# k8s-webhook-auth

**Repository Path**: wilds/k8s-webhook-auth

## Basic Information

- **Project Name**: k8s-webhook-auth
- **Description**: k8s webhook authn
- **Primary Language**: Go
- **License**: MulanPSL-2.0
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2024-02-06
- **Last Updated**: 2024-02-27

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# k8s-webhook-auth

## 介绍
k8s webhook auth

```
{
  "apiVersion": "authentication.k8s.io/v1beta1",
  "kind": "TokenReview",
  "spec": {
    "token": "<持有者令牌>"
  }
}
```
```
{
  "apiVersion": "authentication.k8s.io/v1beta1",
  "kind": "TokenReview",
  "status": {
    "authenticated": true,
    "user": {
      "username": "water@126.com",
      "uid": "42",
      "groups": [
        "developers",
        "qa"
      ],
      "extra": {
        "extrafield1": [
          "extravalue1",
          "extravalue2"
        ]
      }
    }
  }
}
```
## 安装[OpenLDAP](https://www.openldap.org/)
- slapd - stand-alone LDAP daemon (server)

openldap配置涉及到密码、域名、管理员,我的域名是wilds.com
```
[root@openfuyao-0004 sample-apiserver]# yum install -y openldap openldap-clients openldap-servers
[root@openfuyao-0004 sample-apiserver]# systemctl start slapd
[root@openfuyao-0004 sample-apiserver]# systemctl enable slapd
# 生成密码123456
[root@openfuyao-0004 sample-apiserver]# slappasswd
New password:
Re-enter new password:
{SSHA}eFUdko66sOf4FEQMktueoXrlYzmx92HS
# 备份/etc/openldap
[root@openfuyao-0004 etc]# tar -zcvf openldap.tgz openldap/
```
默认配置文件位于/etc/openldap/slapd.d,文件格式为LDAP Input Format(LDIF),ldap目录特定的格式。


## [证书生成](https://kubernetes.io/zh-cn/docs/tasks/tls/managing-tls-in-a-cluster/)
为通过 DNS 访问的 Kubernetes 服务创建 TLS 证书.
### 创建证书签名请求
```
cat <<EOF | cfssl genkey - | cfssljson -bare server
{
  "hosts": [
    "webhook-auth.auth.svc.cluster.local",
    "webhook-auth.auth.pod.cluster.local"
  ],
  "CN": "webhook-auth.auth.pod.cluster.local",
  "key": {
    "algo": "ecdsa",
    "size": 256
  }
}
EOF
```
此命令生成两个文件；它生成包含PEM编码PKCS#10证书请求的server.csr，以及PEM编码的密钥server-key.pem，用于待生成的证书.
> 其中webhook-auth{ServiceName}.auth{Namespace}.svc.cluster.local是服务的DNS名称，webhook-auth{PodName}.authh{Namespace}.pod.cluster.local是Pod的DNS名称。
### 创建证书签名请求（CSR）对象发送到Kubernetes API
使用以下命令创建CSR清单（YAML格式），并发送到API服务器：
```
cat <<EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: webhook-auth.auth # my-svc.my-namespace
spec:
  request: $(cat server.csr | base64 | tr -d '\n')
  signerName: wilds.io/webhook-auth-signer # kubernetes.io/kube-apiserver-client
  usages:
  - digital signature
  - key encipherment
  - server auth
  - client auth
EOF
```
> 在步骤1中创建的server.csr是base64编码并存储在.spec.request字段中的。你还要求提供 “digital signature（数字签名）”， “密钥加密（key encipherment）” 和 “服务器身份验证（server auth）” 密钥用途，由kubernetes.io/kube-apiserver-client签名程序签名的证书。你也可以要求使用特定的signerName。可参阅[支持的签署者名称](https://kubernetes.io/zh-cn/docs/reference/access-authn-authz/certificate-signing-requests/#signers)。

