RBAC

创建证书

cd /etc/kubernetes/pki/
# 生成key
openssl genrsa -out wizard.key 2048
# 生成csr，中间层
openssl req -new -key wizard.key -out wizard.csr -subj "/CN=wizard"
# 通过scr来签发证书
openssl x509 -req -in wizard.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out wizard.crt -days 365
# 配置用户证书
kubectl config set-credentials wizard --client-certificate=./wizard.crt --client-key=./wizard.key --embed-certs=true

添加用户到K8s

kubectl config set-context wizard@kubernetes --cluster=kubernetes --user=wizard
kubectl config use-context wizard@kubernetes

useradd wizard
cp -rp /root/.kube/ /home/wizard/
chown -R wizard:wizard /home/wizard/

绑定一个用于当前名称空间的角色

# 创建普通角色
kubectl create role wizard --verb=get,list,watch --resource=pods --dry-run -o yaml > wizard-role.yml
# 绑定角色
kubectl create rolebinding wizard-rolebinding --role=wizard --user=wizard --dry-run -o yaml > wizard-rolebinding.yml

# 绑定一个用于当前名称空间的管理员账户
kubectl create rolebinding wizard-admin-rolebinding --clusterrole=admin --user=wizard --dry-run -o yaml

绑定一个用于集群的角色

# 创建cluster角色
kubectl create clusterrole wizard-cluster --verb=get,list,watch --resource=pods --dry-run -o yaml > wizard-cluster.yml
# 绑定cluster角色
kubectl create clusterrolebinding wizard-clusterrolebinding --clusterrole=wizard-cluster --user=wizard --dry-run -o yaml >wizard-clusterrolebinding.yml

一些命令

解绑角色

# 一键解绑所有
for i in `ls`;do kubectl delete -f ${i};done

切换用户

kubectl config use-context kubernetes-admin@kubernetes
kubectl config use-context wizard@kubernetes

删除用户

# 删除用户
kubectl config unset users.wizard