node鉴权机制解析

[llhuii]

根据官方说明https://kubernetes.io/zh/docs/reference/access-authn-authz/node/，node鉴权专门用于认证kubelet。 kubelet 必须使用一个凭证以表示它在 system:nodes 组中，用户名为 system:node:<nodeName>

实际环境

$ openssl x509 -noout -text -in /var/lib/kubelet/pki/kubelet-client-current.pem
Certificate:                                                                                                   
    Data:                                                                                                      
        Version: 3 (0x2)                                                                                       
        Serial Number:                                                                                         
            31:da:70:a0:d8:e7:82:b9:eb:33:f8:9b:42:6b:0f:d5                                                    
        Signature Algorithm: sha256WithRSAEncryption                                                           
        Issuer: CN = kubernetes                                                                                
        Validity                                                                                               
            Not Before: May 29 17:03:08 2021 GMT                                                               
            Not After : May 29 17:03:08 2022 GMT                                                               
        Subject: O = system:nodes, CN = system:node:kind-worker 

证书Organization为system:nodes, Common Name为system:node:kind-worker

代码分析

https://code.k8s.io/plugin/pkg/admission/noderestriction/admission.go

// 获取nodeName，isNode, 判断是否是kubelet的请求
nodeName, isNode := p.nodeIdentifier.NodeIdentity(a.GetUserInfo())

//...
switch a.GetResource().GroupResource() {
case Pod:
     // 只能处理nodeName匹配的pod
     switch a.GetSubresource() {
     case "":  mirror pod 的创建； pod的删除；
     case "status": 状态更新
     case "eviction": 
     }
case node:
     // 只能处理NodeName的node对象， 创建/更新， 查询和删除操作
case pvc:
case svcaccount:
case lease:
case csiNode:

NodeIdentity 由https://code.k8s.io/pkg/auth/nodeidentifier/default.go实现, 从证书的Organization/CN获取到nodeName