OpenShift-Project权限管理

环境准备

环境中有两个Project：Project1和Project2。测试需求如下：

普通用户 admin 作为管理员普通用户 p1admin 作为 project1 管理员普通用户 p1dev1 作为 project1 的开发人员，有修改权限普通用户 p1test1 作为 project1 的测试人员，有查看权限
普通用户 p2admin 作为 project2 管理员普通用户 p2dev1 作为 project2 的开发人员，有修改权限普通用户 p2test1 作为 project2 的测试人员，有查看权限

超级管理员登陆

oc login -u system:admin

创建各个用户

htpasswd -b /etc/origin/master/htpasswd admin admin htpasswd -b /etc/origin/master/htpasswd p1admin p1admin htpasswd -b /etc/origin/master/htpasswd p2admin p2admin htpasswd -b /etc/origin/master/htpasswd p1dev1 p1dev1 htpasswd -b /etc/origin/master/htpasswd p1test1 p1test1 htpasswd -b /etc/origin/master/htpasswd p2dev1 p2dev1 htpasswd -b /etc/origin/master/htpasswd p2test1 p2test1
默认情况下，创建账户后，使用 oc login -u \<账户> -p \<口令> 登录后，该账户就可以创建 Project，创建 Project 后，就成为这个 Project 的管理员，具有 admin 角色
如果是多 master 结构，需要在每一个 master 节点上创建同样的账户。

为admin账户授权管理员权限

oadm policy add-cluster-role-to-user admin admin
如果授予 admin cluster-admin 角色，则 admin 为超级管理员。
oadm policy add-cluster-role-to-user cluster-admin admin
cluster-admin 和 admin 角色区别在于 cluster-admin 可以查看和修改 clusterPolicy，二者都可以管理集群中所有 Project
常用的授权命令如下：
（1）在当前 Project 下，列出能对指定资源执行指定操作的用户和组 oadm policy who-can verb resource
（2）在当前 Project 下，把指定的角色和用户绑定起来 oadm policy add-role-to-user role username
（3）在当前 Project 下，删除指定用户的指定角色 oadm policy remove-role-from-user role username
（4）在当前 Project 下，在所有的角色中删除指定的用户 oadm policy remove-user username
（5）在当前 Project 下，把指定的角色和组绑定起来 oadm policy add-role-to-group role groupname
（6）在当前 Project 下，删除指定组的指定角色 oadm policy remove-role-from-group role groupname
（7）在当前 Project 下，在所有的角色中删除指定的组 oadm policy remove-group groupname
（8）在集群中所有 Project 下，把指定的角色和用户绑定起来 oadm policy add-cluster-role-to-user role username
（8）在集群中所有 Project 下，把指定的角色和用户绑定起来 oadm policy add-cluster-role-to-user role username
（10）在集群中所有 Project 下，把指定的角色和组绑定起来 oadm policy add-cluster-role-to-group role groupname
（11）在集群中所有 Project 下，删除指定组的指定角色 oadm policy remove-cluster-role-from-group role groupname

创建各个Project

oc new-project project1
oc new-project project2
./media/image1.png

为project1分配权限

oc project project1
oc policy add-role-to-user admin p1admin
oc policy add-role-to-user edit p1dev1
oc policy add-role-to-user view p1test1

为project2分配权限

oc project project2
oc policy add-role-to-user admin p2admin
oc policy add-role-to-user edit p2dev1
oc policy add-role-to-user view p2test1

