流程

1. 创建一个包含令牌期间选项的配置文件。以下文件将此周期设为 48 小时，两倍于默认值。

   apiVersion: config.openshift.io/v1
   kind: OAuth
   metadata:
     name: cluster
   spec:
     tokenConfig:
       accessTokenMaxAgeSeconds: 172800 1

   1

   设置 accessTokenMaxAgeSeconds 以控制访问令牌的生命周期。默认生命周期为 24 小时或 86400 秒。此属性不可为负数。如果设置为零，则使用默认的生命周期。

2. 应用新配置文件：

   注意

   由于您更新现有的 OAuth 服务器，因此必须使用 oc apply 命令来应用更改。

   $ oc apply -f </path/to/file.yaml>

3. 确认更改已生效：

   $ oc describe oauth.config.openshift.io/cluster

   输出示例

   ...
   Spec:
     Token Config:
       Access Token Max Age Seconds:  172800
   ...

流程

1. 更新 OAuth 配置，以设置令牌不活跃超时。

   1. 编辑 OAuth 对象：

      $ oc edit oauth cluster

      添加 spec.tokenConfig.accessTokenInactivityTimeout 字段并设置超时值：

      apiVersion: config.openshift.io/v1
      kind: OAuth
      metadata:
      ...
      spec:
        tokenConfig:
          accessTokenInactivityTimeout: 400s 1

      1

      设定有适当单位的值，例如 400s 代表 400 秒，或 30m 代表 30 分钟。允许的超时最小值为 300s。

   2. 保存文件以使改变生效。

2. 检查 OAuth 服务器 pod 是否已重启：

   $ oc get clusteroperators authentication

   在 PROGRESSING 列为 False 前不要继续进入下一步，如下所示：

   输出示例

   NAME             VERSION   AVAILABLE   PROGRESSING   DEGRADED   SINCE
   authentication   4.10.0    True        False         False      145m

3. 检查是否已推出 Kubernetes API 服务器 pod 的新修订版本。这需要几分钟时间。

   $ oc get clusteroperators kube-apiserver

   在 PROGRESSING 列为 False 前不要继续进入下一步，如下所示：

   输出示例

   NAME             VERSION   AVAILABLE   PROGRESSING   DEGRADED   SINCE
   kube-apiserver   4.10.0     True        False         False      145m

   如果 PROGRESSING 显示为 True，请等待几分钟后再试一次。

验证

1. 使用来自您的 IDP 的身份登录到集群。
2. 执行命令并确认它是否成功。
3. 等待的时间比配置的超时时间长而无需使用身份。在这个示例中，等待的时间超过 400 秒。

4. 尝试从同一身份的会话中执行命令。

   这个命令会失败，因为令牌应该因为不活跃的时间超过配置的超时时间而过期。

   输出示例

   error: You must be logged in to the server (Unauthorized)

流程

1. 编辑集群 Ingress 配置：

   $ oc edit ingress.config.openshift.io cluster

2. 设置自定义主机名以及可选的服务证书和密钥：

   apiVersion: config.openshift.io/v1
   kind: Ingress
   metadata:
     name: cluster
   spec:
     componentRoutes:
       - name: oauth-openshift
         namespace: openshift-authentication
         hostname: <custom_hostname> 1
         servingCertKeyPairSecret:
           name: <secret_name> 2

   1

   自定义主机名.

   2

   对 openshift-config 命名空间中的 secret 的引用，该 secret 包含 TLS 证书 (tls.crt) 和密钥 (tls.key)。如果自定义主机名后缀的域与集群域后缀不匹配，则需要此项。如果后缀匹配，secret 是可选的。

3. 保存文件以使改变生效。

1. <namespace_route> 是指命名空间路由。运行以下命令可以找到：

   $ oc get route oauth-openshift -n openshift-authentication -o json | jq .spec.host

验证

1. 使用来自您的 IDP 的身份登录到集群。确保使用您刚才配置的 OAuth 客户端。
2. 执行操作并验证它是否成功。
3. 等待的时间比配置的超时时间长而无需使用身份。在这个示例中，等待会超过 600 秒。

4. 尝试从同一身份的会话中执行一个操作。

   这个尝试会失败，因为令牌应该因为不活跃的时间超过配置的超时时间而过期。

1. 创建一个 htpasswd 文件来存储 用户和密码信息。
2. 创建一个 secret 来代表 htpasswd 文件。
3. 定义一个htpasswd 身份提供程序资源用于引用该 secret。
4. 将资源应用到 默认的 OAuth 配置，以添加身份提供程序。

