k8s中基于rbac获取管理员配置信息

目的

1. 基于二进制部署的k8s获取超级管理员的配置文件,然后基于jenkins部署微服务

操作实践

1. 签发证书

   1. 创建admin-csr.json文件,如有疑问可参考之前的文章

      {
          "CN": "admin",
          "hosts": [],
          "key": {
              "algo": "rsa",
              "size": 2048
          },
          "names": [
              {
                  "C": "CN",
                  "ST": "beijing",
                  "L": "beijing",
                  "O": "od",
                  "OU": "ops"
              }
          ]
      }
      

   2. 执行命令: cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer admin-csr.json | cfssl-json -bare admin

2. 在/root/.kube生成config文件

   export KUBE_APISERVER="https://192.168.0.201:7443"  # 指向前端反代地址
   kubectl config set-cluster kubernetes   --certificate-authority=/opt/kubernetes/ssl/ca.pem   --embed-certs=true   --server=${KUBE_APISERVER}
   kubectl config set-credentials admin   --client-certificate=/opt/kubernetes/ssl/admin.pem   --embed-certs=true   --client-key=/opt/kubernetes/ssl/admin-key.pem
   kubectl config set-context kubernetes   --cluster=kubernetes   --user=admin
   kubectl config use-context kubernetes
   kubectl config use-context myk8s-context --kubeconfig=kubelet.kubeconfig
   

3. 用户和角色进行绑定,rbac-admin.yaml

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   metadata:
     name: admin
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: cluster-admin
   subjects:
   - apiGroup: rbac.authorization.k8s.io
     kind: User
     name: admin