1.CA簽發(fā)客戶端證書

檢查證書是否存在

# ll /etc/kubernetes/pki/
總用量 48K
-rw-r----- 1 kube root 2.1K  3月  2 16:44 apiserver.crt
-rw------- 1 kube root 1.7K  3月  2 16:44 apiserver.key
-rw-r----- 1 kube root 1.2K  3月  2 16:44 apiserver-kubelet-client.crt
-rw------- 1 kube root 1.7K  3月  2 16:44 apiserver-kubelet-client.key
-rw-r----- 1 kube root 1.1K  3月  2 16:44 ca.crt
-rw------- 1 kube root 1.7K  3月  2 16:44 ca.key
-rw-r----- 1 kube root 1.1K  3月  2 16:44 front-proxy-ca.crt
-rw------- 1 kube root 1.7K  3月  2 16:44 front-proxy-ca.key
-rw-r----- 1 kube root 1.1K  3月  2 16:44 front-proxy-client.crt
-rw------- 1 kube root 1.7K  3月  2 16:44 front-proxy-client.key
-rw------- 1 kube root 1.7K  3月  2 16:44 sa.key
-rw-r----- 1 kube root  451  3月  2 16:44 sa.pub

2.安裝cfssl工具

# wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
# wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
# wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
# chmod +x cfssl*
# mv cfssl_linux-amd64 /usr/bin/cfssl
# mv cfssljson_linux-amd64 /usr/bin/cfssljson
# mv cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo

# ll /usr/bin/cfs*
-rwxrwxrwx 1 root root 9.9M  5月  9 14:53 /usr/bin/cfssl
-rwxrwxrwx 1 root root 6.3M  5月  9 14:54 /usr/bin/cfssl-certinfo
-rwxrwxrwx 1 root root 2.2M  5月  9 14:53 /usr/bin/cfssljson

3.編寫cert.sh

 cat cert.sh 
cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
        "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ],
        "expiry": "87600h"
      }
    }
  }
}
EOF
 
cat > sk-csr.json <<EOF
{
  "CN": "sk",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF
cfssl gencert -ca=/etc/kubernetes/pki/ca.crt -ca-key=/etc/kubernetes/pki/ca.key -config=ca-config.json -profile=kubernetes sk-csr.json | cfssljson -bare sk

API Server會(huì)把客戶端證書的CN字段作為User，把names.O字段作為Group。

需要新建的用戶名為sk

k8s在校驗(yàn)授權(quán)的時(shí)候就會(huì)讀取這兩個(gè)字段。

????????kubelet 使用 TLS Bootstaping 認(rèn)證時(shí)，API Server 可以使用 Bootstrap Tokens 或者 Token authenticationfile 驗(yàn)證=token，無論哪一種，Kubenetes 都會(huì)為 token 綁定一個(gè)默認(rèn)的 User 和 GroupPod使用 ServiceAccount 認(rèn)證時(shí)，service-account-token 中的 JWT 會(huì)保存 User 信息有了用戶信息，再創(chuàng)建一對(duì)角色/角色綁定(集群角色/集群角色綁定)資源對(duì)象，就可以完成權(quán)限綁定了

執(zhí)行cert.sh腳本

# sudo ./cert.sh 
2023/05/30 15:52:54 [INFO] generate received request
2023/05/30 15:52:54 [INFO] received CSR
2023/05/30 15:52:54 [INFO] generating key: rsa-2048
2023/05/30 15:52:54 [INFO] encoded CSR
2023/05/30 15:52:54 [INFO] signed certificate with serial number 528018676919261691291627255415154576375819761670
2023/05/30 15:52:54 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
# ll
總用量 24K
-rw-r----- 1 root     root      292  5月 30 15:52 ca-config.json
-rwxr-x--- 1 nmyunwei nmyunwei  724  5月 10 16:43 cert.sh
-rw-r----- 1 root     root      989  5月 30 15:52 sk.csr
-rw-r----- 1 root     root      215  5月 30 15:52 sk-csr.json
-rw------- 1 root     root     1.7K  5月 30 15:52 sk-key.pem
-rw-r----- 1 root     root     1.3K  5月 30 15:52 sk.pem