在API server中可以看到这些CSR处于Pending状态。执行下面的命令你将可以看到：
```
kubectl describe csr  webhook-auth.auth
Name:         webhook-auth.auth
Labels:       <none>
Annotations:  ...

CreationTimestamp:  Sat, 17 Feb 2024 18:03:03 +0800
Requesting User:    kubernetes-admin
Signer:             wilds.io/webhook-auth-signer
Status:             Pending
Subject:
  Common Name:    webhook-auth.auth.pod.cluster.local
  Serial Number:
Subject Alternative Names:
  DNS Names:  webhook-auth.auth.svc.cluster.local
              webhook-auth.auth.pod.cluster.local
Events:
  Type    Reason  Age   From            Message
  ----    ------  ----  ----            -------
  Normal  Synced  2m3s  csr-controller  Synced successfully
```
### 批准证书签名请求（CSR）
证书签名请求的批准或是通过自动批准过程完成，或由集群管理员一次性完成。如果你被授权批准证书请求，可以使用kubectl来手动完成此操作；例如：
```
kubectl certificate approve webhook-auth.auth
certificatesigningrequest.certificates.k8s.io/webhook-auth.auth approved
```
现在应该能看到如下输出：
```
kubectl get csr
NAME                AGE     SIGNERNAME                     REQUESTOR          REQUESTEDDURATION   CONDITION
webhook-auth.auth   5m38s   wilds.io/webhook-auth-signer   kubernetes-admin   <none>              Approved
```
### 签名证书签名请求（CSR）
接下来，你将扮演证书签署者角色，颁发证书并将其上传到API服务器。

签名者通常会使用其SignerName查看对象的CertificateSigningRequest API，检查它们是否已被批准，为这些请求签署证书，并使用已颁发的证书更新API对象状态。
#### 创建证书颁发机构
你需要授权在新证书上提供数字签名。

首先，通过运行以下命令创建签名证书：
```
cat <<EOF | cfssl gencert -initca - | cfssljson -bare ca
{
  "CN": "wilds.io/webhook-auth-signer",
  "key": {
    "algo": "rsa",
    "size": 2048
  }
}
EOF
```
你应该看到类似于以下的输出：
```
2024/02/17 18:11:28 [INFO] generating a new CA key and certificate from CSR
2024/02/17 18:11:28 [INFO] generate received request
2024/02/17 18:11:28 [INFO] received CSR
2024/02/17 18:11:28 [INFO] generating key: rsa-2048
2024/02/17 18:11:28 [INFO] encoded CSR
2024/02/17 18:11:28 [INFO] signed certificate with serial number 234685031346128580397476451149535210174351800538
```
这会产生一个证书颁发机构密钥文件（ca-key.pem）、证书（ca.pem）和ca.csr。
#### 颁发证书
tls/server-signing-config.json
```
{
    "signing": {
        "default": {
            "usages": [
                "digital signature",
                "key encipherment",
                "server auth",
                "client auth"
            ],
            "expiry": "876000h",
            "ca_constraint": {
                "is_ca": false
            }
        }
    }
}
```
使用server-signing-config.json签名配置、证书颁发机构密钥文件和证书来签署证书请求：
```
kubectl get csr webhook-auth.auth -o jsonpath='{.spec.request}' | \
  base64 --decode | \
  cfssl sign -ca ca.pem -ca-key ca-key.pem -config server-signing-config.json - | \
  cfssljson -bare ca-signed-server
```
你应该看到类似于以下的输出：
```
2024/02/17 18:15:59 [INFO] signed certificate with serial number 277461036704004025698700586595767042176473210696
```
这会生成一个签名的服务证书文件ca-signed-server.pem及ca-signed-server.csr。
#### 上传签名证书
最后，在API对象的状态中填充签名证书：
```
kubectl get csr webhook-auth.auth -o json | \
  jq '.status.certificate = "'$(base64 ca-signed-server.pem | tr -d '\n')'"' | \
  kubectl replace --raw /apis/certificates.k8s.io/v1/certificatesigningrequests/webhook-auth.auth/status -f -
```
> 说明：这使用命令行工具jq在.status.certificate字段中填充base64编码的内容。如果你没有jq工具，你还可以将JSON输出保存到文件中，手动填充此字段，然后上传结果文件。

批准CSR并上传签名证书后，运行：
```
kubectl get csr
```
输入类似于：
```
NAME                AGE   SIGNERNAME                     REQUESTOR          REQUESTEDDURATION   CONDITION
webhook-auth.auth   16m   wilds.io/webhook-auth-signer   kubernetes-admin   <none>              Approved,Issued
```
### 下载证书并使用它
现在，作为请求用户，你可以通过运行以下命令下载颁发的证书并将其保存到server.crt文件中：

