June 2021
Intermediate to advanced
335 pages
5h 50m
Chinese
Content preview from Kubernetes编程
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
200
｜
第
8
章
•
自己进行审计。
Kubernetes API
服务器会审计特定字段，但是只是元信息
级别的。对象级别的审计需要由聚合自定义
API
服务器来完成。
•
使用
SubjectAccessReview
请求
Kubernetes API
服务器完成自己的身份认
证逻辑。我们很快会讨论有关授权的更多细节。
8.3.3
委托身份认证和信任机制
聚合自定义
API
服务器（基于
k8s.io/apiserver
）和
Kubernetes API
服务器使
用相同的身份认证库。它可以使用客户端证书或者令牌来对用户进行认证。
由于聚合的自定义
API
服务器在架构上位于
Kubernetes API
服务器之后（也
就是说，
Kubernetes API
服务器会负责接收请求然后再转发给聚合自定义
API
服务器），请求到达自定义
API
服务器时已经被
Kubernetes API
服务器认证
过了。
Kubernetes API
服务器会将身份认证的结果（即用户名和组成员信息）
存储到
HTTP
请求头里，通常是
X-Remote-User
和
X-Remote-Group
（可以通
过
--requestheader-username-headers
和
--requestheader-group-headers
选项来配置它们的名字）。
聚合自定义
API
服务器需要知道何时可以信任这些头，否则任何其他的调
用方都可以假称自己已经完成了身份认证并设置好这些头。这个需求通过
客户端
CA
的特殊请求头来实现。它可以在
kube-system/extension-apiserver- ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.