kubernetes 创建 ServiceAccount

偏执的太偏执、 2024-04-17 05:44 135阅读 0赞

## 创建用户示例 ##

本示例将通过告诉大家如何通过kubernetes的Service Account机制，生成一个管理员账号并通过

Token方式登录进入Dashboard。

首先新建admin-user.yaml文件，在文件中添加一下内容：

apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: admin-user
      namespace: kube-system
    
    ---
    
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: admin-user
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: cluster-admin
    subjects:
    - kind: ServiceAccount
      name: admin-user
      namespace: kube-system

## 创建 Service Account ##

我们在admin-user.yaml中的第一部分内容的作用就是命名空间 kube-system 中创建一个 Service Account

apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: admin-user
      namespace: kube-system

## 创建 ClusterRoleBinding ##

在大多数情况下，我们在搭建好kubernetes集群之后 ClusterRole 和 admin-Role 就已经在集群中被创建好了

我们可以直接使用它们来为我们的 Service Account 创建 ClusterRoleBinding，需要注意的是不同的kubernetes版

本使用的apiVersion是不同的，v1.8以前使用的是  rbac.authorization.k8s.io/v1

apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: admin-user
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: cluster-admin
    subjects:
    - kind: ServiceAccount
      name: admin-user
      namespace: kube-system

## 完成创建并获取Token ##

1.admin-user.yaml文件编写好后我们执行一下命令kubectl create 创建Service Account

kubectl create -f ./admin-user.yaml

2.然后，我们需要查找我们新创建的账号对应的Token并保存下来

kubectl -n kube-system describe secret | grep -A 10 admin-user

3.控制台应该会打印出一下结果

Name:         admin-user-token-6gl6l
    Namespace:    kube-system
    Labels:       <none>
    Annotations:  kubernetes.io/service-account.name=admin-user
                  kubernetes.io/service-account.uid=b16afba9-dfec-11e7-bbb9-901b0e532516
    
    Type:  kubernetes.io/service-account-token
    
    Data
    ====
    ca.crt:     1025 bytes
    namespace:  11 bytes
    token:      eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLTZnbDZsIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJiMTZhZmJhOS1kZmVjLTExZTctYmJiOS05MDFiMGU1MzI1MTYiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.M70CU3lbu3PP4OjhFms8PVL5pQKj-jj4RNSLA4YmQfTXpPUuxqXjiTf094_Rzr0fgN_IVX6gC4fiNUL5ynx9KU-lkPfk0HnX8scxfJNzypL039mpGt0bbe1IXKSIRaq_9VW59Xz-yBUhycYcKPO9RM2Qa1Ax29nqNVko4vLn1_1wPqJ6XSq3GYI8anTzV8Fku4jasUwjrws6Cn6_sPEGmL54sq5R4Z5afUtv-mItTmqZZdxnkRqcJLlg2Y8WbCPogErbsaCDJoABQ7ppaqHetwfM_0yMun6ABOQbIwwl8pspJhpplKwyo700OSpvTT9zlBsu-b35lzXGBRHzv5g_RA

4.最后我们把 token 输入到 Dashboard 的登录界面中就能登录到我们的 Dashboard里面了

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dld2VlZWVlZWVl_size_16_color_FFFFFF_t_70][]![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dld2VlZWVlZWVl_size_16_color_FFFFFF_t_70 1][]

In order to find out more about how to grant/deny permissions in Kubernetes read official [authentication][] & [authorization][] documentation.

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dld2VlZWVlZWVl_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20190823171714223.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dld2VlZWVlZWVl,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dld2VlZWVlZWVl_size_16_color_FFFFFF_t_70 1]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/11/8d2f9bec8faa4af6911b7d1d86b3c6b2.png
[authentication]: https://kubernetes.io/docs/admin/authentication/
[authorization]: https://kubernetes.io/docs/admin/authorization/