CODEWITHSUNDEEP
authenticationauthorizationkubernetes
Morgan Jones
Morgan Jones

Reputation: 91

What username does the kubernetes kubelet use when contacting the kubernetes API?

So I've been trying to implement ABAC authorization in the kubernetes API, with the following arguments in my kube-api manifest file.

  - --authorization-mode=ABAC
  - --authorization-policy-file=/etc/kubernetes/auth/abac-rules.json

And the following content in the abac-rulse.json file.

{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"*",         "nonResourcePath": "*", "readonly": true}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"admin",     "namespace": "*",              "resource": "*",         "apiGroup": "*"                   }}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"scheduler", "apiGroup": "*", "namespace": "*", "resource": "*", "readonly": false}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"kubelet", "apiGroup": "*",   "namespace": "*", "resource": "*", "readonly": false }}

However, the kubelets can't seem to connect to the api servers. I read that the username is taken from the CN field of the -subject in the certificate used to authenticate the connection, see here. In this case that's the fqdn of the hose, i've tried that too with no luck.

Any ideas what i'm doing wrong?

Cheers in advance

Edit:

I'm using Kubernetes version 1.2.2, both kubectl and hyperkube docker image.

Upvotes: 3

Views: 1240

Answers (1)

Morgan Jones
Morgan Jones

Reputation: 91

Figured out the answer, documenting here for anyone else having the same issue with ABAC.

The kubelet user is define in the worker configuration, which in my case is a yaml file which i store here - /etc/kubernetes/worker-kubeconfig.yaml, the content of which is shown below:

apiVersion: v1
kind: Config
clusters:
- name: default
  cluster:
    server: https://10.96.17.34:8443
    certificate-authority: /etc/kubernetes/ssl/ca.pem
users:
- name: kubelet
  user:
    client-certificate: /etc/kubernetes/ssl/worker.pem
    client-key: /etc/kubernetes/ssl/worker-key.pem
contexts:
- context:
    cluster: default
    user: kubelet
  name: kubelet-context
current-context: kubelet-context

So the user it's connecting with is kubelet.

In my case I had create my certificates with the CN=${MINION_FQDN}, and since this did not match "kubelet" then the ABAC policies weren't met. I regenerated my certifcates with the following arguments and now the nodes authenticate succesfully :) 

# Create worker key
openssl genrsa -out $OUT/${WORKER_HOSTNAME}/worker-key.pem 2048
#Creating Worker CSR...
WORKER_FQDN=${WORKER_FQDN} WORKER_IP=${WORKER_IP} openssl req -new -key $OUT/${WORKER_HOSTNAME}/worker-key.pem -out $OUT/${WORKER_HOSTNAME}/worker.csr -subj "/CN=kubelet" -config $SSL_CONFIG
# Creating Worker Cert
WORKER_FQDN=${WORKER_FQDN} WORKER_IP=${WORKER_IP} openssl x509 -req -in $OUT/${WORKER_HOSTNAME}/worker.csr -CA $CA/ca.pem -CAkey $CA/ca-key.pem -CAcreateserial -out $OUT/${WORKER_HOSTNAME}/worker.pem -days 365 -extensions v3_req -extfile $SSL_CONFIG

The important part of which is this:

-subj "/CN=kubelet"

Hope this helps someone else.

Upvotes: 6

Related Questions