创建k8s User Account
使用openssl方法创建普通用户
准备工作
|
1
2
3
4
|
mkdir /root/pki/将k8s ca.pem ca-key.pem 证书拷贝到此目录
cp /opt/kubernetes/ssl/ca-key.pem /root/pki/cp /opt/kubernetes/ssl/ca.pem /root/pki/ |
一、创建证书
1.创建user私钥
|
1
|
(umask077;openssl genrsa -out dev.key2048)
|
2.创建证书签署请求
O=组织信息，CN=用户名
|
1
|
openssl req -new -key dev.key -out dev.csr -subj"/O=k8s/CN=dev"
|
3.签署证书
|
1
2
3
|
openssl x509 -req -in dev.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out dev.crt -days365
Signature oksubject=/O=k8s/CN=dev
|
二、创建配置文件
|
1
2
3
4
|
kubectl config set-cluster --kubeconfig=/PATH/TO/SOMEFILE #集群配置kubectl config set-credentials NAME --kubeconfig=/PATH/TO/SOMEFILE #用户配置kubectl config set-context #context配置kubectl config use-context #切换context |
|
1
2
3
|
* --embed-certs=true的作用是不在配置文件中显示证书信息。* --kubeconfig=/root/dev.conf用于创建新的配置文件，如果不加此选项,则内容会添加到家目录下.kube/config文件中，可以使用use-context来切换不同的用户管理k8s集群。
* context简单的理解就是用什么用户来管理哪个集群，即用户和集群的结合。 |
创建集群配置
|
1
2
3
4
|
kubectl config set-cluster k8s --server=https://192.168.124.61:6443 \
--certificate-authority=ca.pem \--embed-certs=true \--kubeconfig=/root/dev.conf |
创建用户配置
|
1
2
3
4
5
|
kubectl config set-credentials dev \--client-certificate=dev.crt \--client-key=dev.key \--embed-certs=true \--kubeconfig=/root/dev.conf |
创建context配置
|
1
2
3
4
|
kubectl config set-context dev@k8s \
--cluster=k8s \
--user=dev \--kubeconfig=/root/dev.conf |
切换context
|
1
2
|
kubectl config use-context dev@k8s --kubeconfig=/root/dev.conf
kubectl config view --kubeconfig=/root/dev.conf |
创建系统用户
|
1
2
3
4
5
|
useradd devmkdir -p /home/dev/.kubecp /root/dev.conf /home/dev/.kube/configchown dev.dev -R /home/dev/su - dev |
k8s验证文件
kubectl get pod
这个时候不成功是因为没有进行权限绑定
创建Role
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
root@k8s-master:~# cat > pods-reader.yaml <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: Rolemetadata: name: pods-reader
rules:- apiGroups: -""
resources:
- pods
verbs:
- get
- list
- watch
EOF
|
创建Rolebinding
用户dev和role pods-reader的绑定
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
root@k8s-master:~# cat >test-pods-reader.yaml <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBindingmetadata: name: cbmljs-pods-reader
roleRef: apiGroup: rbac.authorization.k8s.io
kind: Role
name: pods-reader
subjects:- apiGroup: rbac.authorization.k8s.io
kind: User
name: dev
EOF |
到这一步就可以进行验证了
kubectl get pod
我们是可以查看查看default命名空间的pod，但是其他空间的pod是无法查看的。
创建ClusterRole
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
root@k8s-master:~# cat cluster-reader.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRolemetadata: name: cluster-reader
rules:- apiGroups: -""
resources:
- pods
verbs:
- get
- list
- watch
|
创建ClusterRoleBinding
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
root@k8s-master:~# cat cbmljs-read-all-pod.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBindingmetadata: name: billy-read-all-pods
roleRef: apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-reader
subjects:- apiGroup: rbac.authorization.k8s.io
kind: User
name: dev
|
验证结果
kubectl get pod --all-namespaces
就可以看到所有命名空间的pod了.
权限绑定指定的namespace
也可以使用下面方法进行绑定
kubectl get clusterrole 查看系统自带角色
|
1
|
kubectl create rolebinding devuser-admin-rolebinding（rolebinding的名字） --clusterrole=admin（clusterrole的名字，admin在k8s所有namespace下都有最高权限） --user=devuser（将admin的权限赋予devuser用户） --namespace=dev（范围是dev这个namespace下） 即dev
|
扩展:
kubectl api-resources 可以查看apiGroups
示例：
创建集群角色
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
cat clusterrole.yamlapiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRolemetadata: name: test-clusterrole
rules: - apiGroups: [""]
resources: ["pods"]
verbs: ["get","list","watch","create","update","patch","delete"]
- apiGroups: ["extensions","apps"]
resources: ["deployments"]
verbs: ["get","watch","list"]
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["get","list","watch","create","update","patch","delete"]
- apiGroups: [""]
resources: ["pods/log"]
verbs: ["get","list","watch","create","update","patch","delete"]
- apiGroups: [""]
resources: ["namespaces","namespaces/status"]
verbs: ["*"] # 也可以使用[‘*‘]
- apiGroups: ["","apps","extensions","apiextensions.k8s.io"]
resources: ["role","replicasets","deployments","customresourcedefinitions","configmaps"]
verbs: ["*"]
|
集群绑定
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
[root@master role]# cat test-classbind.yamlapiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBindingmetadata: name: test-all-pods
roleRef: apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: test-clusterrole
subjects:- apiGroup: rbac.authorization.k8s.io
kind: User
name: test
|
参考：
https://blog.csdn.net/cbmljs/article/details/102953428