9.k8s中sa指定-角色绑定-资源限制
·
K8S默认基于sa进行认证
1. 为何需要Service Account
Kubernetes原生（kubernetes-native）托管就支持sa账号，通常需要直接与API Server进行交互以获取必要的信息。
API Server同样需要对这类来自于Pod资源中客户端程序进行身份验证，Service Account也就是设计专用于这类场景的账号。
ServiceAccount是API Server支持的标准资源类型之一。
- 1.基于资源对象保存ServiceAccount的数据;
- 2.认证信息保存于ServiceAccount对象专用的Secret中（v1.23-版本）
- 3.支持名称空间级别，专供集群上的Pod中的进程访问API Server时使用;
2. Pod使用ServiceAccount方式
在Pod上使用Service Account通常有两种方式：
- 自动设定：
Service Account通常由API Server自动创建并通过ServiceAccount准入控制器自动关联到集群中创建的每个Pod上。
如果Pod没有定义serviceAccountName字段，则默认使用当前名称空间下的一个"default"的sa账号。
创建sa并让pod引用指定的sa
# sa-pods.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: oldboy
#创建一个oldboy的sa
---
apiVersion: v1
kind: Pod
metadata:
name: oldboyedu-pods-sa
spec:
# 使用sa的名称
serviceAccountName: oldboy #记住pod如何引用sa
containers:
- name: c1
image: registry.cn-hangzhou.aliyuncs.com/yinzhengjie-k8s/apps:v1
[root@master231 auth]# kubectl apply -f sa-pods.yaml
serviceaccount/oldboy created
pod/oldboyedu-pods-sa created
[root@master231 auth]# kubectl get pods,sa -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
pod/oldboyedu-pods-sa 1/1 Running 0 5s 10.100.2.2 worker233 <none> <none>
NAME SECRETS AGE
serviceaccount/default 1 8d #自己默认创建的
serviceaccount/oldboy 1 5s #自定义创建的
5. 验证pod使用sa的验证身份
[root@master231 auth]# kubectl exec -it oldboyedu-pods-sa -- sh 进入到这个pod内部
/ # ls -l /var/run/secrets/kubernetes.io/serviceaccount #这是认证信息默认的挂载点
total 0
lrwxrwxrwx 1 root root 13 Sep 28 01:17 ca.crt -> ..data/ca.crt
lrwxrwxrwx 1 root root 16 Sep 28 01:17 namespace -> ..data/namespace
lrwxrwxrwx 1 root root 12 Sep 28 01:17 token -> ..data/token
/ # cat /var/run/secrets/kubernetes.io/serviceaccount/token
eyJhbGciOiJSUzI1NiIsImtpZCI6IkR0dEIwTzJGbFJlN2xFVUNUZGRhV2tkS3BSS3RlZzVKZ3V6dVJjdDh4NkkifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLm9sZGJveWVkdS5jb20iXSwiZXhwIjoxNzkwNTU4MjUzLCJpYXQiOjE3NTkwMjIyNTMsImlzcyI6Imh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2Yy5vbGRib3llZHUuY29tIiwia3ViZXJuZXRlcy5pbyI6eyJuYW1lc3BhY2UiOiJkZWZhdWx0IiwicG9kIjp7Im5hbWUiOiJvbGRib3llZHUtcG9kcy1zYSIsInVpZCI6ImQzMjhmZTdmLWFjMDYtNGQ5Ni05NmUxLTkwMGZmNWFkZWE3ZiJ9LCJzZXJ2aWNlYWNjb3VudCI6eyJuYW1lIjoib2xkYm95IiwidWlkIjoiNDEzYzJhNmItOWZiYS00OTRiLTg2MDctMTg4ZTdmMzNmMzNlIn0sIndhcm5hZnRlciI6MTc1OTAyNTg2MH0sIm5iZiI6MTc1OTAyMjI1Mywic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50OmRlZmF1bHQ6b2xkYm95In0.ZkBLHVNGdgK_ooSbUQ8CYgledKWKVXS-I067uuxNJ2ovZN8SCKpqEAHIfJtSmW0GPPr8WwSXEX8HYoznRWY4U6nkK6gkXVnbjmsg3VS9blwvYa2bF_27zuvUQXgS_10aK_AwbEVVzgXuvLHa9eAe53bMGI3H3x93Qc4OSukHHDmFo_kCRY-K03lgb0nEP7jXWv8O-exeEuaADe79DpiGODRymPh_8RxkxCpNlJfO0at8dsogLr9qIw3er-J0uAoAiMjI8J4Se1_IF-BhN2UPvG19cApXfpvZfp76WWIL2UNR69C0InXYOoIsfeEWyCduytw-awoe0X964NGWEJX7KA/ #
/ #
/ #
/ # TOKEN=`cat /var/run/secrets/kubernetes.io/serviceaccount/token` #存在变量中
/ #
/ # curl -k -H "Authorization: Bearer ${TOKEN}" https://kubernetes.default.svc.oldboyedu.com;echo
{
"kind": "Status",
"apiVersion": "v1",
"metadata": {},
"status": "Failure",
"message": "forbidden: User \"system:serviceaccount:default:oldboy\" cannot get path \"/\"",
"reason": "Forbidden",
"details": {},
"code": 403
}
#直接去认证试一下，指向api-server
#使用的是名为 oldboy 的 Service Account（位于 default 命名空间），完整身份为： system:serviceaccount:default:oldboy
clusteradmin管理员角色绑定用户实战
相关角色说明：
从权限角度而言，其中cluster-admin相当于Linux的root用户。
其次是admin，edit和view权限依次减小。其中view权限最小，对于的大多数资源只能读取。
2. 查看集群角色’cluster-admin’相当于Linux的root用户。
[root@master231 pods]# kubectl get clusterrole cluster-admin -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
creationTimestamp: "2025-05-22T02:57:49Z"
labels:
kubernetes.io/bootstrapping: rbac-defaults
name: cluster-admin
resourceVersion: "86"
uid: 7324f527-e03e-425a-a4ba-3f4dca4a6017
