TKE Authenticator 组件实践指南

k8s-tke-v1.<base64 编码的 JSON>

{
  "clusterId": "cls-*****",
  "header": {
    "Authorization": [
      "TC3-HMAC-SHA256 Credential=AKID*****/2024-09-03/sts/tc3_request, SignedHeaders=content-type;host;x-tc-action;x-tc-tke-clusterid, Signature=*****"
    ],
    "Content-Type": ["application/json; charset=utf-8"],
    "Host": ["sts.internal.tencentcloudapi.com"],
    "X-TC-Action": ["GetCallerIdentity"],
    "X-TC-TKE-ClusterID": ["cls-*****"],
    "X-TC-Timestamp": ["1725332268"],
    "X-TC-Token": ["*****"],
    "X-TC-Version": ["2018-08-13"]
  }
}

tke-cam-tool exec-cred token --cluster-id <CLUSTER_ID> [FLAGS...]

{
  "kind": "ExecCredential",
  "apiVersion": "client.authentication.k8s.io/v1beta1",
  "spec": { "interactive": false },
  "status": {
    "expirationTimestamp": "2024-10-12T09:18:05Z",
    "token": "k8s-tke-v1.<base64 编码内容>"
  }
}

tke-cam-tool exec-cred kubeconfig --cluster-id <CLUSTER_ID> --region <REGION> [FLAGS...]

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: BASE64_PEM_ENCODED_CA_CERTIFICATE
    server: API_SERVER_ADDRESS
  name: <CLUSTER_ID>                   # 自动生成，值为集群 ID
contexts:
- context:
    cluster: <CLUSTER_ID>
    user: <CLUSTER_ID>-exec-cred-plugin
  name: <CLUSTER_ID>-exec-cred-plugin-context  # 自动生成
current-context: <CLUSTER_ID>-exec-cred-plugin-context
kind: Config
preferences: {}
users:
- name: <CLUSTER_ID>-exec-cred-plugin  # 自动生成
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
      - exec-cred
      - token
      - --cluster-id
      - <CLUSTER_ID>
      - --profile
      - default
      command: tke-cam-tool
      env: null
      interactiveMode: Never
      provideClusterInfo: false

apiVersion: authenticator.tke.cloud.tencent.com/v1
kind: CAMIdentityMapping
metadata:
  name: <MAPPING_NAME>              # 自定义资源名称，例如：my-sub-account-mapping
spec:
  arn: <CAM_IDENTITY_ARN>        # CAM 身份 ARN，例如：qcs::cam::uin/100000000001:uin/100000000002
  username: <K8S_USERNAME>         # 自定义 Kubernetes 用户名，例如：my-user
  groups:                             # 映射后的 Kubernetes 用户组（可选）
    - <GROUP_1>                     # 自定义用户组名称，例如：dev-team
    - <GROUP_2>                    # 自定义用户组名称，例如：read-only

apiVersion: authenticator.tke.cloud.tencent.com/v1
kind: CAMIdentityMapping
metadata:
  name: <MAPPING_NAME>              # 自定义资源名称，例如：my-sub-account-mapping
spec:
  arn: qcs::cam::uin/<ROOT_ACCOUNT_ID>:uin/<SUB_ACCOUNT_ID>
  username: <K8S_USERNAME>           # 自定义 Kubernetes 用户名，例如：my-user
  groups:
    - read-group                  # 自定义用户组名称
    - write-group                  # 自定义用户组名称
    - {{CAMUserGroupIDs}}

apiVersion: authenticator.tke.cloud.tencent.com/v1
kind: CAMIdentityMapping
metadata:
  name: <MAPPING_NAME>              # 自定义资源名称，例如：account-id-mapping
spec:
  arn: qcs::cam::uin/<ROOT_ACCOUNT_ID>:uin/<SUB_ACCOUNT_ID>
  username: {{AccountID}}

apiVersion: authenticator.tke.cloud.tencent.com/v1
kind: CAMIdentityMapping
metadata:
  name: <MAPPING_NAME>              # 自定义资源名称，例如：cam-group-mapping
spec:
  arn: qcs::cam::uin/<ROOT_ACCOUNT_ID>:uin/<SUB_ACCOUNT_ID>
  username: <K8S_USERNAME>           # 自定义 Kubernetes 用户名，例如：my-user
  groups:
    - cam-group-{{CAMUserGroupIDs}}

