18、Kubernetes准入控制器

[root@node1 ~]# grep 'admission' /etc/kubernetes/manifests/kube-apiserver.yaml 
    - --enable-admission-plugins=NodeRestriction

apiVersion: v1
kind: LimitRange
metadata:
  name: core-resource-limits
spec:
  limits:
  - type: Pod
    max:
      cpu: 2
      memory: 1Gi
    min:
      cpu: 200m
      memory: 6Mi
  - type: Container
    max:
      cpu: 2
      memory: 1Gi
    min:
      cpu: 200m
      memory: 6Mi
    default:  # 如果某一容器在定义时，没有定义请求上限，可以用default定义
      cpu: 300m
      memory: 200Mi
    defaultRequest: # 如果某一容器在定义时，没有定义请求下限，可以用default定义
      cpu: 200m
      memory: 100Mi
    maxLimitRequestRatio: # 上限最多不能是下限的多少倍
      cpu: 10

# 在cce名称空间创建一个limitrange资源，表示这个名称空间的所有Pod或者Container都会受到这个limitrange准入控制器的检测
[root@node1 ~]# cat limitrange.yaml 
apiVersion: v1
kind: Namespace
metadata:
  name: cce
---
apiVersion: v1
kind: LimitRange
metadata:
  name: cpu-limit-range
  namespace: cce
spec:
  limits:
  - type: Container
    default:  # 如果某一容器在定义时，没有定义请求上限，可以用default定义
      cpu: 1000m
    defaultRequest: # 如果某一容器在定义时，没有定义请求下限，可以用default定义
      cpu: 1000m
    min: # 最小下限
      cpu: 500m
    max: # 最大上限
      cpu: 2000m
    maxLimitRequestRatio:  # 允许最大倍数，最大允许max是min的多少倍，如果max和maxLimitRequestRatio同时定义那么就得符合标准，min*maxLimitRequestRatio<=max
      cpu: 4
[root@node1 ~]# kubectl describe limitranges -n cce cpu-limit-range 
Name:       cpu-limit-range
Namespace:  cce
Type        Resource  Min   Max  Default Request  Default Limit  Max Limit/Request Ratio
----        --------  ---   ---  ---------------  -------------  -----------------------
Container   cpu       500m  2    1                1              4

# 创建一个自主式Pod，不定义资源上下限，查看limitrange是否会默认附加预定义的配置
[root@node1 ~]# cat cat pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: test-limit-range
  namespace: cce
spec:
  containers:
  - name: test
    image: ikubernetes/myapp:v1
    imagePullPolicy: IfNotPresent
[root@node1 ~]# 
[root@node1 ~]# cat pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: test-limit-range
  namespace: cce
spec:
  containers:
  - name: test
    image: ikubernetes/myapp:v1
    imagePullPolicy: IfNotPresent
[root@node1 ~]# kubectl apply -f pod.yaml 
pod/test-limit-range created
# 可以看到已经添加了默认值
[root@node1 ~]# kubectl describe pod -n cce test-limit-range |egrep -A 1 '(Limits|Requests)'
    Limits:
      cpu:  1
    Requests:
      cpu:        1

# 假设我们自己定义了资源请求不符合的我们的LimitRange准入控制器的要求就会拒绝
 [root@node1 ~]# cat limitrange2.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: test2-limit-range
  namespace: cce
spec:
  containers:
  - name: test
    image: ikubernetes/myapp:v1
    imagePullPolicy: IfNotPresent
    resources:
      requests:
        cpu: 200m  # 请求CPU不符合我们定义的LimitRange的最小500m
      limits:
        cpu: 300m
# 已经显式拒绝了
[root@node1 ~]# kubectl apply -f limitrange2.yaml 
Error from server (Forbidden): error when creating "limitrange2.yaml": pods "test2-limit-range" is forbidden: minimum cpu usage per Container is 500m, but request is 200m

apiVersion: v1
kind: ResoucreQuota
metadata:
  name: core-object-counts  # 核心资源技术
  namespace: cce # 指定生效的namespace
spec:
  hard: # 硬限制
    configmaps: 10 # configmaps资源不能超过10个
    persistentvolumeclaims: 4 # pvc不能超过4个
    replicationcontrollers: 20 # replicationcontrollers控制器不能超过20个
    secrets: 10 # secrets不能超过10个
    services: 10  # services不能超过10个
---
apiVersion: v1
kind: ResoucreQuota
metadata:
  name: compute-resources # 计算资源限制
  namespace: cce # 指定生效的namespace
spec:
  hard: # 硬限制
    pods: 10 # pod不能超过10个
    requests.cpu: 4 # 所有Pod请求的CPU不能超过4个
    requests.memory: 1Gi # 所有Pod请求的memory不能超过1G
    limits.cpu: 2 # 所有Pod最大使用的CPU总数不能超过2核心
    limits.memory: 2Gi # 所有Pod最大使用的memory总数不能超过2核心

# 创建一个ResourceQuota资源
[root@node1 ~]# vi quota.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-resources # 计算资源限制
  namespace: cce # 指定生效的namespace
spec:
  hard: # 硬限制
    services: 1 # 该名称空间最大之能有一个services
    pods: 1 # pod不能超过10个
    requests.cpu: 1 # 所有Pod请求的CPU不能超过4个
    requests.memory: 1Gi # 所有Pod请求的memory不能超过1G
    limits.cpu: 1 # 所有Pod最大使用的CPU总数不能超过2核心
    limits.memory: 1Gi # 所有Pod最大使用的memory总数不能超过2核心
    count/deployments.apps: 1  # 这个名称空间最多之能有一个apps群组的deployment控制器
    count/deployments.extensions: 1 # 新版本默认使用apps
    persistentvolumeclaims: 2                                                                                                    
[root@node1 ~]# kubectl apply -f !$
kubectl apply -f quota.yaml
# 查看配置
[root@node1 ~]# kubectl describe -n cce resourcequotas compute-resources 
Name:                         compute-resources
Namespace:                    cce
Resource                      Used  Hard
--------                      ----  ----
count/deployments.apps        0     1
count/deployments.extensions  0     1
limits.cpu                    1     1
limits.memory                 0     1Gi
persistentvolumeclaims        0     2
pods                          1     1
requests.cpu                  1     1
requests.memory               0     1Gi
services                      1     1
# 测试资源显示是否生效
[root@node1 ~]# kubectl create service clusterip c1 --tcp=81 -n cce
service/c1 created
# 可以看到已经在namespace级别限制了services的数量
[root@node1 ~]# kubectl create service clusterip c2 --tcp=82 -n cce      
Error from server (Forbidden): services "c2" is forbidden: exceeded quota: compute-resources, requested: services=1, used: services=1, limited: services=1

[root@node1 chapter10]# cat psp-privileged.yaml 
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: privileged
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
spec:
  privileged: true
  allowPrivilegeEscalation: true
  allowedCapabilities:
  - '*'
  volumes:
  - '*'
  hostNetwork: true
  hostPorts:
  - min: 0
    max: 65535
  hostIPC: true
  hostPID: true
  runAsUser:
    rule: 'RunAsAny'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'
[root@node1 chapter10]# cat psp-restricted.yaml 
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  readOnlyRootFilesystem: false