rules:#对所有核心组的所有核心资源有执行权限，相当于Linux的root权限
- apiGroups:
- '*'
resources:
- '*'
verbs:
- '*'
- nonResourceURLs:
- '*'
verbs:
- '*'
#所以我们集群角色创建好了，用户也创建好了，只要创建一个bind就可以跑起来了
2. 将我们自定义的kubeconfig文件的用户进行授权案例
2.1 环境准备未授权前
[root@worker232 ~]# kubectl get pods --kubeconfig=yinzhengjie-k8s-token.conf #未授权的时候无法，无法操作
Error from server (Forbidden): pods is forbidden: User "yinzhengjie" cannot list resource "pods" in API group "" in the namespace "default"
2.2 授权用户：授权集群角色cluster-admin给用户yinzhengjie。这样一个绑定组设置名称为myuser
[root@master231 rbac]# kubectl create clusterrolebinding myuser --clusterrole=cluster-admin --user=yinzhengjie
clusterrolebinding.rbac.authorization.k8s.io/myuser created
2.3 查看集群角色绑定信息
[root@master231 rbac]# kubectl get clusterrolebindings myuser
NAME ROLE AGE
myuser ClusterRole/cluster-admin 90s
[root@master231 rbac]# kubectl get clusterrolebindings myuser -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
creationTimestamp: "2025-09-28T01:38:24Z"
name: myuser
resourceVersion: "351947"
uid: 0dc22252-346c-49f3-b136-c6a8fd5b15b9
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: yinzhengjie
2.4 验证权限
[root@worker232 ~]# kubectl get pods --kubeconfig=yinzhengjie-k8s-token.conf -n kube-system 想看某个名称空间的资源想看就看
NAME READY STATUS RESTARTS AGE
coredns-6d8c4cb4d-s85bq 1/1 Running 212 (66m ago) 8d
coredns-6d8c4cb4d-tdrnj 1/1 Running 211 (66m ago) 8d
etcd-master231 1/1 Running 3 (66m ago) 8d
kube-apiserver-master231 1/1 Running 1 (66m ago) 18h
kube-controller-manager-master231 1/1 Running 19 (66m ago) 8d
kube-proxy-55jhz 1/1 Running 3 (66m ago) 3d21h
kube-proxy-7ffbs 1/1 Running 7 (66m ago) 3d21h
kube-proxy-xgqln 1/1 Running 4 (66m ago) 3d21h
kube-scheduler-master231 1/1 Running 19 (66m ago) 8d
[root@worker232 ~]# kubectl get nodes --kubeconfig=yinzhengjie-k8s-token.conf
NAME STATUS ROLES AGE VERSION
master231 Ready control-plane,master 8d v1.23.17
worker232 Ready <none> 8d v1.23.17
worker233 Ready <none> 8d v1.23.17
2.5 删除绑定关系
[root@master231 rbac]# kubectl get clusterrolebindings myuser
NAME ROLE AGE
myuser ClusterRole/cluster-admin 2m18s
[root@master231 rbac]# kubectl delete clusterrolebindings myuser
clusterrolebinding.rbac.authorization.k8s.io "myuser" deleted
[root@master231 rbac]# kubectl get clusterrolebindings myuser
Error from server (NotFound): clusterrolebindings.rbac.authorization.k8s.io "myuser" not found
2.6 验证客户端权限会立即生效：发现删除权限之后无法进行控制
[root@worker232 ~]# kubectl get nodes --kubeconfig=yinzhengjie-k8s-token.conf
Error from server (Forbidden): nodes is forbidden: User "yinzhengjie" cannot list resource "nodes" in API group "" at the cluster scope
所以master中的kubernetes-admin用户
kubernetes-admin 用户：这是证书中的 CN（Common Name），通常通过 system:masters 组间接绑定到 cluster-admin 角色。
Role授权给一个用户类型实战
1. 未授权前测试：根据认证策略优先级，把这个认证文件放到这个目录下可以，直接认证，则不需要加—kubeconifg这个参数
[root@worker233 ~]# cp yinzhengjie-k8s-certs.conf ~/.kube/config
[root@worker233 ~]# kubectl get pods -o wide
Error from server (Forbidden): pods is forbidden: User "jiege" cannot list resource "pods" in API group "" in the namespace "default"
[root@worker233 ~]# kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority: /etc/kubernetes/pki/ca.crt
server: https://10.0.0.231:6443
name: myk8s
contexts:
- context:
cluster: myk8s
user: jiege
name: jiege@myk8s
current-context: jiege@myk8s
kind: Config
preferences: {}
users:
- name: jiege
user:
client-certificate-data: REDACTED
client-key-data: REDACTED
2. 创建Role：定义一个角色
[root@master231 ~]# kubectl create role reader --resource=po,svc --verb=get,watch,list -o yaml --dry-run=client # 声明式查看
apiVersion: rbac.authorization.k8s.io/v1 #下面是给用户的一些授权
kind: Role
metadata:
creationTimestamp: null
name: reader
rules:
- apiGroups:
- ""
resources:
- pods
- services