CSR被签署并获得批准后，你应该看到以下内容：
```
kubectl get csr webhook-auth.auth -o jsonpath='{.status.certificate}' \
    | base64 --decode > server.crt
```
现在你可以将server.crt和server-key.pem填充到Secret中，稍后你可以将其挂载到Pod中（例如，用于提供HTTPS的网络服务器）。
```
kubectl create secret tls webhook-auth-server --cert server.crt --key server-key.pem -n auth
secret/webhook-auth-server created
```
最后，你可以将ca.pem填充到ConfigMap并将其用作信任根来验证服务证书：
```
kubectl create configmap webhook-auth-serving-ca --from-file ca.crt=ca.pem -n auth
configmap/webhook-auth-serving-ca created
```
## [APIServer添加认证服务](https://kubernetes.io/zh-cn/docs/reference/access-authn-authz/authentication/#webhook-token-authentication)
使用Webhook进行认证，需要在kube-apiserver里开启，参数如下：
```
# 指向一个配置文件，描述如何访问远程Webhook服务
--authentication-token-webhook-config-file 
```
配置文件使用kubeconfig文件格式。文件中,clusters指代远程服务,users指代远程API服务Webhook(APIServer)。配置如下：
```
# mkdir /etc/kubernetes/webhook
# cat > webhook-config.yaml <<EOF
apiVersion: v1
kind: Config
clusters:
  - name: webhook-auth
    cluster:
      certificate-authority: /etc/config/ca.pem
      server: https://webhook-auth.auth.svc.cluster.local:9999/auth
users:
  - name: apiserver
    user:
      token: github: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
current-context: webhook
contexts:
- context:
    cluster: webhook-auth
    user: apiserver
  name: webhook
EOF

cat > webhook-config.yaml <<EOF
apiVersion: v1
kind: Config
clusters:
  - name: webhook-auth
    cluster:
      certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURIakNDQWdhZ0F3SUJBZ0lVS1J1a0NXekFuS3FOM08yVTV5RXFIU2Q5K05vd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0p6RWxNQ01HQTFVRUF4TWNkMmxzWkhNdWFXOHZkMlZpYUc5dmF5MWhkWFJvTFhOcFoyNWxjakFlRncweQpOREF5TVRjeE1EQTJNREJhRncweU9UQXlNVFV4TURBMk1EQmFNQ2N4SlRBakJnTlZCQU1USEhkcGJHUnpMbWx2CkwzZGxZbWh2YjJzdFlYVjBhQzF6YVdkdVpYSXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUsKQW9JQkFRRGdiQVFOQUhaSmQ3TTlhQW1ydHk5cCtVUFpzZlJXN1NOT21lZkZTYUtvc25XT1BvdDRSM0J1NTVidwpYTWlwd0VRcEpGZWw1TURKYnlPcTZBc1J5b3BCbjhmdEZBRlY4Wng2ajFWY1UxYUFIR1B2d0R0NG4yV2xqb1dYCk9kSWFXbWRUOXc3dmxxM3J0UjFaQ2hOTml3Ym5pbjhzTWcwaStwZmdrWnI1Vi9qSDRCYmdQaGxIdXJzQURRaW0KZTliRTVYUmhnNjlYY1RaeGQ2c1R6STVvdzJYVFhyZlZlUktlYnZ0ZSt2dEpLbHVqeC84YjZhV3BTQkJZMGFvWApGV2JBT0NTSjRxUW90WGhyUjUvWXk5NGcvWGFkblJ2NUlyRVkxRmpjWmtEOWx1MzZuU1JvUlYraXNlajhZMkJOCnB3Z3UxdkFJZW1LNmhmOHVTZEJJdDJoOGVkVWJBZ01CQUFHalFqQkFNQTRHQTFVZER3RUIvd1FFQXdJQkJqQVAKQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFQcnpvUnZBejl2QlJHY1dRMUMrOTJKTVFUWURBTgpCZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFtMmM5VXB3SHlDY01JZ25udytPWWVzSC9YbnhMcjlPY0NCZy9WaVZVCk5pZ2ZPMDc2RWpBUUI0YjVXM2J6KzRKS3VSQWxxYkRFb2pmdXdTS2xTdm1lb2NNMjZ5TDA5Y1FuR0dyR1VLdUsKRzlsQkFZSlZqYTlRRXQ5SFVObFhldHQzYm4zNmVYYkEzMm81Q1lmZTRmejhxN0F6cnhNdjdjRFNyMTlORWFMQwo0cjVOeHFzL09LTnRTYVl4akIzcWhjVlMxY2hxeE5RbUFPNGgwdWF1NDU5YUtGc1RvR0cwTmNjQjR1Mlk1a2xDCkQveUtrQkJrYkZWU1lIVjJweFNxRi9ESGZabEQ2SzRFOEo4MDYxazNrRVJ2em85MitvT2NpQnZtd3ZZbE1nS04KbFF0RTI0ekNhdXBJdzlKMnFCaEtzWjlPanV2QlhpVDgwK2lyRWpSUzFmbDlHUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
      server: https://webhook-auth.auth.svc.cluster.local:9999/auth
users:
  - name: apiserver
    user:
      client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM4RENDQWRpZ0F3SUJBZ0lVYkRZQTA2WjZmam1JdHZtZGpFMCtRcDBsZ3FFd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0p6RWxNQ01HQTFVRUF4TWNkMmxzWkhNdWFXOHZkMlZpYUc5dmF5MWhkWFJvTFhOcFoyNWxjakFnRncweQpOREF5TVRneE1UUXpNREJhR0E4eU1USTBNREV5TlRFeE5ETXdNRm93TGpFc01Db0dBMVVFQXhNamQyVmlhRzl2CmF5MWhkWFJvTG1GMWRHZ3VjRzlrTG1Oc2RYTjBaWEl1Ykc5allXd3dXVEFUQmdjcWhrak9QUUlCQmdncWhrak8KUFFNQkJ3TkNBQVFPRlFab2dJZGJYUTUrM3ZZN25ZMWVFS1F2aEx5SHF5Z2xnMnY1MzhkSEVEcTdtM2gzT0QrLwpFZkptbXpJSENNOWNmNDNJTVRITmtuclVVUE1sREtUb280SFZNSUhTTUE0R0ExVWREd0VCL3dRRUF3SUZvREFkCkJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUlLd1lCQlFVSEF3SXdEQVlEVlIwVEFRSC9CQUl3QURBZEJnTlYKSFE0RUZnUVVTYjdVNVMvakdockVENlhmRE9rM293R2ZiRTB3SHdZRFZSMGpCQmd3Rm9BVUQ2ODZFYndNL2J3VQpSbkZrTlF2dmRpVEVFMkF3VXdZRFZSMFJCRXd3U29JamQyVmlhRzl2YXkxaGRYUm9MbUYxZEdndWMzWmpMbU5zCmRYTjBaWEl1Ykc5allXeUNJM2RsWW1odmIyc3RZWFYwYUM1aGRYUm9MbkJ2WkM1amJIVnpkR1Z5TG14dlkyRnMKTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFCUWJEQXBhdVFTR3lGZ2d4SSs4UkpxakdZMm40QkVDYWgvcjVINQpoMTlUMUNDT2I4UStmSG4yaDRVL2FVQ0llS1EzQ3N2TmZSaGpCOWkzZnUzYTRyd3o5dFNYMmRUbUxncFpsYlV2ClErVXZDWTh2bkNVQy9FTG43NlFlR1ViNUlqUEFkdWo2MDRJOVR4UDlxTHNlek5sREluRU40SzYvbTFIRHBBY2sKWlo3OVNtM2dnTTNlaWNUdEVQRnhKQ1puT05yVEpzcTcwcTBxalUwTmNocTZvSjJwL3ZwUmNUNWNlanc1TFJBQwpiVHNUYlBOM1NSaUxRTmpKbEFmNFZaMnc2Z1hyMGtmR0RSUnJFNVJBK2FESGlmNnB5VWJSdUhZMTFUL3hxTlhmCi9kUy9kbnVrRlVXQk9vNWRSQW44Tm9EMGhqWEJJai9NT2pzQW5vUjcrak5OQTNPVwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
      client-key-data:  LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSVB5eVA3YkhuQkZCaUR6bjNubzl4aDdJR2VEa2pHRG1TZVZXZUxtRmpVOWNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFRGhVR2FJQ0hXMTBPZnQ3Mk81Mk5YaENrTDRTOGg2c29KWU5yK2QvSFJ4QTZ1NXQ0ZHpnLwp2eEh5WnBzeUJ3alBYSCtOeURFeHpaSjYxRkR6SlF5azZBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
current-context: webhook
contexts:
- context:
    cluster: webhook-auth
    user: apiserver
  name: webhook
EOF
```
> certificate-authority-data/client-certificate-data/client-key-data为上面生成的证书