上面就是客戶端證書，有多個(gè)用戶需要生成多個(gè)

sk-key.pem 私鑰 類似配置nginx https訪問 .key私鑰

sk.pem 數(shù)字證書 類似配置nginx https訪問的 .crt證書

注意這里要指定k8s根證書的，kubeadm部署的話根證書默認(rèn)在/etc/kubernetes/pki/

# ll /etc/kubernetes/pki/
總用量 12K
-rw-r----- 1 kube root 1.1K  3月  2 16:44 ca.crt
-rw------- 1 kube root 1.7K  5月  9 15:11 ca.key
-rw-r----- 1 root root   41  5月  9 17:14 ca.srl

????????以上步驟就是生成了根證書的配置文件ca-config.json，再生成為某個(gè)用戶頒發(fā)的客戶端請(qǐng)求文件。

????????最后就是使用cfssl工具指定相關(guān)的文件去生成客戶端所需要的證書。每個(gè)用戶的客戶端證書都是這樣生成的。唯一需要區(qū)分的就是CN字段的用戶名。

?

生成kubeconfig授權(quán)文件

1.生產(chǎn)sk.kubeconfig的配置文件

sk為用戶名

# cat sconfig.sh 
kubectl config set-cluster kubernetes \
  --certificate-authority=/etc/kubernetes/pki/ca.crt \
  --embed-certs=true \
  --server=https://10.221.221.221:8443 \  
  --kubeconfig=sk.kubeconfig

?server的地址為k8s集群中master主機(jī)vip的ip：port

# ./sconfig.sh 
Cluster "kubernetes" set.

# cat sk.kubeconfig 
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURBRENDQWVpZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQ0FYRFRJek1ETXdNakE0TkRBek0xb1lEekl4TWpNd01qQTJNRGcwTURNeldqQVZNUk13RVFZRApWUVFERXdwcmRXSmxjbTVsZEdWek1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxMDBGV3huOVdacXY1bElhei9GcXpGZ1V6ZG1sYUthUnZpb2s1eVkKRFkyK0VjaU0yNmFCU3ZucFo4NmREcjB3bUNBZThKNkpYKzBKSmJqZUhMOE9GR2ppQmdIWlR0M2RmZlNNVkM5cgpVRkZqR3M1TnB6Qm1uNEZ5Z3lOSXVRcmNHMmVid3NBSm1nWXJVamV4Tkl5T1dzZnhNU3dJZkhsT3p2SmxnOVRCCkdWaTE5RFF2K0NkanFoek8wNmMrRG4xaWFsZ2JpNU5YK0kyekkvMmowQkUrdUhaTFJFZHNSUXE2dVFpeHVySXgKZ0t6R2h3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
    server: https://10.221.221.221:8443
  name: kubernetes
contexts: null
current-context: ""
kind: Config
preferences: {}
users: null

??本段設(shè)置了所需要訪問的集群的信息。

使用set-cluster設(shè)置了需要訪問的集群，如上為kubernetes，這只是個(gè)名稱，實(shí)際為--server指向的apiserver

--certificate-authority設(shè)置了該集群的公鑰

--embed-certs為true表示將--certificate-authority證書寫入到kubeconfig中

--server則表示該集群的kube-apiserver地址，需手動(dòng)修改為對(duì)應(yīng)集群地址

生成的kubeconfig 被保存到 sk.kubeconfig文件

2.用戶參數(shù)設(shè)置

# cat userconfig.sh 
kubectl config set-credentials sk    --client-key=sk-key.pem    --client-certificate=sk.pem    --embed-certs=true    --kubeconfig=sk.kubeconfig