verbs:
- get
- watch
- list
- apiGroups:
- apps
resources:
- deployments
verbs:
- get
- watch
- list
#创建角色
[root@master231 ~]# kubectl create role reader --resource=po,svc,deploy --verb=get,watch,list # 响应式创建了叫reader的角色
role.rbac.authorization.k8s.io/reader created #可以操作po，svc，deploy资源，可以执行get，watch，list等操作。不用关心什么组
[root@master231 ~]# kubectl get role
NAME CREATED AT
reader 2025-09-28T02:24:49Z
3. 创建角色绑定：将创建的角色reader和用户jiege进行绑定
[root@master231 ~]# kubectl create rolebinding jiege-as-reader --user=jiege --role=reader -o yaml --dry-run=client #这个是获取资源清单
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
creationTimestamp: null
name: jiege-as-reader
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: reader
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: jiege
[root@master231 ~]# kubectl create rolebinding jiege-as-reader --user=jiege --role=reader #真正的创建
rolebinding.rbac.authorization.k8s.io/jiege-as-reader created
[root@master231 ~]# kubectl get rolebindings -o wide
NAME ROLE AGE USERS GROUPS SERVICEACCOUNTS
jiege-as-reader Role/reader 25s jiege
4. 授权后再次验证
[root@worker233 ~]# kubectl get pods,svc,deploy
NAME READY STATUS RESTARTS AGE
pod/deploy-xiuxian-6f5c7c558b-49h7j 1/1 Running 0 84s
pod/deploy-xiuxian-6f5c7c558b-ljnkk 1/1 Running 0 84s
pod/deploy-xiuxian-6f5c7c558b-qmps9 1/1 Running 0 84s
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-75d4c 1/1 Running 0 84s
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-cbl79 1/1 Running 0 84s
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-fg6jc 1/1 Running 0 84s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.200.0.1 <none> 443/TCP 23h
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/deploy-xiuxian 3/3 3 3 84s
deployment.apps/deploy-xiuxian-imagepullpolicy 3/3 3 3 84s
[root@worker233 ~]# kubectl delete pods --all 没有给jiege删除权限，所以无法操作
Error from server (Forbidden): pods "deploy-xiuxian-6f5c7c558b-49h7j" is forbidden: User "jiege" cannot delete resource "pods" in API group "" in the namespace "default"
Error from server (Forbidden): pods "deploy-xiuxian-6f5c7c558b-ljnkk" is forbidden: User "jiege" cannot delete resource "pods" in API group "" in the namespace "default"
Error from server (Forbidden): pods "deploy-xiuxian-6f5c7c558b-qmps9" is forbidden: User "jiege" cannot delete resource "pods" in API group "" in the namespace "default"
Error from server (Forbidden): pods "deploy-xiuxian-imagepullpolicy-5c4f574cf6-75d4c" is forbidden: User "jiege" cannot delete resource "pods" in API group "" in the namespace "default"
Error from server (Forbidden): pods "deploy-xiuxian-imagepullpolicy-5c4f574cf6-cbl79" is forbidden: User "jiege" cannot delete resource "pods" in API group "" in the namespace "default"
Error from server (Forbidden): pods "deploy-xiuxian-imagepullpolicy-5c4f574cf6-fg6jc" is forbidden: User "jiege" cannot delete resource "pods" in API group "" in the namespace "default"
[root@worker233 ~]# kubectl get pods -n kube-system #也没给权限，role只能给到某个名称空间下的操作
Error from server (Forbidden): pods is forbidden: User "jiege" cannot list resource "pods" in API group "" in the namespace "kube-system"
5. 响应式修改权限：将 -o yaml --dry-run=client删除就是声明的修改
[root@master231 ~]# kubectl create role reader --resource=po,svc,deploy --verb=get,watch,list,delete -o yaml --dry-run=client | kubectl apply -f -
Warning: resource roles/reader is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
role.rbac.authorization.k8s.io/reader configured
6. 测试验证
[root@worker233 ~]# kubectl get pods,svc,deploy
NAME READY STATUS RESTARTS AGE
pod/deploy-xiuxian-6f5c7c558b-49h7j 1/1 Running 0 2m52s
pod/deploy-xiuxian-6f5c7c558b-ljnkk 1/1 Running 0 2m52s
pod/deploy-xiuxian-6f5c7c558b-qmps9 1/1 Running 0 2m52s