1. 选中集群范围的“allow”规则。
2. 选中本地绑定的“allow”规则。
3. 默认为拒绝。

流程

1. 查看集群角色及其关联的规则集：

   $ oc describe clusterrole.rbac

   输出示例

   Name:         admin
   Labels:       kubernetes.io/bootstrapping=rbac-defaults
   Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
   PolicyRule:
     Resources                                                  Non-Resource URLs  Resource Names  Verbs
     ---------                                                  -----------------  --------------  -----
     .packages.apps.redhat.com                                  []                 []              [* create update patch delete get list watch]
     imagestreams                                               []                 []              [create delete deletecollection get list patch update watch create get list watch]
     imagestreams.image.openshift.io                            []                 []              [create delete deletecollection get list patch update watch create get list watch]
     secrets                                                    []                 []              [create delete deletecollection get list patch update watch get list watch create delete deletecollection patch update]
     buildconfigs/webhooks                                      []                 []              [create delete deletecollection get list patch update watch get list watch]
     buildconfigs                                               []                 []              [create delete deletecollection get list patch update watch get list watch]
     buildlogs                                                  []                 []              [create delete deletecollection get list patch update watch get list watch]
     deploymentconfigs/scale                                    []                 []              [create delete deletecollection get list patch update watch get list watch]
     deploymentconfigs                                          []                 []              [create delete deletecollection get list patch update watch get list watch]
     imagestreamimages                                          []                 []              [create delete deletecollection get list patch update watch get list watch]
     imagestreammappings                                        []                 []              [create delete deletecollection get list patch update watch get list watch]
     imagestreamtags                                            []                 []              [create delete deletecollection get list patch update watch get list watch]
     processedtemplates                                         []                 []              [create delete deletecollection get list patch update watch get list watch]
     routes                                                     []                 []              [create delete deletecollection get list patch update watch get list watch]
     templateconfigs                                            []                 []              [create delete deletecollection get list patch update watch get list watch]
     templateinstances                                          []                 []              [create delete deletecollection get list patch update watch get list watch]
     templates                                                  []                 []              [create delete deletecollection get list patch update watch get list watch]
     deploymentconfigs.apps.openshift.io/scale                  []                 []              [create delete deletecollection get list patch update watch get list watch]
     deploymentconfigs.apps.openshift.io                        []                 []              [create delete deletecollection get list patch update watch get list watch]
     buildconfigs.build.openshift.io/webhooks                   []                 []              [create delete deletecollection get list patch update watch get list watch]
     buildconfigs.build.openshift.io                            []                 []              [create delete deletecollection get list patch update watch get list watch]
     buildlogs.build.openshift.io                               []                 []              [create delete deletecollection get list patch update watch get list watch]
     imagestreamimages.image.openshift.io                       []                 []              [create delete deletecollection get list patch update watch get list watch]
     imagestreammappings.image.openshift.io                     []                 []              [create delete deletecollection get list patch update watch get list watch]
     imagestreamtags.image.openshift.io                         []                 []              [create delete deletecollection get list patch update watch get list watch]
     routes.route.openshift.io                                  []                 []              [create delete deletecollection get list patch update watch get list watch]
     processedtemplates.template.openshift.io                   []                 []              [create delete deletecollection get list patch update watch get list watch]
     templateconfigs.template.openshift.io                      []                 []              [create delete deletecollection get list patch update watch get list watch]
     templateinstances.template.openshift.io                    []                 []              [create delete deletecollection get list patch update watch get list watch]
     templates.template.openshift.io                            []                 []              [create delete deletecollection get list patch update watch get list watch]
     serviceaccounts                                            []                 []              [create delete deletecollection get list patch update watch impersonate create delete deletecollection patch update get list watch]
     imagestreams/secrets                                       []                 []              [create delete deletecollection get list patch update watch]
     rolebindings                                               []                 []              [create delete deletecollection get list patch update watch]
     roles                                                      []                 []              [create delete deletecollection get list patch update watch]
     rolebindings.authorization.openshift.io                    []                 []              [create delete deletecollection get list patch update watch]
     roles.authorization.openshift.io                           []                 []              [create delete deletecollection get list patch update watch]
     imagestreams.image.openshift.io/secrets                    []                 []              [create delete deletecollection get list patch update watch]
     rolebindings.rbac.authorization.k8s.io                     []                 []              [create delete deletecollection get list patch update watch]
     roles.rbac.authorization.k8s.io                            []                 []              [create delete deletecollection get list patch update watch]
     networkpolicies.extensions                                 []                 []              [create delete deletecollection patch update create delete deletecollection get list patch update watch get list watch]
     networkpolicies.networking.k8s.io                          []                 []              [create delete deletecollection patch update create delete deletecollection get list patch update watch get list watch]
     configmaps                                                 []                 []              [create delete deletecollection patch update get list watch]
     endpoints                                                  []                 []              [create delete deletecollection patch update get list watch]
     persistentvolumeclaims                                     []                 []              [create delete deletecollection patch update get list watch]
     pods                                                       []                 []              [create delete deletecollection patch update get list watch]
     replicationcontrollers/scale                               []                 []              [create delete deletecollection patch update get list watch]
     replicationcontrollers                                     []                 []              [create delete deletecollection patch update get list watch]
     services                                                   []                 []              [create delete deletecollection patch update get list watch]
     daemonsets.apps                                            []                 []              [create delete deletecollection patch update get list watch]
     deployments.apps/scale                                     []                 []              [create delete deletecollection patch update get list watch]
     deployments.apps                                           []                 []              [create delete deletecollection patch update get list watch]
     replicasets.apps/scale                                     []                 []              [create delete deletecollection patch update get list watch]
     replicasets.apps                                           []                 []              [create delete deletecollection patch update get list watch]
     statefulsets.apps/scale                                    []                 []              [create delete deletecollection patch update get list watch]
     statefulsets.apps                                          []                 []              [create delete deletecollection patch update get list watch]
     horizontalpodautoscalers.autoscaling                       []                 []              [create delete deletecollection patch update get list watch]
     cronjobs.batch                                             []                 []              [create delete deletecollection patch update get list watch]
     jobs.batch                                                 []                 []              [create delete deletecollection patch update get list watch]
     daemonsets.extensions                                      []                 []              [create delete deletecollection patch update get list watch]
