RBAC授权

[root@hdss7-200 rbac]# cat /data/k8s-yaml/base_resource/rbac/maxiaoke-user.yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: maxiaoke-role
  namespace: app
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - services
  verbs:
  - get
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: maxiaoke-rolebinding
  namespace: app
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: maxiaoke-role
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: maxiaoke

创建必要的用户证书

# kubectl 的配置文件读取顺序：--kubeconfig 参数指定 > $KUBECONFIG 环境变量指定 > ${HOME}/.kube/config
# 此次以集群的CA证书为本，签署并创建一个新的 user account：
# 10.4.7.201 只拷贝了一个二进制命令 kubectl 到 /root/bin/ 下，未拷贝其它任何内容K8S配置
[root@hdss7-200 ~]# cd /opt/certs
[root@hdss7-200 certs]# cat maxiaoke-csr.json  # 模仿 kubelet-csr.json 来修改
{
    "CN": "maxiaoke",
    "hosts": [
    "127.0.0.1",
    "10.4.7.10",
    "10.4.7.21",
    "10.4.7.22",
    "10.4.7.23",
    "10.4.7.24",
    "10.4.7.25",
    "10.4.7.26",
    "10.4.7.27",
    "10.4.7.28"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "beijing",
            "L": "beijing",
            "O": "od",
            "OU": "ops"
        }
    ]
}
[root@hdss7-200 certs]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client maxiaoke-csr.json | cfssl-json -bare maxiaoke
[root@hdss7-200 certs]# scp maxiaoke* ca.pam 10.4.7.201:/root/certs

创建config文件

[root@operate-7-201 ~]# kubectl config set-cluster myk8s \ # 集群名称可以自定义
--certificate-authority=/root/certs/ca.pem \
--embed-certs=true \
--server=https://10.4.7.10:7443 \
--kubeconfig=/root/.kube/config
[root@operate-7-201 ~]# kubectl config set-credentials maxiaoke \
--client-certificate=/root/certs/maxiaoke.pem \
--client-key=/root/certs/maxiaoke-key.pem \
--embed-certs=true \
--kubeconfig=/root/.kube/config
[root@operate-7-201 ~]# kubectl config set-context myk8s-context \
--cluster=myk8s \
--user=maxiaoke \
--kubeconfig=/root/.kube/config
[root@operate-7-201 ~]# kubectl config use-context myk8s-context --kubeconfig=/root/.kube/config
[root@operate-7-201 ~]# kubectl get pod # 没有访问default名称空间
Error from server (Forbidden): pods is forbidden: User "maxiaoke" cannot list resource "pods" in API group "" in the namespace "default"
[root@operate-7-201 ~]# kubectl get svc -n app  # 账户创建成功
NAME     TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)       AGE
slb-s1   ClusterIP   192.168.219.15   <none>        80/TCP        6d21h
slb-s2   ClusterIP   192.168.10.100   <none>        80/TCP        6d9h
slb-s3   NodePort    192.168.1.125    <none>        80:3080/TCP   6d8h
slb-s4   ClusterIP   None             <none>        80/TCP        6d6h
[root@operate-7-201 ~]# rm -fr /root/certs