K8s IAM

• k8s does not have group or user.
• layers for auth
  • Authentication (AuthN) (access for cluster ) – who are you (external connect to k8s cluster)
    • client certificate
    • service account
    • OIDC token
    • Cloud IAM
  • Authorization (AuthZ) – what can you do (role, rolebinding, clusterrole,clusterrolebinding )
  • Admission – is rquest to allow policy ( Admission controller)

client Certificate :

• certificate CN (common name) become user
• Certificate o (organization) become group , multiple o

prerequisites:

• k8s config with admin access
• openssl installtion

 sudo apt update && sudo apt install openssl -y

Generate openssl certificate

kubectl cluster-info
kubectl auth can-i "*" "*" --all-namespaces

kubectl create ns ram
kubectl get ns ram -o yaml

# generate pravite key and csr for the user 

mkdir -p ~/k8s-users/ram
openssl genrsa -out ram.key 2048
openssl req -new -key ram.key -out ram.csr -subj "/CN=ram/O=dev-team"

# Verify 
openssl req -in ram.csr -noout -subject
cp ram.key k8s-users/
cp ram.csr k8s-users/

Submit csr to k8s (csr- cerificate signing request)

cat <<EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: ram
spec: 
  request: $(base64 -w0 < ram.csr)
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 86400
  usages:
    - client auth
EOF

root@ip-172-31-44-4:~# kubectl get csr
NAME   AGE   SIGNERNAME                            REQUESTOR          REQUESTEDDURATION   CONDITION
ram    76s   kubernetes.io/kube-apiserver-client   kubernetes-admin   24h                 Pending
root@ip-172-31-44-4:~# kubectl certificate approve ram
certificatesigningrequest.certificates.k8s.io/ram approved
root@ip-172-31-44-4:~# kubectl get csr
NAME   AGE    SIGNERNAME                            REQUESTOR          REQUESTEDDURATION   CONDITION
ram    118s   kubernetes.io/kube-apiserver-client   kubernetes-admin   24h                 Approved,Issued
root@ip-172-31-44-4:~#

kubectl get csr ram -o jsonpath='{.status.certificate}' | base64 -d > ram.crt

openssl x509 -in ram.crt -noout -subject -dates

refer

build kubeconfig for user

# Cluster details from the admin kubeconfig
SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
CLUSTER=$(kubectl config view --minify -o jsonpath='{.clusters[0].name}')
kubectl config view --raw --minify \
  -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d > ca.crt

# Cluster
kubectl config set-cluster $CLUSTER \
  --server=$SERVER \
  --certificate-authority=ca.crt \
  --embed-certs=true \
  --kubeconfig=ram.kubeconfig

# User credentials
kubectl config set-credentials ram \
  --client-certificate=ram.crt \
  --client-key=ram.key \
  --embed-certs=true \
  --kubeconfig=ram.kubeconfig

# Context (default namespace = dev)
kubectl config set-context ram-ctx \
  --cluster=$CLUSTER \
  --user=ram \
  --namespace=dev \
  --kubeconfig=ram.kubeconfig

kubectl config use-context ram-ctx --kubeconfig=ram.kubeconfig

 kubectl config set-context ram-ctx   --cluster=$CLUSTER   --user=ram   --namespace=dev   --kubeconfig=ram.kubeconfig

kubectl get ns --kubeconfig=ram.kubeconfig

# out put
Error from server (Forbidden): namespaces is forbidden: User "ram" cannot list resource "namespaces" in API group "" at the cluster scope

create role and role binding:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: dev-team-edit 
  namespace: dev
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log", "services", "configmaps"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: dev-team-edit-RoleBinding
  namespace: dev
subjects:
  - kind: Group
    name: /dev-team-edit 
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: dev-team-edit
  apiGroup: rbac.authorization.k8s.io

if user

subjects:
  - kind: User
    name: ram
    apiGroup: rbac.authorization.k8s.io

Verify access

kubectl auth can-i create deployments -n dev --as=ram --as-group=dev-team-edit
kubectl auth can-i list pods        -n dev --as=ram --as-group=dev-team-edit

Task

1. create openssl certifacte
   1. user: dev, qa, admin1
2. deploy csr in k8s cluster
3. create role and rolebinding
   1. dev- read all resources
   2. qa edit access qa namespace
   3. admin1 – provides access dev, qa namespace
4. validate access
   1. deploy app

Next topic cluster role and cluster rolebinding , Helm