EKS/GKE/AKS の参照権限を外部パートナーへ付与する

$ kubectl get namespaces
NAME              STATUS   AGE
default           Active   47h
kube-node-lease   Active   47h
kube-public       Active   47h
kube-system       Active   47h
ns-a              Active   4m38s
ns-b              Active   4m35s

$ kubectl get -n 'ns-a' pods
NAME      READY   STATUS    RESTARTS   AGE
nginx-a   0/1     Pending   0          2m7s

$ kubectl get -n 'ns-b' pods
NAME      READY   STATUS    RESTARTS   AGE
nginx-b   0/1     Pending   0          60s

$ kubectl edit -n 'kube-system' configmaps 'aws-auth'

data:
  mapRoles: |
    - ...(デフォルトのマッピング)...
    - rolearn: 'arn:aws:iam::123456789012:role/K8sReadOnlyRole-Vendor'
      username: 'vendor'
      groups:
        - 'vendor'    

$ kubectl apply -f ./role-binding-eks.yml
rolebinding.rbac.authorization.k8s.io/vendor created

# kubeconfig セットアップ
$ aws eks update-kubeconfig --name 'eks-cluster'
Added new context arn:aws:eks:ap-northeast-1:123456789012:cluster/eks-cluster to /Users/yumeko/.kube/config

# ケース1 => OK
$ kubectl get -n 'ns-a' pods
NAME      READY   STATUS    RESTARTS   AGE
nginx-a   0/1     Pending   0          4h31m

# ケース2 => OK
$ kubectl edit -n 'ns-a' pods 'nginx-a'
error: pods "nginx-a" could not be patched: pods "nginx-a" is forbidden: User "vendor" cannot patch resource "pods" in API group "" in the namespace "ns-a"
You can run `kubectl replace -f /var/folders/dy/wzzvq1nd309_5r55lbcttdqc0000gn/T/kubectl-edit-1730301081.yaml` to try this update again.

# ケース3 => OK
$ kubectl get -n 'ns-b' pods
Error from server (Forbidden): pods is forbidden: User "vendor" cannot list resource "pods" in API group "" in the namespace "ns-b"

# ケース4 => OK
$ kubectl get namespaces
Error from server (Forbidden): namespaces is forbidden: User "vendor" cannot list resource "namespaces" in API group "" at the cluster scope

$ kubectl apply -f ./role-binding-gke.yml
rolebinding.rbac.authorization.k8s.io/vendor created

# Google Cloud ログイン
$ gcloud auth login 'gondawara-yumeko@vendor.quickguard.net'
Your browser has been opened to visit:

    https://accounts.google.com/o/oauth2/auth?...(snip)...


You are now logged in as [gondawara-yumeko@vendor.quickguard.net].
Your current project is [proj-a].  You can change this setting by running:
  $ gcloud config set project PROJECT_ID

# kubeconfig セットアップ
$ gcloud container clusters get-credentials --region 'asia-northeast1' 'gke-cluster'
Fetching cluster endpoint and auth data.
kubeconfig entry generated for gke-cluster.

# ケース1 => OK
$ kubectl get -n 'ns-a' pods
NAME      READY   STATUS    RESTARTS   AGE
nginx-a   1/1     Running   0          13h

# ケース2 => OK
$ kubectl edit -n 'ns-a' pods 'nginx-a'
error: pods "nginx-a" could not be patched: pods "nginx-a" is forbidden: User "gondawara-yumeko@vendor.quickguard.net" cannot patch resource "pods" in API group "" in the namespace "ns-a": requires one of ["container.pods.update"] permission(s).
You can run `kubectl replace -f /var/folders/dy/wzzvq1nd309_5r55lbcttdqc0000gn/T/kubectl-edit-1937391533.yaml` to try this update again.

# ケース3 => OK
$ kubectl get -n 'ns-b' pods
Error from server (Forbidden): pods is forbidden: User "gondawara-yumeko@vendor.quickguard.net" cannot list resource "pods" in API group "" in the namespace "ns-b": requires one of ["container.pods.list"] permission(s).

# ケース4 => OK
$ kubectl get namespaces
Error from server (Forbidden): namespaces is forbidden: User "gondawara-yumeko@vendor.quickguard.net" cannot list resource "namespaces" in API group "" at the cluster scope: requires one of ["container.namespaces.list"] permission(s).

$ kubectl apply -f ./role-binding-aks.yml
rolebinding.rbac.authorization.k8s.io/vendor created

$ az aks get-credentials -g 'aks-rg' -n 'aks-cluster'
Merged "aks-cluster" as current context in /Users/yumeko/.kube/config

# ケース1 => OK
$ kubectl get -n 'ns-a' pods
NAME      READY   STATUS    RESTARTS   AGE
nginx-a   1/1     Running   0          2d7h

# ケース2 => OK
$ kubectl edit -n 'ns-a' pods 'nginx-a'
error: pods "nginx-a" could not be patched: pods "nginx-a" is forbidden: User "3386fb83-dc08-c2cb-5202-fa421226bef0" cannot patch resource "pods" in API group "" in the namespace "ns-a": User does not have access to the resource in Azure. Update role assignment to allow access.
You can run `kubectl replace -f /var/folders/dy/wzzvq1nd309_5r55lbcttdqc0000gn/T/kubectl-edit-3175532603.yaml` to try this update again.

# ケース3 => OK
$ kubectl get -n 'ns-b' pods
Error from server (Forbidden): pods is forbidden: User "3386fb83-dc08-c2cb-5202-fa421226bef0" cannot list resource "pods" in API group "" in the namespace "ns-b": User does not have access to the resource in Azure. Update role assignment to allow access.

# ケース4 => OK
$ kubectl get namespaces
Error from server (Forbidden): namespaces is forbidden: User "3386fb83-dc08-c2cb-5202-fa421226bef0" cannot list resource "namespaces" in API group "" at the cluster scope: User does not have access to the resource in Azure. Update role assignment to allow access.