k8s查看用户的token并验证

最新推荐文章于 2024-05-05 14:30:00 发布

中国lanwp

最新推荐文章于 2024-05-05 14:30:00 发布

阅读量1.5w

点赞数 2

分类专栏： linux K8s

本文链接：https://blog.csdn.net/lanwp5302/article/details/88749816

版权

linux 同时被 2 个专栏收录

43 篇文章 0 订阅

订阅专栏

K8s

17 篇文章 0 订阅

订阅专栏

参考 k8s使用ServiceAccount Token的方式访问apiserver

kube-dns查看token

serviceaccounts (aka 'sa')

查看账号

    #查看所有账号
[root@docker176 kubernetes]# kubectl -n kube-system get sa
NAME                       SECRETS   AGE
calico-cni-plugin          1         2d
calico-policy-controller   1         2d
default                    1         124d
heapster                   1         55d
kube-dns                   1         2d

# 查看指定账号
kubectl -n kube-system get sa  kube-dns

取得secrets

kubectl -n kube-system get sa kube-dns -o yaml 取得secrets

[root@docker176 ~]# kubectl -n kube-system get sa  kube-dns -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: 2019-04-12T12:32:49Z
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
    kubernetes.io/cluster-service: "true"
  name: kube-dns
  namespace: kube-system
  resourceVersion: "16174692"
  selfLink: /api/v1/namespaces/kube-system/serviceaccounts/kube-dns
  uid: 1557807a-5d1f-11e9-9df3-000c2938862c
secrets:
- name: kube-dns-token-rst6j

