Service Account Token Volume Projection

2020年09月16日 9137点热度 1人点赞 0条评论

用于自动化的为一个容器申请jwt token，并关联到此容器上，可以代表该容器身份。kubelet负责申请，挂载，以及更新该token。

要实现该功能需要：

k8s 版本v1.12以上

kube-apiserver 中启用如下flag，具体key文件位置，以及audiences要根据实际情况配置

--service-account-issuer=kubernetes.default.svc \
--api-audiences=api,istio-ca \
--service-account-key-file=/srv/kubernetes/server.key \
--service-account-signing-key-file=/srv/kubernetes/server.key

--service-account-issuer=kubernetes.default.svc \

--api-audiences=api,istio-ca \

--service-account-key-file=/srv/kubernetes/server.key \

--service-account-signing-key-file=/srv/kubernetes/server.key

pod里的容器spec定义需要包含如下volumemount以及volumes定义，注意volumes定义使用的是serviceAccountToken （projectedVolume类型）

    volumeMounts:
    - mountPath: /var/run/secrets/tokens
      name: istio-token


  volumes:
  - name: istio-token
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          audience: istio-ca
          expirationSeconds: 43200
          path: istio-token

volumeMounts:

- mountPath: /var/run/secrets/tokens

name: istio-token

volumes:

- name: istio-token

projected:

defaultMode: 420

sources:

- serviceAccountToken:

audience: istio-ca

expirationSeconds: 43200

path: istio-token

这样当此pod启动，kubelet利用相应的信息申请并注入jwt到容器里（上面例子中挂到/var/run/secrets/tokens目录下）

可以查看对应容器中的token文件：

[root@am-primary aspenmesh-1.6.5-am1]# kubectl exec -it aspen-mesh-metrics-collector-6cfd7bbc7c-tkrbp -c istio-proxy -n istio-system -- cat /var/run/secrets/tokens/istio-token
eyJhbGciOiJSUzI1NiIsImtpZCI6Iks3eG5DSFF3M0tqN2hRMFAySmVYblQtd1haUExJTlBGMkpDM1doQmZBencifQ.eyJhdWQiOlsiaXN0aW8tY2EiXSwiZXhwIjoxNjAwMjg2MzEyLCJpYXQiOjE2MDAyNDMxMTIsImlzcyI6Imt1YmVybmV0ZXMuZGVmYXVsdC5zdmMiLCJrdWJlcm5ldGVzLmlvIjp7Im5hbWVzcGFjZSI6ImlzdGlvLXN5c3RlbSIsInBvZCI6eyJuYW1lIjoiYXNwZW4tbWVzaC1tZXRyaWNzLWNvbGxlY3Rvci02Y2ZkN2JiYzdjLXRrcmJwIiwidWlkIjoiZDcxYzU1OTktZmE0Ny00ZDNjLWJhMmMtMzVmNjYwMTdjZDZiIn0sInNlcnZpY2VhY2NvdW50Ijp7Im5hbWUiOiJhc3Blbi1tZXNoLW1ldHJpY3MtY29sbGVjdG9yIiwidWlkIjoiZDJmYzJjMGQtYjk2Yi00Nzc3LTlkMTctNjdmMWM1ODM0NmJjIn19LCJuYmYiOjE2MDAyNDMxMTIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDppc3Rpby1zeXN0ZW06YXNwZW4tbWVzaC1tZXRyaWNzLWNvbGxlY3RvciJ9.Pdm1vstGFuAxr8DVamOQ37b8NJWb968dVmT7xr1HP1s8V4lN1eMYUr02piHpxKsSPGrQVybuA21ZnvGdhbol77qnuD_O_CezCYNjIlGDT8ugcS7-5dsulFAyZB4wIoq26K4KIprQvO4dFG8TPekgd5Zm1pGs2IVGArOySyrVq3QlOCn8Cu8V2GumhTQLY6TMmjoUopsWoYCON2uNAfkCEpXllA2_0BiEdQ9Rn2Ka-eli7DmWuoZB2QGSIUb5DS6_I_LsO0NyPVEYq7V-uH120KRXIaJOb8USCvgbGlFLqrpeIA2fkrwbmxB2-XRt2eX_e7eSHBCT1Xi_ubhEq4jJTg