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-75d4c 1/1 Running 0 2m52s
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-cbl79 1/1 Running 0 2m52s
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-fg6jc 1/1 Running 0 2m52s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.200.0.1 <none> 443/TCP 23h
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/deploy-xiuxian 3/3 3 3 2m52s
deployment.apps/deploy-xiuxian-imagepullpolicy 3/3 3 3 2m52s
[root@worker233 ~]# kubectl delete pods --all
pod "deploy-xiuxian-6f5c7c558b-49h7j" deleted
pod "deploy-xiuxian-6f5c7c558b-ljnkk" deleted
pod "deploy-xiuxian-6f5c7c558b-qmps9" deleted
pod "deploy-xiuxian-imagepullpolicy-5c4f574cf6-75d4c" deleted
pod "deploy-xiuxian-imagepullpolicy-5c4f574cf6-cbl79" deleted
pod "deploy-xiuxian-imagepullpolicy-5c4f574cf6-fg6jc" deleted
[root@worker233 ~]#
[root@worker233 ~]# kubectl get pods,svc,deploy
NAME READY STATUS RESTARTS AGE
pod/deploy-xiuxian-6f5c7c558b-85hb9 1/1 Running 0 7s
pod/deploy-xiuxian-6f5c7c558b-gt8f7 1/1 Running 0 7s
pod/deploy-xiuxian-6f5c7c558b-sz66v 1/1 Running 0 7s
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-26rnm 1/1 Running 0 7s
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-b5w6d 1/1 Running 0 7s
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-cpkgc 1/1 Running 0 7s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.200.0.1 <none> 443/TCP 23h
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/deploy-xiuxian 3/3 3 3 3m2s
deployment.apps/deploy-xiuxian-imagepullpolicy 3/3 3 3 3m2s
7. 声明式修改权限：另一种方法声明式修改把deploy权限删了
[root@master231 ~]# kubectl create role reader --resource=po,svc --verb=get,watch,list -o yaml --dry-run=client
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
creationTimestamp: null
name: reader
rules:
- apiGroups:
- ""
resources:
- pods
- services
verbs:
- get
- watch
- list
[root@master231 ~]# kubectl create role reader --resource=po,svc --verb=get,watch,list -o yaml --dry-run=client > /tmp/reader.yaml
[root@master231 ~]# kubectl apply -f /tmp/reader.yaml
role.rbac.authorization.k8s.io/reader configured
8. 测试验证
[root@worker233 ~]# kubectl get deploy,svc,po -o wide
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
service/kubernetes ClusterIP 10.200.0.1 <none> 443/TCP 23h <none>
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
pod/deploy-xiuxian-6f5c7c558b-85hb9 1/1 Running 0 2m47s 10.100.1.162 worker232 <none> <none>
pod/deploy-xiuxian-6f5c7c558b-gt8f7 1/1 Running 0 2m47s 10.100.2.7 worker233 <none> <none>
pod/deploy-xiuxian-6f5c7c558b-sz66v 1/1 Running 0 2m47s 10.100.2.8 worker233 <none> <none>
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-26rnm 1/1 Running 0 2m47s 10.100.1.163 worker232 <none> <none>
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-b5w6d 1/1 Running 0 2m47s 10.100.1.164 worker232 <none> <none>
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-cpkgc 1/1 Running 0 2m47s 10.100.1.161 worker232 <none> <none>
Error from server (Forbidden): deployments.apps is forbidden: User "jiege" cannot list resource "deployments" in API group "apps" in the namespace "default"
ClusterRole授权给一个用户组类型的角色
1. 授权前测试
[root@worker232 ~]# kubectl config view --kubeconfig=yinzhengjie-k8s-token.conf
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://10.0.0.231:6443
name: myk8s
contexts:
- context:
cluster: myk8s
user: jasonyin
name: jasonyin@myk8s
- context:
cluster: myk8s
user: yinzhengjie
name: yinzhengjie@myk8s
current-context: yinzhengjie@myk8s
kind: Config
preferences: {}
users:
- name: jasonyin
user:
token: REDACTED
- name: yinzhengjie
user:
token: REDACTED
#我现在想给用户所在的组进行授权，而不是给某个用户授权。
[root@worker232 ~]# kubectl get pods --kubeconfig=./yinzhengjie-k8s-token.conf
