name:  system:deployer
   Subjects:
     Kind            Name      Namespace
     ----            ----      ---------
     ServiceAccount  deployer  joe
   
   
   Name:         system:image-builders
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows builds in this namespace to push images to this
                   namespace.  It is auto-managed by a controller; remove subjects
                   to disable.
   Role:
     Kind:  ClusterRole
     Name:  system:image-builder
   Subjects:
     Kind            Name     Namespace
     ----            ----     ---------
     ServiceAccount  builder  joe
   
   
   Name:         system:image-pullers
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows all pods in this namespace to pull images from this
                   namespace.  It is auto-managed by a controller; remove subjects
                   to disable.
   Role:
     Kind:  ClusterRole
     Name:  system:image-puller
   Subjects:
     Kind   Name                                Namespace
     ----   ----                                ---------
     Group  system:serviceaccounts:joe

   1

   alice 用户已添加到 admins RoleBinding。

流程

1. 要为项目创建本地角色，请运行以下命令：

   $ oc create role <name> --verb=<verb> --resource=<resource> -n <project>

   在此命令中，指定：

   • <name>，本地角色的名称
   • <verb>，以逗号分隔的、应用到角色的操作动词列表
   • <resource>，角色应用到的资源
   • <project>，项目名称

   例如，要创建一个本地角色来允许用户查看 blue 项目中的 Pod，请运行以下命令：

   $ oc create role podview --verb=get --resource=pod -n blue

2. 要将新角色绑定到用户，运行以下命令：

   $ oc adm policy add-role-to-user podview user2 --role-namespace=blue -n blue

流程

1. 进入到 OpenShift Cluster Manager 并选择您的集群。
2. 点 Access control 选项卡。
3. 在 Cluster Roles and Access 选项卡中，点 Add user。
4. 输入身份提供程序用户的用户 ID。
5. 点 Add user 为用户授予 dedicated-admin 集群特权。

流程

1. 可选：查看当前项目中的服务帐户：

   $ oc get sa

   输出示例

   NAME       SECRETS   AGE
   builder    2         2d
   default    2         2d
   deployer   2         2d

2. 在当前项目中创建新服务帐户：

   $ oc create sa <service_account_name> 1

   1

   要在另一项目中创建服务帐户，请指定 -n <project_name>。

   输出示例

   serviceaccount "robot" created

   提示

   您还可以应用以下 YAML 来创建服务帐户：

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: <service_account_name>
     namespace: <current_project>

3. 可选：查看服务帐户的 secret ：

   $ oc describe sa robot

   输出示例

   Name:                robot
   Namespace:           project1
   Labels:	             <none>
   Annotations:	     <none>
   Image pull secrets:  robot-dockercfg-qzbhb
   Mountable secrets:   robot-dockercfg-qzbhb
   Tokens:              robot-token-f4khf
   Events:              <none>

流程

1. 可选：查看当前项目中的服务帐户：

   $ oc get sa

   输出示例

   NAME       SECRETS   AGE
   builder    2         2d
   default    2         2d
   deployer   2         2d

2. 在当前项目中创建新服务帐户：

   $ oc create sa <service_account_name> 1

   1

   要在另一项目中创建服务帐户，请指定 -n <project_name>。

   输出示例

   serviceaccount "robot" created

   提示

   您还可以应用以下 YAML 来创建服务帐户：

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: <service_account_name>
     namespace: <current_project>

3. 可选：查看服务帐户的 secret ：

   $ oc describe sa robot

   输出示例

   Name:                robot
   Namespace:           project1
   Labels:	             <none>
   Annotations:	     <none>
   Image pull secrets:  robot-dockercfg-qzbhb
   Mountable secrets:   robot-dockercfg-qzbhb
   Tokens:              robot-token-f4khf
   Events:              <none>

流程

1. 创建名为 add-<cluster_role>-unauth.yaml 的 YAML 文件，并添加以下内容：

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   metadata:
    annotations:
      rbac.authorization.kubernetes.io/autoupdate: "true"
    name: <cluster_role>access-unauthenticated
   roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: <cluster_role>
   subjects:
    - apiGroup: rbac.authorization.k8s.io
      kind: Group
      name: system:unauthenticated

2. 运行以下命令来应用配置：

   $ oc apply -f add-<cluster_role>.yaml

流程

1. 使用卷投影将 pod 配置为使用绑定服务帐户令牌。

   1. 创建名为 pod-projected-svc-token.yaml 的文件，其内容如下：

      apiVersion: v1
      kind: Pod
      metadata:
        name: nginx
      spec:
        securityContext:
          runAsNonRoot: true 1
          seccompProfile:
            type: RuntimeDefault 2
        containers:
        - image: nginx
          name: nginx
          volumeMounts:
          - mountPath: /var/run/secrets/tokens
            name: vault-token
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
        serviceAccountName: build-robot 3
        volumes:
        - name: vault-token
          projected:
            sources:
            - serviceAccountToken:
                path: vault-token 4
                expirationSeconds: 7200 5
                audience: vault 6