     deployments.extensions/scale                               []                 []              [create delete deletecollection patch update get list watch]
     deployments.extensions                                     []                 []              [create delete deletecollection patch update get list watch]
     ingresses.extensions                                       []                 []              [create delete deletecollection patch update get list watch]
     replicasets.extensions/scale                               []                 []              [create delete deletecollection patch update get list watch]
     replicasets.extensions                                     []                 []              [create delete deletecollection patch update get list watch]
     replicationcontrollers.extensions/scale                    []                 []              [create delete deletecollection patch update get list watch]
     poddisruptionbudgets.policy                                []                 []              [create delete deletecollection patch update get list watch]
     deployments.apps/rollback                                  []                 []              [create delete deletecollection patch update]
     deployments.extensions/rollback                            []                 []              [create delete deletecollection patch update]
     catalogsources.operators.coreos.com                        []                 []              [create update patch delete get list watch]
     clusterserviceversions.operators.coreos.com                []                 []              [create update patch delete get list watch]
     installplans.operators.coreos.com                          []                 []              [create update patch delete get list watch]
     packagemanifests.operators.coreos.com                      []                 []              [create update patch delete get list watch]
     subscriptions.operators.coreos.com                         []                 []              [create update patch delete get list watch]
     buildconfigs/instantiate                                   []                 []              [create]
     buildconfigs/instantiatebinary                             []                 []              [create]
     builds/clone                                               []                 []              [create]
     deploymentconfigrollbacks                                  []                 []              [create]
     deploymentconfigs/instantiate                              []                 []              [create]
     deploymentconfigs/rollback                                 []                 []              [create]
     imagestreamimports                                         []                 []              [create]
     localresourceaccessreviews                                 []                 []              [create]
     localsubjectaccessreviews                                  []                 []              [create]
     podsecuritypolicyreviews                                   []                 []              [create]
     podsecuritypolicyselfsubjectreviews                        []                 []              [create]
     podsecuritypolicysubjectreviews                            []                 []              [create]
     resourceaccessreviews                                      []                 []              [create]
     routes/custom-host                                         []                 []              [create]
     subjectaccessreviews                                       []                 []              [create]
     subjectrulesreviews                                        []                 []              [create]
     deploymentconfigrollbacks.apps.openshift.io                []                 []              [create]
     deploymentconfigs.apps.openshift.io/instantiate            []                 []              [create]
     deploymentconfigs.apps.openshift.io/rollback               []                 []              [create]
     localsubjectaccessreviews.authorization.k8s.io             []                 []              [create]
     localresourceaccessreviews.authorization.openshift.io      []                 []              [create]
     localsubjectaccessreviews.authorization.openshift.io       []                 []              [create]
     resourceaccessreviews.authorization.openshift.io           []                 []              [create]
     subjectaccessreviews.authorization.openshift.io            []                 []              [create]
     subjectrulesreviews.authorization.openshift.io             []                 []              [create]
     buildconfigs.build.openshift.io/instantiate                []                 []              [create]
     buildconfigs.build.openshift.io/instantiatebinary          []                 []              [create]
     builds.build.openshift.io/clone                            []                 []              [create]
     imagestreamimports.image.openshift.io                      []                 []              [create]
     routes.route.openshift.io/custom-host                      []                 []              [create]
     podsecuritypolicyreviews.security.openshift.io             []                 []              [create]
     podsecuritypolicyselfsubjectreviews.security.openshift.io  []                 []              [create]
     podsecuritypolicysubjectreviews.security.openshift.io      []                 []              [create]
     jenkins.build.openshift.io                                 []                 []              [edit view view admin edit view]
     builds                                                     []                 []              [get create delete deletecollection get list patch update watch get list watch]
     builds.build.openshift.io                                  []                 []              [get create delete deletecollection get list patch update watch get list watch]
     projects                                                   []                 []              [get delete get delete get patch update]
     projects.project.openshift.io                              []                 []              [get delete get delete get patch update]
     namespaces                                                 []                 []              [get get list watch]
     pods/attach                                                []                 []              [get list watch create delete deletecollection patch update]
     pods/exec                                                  []                 []              [get list watch create delete deletecollection patch update]
     pods/portforward                                           []                 []              [get list watch create delete deletecollection patch update]
     pods/proxy                                                 []                 []              [get list watch create delete deletecollection patch update]
     services/proxy                                             []                 []              [get list watch create delete deletecollection patch update]
     routes/status                                              []                 []              [get list watch update]
     routes.route.openshift.io/status                           []                 []              [get list watch update]
     appliedclusterresourcequotas                               []                 []              [get list watch]
     bindings                                                   []                 []              [get list watch]
     builds/log                                                 []                 []              [get list watch]
     deploymentconfigs/log                                      []                 []              [get list watch]
     deploymentconfigs/status                                   []                 []              [get list watch]
     events                                                     []                 []              [get list watch]
     imagestreams/status                                        []                 []              [get list watch]
     limitranges                                                []                 []              [get list watch]
     namespaces/status                                          []                 []              [get list watch]
     pods/log                                                   []                 []              [get list watch]
     pods/status                                                []                 []              [get list watch]
     replicationcontrollers/status                              []                 []              [get list watch]
     resourcequotas/status                                      []                 []              [get list watch]
     resourcequotas                                             []                 []              [get list watch]
     resourcequotausages                                        []                 []              [get list watch]
     rolebindingrestrictions                                    []                 []              [get list watch]
     deploymentconfigs.apps.openshift.io/log                    []                 []              [get list watch]
     deploymentconfigs.apps.openshift.io/status                 []                 []              [get list watch]
     controllerrevisions.apps                                   []                 []              [get list watch]
     rolebindingrestrictions.authorization.openshift.io         []                 []              [get list watch]
     builds.build.openshift.io/log                              []                 []              [get list watch]
     imagestreams.image.openshift.io/status                     []                 []              [get list watch]
     appliedclusterresourcequotas.quota.openshift.io            []                 []              [get list watch]
     imagestreams/layers                                        []                 []              [get update get]
     imagestreams.image.openshift.io/layers                     []                 []              [get update get]
     builds/details                                             []                 []              [update]
     builds.build.openshift.io/details                          []                 []              [update]
   