Error from server (Forbidden): pods is forbidden: User "yinzhengjie" cannot list resource "pods" in API group "" in the namespace "default"
2. 创建集群角色
[root@master231 ~]# kubectl create clusterrole reader --resource=deploy,rs,pods --verb=get,watch,list -o yaml --dry-run=client #查看效果而已
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: null
name: reader
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- watch
- list
- apiGroups:
- apps
resources:
- deployments
- replicasets
verbs:
- get
- watch
- list
[root@master231 ~]# kubectl create clusterrole reader --resource=deploy,rs,pods --verb=get,watch,list #响应式创建
clusterrole.rbac.authorization.k8s.io/reader created
[root@master231 ~]# kubectl get clusterrole reader
NAME CREATED AT
reader 2025-09-28T02:37:35Z
3. 将集群角色绑定给k8s组
[root@master231 ~]# cat /etc/kubernetes/pki/token.csv
b4gp4h.tqnqlkov8zzbzuot,yinzhengjie,10001,k8s
53llgt.n4xci771guevocbk,jasonyin,10002,k8s
m7k336.omp1yul0w1i3t0pp,linux97,10003,k3s
6i2rhg.lwhnrkihqbyck41w,linux98,10004,k3s
4ixflg.nnbo21v9waa9bqr4,linux99,10005,k3s
1y3yb0.j7f3lh93tqbqo28s,linux100,10006,k3s
#关联集群角色
[root@master231 ~]# kubectl create clusterrolebinding k8s-as-reader --clusterrole=reader --group=k8s -o yaml --dry-run=client
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
creationTimestamp: null
name: k8s-as-reader
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: reader
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: k8s
[root@master231 ~]# kubectl create clusterrolebinding k8s-as-reader --clusterrole=reader --group=k8s 响应式关联
clusterrolebinding.rbac.authorization.k8s.io/k8s-as-reader created
[root@master231 ~]# kubectl get clusterrolebindings k8s-as-reader
NAME ROLE AGE
k8s-as-reader ClusterRole/reader 10s
[root@master231 ~]# kubectl get clusterrolebindings k8s-as-reader -o wide
NAME ROLE AGE USERS GROUPS SERVICEACCOUNTS
k8s-as-reader ClusterRole/reader 25s k8s
4. 基于kubeconfig测试
[root@worker232 ~]# kubectl get deploy,rs,pod --kubeconfig=./yinzhengjie-k8s-token.conf
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/deploy-xiuxian 3/3 3 3 13m
deployment.apps/deploy-xiuxian-imagepullpolicy 3/3 3 3 13m
NAME DESIRED CURRENT READY AGE
replicaset.apps/deploy-xiuxian-6f5c7c558b 3 3 3 13m
replicaset.apps/deploy-xiuxian-imagepullpolicy-5c4f574cf6 3 3 3 13m
NAME READY STATUS RESTARTS AGE
pod/deploy-xiuxian-6f5c7c558b-85hb9 1/1 Running 0 10m
pod/deploy-xiuxian-6f5c7c558b-gt8f7 1/1 Running 0 10m
pod/deploy-xiuxian-6f5c7c558b-sz66v 1/1 Running 0 10m
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-26rnm 1/1 Running 0 10m
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-b5w6d 1/1 Running 0 10m
pod/deploy-xiuxian-imagepullpolicy-5c4f574cf6-cpkgc 1/1 Running 0 10m
[root@worker232 ~]# kubectl get no --kubeconfig=./yinzhengjie-k8s-token.conf #因为没有给no的权限
Error from server (Forbidden): nodes is forbidden: User "yinzhengjie" cannot list resource "nodes" in API group "" at the cluster scope
#no不行
5. 基于token测试：clusterrole是全局资源，-A所有名称空间下都可以执行我定义的操作
[root@worker232 ~]# kubectl --server=https://10.0.0.231:6443 --token=b4gp4h.tqnqlkov8zzbzuot --certificate-authority=/etc/kubernetes/pki/ca.crt get deploy -o wide -A
NAMESPACE NAME READY UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR
default deploy-xiuxian-sa-secrets-harbor 3/3 3 3 5h41m c1 harbor250.oldboyedu.com/oldboyedu-xiuxian/apps:v3 apps=v1
kube-system coredns 2/2 2 2 9d coredns registry.aliyuncs.com/google_containers/coredns:v1.8.6 k8s-app=kube-dns
metallb-system controller 1/1 1 1 2d22h controller quay.io/metallb/controller:v0.15.2 app=metallb,component=controller