      1

      防止容器以 root 用户身份运行，以最大程度降低威胁的风险。

      2

      设置默认 seccomp 配置集，限制为仅可以使用必要的系统调用，以降低风险。

      3

      对现有服务帐户的引用。

      4

      相对于文件挂载点的相对路径，用于将令牌放入。

      5

      （可选）设置服务帐户令牌的到期时间（以秒为单位）。默认值为 3600 秒（1 小时），这个值必须至少为 600 秒（10 分钟）。如果令牌已使用的时间超过这个值的 80%，或者超过 24 小时，则 kubelet 会开始尝试轮转令牌。

      6

      （可选）设置令牌的预期使用者。令牌的接收者应验证接收者身份是否与令牌的使用声明匹配，否则应拒绝令牌。使用者默认为 API 服务器的标识符。

      注意

      为了防止意外失败，OpenShift Dedicated 会使用 --service-account-extend-token-expiration（默认为true）覆盖 expirationSeconds 值，将其设置为从初始令牌生成开始后的一年。您无法更改此设置。

   2. 创建 pod：

      $ oc create -f pod-projected-svc-token.yaml

      Kubelet 代表 pod 请求并存储令牌，使 pod 可以在一个可配置的文件路径中获得令牌，并在该令牌接近到期时刷新令牌。

2. 使用绑定令牌的应用程序需要在令牌轮转时重新载入令牌。

   如果令牌使用的时间超过这个值的 80%，或者超过 24 小时，则 kubelet 会轮转令牌。

1. RunAsUser 策略为 MustRunAsRange 且未设置最小或最大值。准入查找 openshift.io/sa.scc.uid-range 注解来填充范围字段。
2. SELinuxContext 策略为 MustRunAs 且未设定级别。准入查找 openshift.io/sa.scc.mcs 注解来填充级别。
3. FSGroup 策略为 MustRunAs。准入查找 openshift.io/sa.scc.supplemental-groups 注解。
4. SupplementalGroups 策略为 MustRunAs。准入查找 openshift.io/sa.scc.supplemental-groups 注解。

1. RunAsAny 和 MustRunAsNonRoot 策略不提供默认值。如果 Pod 需要参数值，如组 ID，您必须在 Pod 规格中定义这个值。
2. MustRunAs（单值）策略提供始终使用的默认值。例如，对于组 ID，即使 Pod 规格定义了自己的 ID 值，命名空间的默认参数值也会出现在 Pod 的组中。
3. MustRunAsRange 和 MustRunAs （基于范围）策略提供范围的最小值。与单值 MustRunAs 策略一样，命名空间的默认参数值出现在运行的 Pod 中。如果基于范围的策略可以配置多个范围，它会提供配置的第一个范围的最小值。

流程

1. 在名为 scc-admin.yaml 的 YAML 文件中定义 SCC：

   kind: SecurityContextConstraints
   apiVersion: security.openshift.io/v1
   metadata:
     name: scc-admin
   allowPrivilegedContainer: true
   runAsUser:
     type: RunAsAny
   seLinuxContext:
     type: RunAsAny
   fsGroup:
     type: RunAsAny
   supplementalGroups:
     type: RunAsAny
   users:
   - my-admin-user
   groups:
   - my-admin-group

   另外，您可以通过将 requiredDropCapabilities 字段设为所需的值来丢弃 SCC 的特定功能。所有指定的功能都会从容器中丢弃。要丢弃所有的能力，请指定 ALL。例如，要创建一个丢弃 KILL、MKNOD 和 SYS_CHROOT 功能的 SCC，请将以下内容添加到 SCC 对象中：

   requiredDropCapabilities:
   - KILL
   - MKNOD
   - SYS_CHROOT

   注意

   您不能列出 allowedCapabilities 和 requiredDropCapabilities 中的功能。

   CRI-O 支持 Docker 文档中找到的相同功能值列表。

2. 通过传递文件来创建 SCC：

   $ oc create -f scc-admin.yaml

   输出示例

   securitycontextconstraints "scc-admin" created

流程

1. 为部署创建 YAML 文件，并通过设置 openshift.io/required-scc 注解来指定所需的 SCC：

   deployment.yaml 示例

   apiVersion: config.openshift.io/v1
   kind: Deployment
   apiVersion: apps/v1
   spec:
   # ...
     template:
       metadata:
         annotations:
           openshift.io/required-scc: "my-scc" 1
   # ...

   1

   指定需要的 SCC 的名称。

2. 运行以下命令来创建资源：

   $ oc create -f deployment.yaml