1. # 创建用户授权文件目录
    2. cd /etc/kubernetes/pki
    3. mkdir -p users
    4. cd users/
    6. # 创建 openssl.cnf 配置文件
    7. vim openssl.cnf
    8. ------------------------
    9. [ req ]
    10. default_bits = 2048
    11. default_md = sha256
    12. distinguished_name = req_distinguished_name
    14. [req_distinguished_name]
    16. [ v3_ca ]
    17. basicConstraints = critical, CA:TRUE
    18. keyUsage = critical, digitalSignature, keyEncipherment, keyCertSign
    20. [ v3_req_server ]
    21. basicConstraints = CA:FALSE
    22. keyUsage = critical, digitalSignature, keyEncipherment
    23. extendedKeyUsage = serverAuth
    25. [ v3_req_client ]
    26. basicConstraints = CA:FALSE
    27. keyUsage = critical, digitalSignature, keyEncipherment
    28. extendedKeyUsage = clientAuth
    29. ------------------------
    31. # 使用 openssl 工具创建用户秘钥文件
    32. openssl genrsa -out ifcloud-viewer.key 2048
    34. # 使用 openssl 工具生成用户证书请求文件
    35. openssl req -new -key ifcloud-viewer.key -subj "/CN=ifcloud-viewer/O=CS" -out ifcloud-viewer.csr
    37. # 使用 openssl 工具生成用户证书
    38. openssl x509 -req -in ifcloud-viewer.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -extensions v3_req_client -extfile openssl.cnf -out ifcloud-viewer.crt -days 3650
    40. ==================================================
    41. # 设置集群参数变量，设置一个集群，需要指定根证书和 server-api 服务地址，指定 kubeconfig 文件
    42. export KUBE_APISERVER="https://lb.kubesphere.local:6443"
    43. kubectl config set-cluster k8s-ifcloud-viewer \
    44. --certificate-authority=/etc/kubernetes/pki/ca.crt \
    45. --server=https://lb.kubesphere.local:6443 \
    46. --embed-certs=true \
    47. --kubeconfig=ifcloud-viewer.kubeconfig
    49. # 设置客户端认证参数，设置一个证书用户 devuser，需要指定用户证书和秘钥，指定 kubeconfig 文件
    50. kubectl config set-credentials ifcloud-viewer \        # clustername（自定义必须和其他的保持一致）
    51. --client-certificate=ifcloud-viewer.crt \        
    52. --client-key=ifcloud-viewer.key \
    53. --embed-certs=true \
    54. --kubeconfig=ifcloud-viewer.kubeconfig
    56. # 设置上下文参数，需要指定用户名，可以指定 NAMESPACE，指定 kubeconfig 文件
    57. kubectl config set-context k8s-ifcloud-viewer \        # clustername（自定义必须和其他的保持一致）
    58. --cluster=k8s-ifcloud-viewer \            # clustername（自定义必须和其他的保持一致）
    59. --user=ifcloud-viewer \            # 这里的用户必须要和openssl生成的用户证书CN保持一致
    60. --kubeconfig=ifcloud-viewer.kubeconfig
    62. # 设置上下文配置，指定 kubeconfig 文件
    63. kubectl config use-context k8s-ifcloud-viewer --kubeconfig=ifcloud-viewer.kubeconfig
    65. # 执行完毕，会在当前目录生成以 devuser 命令的 kubeconfig 配置文件
    67. ===================================================
    68. vim k8s_create_kubeconfig_ClusterRole_Clusterrolebanding.yaml
    69. ---
    70. apiVersion: v1
    71. kind: ServiceAccount
    72. metadata:
    73.   name: ifcloud-viewer
    74.   namespace: default
    76. ---
    77. apiVersion: rbac.authorization.k8s.io/v1
    78. kind: ClusterRole
    79. metadata:
    80.   name: ifcloud-viewer
    81. rules:
    82. - apiGroups: [""]
    83.   resources: ["services", "namespaces", "pods", "deployments", "nodes"] 
    84.   verbs: ["get", "watch", "list"]
    85. - apiGroups: ["tenant.kubesphere.io"] 
    86.   resources: ["workspaces"] 
    87.   verbs: ["get", "watch", "list"] 
    88. - apiGroups: ["extensions"] 
    89.   resources: ["ingresses"] 
    90.   verbs: ["get", "watch", "list"] 
    91. - apiGroups: ["networking.k8s.io"] 
    92.   resources: ["ingresses"] 
    93.   verbs: ["get", "watch", "list"] 
    94. - apiGroups: ["gateway.kubesphere.io"] 
    95.   resources: ["gateways"] 
    96.   verbs: ["get", "watch", "list"]
    98. ---
    99. apiVersion: rbac.authorization.k8s.io/v1
    100. kind: ClusterRoleBinding
    101. metadata:
    102.   name: ifcloud-viewer
    103. subjects:
    104. #- kind: ServiceAccount
    105. #  name: ifcloud-viewer
    106. #  namespace: default
    107. - kind: User
    108.   name: ifcloud-viewer
    109.   apiGroup: rbac.authorization.k8s.io
    110. roleRef:  
    111.   kind: ClusterRole
    112.   name: ifcloud-viewer
    113.   apiGroup: rbac.authorization.k8s.io
    115. =========================
    116. # 查看权限
    117. kubectl describe clusterrole ifcloud-viewer