[root@worker232 ~]# kubectl --server=https://10.0.0.231:6443 --token=qo7azt.y27gu4idn5cunudd --certificate-authority=/etc/kubernetes/pki/ca.crt get deploy,rs,po -o wide -A # 很明显，linux99属于k3s分组，不属于K8S组的，因此无法访问！
Error from server (Forbidden): deployments.apps is forbidden: User "linux99" cannot list resource "deployments" in API group "apps" at the cluster scope
Error from server (Forbidden): replicasets.apps is forbidden: User "linux99" cannot list resource "replicasets" in API group "apps" at the cluster scope
Error from server (Forbidden): pods is forbidden: User "linux99" cannot list resource "pods" in API group "" at the cluster scope
6. 更新权限，直接重新加就行了
[root@master231 ~]# kubectl create clusterrole reader --resource=deploy,pods,no --verb=get,watch,list -o yaml --dry-run=client | kubectl apply -f -
Warning: resource clusterroles/reader is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
clusterrole.rbac.authorization.k8s.io/reader configured
7. 测试验证
[root@worker232 ~]# kubectl get no --kubeconfig=./yinzhengjie-k8s-token.conf
NAME STATUS ROLES AGE VERSION
master231 Ready control-plane,master 8d v1.23.17
worker232 Ready <none> 8d v1.23.17
worker233 Ready <none> 8d v1.23.17
ClusterRole授权给一个ServiceAccount类型，所以我们要创建一个账号，基于这个账号进行认证，一般给开发
1. 导入镜像：客串一下运维开发
[root@worker233 ~]# wget http://192.168.16.253/Resources/Kubernetes/Case-Demo/Python/python-v3.9.16.tar.gz
[root@worker233 ~]# docker load -i python-v3.9.16.tar.gz
[root@worker233 ~]# docker tag python:3.9.16-alpine3.16 harbor250.oldboyedu.com/oldboyedu-casedemo/python:3.9.16-alpine3.16
[root@worker233 ~]# docker push harbor250.oldboyedu.com/oldboyedu-casedemo/python:3.9.16-alpine3.16
docker pull harbor250.oldboyedu.com/oldboyedu-casedemo/python:3.9.16-alpine3.16
2. 编写资源清单
[root@master231 rbac]#
cat > oldboyedu-sa-rbac.yaml <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: kube-public
name: oldboy
#创建sa账户名字为oldboy，并且指定资源空间在kube-public
---
#这个pod给对应的sa账号
apiVersion: apps/v1
kind: Deployment
metadata:
name: xiuxian
namespace: kube-public
spec:
replicas: 1
selector:
matchLabels:
app: xiuxian
template:
metadata:
labels:
app: xiuxian
spec:
nodeName: worker232
serviceAccountName: oldboy
containers:
- image: harbor250.oldboyedu.com/oldboyedu-casedemo/python:3.9.16-alpine3.16
command:
- tail
- -f
- /etc/hosts
name: apps
---
#进行集群角色的创建，并且赋予对应的功能
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: reader-oldboy
rules:
- apiGroups:
- ""
resources:
- pods
- services
verbs:
- get
- watch
- list
- delete
- apiGroups:
- apps
resources:
- deployments
verbs:
- get
- watch
- list
- delete
---
#指定集群角色和用户oldboy进行绑定
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: reader-oldboy-bind
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: reader-oldboy
subjects:
- kind: ServiceAccount
name: oldboy
namespace: kube-public #可以加个名称空间，限制在该名称空间下访问
EOF
3. 创建资源
[root@master231 rbac]# kubectl apply -f oldboyedu-sa-rbac.yaml
serviceaccount/oldboy created
deployment.apps/xiuxian created
clusterrole.rbac.authorization.k8s.io/reader-oldboy created
clusterrolebinding.rbac.authorization.k8s.io/reader-oldboy-bind created
[root@master231 rbac]# kubectl get deploy,sa,po -o wide -n kube-public
NAME READY UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR
deployment.apps/xiuxian 1/1 1 1 111s apps harbor250.oldboyedu.com/oldboyedu-casedemo/python:3.9.16-alpine3.16 app=xiuxian
NAME SECRETS AGE
serviceaccount/default 1 9d
serviceaccount/oldboy 1 111s
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
pod/xiuxian-6ffc4f5fd7-m9tf2 1/1 Running 0 111s 10.100.1.165 worker232 <none> <none>
4. 安装依赖包
[root@master231 rbac]# kubectl -n kube-public exec -it xiuxian-6ffc4f5fd7-hwx4t -- sh
/ #
/ # python -V
Python 3.9.16
/ #
/ # pip install kubernetes -i https://pypi.tuna.tsinghua.edu.cn/simple/
...
