imduffy15/k8s-gke-service-account-assigner

k8s-gke-service-account-assigner

为运行在Kubernetes集群中的容器提供基于注解的Google服务账户令牌，解决多租户环境下容器共享节点服务账户权限的问题。灵感来源于并基于https://github.com/jtblin/kube2iam%E5%BC%80%E5%8F%91%E3%80%82

背景

服务账户附加在实例上，容器通过Google实例元数据API透明获取临时凭证以调用Google服务。但在多租户容器环境中，多个容器共享节点时会获得相同的服务账户凭证，存在权限过度暴露风险。

核心功能

1. 基于Pod注解分配指定的Google服务账户和作用域
2. 支持默认服务账户和作用域作为fallback
3. 通过命名空间注解限制Pod可使用的服务账户
4. 自动添加iptables规则拦截元数据API流量
5. 提供调试端点和详细日志选项

使用场景

• GKE集群中多租户应用需要隔离Google云服务权限
• 容器需不同Google服务账户权限访问特定云资源
• 需限制Pod对Google云资源的访问范围

配置说明

前提条件

1. 创建具有roles/iam.serviceAccountTokenCreator角色的服务账户，用于生成其他账户的令牌
2. GKE集群需启用https://www.googleapis.com/auth/cloud-platform作用域
3. 项目中启用https://console.developers.google.com/apis/api/iamcredentials.googleapis.com/overview

DaemonSet部署

将工具作为DaemonSet运行在每个节点（启用主机网络）：

yaml
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: saassigner
  labels:
    app: saassigner
spec:
  template:
    metadata:
      labels:
        name: saassigner
    spec:
      hostNetwork: true
      containers:
        - image: imduffy15/k8s-gke-service-account-assigner:latest
          name: saassigner
          args:
            - "--iptables=true"
            - "--host-ip=$(HOST_IP)"
            - "--node=$(NODE_NAME)"
            - "--default-service-account=default"
            - "--default-scopes=https://www.googleapis.com/auth/devstorage.read_write,https://www.googleapis.com/auth/logging.write,https://www.googleapis.com/auth/monitoring,https://www.googleapis.com/auth/servicecontrol,https://www.googleapis.com/auth/service.management.readonly,https://www.googleapis.com/auth/trace.append"
          env:
            - name: HOST_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - containerPort: 8181
              hostPort: 8181
              name: http

Pod注解配置

为Pod添加注解指定服务账户和作用域：

yaml
apiVersion: v1
kind: Pod
metadata:
  name: debug-shell
  labels:
    name: debug-shell
  annotations:
    accounts.google.com/service-account: "<PROJECT-ID>-compute@developer.gserviceaccount.com"
    accounts.google.com/scopes: "https://www.googleapis.com/auth/cloud-platform"
spec:
  restartPolicy: Never
  containers:
    - image: imduffy15/docker-gcloud
      imagePullPolicy: Always
      name: debug-shell
      tty: true

命名空间限制

通过命名空间注解限制允许使用的服务账户：

yaml
apiVersion: v1
kind: Namespace
metadata:
  annotations:
    accounts.google.com/allowed-service-accounts: |
      ["service-account"]
  name: default

RBAC配置

创建服务账户及权限绑定：

yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8s-gke-service-account-assigner
  namespace: kube-system

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: k8s-gke-service-account-assigner
rules:
  - apiGroups: [""]
    resources: ["namespaces","pods"]
    verbs: ["get","watch","list"]

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: k8s-gke-service-account-assigner
subjects:
- kind: ServiceAccount
  name: k8s-gke-service-account-assigner
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: k8s-gke-service-account-assigner
  apiGroup: rbac.authorization.k8s.io

调试与选项

启用--debug flag可访问/debug/store端点查看命名空间和服务账户关联信息。运行k8s-gke-service-account-assigner --help查看所有配置选项。