kubernetesへのユーザ追加〜Context追加まで

Kubernetesではサービスアカウントと、通常のユーザ2種類のユーザがある。
通常のユーザはいくつかの方式で認証されるが、今回は「X509クライアント証明書」による認証をまとめる。

#環境
master1台(centos8)、worker2台(centos8)
version v1.21.3

#証明書作成

```
openssl genrsa -out tuser.key 4096
```

```
openssl req -new -key tuser.key -out tuser.csr -subj "/CN=tuser/O=group1/O=group2"
```

```
cat <<EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: tuser
spec:
  request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJRWR6Q0NBbDhDQVFBd01qRU9NQXdHQTFVRUF3d0ZkSFZ6WlhJeER6QU5CZ05WQkFvTUJtZHliM1Z3TVRFUApNQTBHQTFVRUNnd0daM0p2ZFhBeU1JSUNJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBCnZnY1JYcGs3dVFwbFBVbW9iUThzN3lDMm1Da2ZGRmEwT1NBWEZxalFDUmlPSTkyWXBNVjg5RStneWdPMHNJc3EKNWRueVAyZkRIZm14K2xNaGpMY3E3d3IrWEN1T3k0dXduQnNaVGNPaXhaUDhySFZ1Z2Y0N2xsYk81bzl6bXJZNApxVVJIYlptRGJMVEFmYSt1eEkxYjlUYTUxOFppNTZIa24wTjV4UzkwSW9SaHVSTWxWZVNmWkNlTGp3UUhrQWdpCnJ5N0c3RWcrMzBxUUFCbENkc3AxTTl2YnBCT24zcjhNSDJsU3hPOEpUUzc5K1QxczIvYnFKZDgrYVVDaUdmZDkKV2FDZURiZGpxWk9LcWxJL2FTREJHR05aU0hOOTcvSkZsL1d5VUptdUVLamF4dVhnUmFHSXN5YkR1VzFPNjFLTApVRE1uNHBsYTE2bDYzS2hKUjZBV05IMzJsZ0V4RWJ4M0l0dzE0MTI5WVRPYU5XcnE5d3h6b21vMjBXeFYyUVRoCnFCMHhsdU50dDVKUS9DV0tlM3RQTEt4VlAvRm80QWtIeS9YK3psMUUyS1dHSkk3R2V1ZTlTSGRrNjk4VlFQTGUKV0FOTHM1OEpsU2QrM2sxbHV1dUFqWFhEaFBZbEhEZTlLT2ZzaW44M2dSRmFHMFdmcWNtUDRsTmdxb2RMcXNKbwpHYTIycERQK1ZndGo3cXE0NVVSNlFmUS9rQ1ZuVFR2Sk9yU21NZURSNTJGMmJkREJWMitiMWs0QVdZNTJBRzBSCk8zblV6eVpmdVdvd095YjFyRHlHTThDdnZFQXlVc3RMUEQ3WVQwSU5yRDNQTlZSUEdBd25zWnlvMThWN1htYmkKc3pYMDduTHdpUkl0MlZYdkRkL28waFlQRTRXNWF3c1JWalJUYmszVnZHVUNBd0VBQWFBQU1BMEdDU3FHU0liMwpEUUVCQ3dVQUE0SUNBUUFxYk1tRnJ0Z0JFNVl2Tk5EVWkxSDhKaG1ubVZjL2cwUGxrcDFoaVZKbmx6ZmNIRktMClFCVmlEOUlneGhOZXJvOWJlRVhSQWxYSkx0MGpkNHJRRjZWdUNET1M0VnlLSUFlK29YMW1RNmtVOWR0UUhUc3EKZHBYcEVFNmRYdUZqSWNEdGV0MWhrOXVCNDJVSXFKZEpUQ240ZmZvQ0UzL2lZNGRmWWt0eS9iVkVTSWtYczY2TQovQU84VHc5R1B0ZW9OaEFENmk1bDFPU2Fnd21SK3ZQWEhlR09sTG9XUFR0WU50djNWT3c2WkhmaEhVZXJqVE5FCnpISkZUVmpWdUpxZDNVeEI4aHliQ3hTYnBvSTRCM2hUZmNHRTRHMU90Nmg0WkV3bXJDd2xXaWptTTNyelVQOFQKSkQ4dmxXbXVnMFhrRDJYUG9lTTFvdHRzd1MzcFZ6NHp2V1EzR1VDREhDclQwTDdKTkxmRmR4MEJhemRIVTdERwpyUlMzWml2d1BIb1VKWlpXa2RYbE1TQThtZERIZ090akhzN2hpRU5mT0hSNGZCZnVoTUNjZUxla2xJM0NBall6CmNFc280b0xkdmZvRDRoUEthNHg1WFRja1lSTHdFaWlmd0FvS0MzNGVpZFhtcDFDK2lyU0ptQVdSeTJBdDI2TkYKenV4Wlc2NEhGWmZMeS90d05iT29TVndJQnVmQk96cHNRZ0syTFlXVkdBbGN1SERtYWx3dCtpS2trTEJsYUxveAplQ0Z2MEk0RG9vQWRBbGRBTXBvRnlrNEVvSXFDVFg5akZJV1BSYzdOQkY2bldJWERGUnN5TnpNVGpLUE5UcVVOCnFPQ1l0RVlONWZ5UnlNaHJDVFEzWStaV04rU1Y0T3drOFU0RkdlVTZCYU1Canp6ZHhLWjNzM3ZFYmc9PQotLS0tLUVORCBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0K
  signerName: kubernetes.io/kube-apiserver-client
  #expirationSeconds: 86400000  # 1.21では対応していなかったためコメントアウト
  usages:
  - client auth
EOF
```
>Note: The spec.expirationSeconds field was added in Kubernetes v1.22. Earlier versions of Kubernetes do not honor this field. Kubernetes API servers prior to v1.22 will silently drop this field when the object is created.


```
kubectl certificate approve tuser
```

#Context作成

```
kubectl config set-credentials tuser --client-certificate=tuser.crt --client-key=tuser.key

# クラスタは既存のものを利用
kubectl config set-context tuser-context --cluster=cluster.local --user=tuser
```

#確認
1.clusterroleのviewをバインド

```
kubectl create clusterrolebinding view-all-resources-tuser --clusterrole=view --user=tuser
```
2.use-contextを実行し、kubectlコマンドがtuserで叩けるようになっていることを確認

```
$ kubectl config use-context tuser-context 
Switched to context "tuser-context".
$ kubectl get po
NAME                            READY   STATUS      RESTARTS   AGE
kube-bench-dbxlm                0/1     Completed   0          8d
nginx                           0/1     Shutdown    0          13d
nginx-deploy-6799fc88d8-fdwnf   1/1     Running     6          11d
nginx-deploy-6799fc88d8-ztnr2   1/1     Running     6          11d
$ kubectl auth can-i create pod
no
$ kubectl run nginx --image=nginx
Error from server (Forbidden): pods is forbidden: User "tuser" cannot create resource "pods" in API group "" in the namespace "default"
```

#参考
https://kubernetes.io/ja/docs/reference/access-authn-authz/authentication/

https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/

https://kubernetes.io/ja/docs/tasks/access-application-cluster/configure-access-multiple-clusters/