Successfully installed cachetools-5.5.2 certifi-2025.1.31 charset-normalizer-3.4.1 durationpy-0.9 google-auth-2.38.0 idna-3.10 kubernetes-32.0.1 oauthlib-3.2.2 pyasn1-0.6.1 pyasn1-modules-0.4.2 python-dateutil-2.9.0.post0 pyyaml-6.0.2 requests-2.32.3 requests-oauthlib-2.0.0 rsa-4.9 six-1.17.0 urllib3-2.4.0 websocket-client-1.8.0
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv
WARNING: You are using pip version 22.0.4; however, version 25.0.1 is available.
You should consider upgrading via the '/usr/local/bin/python -m pip install --upgrade pip' command.
/ #
5. 编写python脚本【运维开发人员编写】
/ #
cat > view-k8s-resources.py <<EOF
from kubernetes import client, config
with open('/var/run/secrets/kubernetes.io/serviceaccount/token') as f:
token = f.read()
configuration = client.Configuration()
configuration.host = "https://10.0.0.231:6443" # APISERVER地址
configuration.ssl_ca_cert="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" # CA证书
configuration.verify_ssl = True # 启用证书验证
configuration.api_key = {"authorization": "Bearer " + token} # 指定Token字符串
client.Configuration.set_default(configuration)
apps_api = client.AppsV1Api()
core_api = client.CoreV1Api()
try:
print("###### Deployment列表 ######")
#列出default命名空间所有deployment名称
for dp in apps_api.list_namespaced_deployment("kube-public").items:
print(dp.metadata.name)
except:
print("没有权限访问Deployment资源！")
try:
#列出default命名空间所有pod名称
print("###### Pod列表 ######")
for po in core_api.list_namespaced_pod("kube-public").items:
print(po.metadata.name)
except:
print("没有权限访问Pod资源！")
EOF
3. 运行python脚本
/ # python3 view-k8s-resources.py
###### Deployment列表 ######
xiuxian
###### Pod列表 ######
oldboyedu-pods-sa
xiuxian-6ffc4f5fd7-m9tf2
/ #
4. 更新权限
[root@master231 auth]# kubectl get clusterrolebinding reader-oldboy-bind -o wide
NAME ROLE AGE USERS GROUPS SERVICEACCOUNTS
reader-oldboy-bind ClusterRole/reader-oldboy 18m kube-public/oldboy
#删除权限绑定：全局资源直接删就行了
[root@master231 auth]# kubectl delete clusterrolebinding reader-oldboy-bind
clusterrolebinding.rbac.authorization.k8s.io "reader-oldboy-bind" deleted
[root@master231 auth]# kubectl get clusterrolebinding reader-oldboy-bind -o wide
Error from server (NotFound): clusterrolebindings.rbac.authorization.k8s.io "reader-oldboy-bind" not found
5. 再次测试验证
/ # python view-k8s-resources.py
###### Deployment列表 ######
没有权限访问Deployment资源！
###### Pod列表 ######
没有权限访问Pod资源！
认证流程：
创建证书并分发到客户端，然后添加用户，创建集群，绑定上下文。
最后创建角色绑定授权
容器的资源限制resources - 重点讲解
一、核心概念：Requests vs Limits
Requests（请求）
- 调度器选择节点的依据
- Pod保证获得的最小资源
- 示例：
requests.cpu: "500m"→ 保证获得0.5个CPU
Limits（限制）
- Pod最多能使用的资源上限
- 超过会触发不同行为（CPU被限流，内存会导致OOM杀死）
