admin管理员组文章数量:1648020
背景
有时为了需要,我们需要给出一些具有特定集群权限的kubeconfig文件,这时我们可以通过使用serviceAccount来制作具有一定集群权限的kubeconfig
下面我们来使用这一技术创建一个只有greenstock命名空间权限的pod读取权限的kubeconfig
代码来源:https://gist.github/innovia/fbba8259042f71db98ea8d4ad19bd708
准备
1. 机器需要安装 jq
2. serviceAccount需要配置好rbac
- rbac的资料:https://jimmysong.io/kubernetes-handbook/guide/rbac.html
- service account:
- https://jimmysong.io/kubernetes-handbook/concepts/serviceaccount.html
- https://jimmysong.io/kubernetes-handbook/guide/configure-pod-service-account.html
创建步骤
1. 创建好rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: greenstock
name: k8s-tester-sa
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: greenstock
name: greenstock-pod-reader
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: k8s-tester-sa-rolebinding
namespace: k8s-tester
subjects:
- kind: ServiceAccount
name: k8s-tester-sa
namespace: greenstock
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: greenstock-pod-reader
安装上述的文件 kubectl apply -f rbac.yaml
2.根据serviceaccount 生成kubeconfig
执行https://gist.github/innovia/fbba8259042f71db98ea8d4ad19bd708 这个里面的脚本,脚本内容如下 :
#!/bin/bash
set -e
set -o pipefail
# Add user to k8s using service account, no RBAC (must create RBAC after this script)
if [[ -z "$1" ]] || [[ -z "$2" ]]; then
echo "usage: $0 <service_account_name> <namespace>"
exit 1
fi
SERVICE_ACCOUNT_NAME=$1
NAMESPACE="$2"
KUBECFG_FILE_NAME="/tmp/kube/k8s-${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-conf"
TARGET_FOLDER="/tmp/kube"
create_target_folder() {
echo -n "Creating target directory to hold files in ${TARGET_FOLDER}..."
mkdir -p "${TARGET_FOLDER}"
printf "done"
}
create_service_account() {
echo -e "\\nCreating a service account in ${NAMESPACE} namespace: ${SERVICE_ACCOUNT_NAME}"
kubectl create sa "${SERVICE_ACCOUNT_NAME}" --namespace "${NAMESPACE}"
}
get_secret_name_from_service_account() {
echo -e "\\nGetting secret of service account ${SERVICE_ACCOUNT_NAME} on ${NAMESPACE}"
SECRET_NAME=$(kubectl get sa "${SERVICE_ACCOUNT_NAME}" --namespace="${NAMESPACE}" -o json | jq -r .secrets[].name)
echo "Secret name: ${SECRET_NAME}"
}
extract_ca_crt_from_secret() {
echo -e -n "\\nExtracting ca.crt from secret..."
kubectl get secret --namespace "${NAMESPACE}" "${SECRET_NAME}" -o json | jq \
-r '.data["ca.crt"]' | base64 -D > "${TARGET_FOLDER}/ca.crt"
printf "done"
}
get_user_token_from_secret() {
echo -e -n "\\nGetting user token from secret..."
USER_TOKEN=$(kubectl get secret --namespace "${NAMESPACE}" "${SECRET_NAME}" -o json | jq -r '.data["token"]' | base64 -D)
printf "done"
}
set_kube_config_values() {
context=$(kubectl config current-context)
echo -e "\\nSetting current context to: $context"
CLUSTER_NAME=$(kubectl config get-contexts "$context" | awk '{print $3}' | tail -n 1)
echo "Cluster name: ${CLUSTER_NAME}"
ENDPOINT=$(kubectl config view \
-o jsonpath="{.clusters[?(@.name == \"${CLUSTER_NAME}\")].cluster.server}")
echo "Endpoint: ${ENDPOINT}"
# Set up the config
echo -e "\\nPreparing k8s-${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-conf"
echo -n "Setting a cluster entry in kubeconfig..."
kubectl config set-cluster "${CLUSTER_NAME}" \
--kubeconfig="${KUBECFG_FILE_NAME}" \
--server="${ENDPOINT}" \
--certificate-authority="${TARGET_FOLDER}/ca.crt" \
--embed-certs=true
echo -n "Setting token credentials entry in kubeconfig..."
kubectl config set-credentials \
"${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-${CLUSTER_NAME}" \
--kubeconfig="${KUBECFG_FILE_NAME}" \
--token="${USER_TOKEN}"
echo -n "Setting a context entry in kubeconfig..."
kubectl config set-context \
"${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-${CLUSTER_NAME}" \
--kubeconfig="${KUBECFG_FILE_NAME}" \
--cluster="${CLUSTER_NAME}" \
--user="${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-${CLUSTER_NAME}" \
--namespace="${NAMESPACE}"
echo -n "Setting the current-context in the kubeconfig file..."
kubectl config use-context "${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-${CLUSTER_NAME}" \
--kubeconfig="${KUBECFG_FILE_NAME}"
}
create_target_folder
# create_service_account
get_secret_name_from_service_account
extract_ca_crt_from_secret
get_user_token_from_secret
set_kube_config_values
echo -e "\\nAll done! Test with:"
echo "KUBECONFIG=${KUBECFG_FILE_NAME} kubectl get pods"
echo "you should not have any permissions by default - you have just created the authentication part"
echo "You will need to create RBAC permissions"
KUBECONFIG=${KUBECFG_FILE_NAME} kubectl get pods
保存脚本名称为makekubecf.sh,执行命令是sh makekubecf.sh k8s-tester-sa greenstock
如果执行的时候遇到makekubecf.sh: 3: set: Illegal option -o pipefail
,原因和解决方案可以参考https://my.oschina/u/1260221/blog/817458,主要就是切换成bash
3. 执行测试
假设上面 生成的脚本kubeconfig文件为config,执行kubectl get pod -n greensock --kubeconfig=./config
4. 开发小技巧
有时候呢,我们通过client-go在开发的时候,也可以通过这种方式来生成一个临时,符合我们的场景的serviceaccount,使用kubeconfigpath的方式来让我们的应用可以从集群外访问到我们已经开启了rbac的集群,具体的例子,可以查看 kubernetes-tester 项目,在项目中,我使用了一个“BuildConfigFromFlags”的方法,传入了kubeconfig文件,然后让应用获取到了指定serviceaccount的身份,也就是上面 的greenstock命令空间下的k8s-tester-sa从而方便了我们调试。
本文标签: 文件ServiceAccountKubeConfig
版权声明:本文标题:使用serviceaccount制作kubeconfig文件 内容由热心网友自发贡献,该文观点仅代表作者本人, 转载请联系作者并注明出处:https://www.elefans.com/dianzi/1729495236a1202829.html, 本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌抄袭侵权/违法违规的内容,一经查实,本站将立刻删除。
发表评论