01 - RBAC：基于角色的访问控制

K8s 安全模型

API 请求的处理流程：

客户端请求 → 认证 (Authentication) → 授权 (Authorization) → 准入控制 (Admission) → API 处理
              "你是谁？"              "你能做什么？"          "请求合法吗？"

RBAC（Role-Based Access Control）是 K8s 默认的授权方式。

---

RBAC 四个核心资源

┌──────────────────────────────────────────────────────────┐
│                                                          │
│  主体 (Subject)        绑定 (Binding)       角色 (Role)  │
│                                                          │
│  ┌─────────────┐     ┌──────────────┐    ┌────────────┐ │
│  │ User        │     │ RoleBinding  │    │ Role       │ │
│  │ Group       │────▶│              │───▶│ (命名空间级) │ │
│  │ ServiceAcct │     └──────────────┘    └────────────┘ │
│  └─────────────┘                                        │
│                      ┌──────────────┐    ┌────────────┐ │
│                      │ClusterRole   │    │ClusterRole │ │
│                 ────▶│  Binding     │───▶│ (集群级)    │ │
│                      └──────────────┘    └────────────┘ │
└──────────────────────────────────────────────────────────┘

资源	作用域	说明
Role	命名空间	定义命名空间内的权限
ClusterRole	集群	定义集群级别的权限
RoleBinding	命名空间	将 Role 绑定到主体
ClusterRoleBinding	集群	将 ClusterRole 绑定到主体

---

Role / ClusterRole

# 命名空间级别的 Role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: dev
rules:
- apiGroups: [""]           # "" = 核心 API 组
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get"]
---
# 集群级别的 ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: deployment-manager
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "list"]

常用 verbs

Verb	对应操作
get	读取单个资源
list	列出资源
watch	监听变化
create	创建
update	更新
patch	部分更新
delete	删除
*	所有操作

---

RoleBinding / ClusterRoleBinding

# 将 Role 绑定到 ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: dev
subjects:
- kind: ServiceAccount
  name: app-sa
  namespace: dev
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io
---
# 将 ClusterRole 绑定到用户
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-binding
subjects:
- kind: User
  name: darren
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

---

ServiceAccount

每个 Pod 都有一个 ServiceAccount，用于 Pod 内部访问 K8s API。

# 创建 ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-sa
  namespace: dev
---
# Pod 使用指定的 ServiceAccount
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  serviceAccountName: app-sa
  containers:
  - name: app
    image: myapp

---

实操：验证 RBAC

# 检查当前用户是否有权限
kubectl auth can-i create deployments
kubectl auth can-i delete pods --namespace=dev

# 以特定 ServiceAccount 检查
kubectl auth can-i get pods --as=system:serviceaccount:dev:app-sa

# 查看所有 ClusterRole
kubectl get clusterroles

# 查看内置的 admin ClusterRole 有哪些权限
kubectl describe clusterrole admin

---

下一步

→ 02 - NetworkPolicy 与安全最佳实践