# ./userconfig.sh 
User "sk" set.

再次查看sk.kubeconfig文件

# cat sk.kubeconfig 
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURBRENDQWVpZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQ0FYRFRJek1ETXdNakE0TkRBek0xb1lEekl4TWpNd01qQTJNRGcwTURNeldqQVZNUk13RVFZRApWUVFERXdwcmRXSmxjbTVsZEdWek1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBCnlBV3JjNnphREdQN1hZS1h0anB0WWVKSVd3SVdsUzEwbENwYjB2RkIyK3NEUUVPeENPMWFLMkRwc1VMZVRKRzIKU1pqTGxxYkxkek5RMWhNeWN0cjltdUMrY2I0bW52Skh4RDJ3Y1ZKUDh1bld4eTRVWTJZVzhxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxvSXVoaytDSGhlZEFNClNiL3lZTEJRVnNIcGFuWGdKdWpoWm9vUjVxMDBGV3huOVdacXY1bElhei9GcXpGZ1V6ZG1sYUthUnZpb2s1eVkKRFkyK0VjaU0yNmFCUxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxlNNVkM5cgpVRkZqR3M1TnB6Qm1uNEZ5Z3lOSXVRcmNHMmVid3NBSm1nWXJVamV4Tkl5T1dzZnhNU3dJZkhsT3p2SmxnOVRCCkdWaTE5RFF2K0NkanFoek8wNmMrRG4xaWFsZ2JpNU5YK0kyekkvMmowQkUrdUhaTFJFZHNSUXE2dVFpeHVySXgKZ0t6R2h3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
    server: https://10.221.221.221:8443
  name: kubernetes
contexts: null
current-context: ""
kind: Config
preferences: {}
users:
- name: sk
  user:
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURmekNDQW1lZ0F3SUJBZ0lVWEgwdEpaNDlqV3pScENXdDdsK1Q0L3JqZUFZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZURVRNQkVHQTFVRUF4TUthM1ZpWlhKdVpYUmxjekFlRncweU16QTFNekF3TnpRNE1EQmFGdzB6TXpBMQpNamN3TnpRNE1EQmFNRjB4Q3pBSkJnTlZCQVlUQWtOT01SQXdEZ1lEVlFRSUV3ZENaV2xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxVjZPdEtoVwpzODNGclE4czAwTEFMYWJwRmk1YlVNcTVzK2Q1VVZvaG1qQXgvU0YzdFA0SitUNW9sRUNTcWE1MVZ6bmhtZHZ6ClgwMW5TR0QvMnV5QnRVZ0tCMVVLRGNpQ1Bxa0dzSUE4NkZWODU3RERCbEcyQm80PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBMHhsNkVwQStTekZycGFTNFlPdktxREY4YVJ6eTUvaDRZYTNVWlZkYzRoR012RG1iCkE1ZDdTWkhjYjJaYTY3OFcxbW5GVlV2Z01xT1U4Zm92dDREaHZFeDdrSC9pdnNlRk5sc3ZUSlYwaU53NnptV2QKcEttaGZSTVo5Nm9hajNBZG1zTlkyS2xhdnFwc1puZGQzbHorZnZUTGM3eEh5UmNVSVpUNm9YRmNPZGpRRGJyawpHVlVjZ0N2eUt1ZlpybXk0emNDbGlxMzlWK3VveWprL0tsa3J6OGdOV0tmN3Q5dnlJRnF3TTFMK0tkNFBrNDFPCjd6azd4NlF5SitzTXMrMjBNZ0lETkhtUEIwK1lMTEIxRVVHTUI2RFc4RmpQUDIrK09udGJkUEpKRnVKenNmT0cKWTlKdHE3TzRoOEJndnJVN1pYSlBxWUtXaDM4cjFZZVhlVk16andJREFRQUJBbxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx2NjQzZAp2c0xUa0E1eGdFYUh0dHd1a0hZUTI4M2dtYWp0Q2tzVEJMek14ZEdQNWlXenl6RDNsQXFLYTlDcFVtV1BvMmVRCjJjU0hBb0dCQUxtaFRkVWRNaWZmSG9MaFo2NFZ2N2RGUEpyUy9GbzY5Nk01aDN6Y3YwUXZEL1RxWGlTcEJCNXMKSWN5ZDJDd0wwWjZVUHk4bDJxV0lXaTlibTFSUjdPNkJRNmdQQlJQdTU0S1I2S3VGQVZjK2tpQ1VhWXpYYzJ0NApXS3pXQisxS3hoZGNySFIwTmtUeUYvTDM5WGJiZ3BGc3BRR2ZXSVBZN1U2L3YvM0xKc0VJCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