   
   Name:         basic-user
   Labels:       <none>
   Annotations:  openshift.io/description: A user that can get basic information about projects.
   	              rbac.authorization.kubernetes.io/autoupdate: true
   PolicyRule:
   	Resources                                           Non-Resource URLs  Resource Names  Verbs
   	  ---------                                           -----------------  --------------  -----
   	  selfsubjectrulesreviews                             []                 []              [create]
   	  selfsubjectaccessreviews.authorization.k8s.io       []                 []              [create]
   	  selfsubjectrulesreviews.authorization.openshift.io  []                 []              [create]
   	  clusterroles.rbac.authorization.k8s.io              []                 []              [get list watch]
   	  clusterroles                                        []                 []              [get list]
   	  clusterroles.authorization.openshift.io             []                 []              [get list]
   	  storageclasses.storage.k8s.io                       []                 []              [get list]
   	  users                                               []                 [~]             [get]
   	  users.user.openshift.io                             []                 [~]             [get]
   	  projects                                            []                 []              [list watch]
   	  projects.project.openshift.io                       []                 []              [list watch]
   	  projectrequests                                     []                 []              [list]
   	  projectrequests.project.openshift.io                []                 []              [list]
   
   Name:         cluster-admin
   Labels:       kubernetes.io/bootstrapping=rbac-defaults
   Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
   PolicyRule:
   Resources  Non-Resource URLs  Resource Names  Verbs
   ---------  -----------------  --------------  -----
   *.*        []                 []              [*]
              [*]                []              [*]
   
   ...

2. 查看当前的集群角色绑定集合，这显示绑定到不同角色的用户和组：

   $ oc describe clusterrolebinding.rbac

   输出示例

   Name:         alertmanager-main
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  alertmanager-main
   Subjects:
     Kind            Name               Namespace
     ----            ----               ---------
     ServiceAccount  alertmanager-main  openshift-monitoring
   
   
   Name:         basic-users
   Labels:       <none>
   Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
   Role:
     Kind:  ClusterRole
     Name:  basic-user
   Subjects:
     Kind   Name                  Namespace
     ----   ----                  ---------
     Group  system:authenticated
   
   
   Name:         cloud-credential-operator-rolebinding
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  cloud-credential-operator-role
   Subjects:
     Kind            Name     Namespace
     ----            ----     ---------
     ServiceAccount  default  openshift-cloud-credential-operator
   
   
   Name:         cluster-admin
   Labels:       kubernetes.io/bootstrapping=rbac-defaults
   Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
   Role:
     Kind:  ClusterRole
     Name:  cluster-admin
   Subjects:
     Kind   Name            Namespace
     ----   ----            ---------
     Group  system:masters
   
   
   Name:         cluster-admins
   Labels:       <none>
   Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
   Role:
     Kind:  ClusterRole
     Name:  cluster-admin
   Subjects:
     Kind   Name                   Namespace
     ----   ----                   ---------
     Group  system:cluster-admins
     User   system:admin
   
   
   Name:         cluster-api-manager-rolebinding
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  cluster-api-manager-role
   Subjects:
     Kind            Name     Namespace
     ----            ----     ---------
     ServiceAccount  default  openshift-machine-api
   
   ...

