User Tools
управление_доступом_в_kubernetes
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
управление_доступом_в_kubernetes [2025/12/19 05:50] val |
управление_доступом_в_kubernetes [2025/12/19 09:44] (current) val [Шаг 7. Использование OpenID Connect] |
||
|---|---|---|---|
| Line 15: | Line 15: | ||
| * [[https://medium.com/@subhampradhan966/implementing-and-verifying-kubernetes-service-accounts-a-step-by-step-guide-c43b727260b2|Implementing and Verifying Kubernetes Service Accounts: A Step-by-Step Guide]] | * [[https://medium.com/@subhampradhan966/implementing-and-verifying-kubernetes-service-accounts-a-step-by-step-guide-c43b727260b2|Implementing and Verifying Kubernetes Service Accounts: A Step-by-Step Guide]] | ||
| - | + | * [[https://medium.com/@amirhosseineidy/kubernetes-authentication-with-keycloak-oidc-63571eaeed61|Kubernetes authentication with keycloak oidc]] | |
| + | * [[https://vlasov.pro/ru/p/kubernetes-oidc/|Kubernetes авторизация через OIDC]] | ||
| + | * [[https://timeweb.cloud/docs/k8s/connect-oidc-provider-to-cluster|Подключение OIDC-провайдера к кластеру]] | ||
| + | * [[https://www.talkingquickly.co.uk/setting-up-oidc-login-kubernetes-kubectl-with-keycloak|OIDC Login to Kubernetes and Kubectl with Keycloak]] | ||
| + | * [[https://github.com/int128/kubelogin|kubelogin - This is a kubectl plugin for Kubernetes OpenID Connect]] | ||
| ===== Реклама ===== | ===== Реклама ===== | ||
| Line 101: | Line 104: | ||
| kube1:~/users# kubectl delete serviceaccounts admin-user | kube1:~/users# kubectl delete serviceaccounts admin-user | ||
| + | |||
| + | user1@client1:~$ rm -rf .kube/ | ||
| </code> | </code> | ||
| ===== Шаг 6. Использование Service Accounts в приложениях ===== | ===== Шаг 6. Использование Service Accounts в приложениях ===== | ||
| Line 145: | Line 150: | ||
| </code> | </code> | ||
| - | ===== Вопросы? ===== | + | ===== Шаг 7. Использование OpenID Connect ===== |
| - | ===== Домашнее задание ===== | + | * Сервис Keycloak [[Сервис Keycloak#Аутентификация пользователей WEB приложения]] |
| - | - Куда и через сколько исчезает "kubectl get csr" после "approve" ? | ||
| - | |||
| - | ===== Перезапуск вебинара ===== | ||
| <code> | <code> | ||
| - | user1@client1:~$ rm -v user1* | ||
| - | |||
| - | user1@client1:~$ rm -rfv .kube/ | ||
| - | |||
| - | kube1:~# rm -rfv users/ | ||
| - | </code> | ||
| - | |||
| - | ===== Дополнительные материалы ===== | ||
| - | |||
| - | ==== Демонстрация OIDC ==== | ||
| - | |||
| - | <code> | ||
| - | user1@client1:~$ cp -rv .kube.iodc/ .kube/ | ||
| - | </code> | ||
| - | |||
| - | * Открываем браузер | ||
| - | * Подколючемся к giltab через keycloak | ||
| - | <code> | ||
| - | user1@client1:~$ kubelogin | ||
| - | |||
| - | user1@client1:~$ kubectl auth whoami | ||
| - | </code> | ||
| - | |||
| - | * [[Система Kubernetes#Предоставление полного доступа к Kubernetes Cluster]] | ||
| - | |||
| - | |||
| - | ==== Черновик OIDC ==== | ||
| - | <code> | ||
| - | https://medium.com/@amirhosseineidy/kubernetes-authentication-with-keycloak-oidc-63571eaeed61 | ||
| - | |||
| - | https://vlasov.pro/ru/p/kubernetes-oidc/ | ||
| - | |||
| - | https://github.com/int128/kubelogin | ||
| - | |||
| - | https://timeweb.cloud/docs/k8s/connect-oidc-provider-to-cluster | ||
| - | |||
| - | ? https://www.talkingquickly.co.uk/setting-up-oidc-login-kubernetes-kubectl-with-keycloak | ||
| - | |||
| - | Email verified | ||
| - | |||
