创立用户认证受权的 kubeconfig 文件
当咱们装置好集群后，如果想要把 kubectl 命令交给用户应用，就不得不对用户的身份进行认证和对其权限做出限度。
上面以创立一个 cby 用户并将其绑定到 cby 和 chenby 的 namespace 为例阐明。
创立生成证书配置文件
具体见：https://github.com/cby-chen/Kubernetes#23%E5%88%9B%E5%BB%BA%E8%AF%81%E4%B9%A6%E7%9B%B8%E5%85%B3%E6%96%87%E4%BB%B6cat > ca-config.json << EOF { "signing": { "default": { "expiry": "876000h" }, "profiles": { "kubernetes": { "usages": [ "signing", "key encipherment", "server auth", "client auth" ], "expiry": "876000h" } } }}EOFcat > cby-csr.json << EOF { "CN": "cby", "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "Beijing", "L": "Beijing", "O": "system:masters", "OU": "Kubernetes-manual" } ]}EOF生成 CA 证书和私钥
cfssl gencert \ -ca=/etc/kubernetes/pki/ca.pem \ -ca-key=/etc/kubernetes/pki/ca-key.pem \ -config=ca-config.json \ -profile=kubernetes \ cby-csr.json | cfssljson -bare /etc/kubernetes/pki/cbyll /etc/kubernetes/pki/cby*-rw-r--r-- 1 root root 1021 May 25 17:36 /etc/kubernetes/pki/cby.csr-rw------- 1 root root 1679 May 25 17:36 /etc/kubernetes/pki/cby-key.pem-rw-r--r-- 1 root root 1440 May 25 17:36 /etc/kubernetes/pki/cby.pem创立 kubeconfig 文件
kubectl config set-cluster kubernetes \ --certificate-authority=/etc/kubernetes/pki/ca.pem \ --embed-certs=true \ --server=https://10.0.0.89:8443 \ --kubeconfig=/etc/kubernetes/cby.kubeconfigkubectl config set-credentials cby \ --client-certificate=/etc/kubernetes/pki/cby.pem \ --client-key=/etc/kubernetes/pki/cby-key.pem \ --embed-certs=true \ --kubeconfig=/etc/kubernetes/cby.kubeconfigkubectl config set-context cby@kubernetes \ --cluster=kubernetes \ --user=cby \ --kubeconfig=/etc/kubernetes/cby.kubeconfigkubectl config use-context cby@kubernetes --kubeconfig=/etc/kubernetes/cby.kubeconfig增加用户并将配置其用户
useradd cbysu - cbymkdir .kube/exit cp /etc/kubernetes/cby.kubeconfig /home/cby/.kube/configchown cby.cby /home/cby/.kube/configRoleBinding
须要应用 RBAC创立角色绑定以将该用户的行为限度在某个或某几个 namespace 空间范畴内
kubectl create namespace cbykubectl create namespace chenbykubectl create rolebinding cby --clusterrole=cluster-admin --user=cby --namespace=cbykubectl create rolebinding cby --clusterrole=cluster-admin --user=cby --namespace=chenbykubectl describe -n chenby rolebindings.rbac.authorization.k8s.io cby Name: cbyLabels: <none>Annotations: <none>Role: Kind: ClusterRole Name: cluster-adminSubjects: Kind Name Namespace ---- ---- --------- User cby kubectl describe -n cby rolebindings.rbac.authorization.k8s.io cby Name: cbyLabels: <none>Annotations: <none>Role: Kind: ClusterRole Name: cluster-adminSubjects: Kind Name Namespace ---- ---- --------- User cby su - cby获取以后的 context
kubectl config get-contextsCURRENT NAME CLUSTER AUTHINFO NAMESPACE* kubernetes-cby@kubernetes kubernetes kubernetes-cby cby无法访问 default namespace
[cby@k8s-master01 ~]$ kubectl get pods --namespace defaultError from server (Forbidden): pods is forbidden: User "cby" cannot list resource "pods" in API group "" in the namespace "default"[cby@k8s-master01 ~]$ 能够拜访 cby namespace
这样 cby 用户对 cby 和 chenby 两个 namespace 具备齐全拜访权限。
[cby@k8s-master01 ~]$ kubectl get pods --namespace cbyNo resources found in cby namespace.[cby@k8s-master01 ~]$ kubectl get pods --namespace chenbyNo resources found in chenby namespace.https://www.oiox.cn/
https://www.chenby.cn/
https://cby-chen.github.io/
https://blog.csdn.net/qq\_33921750
https://my.oschina.net/u/3981543
https://www.zhihu.com/people/...
https://segmentfault.com/u/hp...
https://juejin.cn/user/331578...
https://cloud.tencent.com/dev...
https://www.jianshu.com/u/0f8...
https://www.toutiao.com/c/use...
CSDN、GitHub、知乎、开源中国、思否、掘金、简书、腾讯云、今日头条、集体博客、全网可搜《小陈运维》
文章次要公布于微信公众号：《Linux运维交换社区》