背景：通过jumpserver的录像和审计功能管理各环境k8s

bashrc

alias kubectlola-dev='kubectl --kubeconfig=/root/.kube/ola-dev '
alias kubectlola-test='kubectl --kubeconfig=/root/.kube/ola-test '
alias kubectlola-uat='kubectl --kubeconfig=/root/.kube/ola-uat '
alias kubectlola-prod='kubectl --kubeconfig=/root/.kube/ola-prod '

Dockerfile

# 指定创建的基础镜像
FROM registry.cn-hangzhou.aliyuncs.com/sanchar/kubectl:v1.20.1
 
 # 作者描述信息
MAINTAINER zhangzhidao
 
# 替换阿里云的并更新源、安装openssh 并修改配置文件和生成key 并且同步时间
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories \    
	&& apk update \    
	&& apk add --no-cache openssh tzdata bash python2\
	&& cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
	&& sed -i "s/#PermitRootLogin.*/PermitRootLogin yes/g" /etc/ssh/sshd_config \
	&& ssh-keygen -t dsa -P "" -f /etc/ssh/ssh_host_dsa_key \
	&& ssh-keygen -t rsa -P "" -f /etc/ssh/ssh_host_rsa_key \ 
	&& ssh-keygen -t ecdsa -P "" -f /etc/ssh/ssh_host_ecdsa_key \
	&& ssh-keygen -t ed25519 -P "" -f /etc/ssh/ssh_host_ed25519_key \
	&& echo "root:你的root密码" | chpasswd \
        && echo "/bin/bash" >> /etc/profile

# kubeconfig配置
COPY ola-dev ola-test ola-uat ola-prod /root/.kube/
# alisa 命令行
COPY bashrc /root/.bashrc
# ssh欢迎页定制
COPY motd /etc/
# 开放22端口
EXPOSE 22
 
# 容器启动时执行ssh启动命令
CMD ["/usr/sbin/sshd", "-D"]

# docker build -t 你的镜像仓库/kubectl:v1.20.1 .

k8s Statefulset 启动

apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    k8s-app: kubectl
    qcloud-app: kubectl
  name: kubectl
  namespace: default
spec:
  podManagementPolicy: OrderedReady
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: kubectl
      qcloud-app: kubectl
  serviceName: ""
  template:
    metadata:
      labels:
        k8s-app: kubectl
        qcloud-app: kubectl
    spec:
      containers:
      - image: 你的镜像仓库/kubectl:v1.20.1
        imagePullPolicy: Always
        name: kubectl
        resources:
          limits:
            cpu: 500m
            memory: 256Mi
          requests:
            cpu: 250m
            memory: 256Mi
        securityContext:
          privileged: false
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      imagePullSecrets:
      - name: cdorker-se
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30

k8s nodeport映射22端口，用于ssh连接

apiVersion: v1
kind: Service
metadata:
  name: kubectl
  namespace: default
spec:
  ports:
  - name: 22-22-tcp
    nodePort: 30006
    port: 22
    protocol: TCP
    targetPort: 22
  selector:
    k8s-app: kubectl
    qcloud-app: kubectl
  sessionAffinity: None
  type: NodePort

接下来在jumpserver上就像管理虚拟机一样添加服务器/授权等即可，注意ssh端口哦

参考：
https://blog.csdn.net/qq_34596292/article/details/112083776
https://blog.csdn.net/AMimiDou_212/article/details/106502393