流程

1. 查看当前本地角色绑定集合，这显示绑定到当前项目的不同角色的用户和组：

   $ oc describe rolebinding.rbac

2. 要查其他项目的本地角色绑定，请向命令中添加 -n 标志：

   $ oc describe rolebinding.rbac -n joe-project

   输出示例

   Name:         admin
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  admin
   Subjects:
     Kind  Name        Namespace
     ----  ----        ---------
     User  kube:admin
   
   
   Name:         system:deployers
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows deploymentconfigs in this namespace to rollout pods in
                   this namespace.  It is auto-managed by a controller; remove
                   subjects to disa...
   Role:
     Kind:  ClusterRole
     Name:  system:deployer
   Subjects:
     Kind            Name      Namespace
     ----            ----      ---------
     ServiceAccount  deployer  joe-project
   
   
   Name:         system:image-builders
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows builds in this namespace to push images to this
                   namespace.  It is auto-managed by a controller; remove subjects
                   to disable.
   Role:
     Kind:  ClusterRole
     Name:  system:image-builder
   Subjects:
     Kind            Name     Namespace
     ----            ----     ---------
     ServiceAccount  builder  joe-project
   
   
   Name:         system:image-pullers
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows all pods in this namespace to pull images from this
                   namespace.  It is auto-managed by a controller; remove subjects
                   to disable.
   Role:
     Kind:  ClusterRole
     Name:  system:image-puller
   Subjects:
     Kind   Name                                Namespace
     ----   ----                                ---------
     Group  system:serviceaccounts:joe-project

流程

1. 向指定项目中的用户添加角色：

   $ oc adm policy add-role-to-user <role> <user> -n <project>

   例如，您可以运行以下命令，将 admin 角色添加到 joe 项目中的 alice 用户：

   $ oc adm policy add-role-to-user admin alice -n joe

   提示

   您还可以应用以下 YAML 向用户添加角色：

   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     name: admin-0
     namespace: joe
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: admin
   subjects:
   - apiGroup: rbac.authorization.k8s.io
     kind: User
     name: alice

2. 查看本地角色绑定，并在输出中验证添加情况：

   $ oc describe rolebinding.rbac -n <project>

   例如，查看 joe 项目的本地角色绑定：

   $ oc describe rolebinding.rbac -n joe

   输出示例

   Name:         admin
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  admin
   Subjects:
     Kind  Name        Namespace
     ----  ----        ---------
     User  kube:admin
   
   
   Name:         admin-0
   Labels:       <none>
   Annotations:  <none>
   Role:
     Kind:  ClusterRole
     Name:  admin
   Subjects:
     Kind  Name   Namespace
     ----  ----   ---------
     User  alice 1
   
   
   Name:         system:deployers
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows deploymentconfigs in this namespace to rollout pods in
                   this namespace.  It is auto-managed by a controller; remove
                   subjects to disa...
   Role:
     Kind:  ClusterRole
     Name:  system:deployer
   Subjects:
     Kind            Name      Namespace
     ----            ----      ---------
     ServiceAccount  deployer  joe
   
   
   Name:         system:image-builders
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows builds in this namespace to push images to this
                   namespace.  It is auto-managed by a controller; remove subjects
                   to disable.
   Role:
     Kind:  ClusterRole
     Name:  system:image-builder
   Subjects:
     Kind            Name     Namespace
     ----            ----     ---------
     ServiceAccount  builder  joe
   
   
   Name:         system:image-pullers
   Labels:       <none>
   Annotations:  openshift.io/description:
                   Allows all pods in this namespace to pull images from this
                   namespace.  It is auto-managed by a controller; remove subjects
                   to disable.
   Role:
     Kind:  ClusterRole
     Name:  system:image-puller
   Subjects:
     Kind   Name                                Namespace
     ----   ----                                ---------
     Group  system:serviceaccounts:joe

   1

   alice 用户已添加到 admins RoleBinding。

流程

1. 要为项目创建本地角色，请运行以下命令：

   $ oc create role <name> --verb=<verb> --resource=<resource> -n <project>

   在此命令中，指定：

   • <name>，本地角色的名称
   • <verb>，以逗号分隔的、应用到角色的操作动词列表
   • <resource>，角色应用到的资源
   • <project>，项目名称

   例如，要创建一个本地角色来允许用户查看 blue 项目中的 Pod，请运行以下命令：

   $ oc create role podview --verb=get --resource=pod -n blue

2. 要将新角色绑定到用户，运行以下命令：

   $ oc adm policy add-role-to-user podview user2 --role-namespace=blue -n blue

流程

1. 要创建集群角色，请运行以下命令：

   $ oc create clusterrole <name> --verb=<verb> --resource=<resource>

   在此命令中，指定：

   • <name>，本地角色的名称
   • <verb>，以逗号分隔的、应用到角色的操作动词列表
   • <resource>，角色应用到的资源

   例如，要创建一个集群角色来允许用户查看 Pod，请运行以下命令：

   $ oc create clusterrole podviewonly --verb=get --resource=pod

流程

1. 可选：查看当前项目中的服务帐户：

   $ oc get sa

   输出示例

   NAME       SECRETS   AGE
   builder    2         2d
   default    2         2d
   deployer   2         2d