在kube-apiserver中添加配置参数
- 增加volume: webhook-config
- `- --authentication-token-webhook-config-file=/etc/config/webhook-config.yaml`
- `dnsPolicy: ClusterFirstWithHostNet`
```
# mkdir /etc/kubernetes/backup
# cp /etc/kubernetes/manifests/kube-apiserver.yaml /etc/kubernetes/backup/kube-apiserver.yaml
# cd /etc/kubernetes/manifests/
# cat kube-apiserver.yaml
apiVersion: v1
kind: Pod
metadata:
  annotations:
    kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint: 192.168.100.36:6443
  creationTimestamp: null
  labels:
    component: kube-apiserver
    tier: control-plane
  name: kube-apiserver
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-apiserver
    - --advertise-address=192.168.100.36
    - --allow-privileged=true
    - --authorization-mode=Node,RBAC
    - --client-ca-file=/etc/kubernetes/pki/ca.crt
    - --enable-admission-plugins=NodeRestriction
    - --enable-bootstrap-token-auth=true
    - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
    - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
    - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
    - --etcd-servers=https://127.0.0.1:2379
    - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
    - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
    - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
    - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
    - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
    - --requestheader-allowed-names=front-proxy-client
    - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
    - --requestheader-extra-headers-prefix=X-Remote-Extra-
    - --requestheader-group-headers=X-Remote-Group
    - --requestheader-username-headers=X-Remote-User
    - --secure-port=6443
    - --service-account-issuer=https://kubernetes.default.svc.cluster.local
    - --service-account-key-file=/etc/kubernetes/pki/sa.pub
    - --service-account-signing-key-file=/etc/kubernetes/pki/sa.key
    - --service-cluster-ip-range=10.96.0.0/12
    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
    - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    - --authentication-token-webhook-config-file=/etc/config/webhook-config.yaml
    image: registry.k8s.io/kube-apiserver:v1.29.0
    imagePullPolicy: IfNotPresent
    livenessProbe:
      failureThreshold: 8
      httpGet:
        host: 192.168.100.36
        path: /livez
        port: 6443
        scheme: HTTPS
      initialDelaySeconds: 10
      periodSeconds: 10
      timeoutSeconds: 15
    name: kube-apiserver
    readinessProbe:
      failureThreshold: 3
      httpGet:
        host: 192.168.100.36
        path: /readyz
        port: 6443
        scheme: HTTPS
      periodSeconds: 1
      timeoutSeconds: 15
    resources:
      requests:
        cpu: 250m
    startupProbe:
      failureThreshold: 24
      httpGet:
        host: 192.168.100.36
        path: /livez
        port: 6443
        scheme: HTTPS
      initialDelaySeconds: 10
      periodSeconds: 10
      timeoutSeconds: 15
    volumeMounts:
    - mountPath: /etc/ssl/certs
      name: ca-certs
      readOnly: true
    - mountPath: /etc/pki
      name: etc-pki
      readOnly: true
    - mountPath: /etc/kubernetes/pki
      name: k8s-certs
      readOnly: true
	- name: webhook-config
      mountPath: /etc/config
      readOnly: true
  hostNetwork: true
  dnsPolicy: ClusterFirstWithHostNet
  priority: 2000001000
  priorityClassName: system-node-critical
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  volumes:
  - hostPath:
      path: /etc/ssl/certs
      type: DirectoryOrCreate
    name: ca-certs
  - hostPath:
      path: /etc/pki
      type: DirectoryOrCreate
    name: etc-pki
  - hostPath:
      path: /etc/kubernetes/pki
      type: DirectoryOrCreate
    name: k8s-certs
  - hostPath:
      path: /etc/kubernetes/webhook
      type: DirectoryOrCreate
    name: webhook-config
status: {}
```
## build
```
git clone https://gitee.com/wilds/k8s-webhook-auth.git
cd k8s-webhook-auth/
go mod tidy
go mod vendor
# cd ./cmd/webhook-auth
# go build -o ../../artifacts/image/webhook-auth
# cd ../../artifacts/image/
go build -o ./artifacts/image/webhook-auth ./... 
docker build -t webhook-auth:latest ./artifacts/image/

ctr -n k8s.io images rm docker.io/library/webhook-auth:latest
ctr -n k8s.io images rm wilds.io/webhook-auth:latest

docker save -o webhook-auth.tar webhook-auth:latest
ctr -n k8s.io images import webhook-auth.tar
ctr -n k8s.io i tag docker.io/library/webhook-auth:latest wilds.io/webhook-auth:latest
crictl images ls | grep webhook-auth
```