- 示例：
limits.memory: "1Gi"→ 最多使用1GB内存
二、核心区别表
| 特性 | Requests | Limits |
|---|---|---|
| 目的 | 调度保证 | 限制上限 |
| CPU超过 | 无影响（保证有） | CPU限流 |
| 内存超过 | 可能OOM | 直接OOM杀死 |
| 调度影响 | 必须满足 | 不考虑 |
| 实际值 | 资源预留 | 硬限制 |
三、关键语法
resources:
requests:
cpu: "250m" # 0.25个CPU核心
memory: "256Mi" # 256MB内存
limits:
cpu: "500m" # 最多0.5个CPU
memory: "512Mi" # 最多512MB内存
单位快速参考
CPU: 1 = 1000m = 1个核心
500m = 0.5个核心
100m = 0.1个核心
内存: 1Gi = 1024Mi
512Mi = 512MB
128Mi = 128MB
四、实战示例
示例1：Web服务（Nginx）
containers:
- name: nginx
image: nginx
resources:
requests:
cpu: "100m" # 最少0.1CPU
memory: "128Mi" # 最少128MB
limits:
cpu: "200m" # 最多0.2CPU
memory: "256Mi" # 最多256MB
示例2：数据库（MySQL）
containers:
- name: mysql
image: mysql:8.0
resources:
requests:
cpu: "500m" # 最少0.5CPU
memory: "1Gi" # 最少1GB
limits:
cpu: "2" # 最多2CPU
memory: "4Gi" # 最多4GB
示例3：批处理任务
containers:
- name: job
image: data-processor
resources:
requests:
cpu: "1" # 最少1CPU
memory: "2Gi" # 最少2GB
limits:
cpu: "2" # 最多2CPU
memory: "4Gi" # 最多4GB
五、资源超过限制的后果
CPU超过Limits
- 容器不会被杀死
- CPU使用被限流(throttled)
- 性能下降，响应变慢
内存超过Limits
- 容器立即被OOM Killer杀死
- Pod状态变为
OOMKilled - 触发重启（根据restartPolicy）
内存超过Requests但不超过Limits
- 容器继续运行
- 但该节点内存紧张时，此Pod可能被驱逐
六、最佳实践
1. 必设Limits
# ✅ 正确做法
resources:
limits:
memory: "256Mi"
cpu: "500m"
# ❌ 错误做法（无限制，可能耗尽节点资源）
resources: {}
2. Requests ≈ 50-80% of Limits
resources:
requests:
cpu: "250m" # Limits的50%
memory: "200Mi" # Limits的约80%
limits:
cpu: "500m"
memory: "256Mi"
3. 监控和调整
# 查看资源使用
kubectl top pods
kubectl top nodes
# 查看Pod详细信息
kubectl describe pod <pod-name>
# 查看OOM事件
kubectl get events --field-selector=reason=OOMKilled
七、常见问题排查
问题1：Pod一直Pending
# 查看调度失败原因
kubectl describe pod <pod-name>
# 可能原因：节点没有足够的CPU/内存满足requests
问题2：Pod频繁重启
# 查看重启原因
kubectl describe pod <pod-name>
# 如果看到 OOMKilled → 内存limits设置过小
# 如果看到 CrashLoopBackOff → 可能内存requests过小
问题3：应用性能差
# 查看CPU限流情况
kubectl describe pod <pod-name>
# 检查是否有 Throttled CPU 事件
# 解决方案：适当提高CPU limits
八、快速诊断命令
# 1. 查看Pod资源设置
kubectl get pod <pod-name> -o yaml | grep -A 5 resources
# 2. 查看资源使用情况
kubectl top pod <pod-name> --containers
# 3. 查看节点容量
kubectl describe node <node-name> | grep -A 10 Allocatable
# 4. 检查OOM事件
kubectl get events | grep -i oom
# 5. 检查调度失败
kubectl describe pod <pod-name> | grep -A 5 Events
九、设置建议参考表
| 应用类型 | Requests CPU | Limits CPU | Requests Memory | Limits Memory |
|---|---|---|---|---|
| Web前端 | 100m | 250m | 128Mi | 256Mi |
| API服务 | 200m | 500m | 256Mi | 512Mi |
| 数据库 | 500m | 2 | 1Gi | 4Gi |
| 缓存服务 | 250m | 1 | 512Mi | 2Gi |
| 批处理 | 1 | 2 | 2Gi | 4Gi |
十、一句话总结
Requests是"我要多少"，Limits是"我最多能用多少"；内存超限会死，CPU超限会慢；不设限制很危险，合理设置保平安。
更多推荐
28
0- 0
已为社区贡献30条内容
所有评论(0)