| kube1:~/users# vim /etc/kubernetes/manifests/kube-apiserver.yaml | kube1:~/users# vim /etc/kubernetes/manifests/kube-apiserver.yaml | ||
| + | </code><code> | ||
| ... | ... | ||
| spec: | spec: | ||
| Line 199: | Line 162: | ||
| - command: | - command: | ||
| - kube-apiserver | - kube-apiserver | ||
| - | - --oidc-issuer-url=https://keycloak.corp13.un/realms/corp13 | + | - --oidc-issuer-url=https://keycloak.corpX.un/realms/corpX |
| #- --oidc-client-id=account | #- --oidc-client-id=account | ||
| - --oidc-client-id=any-client | - --oidc-client-id=any-client | ||
| Line 206: | Line 169: | ||
| - --oidc-groups-claim=groups | - --oidc-groups-claim=groups | ||
| ... | ... | ||
| + | </code><code> | ||
| kube1:~# ps ax | grep kube-apiserver | kube1:~# ps ax | grep kube-apiserver | ||
| Line 213: | Line 176: | ||
| E1203 05:22:46.412571 1 authentication.go:73] "Unable to authenticate the request" err="[invalid bearer token, oidc: verify token: oidc: expected audience \"any-client\" got [\"account\"]]" | E1203 05:22:46.412571 1 authentication.go:73] "Unable to authenticate the request" err="[invalid bearer token, oidc: verify token: oidc: expected audience \"any-client\" got [\"account\"]]" | ||
| ... | ... | ||
| + | E1218 10:36:21.105422 1 authentication.go:75] "Unable to authenticate the request" err="[invalid bearer token, oidc: email not verified]" | ||
| + | ... | ||
| + | </code> | ||
| + | |||
| + | * [[Сервис Keycloak#Проверка получения токена]] Keycloak | ||
| + | * [[Система Kubernetes#Создание файла конфигурации kubectl]] c полученным токеном | ||
| + | |||
| + | <code> | ||
| + | client1:~# wget https://github.com/int128/kubelogin/releases/download/v1.35.0/kubelogin_linux_amd64.zip | ||
| + | |||
| + | client1:~# unzip kubelogin_linux_amd64.zip | ||
| + | |||
| + | client1:~# mv kubelogin /usr/local/bin/ | ||
| user1@client1:~$ cat .kube/config | user1@client1:~$ cat .kube/config | ||
| - | apiVersion: v1 | + | </code><code> |
| - | clusters: | + | ... |
| - | - cluster: | + | |
| - | certificate-authority-data: ... | + | |
| - | server: https://192.168.13.221:6443 | + | |
| - | name: cluster.local | + | |
| - | contexts: | + | |
| - | - context: | + | |
| - | cluster: cluster.local | + | |
| - | user: user1 | + | |
| - | name: default-context | + | |
| - | current-context: default-context | + | |
| - | kind: Config | + | |
| - | preferences: {} | + | |
| users: | users: | ||
| - name: user1 | - name: user1 | ||
| Line 241: | Line 205: | ||
| #refresh-token: | #refresh-token: | ||
| name: oidc | name: oidc | ||
| + | </code><code> | ||
| + | user1@client1:~$ kubelogin | ||
| + | user1@client1:~$ kubectl auth whoami | ||
| </code> | </code> | ||
| + | |||
| + | * [[Система Kubernetes#Предоставление полного доступа к Kubernetes Cluster]] | ||
| + | |||
| + | ===== Вопросы? ===== | ||
| + | |||
| + | ===== Домашнее задание ===== | ||
| + | |||
| + | - Куда и через сколько исчезает "kubectl get csr" после "approve" ? | ||
| + | |||
| + | ===== Перезапуск вебинара ===== | ||
| + | <code> | ||
| + | user1@client1:~$ rm -v user1* | ||
| + | |||
| + | user1@client1:~$ rm -rfv .kube/ | ||
| + | |||
| + | kube1:~# rm -rfv users/ | ||
| + | </code> | ||
| + | |||
| + | ===== Дополнительные материалы ===== | ||
| + | |||
| ==== Черновик Auditing ==== | ==== Черновик Auditing ==== | ||
| <code> | <code> | ||
управление_доступом_в_kubernetes.1766112614.txt.gz · Last modified: 2025/12/19 05:50 by val
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