## 测试Github认证
1. 在github上获取Token:Setting->Developer settings->Personal access tokens->Generate new token
2. 配置kubeconfig，添加user
```
# cat ~/.kube/config 
apiVersion: v1
......
users:
- name: water
  user:
    token: basic:admin:admin
- name: water
  user:
    token: github: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
```
3. 用water用户进行访问
```
# kubectl get pod --user=water
# 认证通过，权限不足
Error from server (Forbidden): pods is forbidden: User "" cannot list resource "pods" in API group "" in the namespace "default"
# 以下错误还不情况是什么原因，host上启动进程是可以的
error: You must be logged in to the server (Unauthorized)
[webhook.go:85] Get "https://api.github.com/user": tls: failed to verify certificate: x509: certificate signed by unknown authority
```
4. 用wilds用户进行访问
```
[root@openfuyao-0004 .kube]# kubectl --user=wilds get pod -n auth
NAME                            READY   STATUS    RESTARTS   AGE
webhook-auth-75cb47cb9c-rpdzf   1/1     Running   0          8m19s
```
5. 使用定制kubeconfig访问
```
# cat > webhook-config.yaml <<EOF
apiVersion: v1
kind: Config
clusters:
  - name: kubernetes
    cluster:
      certificate-authority: /etc/kubernetes/pki/ca.crt
      server: https:/192.168.100.36:6443
users:
  - name: basic
    user:
      token: basic:admin:admin
current-context: webhook
contexts:
- context:
    cluster: kubernetes
    user: basic
  name: webhook
EOF
```
```
# kubectl --kubeconfig=webhook-config.yaml get pod -n auth
NAME                            READY   STATUS    RESTARTS   AGE
webhook-auth-75cb47cb9c-rpdzf   1/1     Running   0          16m
```
6. curl
```
curl -v -k -X GET --cert-type PEM --cert /ssl/server.crt --key /ssl/server-key.pem --cacert /ssl/ca.pem -H "Content-Type: application/json" -H "Host: webhook-auth.auth.pod.cluster.local" -H "Authorization: Bearer github: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" -d '{"apiVersion": "authentication.k8s.io/v1","kind": "TokenReview","spec": {"token": "github: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","audiences": []}}' https://127.0.0.1:9999/auth

*   Trying 127.0.0.1:9999...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 9999 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /ssl/ca.pem
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS handshake, CERT verify (15):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=webhook-auth.auth.pod.cluster.local
*  start date: Feb 18 11:43:00 2024 GMT
*  expire date: Jan 25 11:43:00 2124 GMT
*  issuer: CN=wilds.io/webhook-auth-signer
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x55d83d691290)
> GET /auth HTTP/2
> Host: webhook-auth.auth.pod.cluster.local
> User-Agent: curl/7.66.0
> Accept: */*
> Content-Type: application/json
> Authorization: Bearer github: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
> Content-Length: 149
>
* We are completely uploaded and fine
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
< HTTP/2 200
< content-type: text/plain; charset=utf-8
< content-length: 210
< date: Sun, 18 Feb 2024 12:31:56 GMT
<
{"kind":"TokenReview","apiVersion":"authentication.k8s.io/v1","metadata":{"creationTimestamp":null},"spec":{"token":"github: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"},"status":{"authenticated":true,"user":{}}}
* Connection #0 to host 127.0.0.1 left intact
```
## Webhook后端处理身份验证
可以对http使用基本身份验证，对https使用证书。
当kube api服务器与webhook通信时，它将向webhook webserver提供客户端证书以对其自身进行身份验证。
需要在webhook api服务器中安装cacert，才能成功验证kuernetes api服务器。
用于生成客户端证书并将该客户端证书添加到kubeconfig文件中的相同证书。
### 基本身份验证
```
apiVersion: v1
kind: Config
preferences: {}
clusters:
- name: example-cluster
  cluster:
    server: http://127.0.0.1
users:
- name: example-user
  user:
    username: some-user
    password: some-password
contexts:
- name: example-context
  context:
    cluster: example-cluster
    user: example-user
current-context: example-context
```
### 证书身份验证
```
apiVersion: v1
    kind: Config
    preferences: {}
    clusters:
    - name: example-cluster
      cluster:
        certificate-authority-data: <redacted>
        server: https://127.0.0.1
    users:
    - name: example-user
      user:
        client-certificate-data: <redacted>
        client-key-data: <redacted>
    contexts:
    - name: example-context
      context:
        cluster: example-cluster
        user: example-user
    current-context: example-context
```
## ref
- [k8s-webhook-cert-manager](https://github.com/newrelic/k8s-webhook-cert-manager)
- [双向TLS认证的REST Service](https://www.jianshu.com/p/55c1540438f5)
- [使用TLS/SSL证书的两种方法及实践](https://www.dandelioncloud.cn/article/details/1598290174230609921)