go install git.woa.com/tke/tke-cam-tool@latest

export TENCENTCLOUD_SECRET_ID=<YOUR_SECRET_ID>
export TENCENTCLOUD_SECRET_KEY=<YOUR_SECRET_KEY>

apiVersion: authenticator.tke.cloud.tencent.com/v1
kind: CAMIdentityMapping
metadata:
  name: <MAPPING_NAME>               # 自定义资源名称，例如：my-cam-mapping
spec:
  arn: qcs::cam::uin/<ROOT_ACCOUNT_ID>:uin/<SUB_ACCOUNT_ID>
  username: <K8S_USERNAME>            # 自定义 Kubernetes 用户名，例如：my-user，后续 RBAC 绑定需与此一致

apiVersion: authenticator.tke.cloud.tencent.com/v1
kind: CAMIdentityMapping
metadata:
  name: <MAPPING_NAME>               # 自定义资源名称，例如：my-cam-mapping
spec:
  arn: qcs::cam::uin/<ROOT_ACCOUNT_ID>:role/<ROLE_ID>
  username: <K8S_USERNAME>            # 自定义 Kubernetes 用户名，例如：my-user，后续 RBAC 绑定需与此一致

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: <CLUSTER_ROLE_NAME>           # 自定义 ClusterRole 名称，例如：pod-reader
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: <BINDING_NAME>               # 自定义 ClusterRoleBinding 名称，例如：my-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: <CLUSTER_ROLE_NAME>           # 引用上面创建的 ClusterRole 名称
subjects:
  - kind: User
    apiGroup: rbac.authorization.k8s.io
    name: <K8S_USERNAME>              # 与 CAMIdentityMapping 中的 username 保持一致，例如：my-user

export CLUSTER_ID=<YOUR_CLUSTER_ID>    # 例如：cls-xxxxxxxx
export REGION=<YOUR_REGION>            # 例如：ap-guangzhou

tke-cam-tool exec-cred kubeconfig \\
  --cluster-id ${CLUSTER_ID} \\
  --region ${REGION} \\
  -o ${CLUSTER_ID}.kubeconfig

tke-cam-tool exec-cred kubeconfig \\
  --cluster-id ${CLUSTER_ID} \\
  --region ${REGION} \\
  --profile default \\
  --token-profile default \\
  --role qcs::cam::uin/<ROOT_ACCOUNT_ID>:roleName/<ROLE_NAME> \\  # 替换为实际的主账号 ID 和角色名称
  -o ${CLUSTER_ID}.kubeconfig

# 可以读取 pods（已授权）
kubectl --kubeconfig ${CLUSTER_ID}.kubeconfig get pod

# 无法读取 deployments（未授权）
kubectl --kubeconfig ${CLUSTER_ID}.kubeconfig get deployment
# Error from server (Forbidden): deployments.apps is forbidden: User "<K8S_USERNAME>" cannot list resource "deployments" in API group "apps" in the namespace "default"

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: <CLUSTER_ROLE_NAME>           # 自定义 ClusterRole 名称，例如：pod-reader
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: <BINDING_NAME>               # 自定义 ClusterRoleBinding 名称，例如：cam-group-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: <CLUSTER_ROLE_NAME>           # 引用上面创建的 ClusterRole 名称
subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: <CAM_USER_GROUP_ID>       # 替换为 CAM 用户组 ID，例如：12345

# ${KUBECONFIG_PATH} 替换为实际的 kubeconfig 文件路径
# 验证可以读取 pods（用户组已授权）
kubectl --kubeconfig ${KUBECONFIG_PATH} get pods

# 验证无法执行未授权操作
kubectl --kubeconfig ${KUBECONFIG_PATH} delete pod some-pod
# 预期：返回 Forbidden 错误

# 开发团队 - 可以读写 dev 命名空间
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: <BINDING_NAME>               # 自定义 RoleBinding 名称，例如：dev-team-binding
  namespace: dev
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: edit                          # Kubernetes 内置的 ClusterRole
subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: <DEV_GROUP_ID>            # 替换为开发团队 CAM 用户组 ID，例如：56789
---
# 运维团队 - 集群管理员权限
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: <BINDING_NAME>               # 自定义 ClusterRoleBinding 名称，例如：ops-team-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin                 # Kubernetes 内置的 ClusterRole
subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: <OPS_GROUP_ID>            # 替换为运维团队 CAM 用户组 ID，例如：67890