2. 在当前项目中创建新服务帐户：

   $ oc create sa <service_account_name> 1

   1

   要在另一项目中创建服务帐户，请指定 -n <project_name>。

   输出示例

   serviceaccount "robot" created

   提示

   您还可以应用以下 YAML 来创建服务帐户：

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: <service_account_name>
     namespace: <current_project>

3. 可选：查看服务帐户的 secret ：

   $ oc describe sa robot

   输出示例

   Name:		robot
   Namespace:	project1
   Labels:		<none>
   Annotations:	<none>
   
   Image pull secrets:	robot-dockercfg-qzbhb
   
   Mountable secrets: 	robot-token-f4khf
                      	robot-dockercfg-qzbhb
   
   Tokens:            	robot-token-f4khf
                      	robot-token-z8h44

流程

1. 可选：查看当前项目中的服务帐户：

   $ oc get sa

   输出示例

   NAME       SECRETS   AGE
   builder    2         2d
   default    2         2d
   deployer   2         2d

2. 在当前项目中创建新服务帐户：

   $ oc create sa <service_account_name> 1

   1

   要在另一项目中创建服务帐户，请指定 -n <project_name>。

   输出示例

   serviceaccount "robot" created

   提示

   您还可以应用以下 YAML 来创建服务帐户：

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: <service_account_name>
     namespace: <current_project>

3. 可选：查看服务帐户的 secret ：

   $ oc describe sa robot

   输出示例

   Name:		robot
   Namespace:	project1
   Labels:		<none>
   Annotations:	<none>
   
   Image pull secrets:	robot-dockercfg-qzbhb
   
   Mountable secrets: 	robot-token-f4khf
                      	robot-dockercfg-qzbhb
   
   Tokens:            	robot-token-f4khf
                      	robot-token-z8h44

流程

1. 查看服务帐户的 API 令牌：

   $ oc describe secret <secret_name>

   例如：

   $ oc describe secret robot-token-uzkbh -n top-secret

   输出示例

   Name:		robot-token-uzkbh
   Labels:		<none>
   Annotations:	kubernetes.io/service-account.name=robot,kubernetes.io/service-account.uid=49f19e2e-16c6-11e5-afdc-3c970e4b7ffe
   
   Type:	kubernetes.io/service-account-token
   
   Data
   
   token:	eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

2. 使用您获取的令牌进行登录：

   $ oc login --token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

   输出示例

   Logged into "https://server:8443" as "system:serviceaccount:top-secret:robot" using the token provided.
   
   You don't have any projects. You can try to create a new project, by running
   
       $ oc new-project <projectname>

3. 确认您已经以服务帐户登录：

   $ oc whoami

   输出示例

   system:serviceaccount:top-secret:robot

流程

1. 可选：设置服务帐户签发者。

   如果绑定令牌仅在集群中使用，则通常不需要这一步。

   重要

   如果您将服务帐户签发者改为一个自定义的账户，则以前的服务帐户签发者仍可在下一个 24 小时内被信任。

   您可以通过手动重启集群中的所有 pod 或执行滚动节点重启来强制所有拥有者请求新的绑定令牌。在执行任一操作前，等待 Kubernetes API 服务器 pod 的新修订版本来向您的服务帐户签发者更改。

   1. 编辑 cluster Authentication 对象：

      $ oc edit authentications cluster

   2. 将 spec.serviceAccountIssuer 字段设置为所需的服务帐户签发者：

      spec:
        serviceAccountIssuer: https://test.default.svc 1

      1

      这个值应该是 URL，通过这个 URL，绑定令牌的接收方可以从中查找验证令牌签名所需的公钥。默认为 https://kubernetes.default.svc。

   3. 保存文件以使改变生效。

   4. 等待 Kubernetes API 服务器 pod 的新修订版本推出。所有节点更新至新修订版本可能需要几分钟时间。运行以下命令:

      $ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="NodeInstallerProgressing")]}{.reason}{"\n"}{.message}{"\n"}'

      查看 Kubernetes API 服务器的 NodeInstallerProgressing 状态条件，以验证所有节点是否处于最新的修订版本。在更新成功后，输出会显示 AllNodesAtLatestRevision：

      AllNodesAtLatestRevision
      3 nodes are at revision 12 1

      1

      在本例中，最新的修订版本号为 12。

      如果输出显示的信息类似于以下消息之一，则更新仍在进行中。等待几分钟后重试。

      • 3 nodes are at revision 11; 0 nodes have achieved new revision 12
      • 2 nodes are at revision 11; 1 nodes are at revision 12

   5. 可选：强制拥有者通过执行滚动节点重启或重启集群中的所有 pod 来请求新的绑定令牌。

      • 执行滚动节点重启：

        警告

        如果您已在集群上运行自定义工作负载，则不建议执行滚动节点重启，因为它可能会导致服务中断。相反，手动重启集群中的所有 pod。

        按顺序重启节点。等待节点完全可用，然后重启下一个节点。有关如何排空、重启并将节点标记为可以调度的说明，请参阅正常重启节点。

      • 手动重启集群中的所有 pod:

