目錄

1.創(chuàng)建用戶

1.1證書創(chuàng)建

1.2創(chuàng)建用戶

1.3允許用戶登陸

1.4切換用戶

1.5刪除用戶

2.RBAC

2.1允許user1用戶查看pod日志

3.使用用戶

1.創(chuàng)建用戶

1.1證書創(chuàng)建

進(jìn)入證書目錄
# cd /etc/kubernetes/pki

創(chuàng)建key
# openssl genrsa -out user1.key 2048
Generating RSA private key, 2048 bit long modulus
.....................................................+++
........+++
e is 65537 (0x10001)

創(chuàng)建csr
# openssl req -new -key user1.key -out user1.csr -subj "/CN=user1"

查看創(chuàng)建結(jié)果
# ll
total 72
-rw-r--r-- 1 root root 1310 Jun 12 14:52 apiserver.crt
-rw-r--r-- 1 root root 1155 Jun 12 14:52 apiserver-etcd-client.crt
-rw------- 1 root root 1679 Jun 12 14:52 apiserver-etcd-client.key
-rw------- 1 root root 1679 Jun 12 14:52 apiserver.key
-rw-r--r-- 1 root root 1164 Jun 12 14:52 apiserver-kubelet-client.crt
-rw------- 1 root root 1675 Jun 12 14:52 apiserver-kubelet-client.key
-rw-r--r-- 1 root root 1099 Jun 12 14:52 ca.crt
-rw------- 1 root root 1675 Jun 12 14:52 ca.key
-rw-r--r-- 1 root root   17 Oct 10 18:07 ca.srl
drwxr-xr-x 2 root root 4096 Jun 12 14:52 etcd
-rw-r--r-- 1 root root 1115 Jun 12 14:52 front-proxy-ca.crt
-rw------- 1 root root 1675 Jun 12 14:52 front-proxy-ca.key
-rw-r--r-- 1 root root 1119 Jun 12 14:52 front-proxy-client.crt
-rw------- 1 root root 1679 Jun 12 14:52 front-proxy-client.key
-rw------- 1 root root 1679 Jun 12 14:52 sa.key
-rw------- 1 root root  451 Jun 12 14:52 sa.pub
-rw-r--r-- 1 root root  883 Oct 10 18:27 user1.csr
-rw-r--r-- 1 root root 1679 Oct 10 18:26 user1.key

修改權(quán)限
# chmod 600 user1.key

使用集群證書簽發(fā)

# openssl x509 -req -in user1.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out user1.crt -days 1095

Signature ok
subject=/CN=user1
Getting CA Private Key

查看簽發(fā)的證書

# openssl x509 -in user1.crt -text -noout

Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            fc:aa:fd:55:13:43:c3:62
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=kubernetes
        Validity
            Not Before: Oct 10 10:30:34 2023 GMT
            Not After : Oct  9 10:30:34 2026 GMT
        Subject: CN=user1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d8:c0:f2:4c:35:42:32:97:12:0f:c1:c2:0f:16:
                    ........篇幅省略
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha256WithRSAEncryption
         8d:92:df:d1:53:cf:0c:e6:97:10:cc:53:37:16:01:0c:69:c3:
         ......篇幅省略

1.2創(chuàng)建用戶

# kubectl config set-credentials user1 --client-certificate=./user1.crt --client-key=./user1.key --embed-certs=true

User "user1" set.

1.3允許用戶登陸

# kubectl config set-context user1@kubernetes --cluster=kubernetes --user=user1

Context "user1@kubernetes" created.

查看集群信息

# kubectl config view

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://master01:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
- context:
    cluster: kubernetes
    user: user1
  name: user1@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: DATA+OMITTED
    client-key-data: DATA+OMITTED
- name: user1
  user:
    client-certificate-data: DATA+OMITTED
    client-key-data: DATA+OMITTED

可以看到user1已經(jīng)存在并可以登陸

1.4切換用戶

# kubectl config use-context user1@kubernetes

Switched to context "user1@kubernetes".

?但此時(shí)用戶沒有任何權(quán)限，需要配置rbac

# kubectl get pod

Error from server (Forbidden): pods is forbidden: User "user1" cannot list resource "pods" in API group "" in the namespace "default"

1.5刪除用戶

# kubectl config delete-context user1@kubernetes

deleted context user1@kubernetes from /root/.kube/config

# kubectl config unset users.user1

Property "users.user1" unset.

2.RBAC

2.1允許user1用戶查看pod日志

# cat user1_pod_get.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-log-reader
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list"]  # 允許 "user1" 用戶獲取和列出 Pod 以及日志
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-log-reader-binding
  namespace: default
subjects:
- kind: User
  name: user1  # 這里的 "user1" 是您之前創(chuàng)建的用戶名稱
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-log-reader
  apiGroup: rbac.authorization.k8s.io

再次使用user1用戶就可以查看pod和日志了

# kubectl get pod -n default

# kubectl logs -f pod/free-study-questionnaire-5c7f8c878d-859wl

3.使用用戶

默認(rèn)需要切換，但給開發(fā)人員或者相關(guān)人員時(shí)他們是不需要切換的，所以需要配置kubectl

首先需要按照kubectl命令

安裝完成后有幾種方式配置：

1、拷貝創(chuàng)建當(dāng)初創(chuàng)建用戶的kubectl命令所在服務(wù)器下的'$HOME/.kube/config'到新kubectl命令所在服務(wù)器的'$HOME/.kube/config'，然后刪除admin和其他不需要的用戶后即可

2、手動(dòng)編寫

需要拷貝ca.crt、user1.crt、user1.key到新kubectl服務(wù)器

編寫如下文件

apiVersion: v1
clusters:
- cluster:
    certificate-authority: ca.crt
    server: https://master01:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: user1
  name: user1@kubernetes
current-context: user1@kubernetes
kind: Config
preferences: {}
users:
- name: user1
  user:
    client-certificate: user1.crt
    client-key: user1.key

如果將該文件名稱定義為 config， 則可以直接使用kubectl命令進(jìn)行操作

如果改名稱為其他，如 user1.yaml，則使用命令需要指定文件

kubectl --kubeconfig=$HOME/.kube/user1.yaml get pods

當(dāng)然你可以有多個(gè)yaml，放在任何目錄下，就可以操作多個(gè)環(huán)境文章來源地址http://www.zghlxwxcb.cn/news/detail-727211.html

到了這里，關(guān)于kubernetes pod日志查看用戶創(chuàng)建的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！