在K8S v1.8.1中配置RABC

Question

我正在使用Configure RBAC创建用户帐户，一切正常，但在更新上下文之后，在将任何角色与创建的用户绑定之前，apiserver kubectl get pods将返回pods。

apiserver配置

KUBE_API_ADDRESS="--insecure-bind-address=0.0.0.0"
KUBE_API_PORT="--insecure-port=8080"
KUBELET_PORT="--kubelet-port=10250"
KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16"
KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota"
KUBE_API_ARGS="--client-ca-file=/srv/kubernetes/ca.crt --tls-cert-file=/srv/kubernetes/server.crt --tls-private-key-file=/srv/kubernetes/server.key --authorization-mode=RBAC"

kubectl配置

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /srv/kubernetes/ca.crt
    server: http://172.16.3.23:8080
  name: local
contexts:
- context:
    cluster: local
    namespace: kube-system
    user: devops
  name: devops
current-context: devops
kind: Config
preferences: {}
users:
- name: devops
  user:
    client-certificate: /.cert/devops.crt
    client-key: /.cert/devops.key

附言:我正在使用centos裸机环境

Answer 1

不安全端口(http://...:8080)绕过所有身份验证和授权