        警告

        此命令会导致服务中断，因为它将删除每个命名空间中运行的所有 pod。这些 Pod 会在删除后自动重启。

        运行以下命令:

        $ for I in $(oc get ns -o jsonpath='{range .items[*]} {.metadata.name}{"\n"} {end}'); \
              do oc delete pods --all -n $I; \
              sleep 1; \
              done

2. 使用卷投影将 pod 配置为使用绑定服务帐户令牌。

   1. 创建名为 pod-projected-svc-token.yaml 的文件，其内容如下：

      apiVersion: v1
      kind: Pod
      metadata:
        name: nginx
      spec:
        containers:
        - image: nginx
          name: nginx
          volumeMounts:
          - mountPath: /var/run/secrets/tokens
            name: vault-token
        serviceAccountName: build-robot 1
        volumes:
        - name: vault-token
          projected:
            sources:
            - serviceAccountToken:
                path: vault-token 2
                expirationSeconds: 7200 3
                audience: vault 4

      1

      对现有服务帐户的引用。

      2

      相对于文件挂载点的相对路径，用于将令牌放入。

      3

      （可选）设置服务帐户令牌的到期时间（以秒为单位）。默认为 3600 秒（1 小时），且必须至少为 600 秒（10 分钟）。如果令牌使用的时间超过这个值的 80%，或者超过 24 小时，则 kubelet 会开始尝试轮转令牌。

      4

      （可选）设置令牌的预期使用者。令牌的接收者应验证接收者身份是否与令牌的使用声明匹配，否则应拒绝令牌。使用者默认为 API 服务器的标识符。

   2. 创建 pod：

      $ oc create -f pod-projected-svc-token.yaml

      Kubelet 代表 pod 请求并存储令牌，使 pod 可以在一个可配置的文件路径中获得令牌，并在该令牌接近到期时刷新令牌。

3. 使用绑定令牌的应用程序需要在令牌轮转时重新载入令牌。

   如果令牌使用的时间超过这个值的 80%，或者超过 24 小时，则 kubelet 会轮转令牌。

1. RunAsUser 策略为 MustRunAsRange 且未设置最小或最大值。准入查找 openshift.io/sa.scc.uid-range 注解来填充范围字段。
2. SELinuxContext 策略为 MustRunAs 且未设定级别。准入查找 openshift.io/sa.scc.mcs 注解来填充级别。
3. FSGroup 策略为 MustRunAs。准入查找 openshift.io/sa.scc.supplemental-groups 注解。
4. SupplementalGroups 策略为 MustRunAs。准入查找 openshift.io/sa.scc.supplemental-groups 注解。

1. RunAsAny 和 MustRunAsNonRoot 策略不提供默认值。如果 Pod 需要参数值，如组 ID，您必须在 Pod 规格中定义这个值。
2. MustRunAs（单值）策略提供始终使用的默认值。例如，对于组 ID，即使 Pod 规格定义了自己的 ID 值，命名空间的默认参数值也会出现在 Pod 的组中。
3. MustRunAsRange 和 MustRunAs （基于范围）策略提供范围的最小值。与单值 MustRunAs 策略一样，命名空间的默认参数值出现在运行的 Pod 中。如果基于范围的策略可以配置多个范围，它会提供配置的第一个范围的最小值。

流程

1. 在名为 scc_admin.yaml 的 YAML 文件中定义 SCC：

   SecurityContextConstraints 对象定义

   kind: SecurityContextConstraints
   apiVersion: security.openshift.io/v1
   metadata:
     name: scc-admin
   allowPrivilegedContainer: true
   runAsUser:
     type: RunAsAny
   seLinuxContext:
     type: RunAsAny
   fsGroup:
     type: RunAsAny
   supplementalGroups:
     type: RunAsAny
   users:
   - my-admin-user
   groups:
   - my-admin-group

   另外，您可以通过将 requiredDropCapabilities 字段设为所需的值来丢弃 SCC 的特定功能。所有指定的功能都会从容器中丢弃。要丢弃所有的能力，请指定 ALL。例如，要创建一个丢弃 KILL、MKNOD 和 SYS_CHROOT 功能的 SCC，请将以下内容添加到 SCC 对象中：

   requiredDropCapabilities:
   - KILL
   - MKNOD
   - SYS_CHROOT

   注意

   您不能列出 allowedCapabilities 和 requiredDropCapabilities 中的功能。

   CRI-O 支持 Docker 文档中找到的相同功能值列表。

2. 通过传递文件来创建 SCC：

   $ oc create -f scc_admin.yaml

   输出示例

   securitycontextconstraints "scc-admin" created

流程

1. 创建一个在其中运行 cron 任务的项目：

   $ oc new-project ldap-sync 1

   1

   此流程使用名为 ldap-sync 的项目。

2. 找到您在配置 LDAP 身份提供程序时创建的 secret 和配置映射，并将它们复制到此新项目。

   secret 和配置映射存在于 openshift-config 项目中，必须复制到新的 ldap-sync 项目中。

3. 定义服务帐户：

   ldap-sync-service-account.yaml示例

   kind: ServiceAccount
   apiVersion: v1
   metadata:
     name: ldap-group-syncer
     namespace: ldap-sync

