查看 kubectl config 文件中的权限信息
调试 K8S 问题时,手里往往只有一份 kubeconfig,却不知道当前用户到底有哪些权限。其实证书里就藏着答案——把 client-certificate-data 或 .crt 文件用 OpenSSL 解析一下,就能拿到 Group 和 User,再去集群里查对应的 RoleBinding 即可。
解析证书
把 config 文件中的 client-certificate-data 内容,或者 .crt 文件拿出来,用 OpenSSL 解析:
1 2 3 4 5
| echo "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURJVENDQWdtZ0F3SUJBZ0lJWkVMQmxCUDl4dmN3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TXpBeU1EZ3dOak0xTWpKYUZ3MHlOREF6TURVd016QXdNREZhTURReApGekFWQmdOVkJBb1REbk41YzNSbGJUcHRZWE4wWlhKek1Sa3dGd1lEVlFRREV4QnJkV0psY201bGRHVnpMV0ZrCmJXbHVNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXRubG93TUYxeXVHS1c2R2QKVVp3M09OQ3pqVGcyUDRpbU00SHZlU29ZNFdHRmRMQitnQ2tPSmtCTUpYYU92c2UrYStwOVhMYVJjVUwwN2RWdQo5NUVQYStIUWx3VE5UYVRZRXRtNGFHZHhOMUY5L0pxejZGejVXeUZKSTBnOEVCNDVEVGw1WVhuV0E0YzlXcHBDCmF3Y0N2c0lvK0RoRWowSjFMeFlMTHhDSTVha05pWWdKYlJ5NDhiallSengrdDBoUjJEUjZCRmtibUg4a1Z6NmwKNFduSDRHZGhJRWNhV1g5UUxaQnY1QmNDRDRoN3J0V0J1WFd5NVRtUGViRE1nTC9aQmVERVBUTGFRRUVZSDNkbwpGM1dFcGV5QXFsMHc4UHVzWnllRnpIcUY3c2lzYnZWaFAxN2xhSzNtRmloSDNkVG0rN3RieWNtRnQzTk1RVzZjCmtwbkVrd0lEQVFBQm8xWXdWREFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUgKQXdJd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JRaWN3TzROU2hyeU1ib0VVVUNCTjNVU1RMZgo4akFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBVDF5MEtFa1Y5Sm05aU5TRklpeE5raXRjTFVwamJCS2FOSVNNCjI3T2hLWFZWRXdORzRuaERHanQrZFZNa2RhTTFvVlpqRVg2M09CeFdxYnFZNUhSWnZGZi9PUkpGaXo2cUxlbmIKSlJxMk5zSWswdHdpdTZXeFB5WERHOFcxenEvZHdxcmFQOVFlZGd1SFRQMGgrSHd6TFVzalJFSE9SanNOYzUvawpUbWM4andnN2VSckNUamU2Ym41RlNuam1CU0ZOaGM0TGlFZXllVXVpREViOVI2ZG96U1RrdFZHWEFldnlHT1BzCk1PcWJTRTRsT3FsbnZWcTVFd3J0N3ZhZEdmYzRNRDdCWnFLdzBNdkhPckFnb251T1BnM1UrWDlUODNhQ2NZVkgKcmxKaWdybkowc3ZkYjI2WEhKWDZiU3ZnWFpZb3c2S1pGY1liOTdJQURUVDBma0pNZUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==" | base64 -d | openssl x509 -noout -text
openssl x509 -in cluster.crt -noout -text
|
读取 Subject 字段
OpenSSL 输出的内容里会包含如下一段:
1
| Subject: O=system:masters, CN=kubernetes-admin
|
O= 对应 K8S 里的 Group
CN= 对应 User
拿到这两个值之后,去集群里找对应的 RoleBinding、ClusterRoleBinding、Role 和 ClusterRole,就能拼出完整的权限图谱了。