一共有多少种 Role？

oc get clusterroles
NAME admin basic-user cluster-admin cluster-debugger cluster-reader cluster-status edit hawkular-metrics-admin management-infra-admin registry-admin registry-editor registry-viewer self-access-reviewer self-provisioner storage-admin sudoer system:auth-delegator system:basic-user system:build-controller system:build-strategy-custom system:build-strategy-docker system:build-strategy-jenkinspipeline system:build-strategy-source system:certificate-signing-controller system:controller:attachdetach-controller system:controller:certificate-controller system:controller:cronjob-controller system:controller:daemon-set-controller system:controller:deployment-controller system:controller:disruption-controller system:controller:endpoint-controller system:controller:generic-garbage-collector system:controller:horizontal-pod-autoscaler system:controller:job-controller system:controller:namespace-controller system:controller:node-controller system:controller:persistent-volume-binder system:controller:pod-garbage-collector system:controller:replicaset-controller system:controller:replication-controller system:controller:resourcequota-controller system:controller:route-controller system:controller:service-account-controller system:controller:service-controller system:controller:statefulset-controller system:controller:ttl-controller system:daemonset-controller system:deployer system:deployment-controller system:deploymentconfig-controller system:discovery system:disruption-controller system:endpoint-controller system:garbage-collector-controller system:gc-controller system:heapster system:hpa-controller system:image-auditor system:image-builder system:image-pruner system:image-puller system:image-pusher system:image-signer system:job-controller system:kube-aggregator system:kube-controller-manager system:kube-dns system:kube-scheduler system:master system:namespace-controller system:node system:node-admin system:node-bootstrapper system:node-problem-detector system:node-proxier system:node-reader system:oauth-token-deleter system:openshift:controller:build-config-change-controller system:openshift:controller:build-controller system:openshift:controller:cluster-quota-reconciliation-controller system:openshift:controller:deployer-controller system:openshift:controller:deployment-trigger-controller system:openshift:controller:deploymentconfig-controller system:openshift:controller:horizontal-pod-autoscaler system:openshift:controller:image-import-controller system:openshift:controller:image-trigger-controller system:openshift:controller:origin-namespace-controller system:openshift:controller:pv-recycler-controller system:openshift:controller:resourcequota-controller system:openshift:controller:sdn-controller system:openshift:controller:service-ingress-ip-controller system:openshift:controller:service-serving-cert-controller system:openshift:controller:serviceaccount-controller system:openshift:controller:serviceaccount-pull-secrets-controller system:openshift:controller:template-instance-controller system:openshift:controller:unidling-controller system:openshift:template-service-broker system:openshift:templateservicebroker-client system:persistent-volume-provisioner system:registry system:replicaset-controller system:replication-controller system:router system:sdn-manager system:sdn-reader system:statefulset-controller system:webhook view

oc get clusterroles

NAME admin basic-user cluster-admin cluster-debugger cluster-reader cluster-status edit hawkular-metrics-admin management-infra-admin registry-admin registry-editor registry-viewer self-access-reviewer self-provisioner storage-admin sudoer system:auth-delegator system:basic-user system:build-controller system:build-strategy-custom system:build-strategy-docker system:build-strategy-jenkinspipeline system:build-strategy-source system:certificate-signing-controller system:controller:attachdetach-controller system:controller:certificate-controller system:controller:cronjob-controller system:controller:daemon-set-controller system:controller:deployment-controller system:controller:disruption-controller system:controller:endpoint-controller system:controller:generic-garbage-collector system:controller:horizontal-pod-autoscaler system:controller:job-controller system:controller:namespace-controller system:controller:node-controller system:controller:persistent-volume-binder system:controller:pod-garbage-collector system:controller:replicaset-controller system:controller:replication-controller system:controller:resourcequota-controller system:controller:route-controller system:controller:service-account-controller system:controller:service-controller system:controller:statefulset-controller system:controller:ttl-controller system:daemonset-controller system:deployer system:deployment-controller system:deploymentconfig-controller system:discovery system:disruption-controller system:endpoint-controller system:garbage-collector-controller system:gc-controller system:heapster system:hpa-controller system:image-auditor system:image-builder system:image-pruner system:image-puller system:image-pusher system:image-signer system:job-controller system:kube-aggregator system:kube-controller-manager system:kube-dns system:kube-scheduler system:master system:namespace-controller system:node system:node-admin system:node-bootstrapper system:node-problem-detector system:node-proxier system:node-reader system:oauth-token-deleter system:openshift:controller:build-config-change-controller system:openshift:controller:build-controller system:openshift:controller:cluster-quota-reconciliation-controller system:openshift:controller:deployer-controller system:openshift:controller:deployment-trigger-controller system:openshift:controller:deploymentconfig-controller system:openshift:controller:horizontal-pod-autoscaler system:openshift:controller:image-import-controller system:openshift:controller:image-trigger-controller system:openshift:controller:origin-namespace-controller system:openshift:controller:pv-recycler-controller system:openshift:controller:resourcequota-controller system:openshift:controller:sdn-controller system:openshift:controller:service-ingress-ip-controller system:openshift:controller:service-serving-cert-controller system:openshift:controller:serviceaccount-controller system:openshift:controller:serviceaccount-pull-secrets-controller system:openshift:controller:template-instance-controller system:openshift:controller:unidling-controller system:openshift:template-service-broker system:openshift:templateservicebroker-client system:persistent-volume-provisioner system:registry system:replicaset-controller system:replication-controller system:router system:sdn-manager system:sdn-reader system:statefulset-controller system:webhook view

查看 view 角色具体能操作哪些资源

oc describe clusterrole view
./media/image2.png

查看 clusterPolicy 拥有的角色

oc get clusterpolicy
./media/image3.png

查看 clusterPolicy default 具体能操作哪些资源

oc describe clusterPolicy default

查看当前/指定 Project 下的角色和用户、组的绑定关系

oc get rolebinding
./media/image4.png

查看集群角色和用户、组的绑定关系

oc get clusterrolebinding