kubernetes 创建RBAC 用户的例子

我就是我 2022-05-13 10:24 177阅读 0赞

**创建Service Account**

vi demo-serviceaccount.yaml
    
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: admin-user
      namespace: kube-system

[root@master-47-35 service-account]# kubectl create -f demo-serviceaccount.yaml 
    serviceaccount/admin-user created

**创建ClusterRoleBinding**

vi demo-clusterrolebinding.yaml
    
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRoleBinding
    metadata:
      name: admin-user
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: cluster-admin
    subjects:
    - kind: ServiceAccount
      name: admin-user
      namespace: kube-system

[root@master-47-35 service-account]# kubectl create -f demo-clusterrolebinding.yaml 
    clusterrolebinding.rbac.authorization.k8s.io/admin-user created

**Bearer Token**

kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')

[root@master-47-35 service-account]# kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
    Name:         admin-user-token-rmk9r
    Namespace:    kube-system
    Labels:       <none>
    Annotations:  kubernetes.io/service-account.name=admin-user
                  kubernetes.io/service-account.uid=e5280b0d-b63b-11e8-8f84-5254e98192ae
    
    Type:  kubernetes.io/service-account-token
    
    Data
    ====
    ca.crt:     1359 bytes
    namespace:  11 bytes
    token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLXJtazlyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJlNTI4MGIwZC1iNjNiLTExZTgtOGY4NC01MjU0ZTk4MTkyYWUiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.QlCkgEXTK8UWR3sGc3INkOIGlCHaV045KhwGK8vy1CKCF7qUkzrnJNybVa4wbATTavGv36qihnryzjDca_yARIGCOsbRWuIJiZlDzbpjd8d53JPyNTPJKpjAKxOtt-hhlWqYpizBLCuVrJqwJAxN4mx6NBxbqbIJfAqJdo1sRebyFR4afX4Y9kD3SJHlYpcRddy136KfIzwheaB19Hbdz9sCae5Oy4Hxta03GGtGzKMsoSSGag80R7SI5p20-_DsbbsriqMhhRKuIqAKjrEP7R-JSM2xvdER1wIsoDFDTnQctNG-Nt7IonRgKPwPW6EzqWLyg77Cl2yilEf3A_mYQA

参考

[https://github.com/kubernetes/dashboard/wiki/Creating-sample-user][https_github.com_kubernetes_dashboard_wiki_Creating-sample-user]

[https_github.com_kubernetes_dashboard_wiki_Creating-sample-user]: https://github.com/kubernetes/dashboard/wiki/Creating-sample-user