?本段主要設(shè)置用戶的相關(guān)信息，主要是用戶證書。

如上的用戶名為sk，證書為：sk.pem，私鑰為：sk-key.pem。

注意客戶端的證書首先要經(jīng)過集群CA的簽署，否則不會(huì)被集群認(rèn)可。

此處使用的是ca認(rèn)證方式，也可以使用token認(rèn)證，

如kubelet的 TLS Boostrap機(jī)制下的bootstrapping使用的就是token認(rèn)證方式。

上述kubectl使用的是ca認(rèn)證，不需要token字段

3.設(shè)置上下文參數(shù)

# cat context.sh 
 kubectl config set-context kubernetes --cluster=kubernetes --user=sk --kubeconfig=sk.kubeconfig

# ./context.sh 
Context "kubernetes" created.

?再次查看sk.kubeconfig文件

# cat sk.kubeconfig 
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURBRENDQWVpZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQ0FYRFRJek1ETXdNakE0TkRBek0xb1lEekl4TWpNd01qQTJNRGcwTURNeldqQVZNUk13RVFZRApWUVFERXdwcmRXSmxjbTVsZEdWek1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx1V6ZG1sYUthUnZpb2s1eVkKRFkyK0VjaU0yNmFCU3ZucFo4NmREcjB3bUNBZThKNkpYKzBKSmJqZUhMOE9GR2ppQmdIWlR0M2RmZlNNVkM5cgpVRkZqR3M1TnB6Qm1uNEZ5Z3lOSXVRcmNHMmVid3NBSm1nWXJVamV4Tkl5T1dzZnhNU3dJZkhsT3p2SmxnOVRCCkdWaTE5RFF2K0NkanFoek8wNmMrRG4xaWFsZ2JpNU5YK0kyekkvMmowQkUrdUhaTFJFZHNSUXE2dVFpeHVySXgKZ0t6R2h3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
    server: https://10.221.236.248:8443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: sk
  name: kubernetes
current-context: ""
kind: Config
preferences: {}
users:
- name: sk
  user:
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURmekNDQW1lZ0F3SUJBZ0lVWEgwdEpaNDlqV3pScENXdDdsK1Q0L3JqZUFZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZURVRNQkVHQTFVRUF4TUthM1ZpWlhKdVpYUmxjekFlRncweU16xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx1hIaXM4OEZLc1Z2cnhXdTNkdzJqR2lrNUczVjZPdEtoVwpzODNGclE4czAwTEFMYWJwRmk1YlVNcTVzK2Q1VVZvaG1qQXgvU0YzdFA0SitUNW9sRUNTcWE1MVZ6bmhtZHZ6ClgwMW5TR0QvMnV5QnRVZ0tCMVVLRGNpQ1Bxa0dzSUE4NkZWODU3RERCbEcyQm80PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBMHhsNkVwQStTekZycGFTNFlPdktxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxwTmtUeUYvTDM5WGJiZ3BGc3BRR2ZXSVBZN1U2L3YvM0xKc0VJCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

??集群參數(shù)和用戶參數(shù)可以同時(shí)設(shè)置多對(duì)，在上下文參數(shù)中將集群參數(shù)和用戶參數(shù)關(guān)聯(lián)起來。

上面的上下文名稱為kubenetes，集群為kubenetes，用戶為sk，表示使用sk的用戶憑證來訪問kubenetes集群的default命名空間，也可以增加--namspace來指定訪問的命名空間。

最后使用kubectl config use-context kubernetes來使用名為kubenetes的環(huán)境項(xiàng)來作為配置。

如果配置了多個(gè)環(huán)境項(xiàng)，可以通過切換不同的環(huán)境項(xiàng)名字來訪問到不同的集群環(huán)境。

4.新增用戶

# useradd -d /data/sk -m sk

# passwd sk
更改用戶 sk 的密碼 。
新的 密碼：
重新輸入新的 密碼：
passwd：所有的身份驗(yàn)證令牌已經(jīng)成功更新。

?5.設(shè)置當(dāng)前kubernetes

#  kubectl config use-context kubernetes --kubeconfig=sk.kubeconfig
Switched to context "kubernetes".

?6.設(shè)置角色并綁定角色

# cat rbac.yaml 
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: ns-nmzh  #指定用戶命名空間
  name: sk
rules:            #配置授權(quán)維度
- apiGroups: [""]   # '*' 匹配所有資源組
  resources: ["pods","pods/exec","pods/log"]
  verbs: ["get","watch","list","create","update","patch"]  #資源操作方法，除了delete權(quán)限不給，其他權(quán)限給了

---

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: sk
  namespace: ns-nmzh # 指定用戶命名空間
subjects:
- kind: User
  name: sk  # 指定kubeconfig用戶
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: sk
  apiGroup: rbac.authorization.k8s.io

綁定角色驗(yàn)證

# su - sk
最后一次失敗的登錄： 二 5月  9 15:40:55 CST 2023 pts/0 上
最后一次成功登錄后有 3 次失敗的登錄嘗試。

# kubectl get po -A
The connection to the server localhost:8080 was refused - did you specify the right host or port?

# exit
注銷

# kubectl apply -f rbac.yaml 
role.rbac.authorization.k8s.io/sk unchanged
rolebinding.rbac.authorization.k8s.io/sk unchanged

# su - sk
上一次登錄： 二 5月 30 16:27:23 CST 2023 pts/0 上

# kubectl  get po -A
The connection to the server localhost:8080 was refused - did you specify the right host or port?

# kubectl  get po -n ns-nmzh
The connection to the server localhost:8080 was refused - did you specify the right host or port?

?7.用戶設(shè)置.kube目錄

在sk用戶家目錄下創(chuàng)建.kube文件夾，將上文生成的sk.kubeconfig復(fù)制到.kube下，并改名為config

# 在root用戶下操作，或普通用戶具有sudo權(quán)限
# mkdir .kube

# cp sk.kubeconfig  /data/sk/.kube/
# cd .kube/
# ll
總用量 8.0K
-rw------- 1 root root 5.7K  5月 30 16:34 sk.kubeconfig

# mv /data/sk/.kube/sk.kubeconfig  /data/sk/.kube/config
# ll /data/sk/.kube/
總用量 8.0K
-rw------- 1 root root 5.7K  5月 30 16:34 config

# chown -R sk:sk /data/sk/.kube/config 

?執(zhí)行命令驗(yàn)證

$ kubectl  get po -A
Error from server (Forbidden): pods is forbidden: User "sk" cannot list resource "pods" in API group "" at the cluster scope

# kubectl  get po -n ns-nmzh
NAME                                                    READY   STATUS    RESTARTS       AGE
deploy-abtest-559c7b469b-2cvd7                          1/1     Running   0              13d
deploy-harbor90test-85c8c54f47-qtc92                    1/1     Running   11 (16h ago)   13d
deploy-testc-56684fbbf7-5bbcd                           1/1     Running   0              12d
deploy-testv622-5cc555ff97-ccn7q                        1/1     Running   0              28h
deploy-tomcat-test-9638b3ce-8ffc0854-7785598bdf-fplvw   1/1     Running   7 (2d4h ago)   20d
deploy-ttttttt-422f8813-cb55fa7b-6c99888d84-mlttq       1/1     Running   14 (31h ago)   20d
deploy-zhzy-web3-57dc554566-9m5r5                       1/1     Running   0              14d
sts-jjfredis1-0                                         1/1     Running   0              13d
sts-jjfredis1-1                                         1/1     Running   0              13d

# kubectl delete po deploy-harbor90test-85c8c54f47-qtc92 -n ns-nmzh
Error from server (Forbidden): pods "deploy-harbor90test-85c8c54f47-qtc92" is forbidden: User "sk" cannot delete resource "pods" in API group "" in the namespace "ns-nmzh"

# ll .kube/
總用量 8.0K
drwxr-x--- 4 sk sk   35  5月 30 16:39 cache
-rw------- 1 sk sk 5.7K  5月 30 16:34 config

原理參考鏈接Kubernetes RBAC 為指定用戶授權(quán)訪問不同命名空間權(quán)限_富士康質(zhì)檢員張全蛋的博客-CSDN博客文章來源地址http://www.zghlxwxcb.cn/news/detail-492841.html

到了這里，關(guān)于K8S RBAC之Kubeconfig設(shè)置用戶權(quán)限，不同的用戶訪問不同的namespace的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！