kubernetes认证及serviceaccount
认证
授权：
RBAC（目前的主流授权方式）
准入控制：
了解即可
--> 认证
授权 准入控制
客户端 --》api-server:
user: username,uid
group:
extra:
API
Request path
serviceaccount
k8s的资源如果支持create 那么可以使用--dry-run来生成清单配置
--dry-run
获取单个pod的清单配置
[[email protected] ~]# kubectl get pods pod-cm-nginx-3 -o yaml --export
[[email protected] ~]# kubectl get sa
NAME SECRETS AGE
default 1 6d17h
[[email protected] ~]# kubectl create serviceaccount admin
serviceaccount/admin created
kubernetes集群有两类认证值的用户账号
1.useraccount 用户，人的账号
2.serviceaccount 服务账号，pod等资源想访问k8s中apiservice时候里面需要用到的认证信息，包括用户名，密码等
为pod获取私有镜像images的两种方式：
1.使用imagepullsecreit字段指定
2.使用sa（serviceaccount）
kubectl 是怎么认证
kubectl config
kubeconfig
[[email protected] ~]# kubectl config view
连接apiserver
[[email protected] pki]# (umask 077 ; openssl genrsa -out magedu.key 2048)
Generating RSA private key, 2048 bit long modulus
............+++
.......+++
e is 65537 (0x10001)
[[email protected] pki]# openssl req -new -key magedu.key -out magedu.csr -subj "/CN=magedu"
[[email protected] pki]# openssl x509 -req -in magedu.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out magedu.crt -days 365
Signature ok
subject=/CN=magedu
Getting CA Private Key
添加到k8s集群可以认证：
[[email protected] pki]# kubectl config set-credentials magedu --client-certificate=./magedu.crt --client-key=./magedu.key --embed-certs=true
User "magedu" set.
[[email protected] pki]# kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://10.250.0.89:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kubernetes-admin
name: [email protected]
current-context: [email protected]
kind: Config
preferences: {}
users:
- name: kubernetes-admin
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
- name: magedu
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
[[email protected] pki]# kubectl config set-context [email protected] --cluster=kubernetes --user=magedu
Context "[email protected]" created.
[[email protected] pki]# kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://10.250.0.89:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kubernetes-admin
name: [email protected]
- context:
cluster: kubernetes
user: magedu
name: [email protected]
current-context: [email protected]
kind: Config
preferences: {}
users:
- name: kubernetes-admin
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
- name: magedu
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
切换上下文：
[[email protected] pki]# kubectl config use-context [email protected]
Switched to context "[email protected]".
[[email protected] pki]# kubectl get pods
Error from server (Forbidden): pods is forbidden: User "magedu" cannot list resource "pods" in API group "" in the namespace "default"
切换回admin
[[email protected] pki]# kubectl config use-context [email protected]
Switched to context "[email protected]".
定义集群：
[[email protected] pki]# kubectl config set-cluster mycluster --kubeconfig=/tmp/test.conf --server="https://172.20.0.70:6443" --certificate-authority=/etc/kubernetes/pki/ca.crt --embed-certs=true
Cluster "mycluster" set.
[[email protected] pki]# kubectl config view --kubeconfig=/tmp/test.conf
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://172.20.0.70:6443
name: mycluster
contexts: []
current-context: ""
kind: Config
preferences: {}
users: []
通过magedu去访问k8s集群
原文地址：https://www.cnblogs.com/heaven-xi/p/11312623.html