4. 创建服务帐户：

   $ oc create -f ldap-sync-service-account.yaml

5. 定义集群角色：

   ldap-sync-cluster-role.yaml示例

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: ldap-group-syncer
   rules:
     - apiGroups:
         - ''
         - user.openshift.io
       resources:
         - groups
       verbs:
         - get
         - list
         - create
         - update

6. 创建集群角色：

   $ oc create -f ldap-sync-cluster-role.yaml

7. 定义集群角色绑定将集群角色绑定绑定到服务帐户：

   ldap-sync-cluster-role-binding.yaml 示例

   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: ldap-group-syncer
   subjects:
     - kind: ServiceAccount
       name: ldap-group-syncer              1
       namespace: ldap-sync
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: ldap-group-syncer                2

   1

   对此过程前面创建的服务帐户的引用。

   2

   引用此流程前面创建的集群角色。

8. 创建集群角色绑定：

   $ oc create -f ldap-sync-cluster-role-binding.yaml

9. 定义指定同步配置文件的配置映射：

   ldap-sync-config-map.yaml 示例

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: ldap-group-syncer
     namespace: ldap-sync
   data:
     sync.yaml: |                                 1
       kind: LDAPSyncConfig
       apiVersion: v1
       url: ldaps://10.0.0.0:389                  2
       insecure: false
       bindDN: cn=admin,dc=example,dc=com         3
       bindPassword:
         file: "/etc/secrets/bindPassword"
       ca: /etc/ldap-ca/ca.crt
       rfc2307:                                   4
         groupsQuery:
           baseDN: "ou=groups,dc=example,dc=com"  5
           scope: sub
           filter: "(objectClass=groupOfMembers)"
           derefAliases: never
           pageSize: 0
         groupUIDAttribute: dn
         groupNameAttributes: [ cn ]
         groupMembershipAttributes: [ member ]
         usersQuery:
           baseDN: "ou=users,dc=example,dc=com"   6
           scope: sub
           derefAliases: never
           pageSize: 0
         userUIDAttribute: dn
         userNameAttributes: [ uid ]
         tolerateMemberNotFoundErrors: false
         tolerateMemberOutOfScopeErrors: false

   1

   定义同步配置文件。

   2

   指定 URL。

   3

   指定 bindDN。

   4

   本例使用 RFC2307 模式；根据需要调整值。您还可以使用不同的架构。

   5

   为 groupsQuery 指定 baseDN。

   6

   为 usersQuery 指定 baseDN。

10. 创建配置映射：

    $ oc create -f ldap-sync-config-map.yaml

11. 定义 cron 作业：

    ldap-sync-cron-job.yaml 示例

    kind: CronJob
    apiVersion: batch/v1
    metadata:
      name: ldap-group-syncer
      namespace: ldap-sync
    spec:                                                                                1
      schedule: "*/30 * * * *"                                                           2
      concurrencyPolicy: Forbid
      jobTemplate:
        spec:
          backoffLimit: 0
          ttlSecondsAfterFinished: 1800                                                  3
          template:
            spec:
              containers:
                - name: ldap-group-sync
                  image: "registry.redhat.io/openshift4/ose-cli:latest"
                  command:
                    - "/bin/bash"
                    - "-c"
                    - "oc adm groups sync --sync-config=/etc/config/sync.yaml --confirm" 4
                  volumeMounts:
                    - mountPath: "/etc/config"
                      name: "ldap-sync-volume"
                    - mountPath: "/etc/secrets"
                      name: "ldap-bind-password"
                    - mountPath: "/etc/ldap-ca"
                      name: "ldap-ca"
              volumes:
                - name: "ldap-sync-volume"
                  configMap:
                    name: "ldap-group-syncer"
                - name: "ldap-bind-password"
                  secret:
                    secretName: "ldap-secret"                                            5
                - name: "ldap-ca"
                  configMap:
                    name: "ca-config-map"                                                6
              restartPolicy: "Never"
              terminationGracePeriodSeconds: 30
              activeDeadlineSeconds: 500
              dnsPolicy: "ClusterFirst"
              serviceAccountName: "ldap-group-syncer"

    1

    配置 cron 作业的设置。有关 cron 作业设置的更多信息，请参阅"创建 cron 作业"。

    2

    以 cron 格式指定的作业计划。这个示例 cron 作业每 30 分钟运行一次。根据需要调整频率，确保考虑到同步运行所需的时间。

    3

    维护完成的作业的时间（以秒为单位）。这应该与作业调度的期限匹配，以便清理旧的失败作业并防止不必要的警报。如需更多信息，请参阅 Kubernetes 文档中的 TTL-after-finished Controller。

    4

    运行 cron 作业的 LDAP sync 命令。传递配置映射中定义的同步配置文件。

    5

    此 secret 是在配置 LDAP IDP 时创建的。

    6

    此配置映射是在配置 LDAP IDP 时创建的。

12. 创建 cron job：

    $ oc create -f ldap-sync-cron-job.yaml