Docker : Kubernetes Service Account

bogotobogo.com site search:

Service account, Role, RoleBinding in EKS

Role vs ClusterRole

RBAC is based on declarative permissions definitions and cluster API objects. The main objects are roles and cluster roles, both representing a set of permissions on certain objects in the API.

Role - should work with a namespace
ClusterRole - without namespace and works across all namespaces
Both of the roles set permissions

apiVersion: rbac.authorization.k8s.io/v1
kind: Role

metadata:
  namespace: default
  name: role1

rules:

- apiGroups: ['*']
  resources: ['nodes', 'pods', 'pods/log']
  verbs: ['get', 'list']

- apiGroups: ['*']
  resources: ['configmaps']
  resourceNames: ['my-configmap']
  verbs: ['get', 'list']

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole

metadata:
  namespace: default
  name: clusterRole1

rules:

- apiGroups: ['*']
  resources: ['nodes', 'pods']
  verbs: ['get', 'list']

- nonResourceURLs: ['/api', '/healthz*']
  verbs: ['get', 'head']

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole

metadata:
  name: aggregatedClusterRole1

aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      label1: value1

# The control plane automatically fills in the rules
rules: []

Service account

When a pod is created in the Kubernetes cluster with any given namespace, these pods by default creates a service account with the name default. The default service account automatically creates the service token along with the required secret object.

$ kubectl get sa
NAME                   SECRETS   AGE
consul-consul-client   1         15h
consul-consul-server   1         15h
default                1         23h
vault                  1         15h
vault-agent-injector   1         15h

To see all Service Account regardless of the namespace, we want to add "-A" flag:

$ kubectl get sa -A
NAMESPACE              NAME                                 SECRETS   AGE
default                consul-consul-client                 1         24h
default                consul-consul-server                 1         24h
default                default                              1         32h
default                vault                                1         24h
default                vault-agent-injector                 1         24h
kube-node-lease        default                              1         32h
kube-public            default                              1         32h
kube-system            attachdetach-controller              1         32h
kube-system            bootstrap-signer                     1         32h
kube-system            certificate-controller               1         32h
kube-system            clusterrole-aggregation-controller   1         32h
kube-system            coredns                              1         32h
kube-system            cronjob-controller                   1         32h
kube-system            daemon-set-controller                1         32h
kube-system            default                              1         32h
kube-system            deployment-controller                1         32h
kube-system            disruption-controller                1         32h
kube-system            endpoint-controller                  1         32h
kube-system            endpointslice-controller             1         32h
kube-system            endpointslicemirroring-controller    1         32h
kube-system            expand-controller                    1         32h
kube-system            generic-garbage-collector            1         32h
kube-system            horizontal-pod-autoscaler            1         32h
kube-system            job-controller                       1         32h
kube-system            kube-proxy                           1         32h
kube-system            namespace-controller                 1         32h
kube-system            node-controller                      1         32h
kube-system            persistent-volume-binder             1         32h
kube-system            pod-garbage-collector                1         32h
kube-system            pv-protection-controller             1         32h
kube-system            pvc-protection-controller            1         32h
kube-system            replicaset-controller                1         32h
kube-system            replication-controller               1         32h
kube-system            resourcequota-controller             1         32h
kube-system            service-account-controller           1         32h
kube-system            service-controller                   1         32h
kube-system            statefulset-controller               1         32h
kube-system            storage-provisioner                  1         32h
kube-system            token-cleaner                        1         32h
kube-system            ttl-controller                       1         32h

To see the default secret attached with the default token:

$ kubectl get secret
NAME                               TYPE                                  DATA   AGE
default-token-mdrld                kubernetes.io/service-account-token   3      23h

We will be able to get the name of default token value, default-token-mdrld, and this automatically gets created when any pod is created in the given node namespace.

To view the secret object detail against the default token:

$ kubectl describe secret default-token-mdrld
Name:         default-token-mdrld
Namespace:    default
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: default
              kubernetes.io/service-account.uid: 11caa5d6-eadb-4554-b7be-af05411703f1

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1066 bytes
namespace:  7 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6Il9TM1ZBdzNYSUlQclNfQz
...
XkOPIfHgp-0BYr7wuWaPATj3lc_bHOIBhjozQtJSQRk-fa6L5ca0B_83JEKZ_6LQmxC74aYSOkQ

So, for our application hosted in the pod with the same namespace, this default secret object can be used to give access to the API servers lying in the same cluster namespace.

Role binding

A user. group or a service account to be able to access a resource according to a rule, we need to define bindings between the two, those are RoleBinding and ClusterRoleBinding.

Kubernetes RBAC 101: authorization

RoleBuiding is always created in a specific namespace and ClusterRoleBinding can be associated with either a Role in the same namespace or a ClusterRole.

EKS Sample

# Application Load Balancer (ALB) Ingress Controller Deployment Manifest.
# This manifest details sensible defaults for deploying an ALB Ingress Controller.
# GitHub: https://github.com/kubernetes-sigs/aws-alb-ingress-controller
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: alb-ingress-controller
  name: alb-ingress-controller
  # Namespace the ALB Ingress Controller should run in. Does not impact which
  # namespaces it's able to resolve ingress resource for. For limiting ingress
  # namespace scope, see --watch-namespace.
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: alb-ingress-controller
  template:
    metadata:
      labels:
        app.kubernetes.io/name: alb-ingress-controller
    spec:
      containers:
        - name: alb-ingress-controller
          args:
            ...
          # Repository location of the ALB Ingress Controller.
          image: docker.io/amazon/aws-alb-ingress-controller:v1.1.9
      serviceAccountName: alb-ingress-controller

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/name: alb-ingress-controller
  name: alb-ingress-controller
rules:
  - apiGroups:
      - ""
      - extensions
    resources:
      - configmaps
      - endpoints
      - events
      - ingresses
      - ingresses/status
      - services
      - pods/status
    verbs:
      - create
      - get
      - list
      - update
      - watch
      - patch
  - apiGroups:
      - ""
      - extensions
    resources:
      - nodes
      - pods
      - secrets
      - services
      - namespaces
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/name: alb-ingress-controller
  name: alb-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: alb-ingress-controller
subjects:
  - kind: ServiceAccount
    name: alb-ingress-controller
    namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/name: alb-ingress-controller
  annotations:                                                                        # Add the annotations line
    eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/role-name              # Add the IAM role
  name: alb-ingress-controller
  namespace: kube-system