[root@am-primary aspenmesh-1.6.5-am1]# kubectl exec -it aspen-mesh-metrics-collector-6cfd7bbc7c-tkrbp -c istio-proxy -n istio-system -- cat /var/run/secrets/tokens/istio-token

eyJhbGciOiJSUzI1NiIsImtpZCI6Iks3eG5DSFF3M0tqN2hRMFAySmVYblQtd1haUExJTlBGMkpDM1doQmZBencifQ.eyJhdWQiOlsiaXN0aW8tY2EiXSwiZXhwIjoxNjAwMjg2MzEyLCJpYXQiOjE2MDAyNDMxMTIsImlzcyI6Imt1YmVybmV0ZXMuZGVmYXVsdC5zdmMiLCJrdWJlcm5ldGVzLmlvIjp7Im5hbWVzcGFjZSI6ImlzdGlvLXN5c3RlbSIsInBvZCI6eyJuYW1lIjoiYXNwZW4tbWVzaC1tZXRyaWNzLWNvbGxlY3Rvci02Y2ZkN2JiYzdjLXRrcmJwIiwidWlkIjoiZDcxYzU1OTktZmE0Ny00ZDNjLWJhMmMtMzVmNjYwMTdjZDZiIn0sInNlcnZpY2VhY2NvdW50Ijp7Im5hbWUiOiJhc3Blbi1tZXNoLW1ldHJpY3MtY29sbGVjdG9yIiwidWlkIjoiZDJmYzJjMGQtYjk2Yi00Nzc3LTlkMTctNjdmMWM1ODM0NmJjIn19LCJuYmYiOjE2MDAyNDMxMTIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDppc3Rpby1zeXN0ZW06YXNwZW4tbWVzaC1tZXRyaWNzLWNvbGxlY3RvciJ9.Pdm1vstGFuAxr8DVamOQ37b8NJWb968dVmT7xr1HP1s8V4lN1eMYUr02piHpxKsSPGrQVybuA21ZnvGdhbol77qnuD_O_CezCYNjIlGDT8ugcS7-5dsulFAyZB4wIoq26K4KIprQvO4dFG8TPekgd5Zm1pGs2IVGArOySyrVq3QlOCn8Cu8V2GumhTQLY6TMmjoUopsWoYCON2uNAfkCEpXllA2_0BiEdQ9Rn2Ka-eli7DmWuoZB2QGSIUb5DS6_I_LsO0NyPVEYq7V-uH120KRXIaJOb8USCvgbGlFLqrpeIA2fkrwbmxB2-XRt2eX_e7eSHBCT1Xi_ubhEq4jJTg

这个token，通过jwt.io解开，可以看到payload是

{
  "aud": [
    "istio-ca"
  ],
  "exp": 1600286312,
  "iat": 1600243112,
  "iss": "kubernetes.default.svc",
  "kubernetes.io": {
    "namespace": "istio-system",
    "pod": {
      "name": "aspen-mesh-metrics-collector-6cfd7bbc7c-tkrbp",
      "uid": "d71c5599-fa47-4d3c-ba2c-35f66017cd6b"
    },
    "serviceaccount": {
      "name": "aspen-mesh-metrics-collector",
      "uid": "d2fc2c0d-b96b-4777-9d17-67f1c58346bc"
    }
  },
  "nbf": 1600243112,
  "sub": "system:serviceaccount:istio-system:aspen-mesh-metrics-collector"
}

{

"aud": [

"istio-ca"

"exp": 1600286312,

"iat": 1600243112,

"iss": "kubernetes.default.svc",

"kubernetes.io": {

"namespace": "istio-system",

"pod": {

"name": "aspen-mesh-metrics-collector-6cfd7bbc7c-tkrbp",

"uid": "d71c5599-fa47-4d3c-ba2c-35f66017cd6b"

"serviceaccount": {

"name": "aspen-mesh-metrics-collector",

"uid": "d2fc2c0d-b96b-4777-9d17-67f1c58346bc"

}

"nbf": 1600243112,

"sub": "system:serviceaccount:istio-system:aspen-mesh-metrics-collector"

}

该pod的sa是aspen-mesh-metrics-collector，audiences是istio-ca，是可以通过api-server的核查的（api-server的audience配置中包含了istio-ca）

容器内的应用可以直接使用该token与其它service（容器）通信，其它容器收到该jwt后对其进行验证（如果jwt是k8s系统平台自己签发的，则验证也通过k8s的tokenreview api来进行）

参考：

https://jpweber.io/blog/a-look-at-tokenrequest-api/#:~:text=service%2Daccount%2Dsigning%2Dkey%2Dfile%3A%20Path%20to,tokens%20with%20this%20private%20key.&text=The%20service%20account%20token%20authenticator,least%20one%20of%20these%20audiences.

https://github.com/jpweber/tokenrequest-demo

https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection