Kubernetes Dashboard 보안 접속

$ kubectl apply -f \
https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml

#설치 확인
$ kubectl get po -A
....
kubernetes-dashboard   dashboard-metrics-scraper-5657497c4c-wczp4   1/1     Running   0          20m
kubernetes-dashboard   kubernetes-dashboard-78f87ddfc-ml2x2         1/1     Running   0          21m

$ kubectl describe clusterrole cluster-amdim
#아래와 같이 권한이 되어있음 *.* -> admin-user에게 주는 방법으로 진행 예정
Name:         cluster-admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  *.*        []                 []              [*]
             [*]                []              [*]

$ mkdir dashboard_rbac && cd $_

#admin-user 관련 YAML 파일 생성
$ vi dashboard-admin-user.yaml

#vi dashboard-admin-user.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard

$ vi ClusterRoleBinding-admin-user.yml

#vi ClusterRoleBinding-admin-user.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

#admin-user 등록
$ kubectl apply -f dashboard-admin-user.yaml
serviceaccount/admin-user created

$ kubectl apply -f ClusterRoleBinding-admin-user.yml
clusterrolebinding.rbac.authorization.k8s.io/admin-user created

#등록 확인
$ kubectl -n kubernetes-dashboard get sa

#접속토큰 발행
$ kubectl -n kubernetes-dashboard create token admin-user
#토큰은 브라우저 접속시 필요

# APIserver를 이용한 보안 접근을 위해 *.crt와 *.key 생성
$ grep 'client-certificate-data' ~/.kube/config | head -n \
1 | awk '{print $2}' | base64 -d >> kubecfg.crt

$ grep 'client-key-data' ~/.kube/config | head -n 1 | awk \
'{print $2}' | base64 -d >> kubecfg.key

#생성한 키를 기반으로 p12인증서 발행
$openssl pkcs12 -export -clcerts -inkey kubecfg.key -in \
kubecfg.crt -out kubecfg.p12 -name "kubernetes-admin"
Enter Export Password: (패스워드)
Verifying - Enter Export Password: (패스워드)
#윈도우에 인증서 등록시 필요

#ca 인증서 복사
$ sudo cp /etc/kubernetes/pki/ca.crt ./

#ca.crt 와 kubecfg.p12 윈도우로 복사

#p12 인증서 맥에서 등록 안됨 아래의 순서대로 진행 후 접속하면 접속 가능

#맥 설정
$ openssl pkcs12 -in kubecfg.p12 -clcerts -nokeys -out kubecfg.cer
#생성시 위에 입력했던 패스워드 입력

#열리지 않으면 anonymous 등록
#dashboard-anonymous.yaml, ClusterRoleBinding-anonymous.yml
vi dashboard-anonymous.yaml

#vi dashboard-anonymous.yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubernetes-dashboard-anonymous
rules:
- apiGroups: [""]
  resources: ["services/proxy"]
  resourceNames: ["https:kubernetes-dashboard:"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- nonResourceURLs: ["/ui", "/ui/*", "/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/*"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

$ vi ClusterRoleBinding-anonymous.yml

#vi ClusterRoleBinding-anonymous.yml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubernetes-dashboard-anonymous
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubernetes-dashboard-anonymous
subjects:
- kind: User
  name: system:anonymous

$ kubectl apply -f dashboard-anonymous.yaml

$ kubectl apply -f ClusterRoleBinding-anonymous.yml

#ca.crt 와 kubercfg.cer 맥으로 복사
#복사한곳에서 터미널을 열어 아래의 명령어 입력
$ sudo security add-trusted-cert -d -r trustRoot \
 -k "/Library/Keychains/System.keychain" ca.crt
#kubercfg.cer는 더블클릭 하여 keychain에 등록

복사한 폴더\> certutil.exe -addstore "Root" ca.crt

복사한 폴더\> certutil.exe -p k8spass# -user -importPFX kubecfg.p12
#Alert 창뜨면 확인

복사한 폴더\> certmgr.msc
#등록 되었는지 확인

https://[마스터노드IP]:6443/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/#/workloads?namespace=default

$ kubectl -n kubernetes-dashboard edit deployments kubernetes-dashboard

spec:
  containers:
    - args:
    - --auto-generate-certificates
    - --token-ttl=0  # 세션초과 비활성화 추가
    - --namespace=kubernetes-dashboard