- 基于服务账号授权案例

[root@master231 serviceAccount]# cat 01-sa-rabc.yaml 
apiVersion: v1
kind: ServiceAccount 
metadata:
  name: oldboyedu-python 
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: oldboyedu-pod-reader 
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
#- apiGroups: ["apps"]
#  resources: ["deployments"]
#  verbs: ["get", "watch", "list"]

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: oldboyedu-sa-to-role
subjects:
- kind: ServiceAccount 
  name: oldboyedu-python
roleRef:
  kind: Role
  name: oldboyedu-pod-reader
  apiGroup: rbac.authorization.k8s.io

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: oldboyedu-python3-sa
spec:
  replicas: 2
  selector:
    matchExpressions:
    - key: apps
      values: 
      - "python"
      operator: In
  template:
    metadata:
      labels:
         apps: python
    spec:
      # 指定sa的名称，请确认该账号是有权限访问K8S集群的哟!
      serviceAccountName: oldboyedu-python
      containers:
      - image: harbor.oldboyedu.com/oldboyedu-tools/python:3.9.16-alpine3.16
        name: c1
        command:
        - tail 
        - -f
        - /etc/hosts
[root@master231 serviceAccount]# 
[root@master231 serviceAccount]# kubectl apply -f 01-sa-rabc.yaml 
serviceaccount/oldboyedu-python created
role.rbac.authorization.k8s.io/oldboyedu-pod-reader created
rolebinding.rbac.authorization.k8s.io/oldboyedu-sa-to-role created
deployment.apps/oldboyedu-python3-sa created
[root@master231 serviceAccount]# 

    
    
- 编写Python程序，进入到"python"Pod所在的容器执行以下Python代码即可!
[root@master231 serviceAccount]# kubectl get pods
NAME                                    READY   STATUS    RESTARTS   AGE
oldboyedu-python3-sa-799bdd87b4-4cdsh   1/1     Running   0          17s
oldboyedu-python3-sa-799bdd87b4-crpl7   1/1     Running   0          17s
[root@master231 serviceAccount]# 
[root@master231 serviceAccount]# 
[root@master231 serviceAccount]# kubectl exec -it oldboyedu-python3-sa-799bdd87b4-4cdsh -- sh
/ # pip install kubernetes -i https://pypi.tuna.tsinghua.edu.cn/simple/

/ # cat > view-k8s.py <<'EOF'
from kubernetes import client, config

with open('/var/run/secrets/kubernetes.io/serviceaccount/token') as f:
     token = f.read()

configuration = client.Configuration()
configuration.host = "https://kubernetes"  # APISERVER地址
configuration.ssl_ca_cert="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"  # CA证书 
configuration.verify_ssl = True   # 启用证书验证
configuration.api_key = {"authorization": "Bearer " + token}  # 指定Token字符串
client.Configuration.set_default(configuration)
apps_api = client.AppsV1Api() 
core_api = client.CoreV1Api() 
try:
  print("###### Deployment列表 ######")
  # 列出default命名空间所有deployment名称
  for dp in apps_api.list_namespaced_deployment("default").items:
    print(dp.metadata.name)
except:
  print("没有权限访问Deployment资源！")

try:
  # 列出default命名空间所有pod名称
  print("###### Pod列表 ######")
  for po in core_api.list_namespaced_pod("default").items:
    print(po.metadata.name)
except:
  print("没有权限访问Pod资源！")
EOF

/ # python view-k8s.py 
###### Deployment列表 ######
没有权限访问Deployment资源！
###### Pod列表 ######
oldboyedu-python3-sa-799bdd87b4-4cdsh
oldboyedu-python3-sa-799bdd87b4-crpl7
/ # 
/ # 

- 安装Python程序依赖的软件包并测试
pip install kubernetes -i https://pypi.tuna.tsinghua.edu.cn/simple/

python3 <your python app name>