secrets值为kube-dns-token-rst6j

取得token

kubectl get secrets kube-dns-token-rst6j -n kube-system -oyaml

[root@docker176 kubernetes]# kubectl get secrets kube-dns-token-rst6j -n kube-system -oyaml  
apiVersion: v1
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURYekNDQWtlZ0F3SUJBZ0lKQU1jc1NWdStDcEkxTUEwR0NTcUdTSWIzRFFFQkN3VUFNQ1F4SWpBZ0JnTlYKQkFNTUdURTVNaTR4TmpndU1UUXVNVGMxUURFMU5UVXdNemt3TWpVd0hoY05NVGt3TkRFeU1ETXhOekExV2hjTgpNamt3TkRBNU1ETXhOekExV2pBa01TSXdJQVlEVlFRRERCa3hPVEl1TVRZNExqRTBMakUzTlVBeE5UVTFNRE01Ck1ESTFNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXJNaGJNSmN2NGgrZVBBa3IKbFF0dW9ZSlZLZTZqTEFVM1VvRENIRlkxTndSQ1p2Zit2ZEh5NVMxZWJOdGxOak4vdjgvWlpLRllEMG5qWDl3NQpKMWJpK3NhWnh2Y3gza28wdzN3OXo1WTlvRGNQMDNSVE85U2o3VXd1M3JBa3E2UGRVdzBIbGV0RWcyYURjcjQyCmR3U0g2ZTI1L2NlbEQ3ZUN0WDJZdk0xRHFBcllTcFpmNjJVZC9idmpqd05Hc2JxVjBBY0toN09Gckp1U0hFbGoKMVQyT2FoR3V5TW1GWk5hWG5lZ0lYR2pWems1NnZpdEsxRUhoUG05VnA5MHFFK0VSNk1yMS9FSTVReG1XdHJsYQpQcm1MaGhPaEd0WTRjTUNReEVvZGpIQkdFNEtNU2lBNVZPUExYNkZJR0RJVHVRbVhjSGNTV2JlWmR5aEYraitMCm9jUC9tUUlEQVFBQm80R1RNSUdRTUIwR0ExVWREZ1FXQkJRZ0srZk9TT3p0elB0MWFKSlBaL2pYYllpT3pUQlUKQmdOVkhTTUVUVEJMZ0JRZ0srZk9TT3p0elB0MWFKSlBaL2pYYllpT3phRW9wQ1l3SkRFaU1DQUdBMVVFQXd3WgpNVGt5TGpFMk9DNHhOQzR4TnpWQU1UVTFOVEF6T1RBeU5ZSUpBTWNzU1Z1K0NwSTFNQXdHQTFVZEV3UUZNQU1CCkFmOHdDd1lEVlIwUEJBUURBZ0VHTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBd1FFNEM3Mkk0MlNLSkg0ZnIKU0QvNnpwQXZUT3p0VjVPZUkyWWZSQ0t6NitObll1OHdCbE1xYTJUaS8yMnZ0U2JHVUdsRFROenhvVWdJbW5McwpOMjkzRXgxRUFaVUE2THJ2WWM3MnRlYS9SekVzaG5ROFBTQ2VPTXlndFJvVVdENU9YZmxsU2o3cTFWdy9zL3VOCmtMa1RYMjhGQ2VKeDhXTG5vSFZXUmN1eHRUWW1Ec1VKOWgzaGNrVHIwYXFSV0NMYldudHoyNW5IdG1LZmNqa2QKa3pwQkJsMzRJRDE2S3BOTWNIZnAydXFKQUhHd1NHdnVIN0tYWmxkcXo1QyswVkZPcFk4VThVYi9LS0tCS2tYRAo3YXFSSFhEdkxYdHMyM0N4cXJFOHI0ZzcyV3BWL01WbUN0WHl5Z0NMYjVUTFMwYU85MjZmaUt4dWFtNEw4VWNCCllFZEYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  namespace: a3ViZS1zeXN0ZW0=
  token: ZXlKaGJHY2lPaUpTVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnBjM01pT2lKcmRXSmxjbTVsZEdWekwzTmxjblpwWTJWaFkyTnZkVzUwSWl3aWEzVmlaWEp1WlhSbGN5NXBieTl6WlhKMmFXTmxZV05qYjNWdWRDOXVZVzFsYzNCaFkyVWlPaUpyZFdKbExYTjVjM1JsYlNJc0ltdDFZbVZ5Ym1WMFpYTXVhVzh2YzJWeWRtbGpaV0ZqWTI5MWJuUXZjMlZqY21WMExtNWhiV1VpT2lKcmRXSmxMV1J1Y3kxMGIydGxiaTF5YzNRMmFpSXNJbXQxWW1WeWJtVjBaWE11YVc4dmMyVnlkbWxqWldGalkyOTFiblF2YzJWeWRtbGpaUzFoWTJOdmRXNTBMbTVoYldVaU9pSnJkV0psTFdSdWN5SXNJbXQxWW1WeWJtVjBaWE11YVc4dmMyVnlkbWxqWldGalkyOTFiblF2YzJWeWRtbGpaUzFoWTJOdmRXNTBMblZwWkNJNklqRTFOVGM0TURkaExUVmtNV1l0TVRGbE9TMDVaR1l6TFRBd01HTXlPVE00T0RZeVl5SXNJbk4xWWlJNkluTjVjM1JsYlRwelpYSjJhV05sWVdOamIzVnVkRHByZFdKbExYTjVjM1JsYlRwcmRXSmxMV1J1Y3lKOS5qSEFVNmEycEE0WWFKWDBDajJDMGZLR3RvUE8wdjRFLUpMN1A4eDA5amhTc3hvMTVYdEMtcS1zRWRVT1N6NE9ZYTl3TzNaWjRNZkNTak5DSnUxVGJsaml1REprMmZvUFdJb0hsTXZBUFY3ME5PVnY0Um1BdEpxZ0l1ZXF2LW1hRVFkb2lZN2syZW9BOFZIaHBVWGVmY3Q2TUE0WUplUjlpNkZtRzNzb2RjdWo5blU5TlhBeXhhbzV3U2RZMlBlWEtaQVZFS3pMZXRjb3YxSmZFSEZpNDFjc0dkbjEwRmdZUlNWVTE5ZlNWUzVDOGwzMGE1cXlCWVRCS3o1U1M0SjdUMFprQ0lPRDdaV3RMTnNMLXNHTThhRE12V1VwUW51d3ZQX3ZpcmFpR1cxU2xVLUVmc29jT1RjajVKRXctWEZXUzRtcklaNXM0T3BwNUhZSFU1Z2d2LVE=
kind: Secret
metadata:
  annotations:
    kubernetes.io/service-account.name: kube-dns
    kubernetes.io/service-account.uid: 1557807a-5d1f-11e9-9df3-000c2938862c
  creationTimestamp: 2019-04-12T12:32:49Z
  name: kube-dns-token-rst6j
  namespace: kube-system
  resourceVersion: "16174691"
  selfLink: /api/v1/namespaces/kube-system/secrets/kube-dns-token-rst6j
  uid: 155b7304-5d1f-11e9-9df3-000c2938862c
type: kubernetes.io/service-account-token

取得token并解码

取得token值

kubectl get secret kube-dns-token-rst6j -n kube-system -o jsonpath={".data.token"}

[root@docker176 kubernetes]# kubectl get secret kube-dns-token-rst6j -n kube-system -o jsonpath={".data.token"}
ZXlKaGJHY2lPaUpTVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnBjM01pT2lKcmRXSmxjbTVsZEdWekwzTmxjblpwWTJWaFkyTnZkVzUwSWl3aWEzVmlaWEp1WlhSbGN5NXBieTl6WlhKMmFXTmxZV05qYjNWdWRDOXVZVzFsYzNCaFkyVWlPaUpyZFdKbExYTjVjM1JsYlNJc0ltdDFZbVZ5Ym1WMFpYTXVhVzh2YzJWeWRtbGpaV0ZqWTI5MWJuUXZjMlZqY21WMExtNWhiV1VpT2lKcmRXSmxMV1J1Y3kxMGIydGxiaTF5YzNRMmFpSXNJbXQxWW1WeWJtVjBaWE11YVc4dmMyVnlkbWxqWldGalkyOTFiblF2YzJWeWRtbGpaUzFoWTJOdmRXNTBMbTVoYldVaU9pSnJkV0psTFdSdWN5SXNJbXQxWW1WeWJtVjBaWE11YVc4dmMyVnlkbWxqWldGalkyOTFiblF2YzJWeWRtbGpaUzFoWTJOdmRXNTBMblZwWkNJNklqRTFOVGM0TURkaExUVmtNV1l0TVRGbE9TMDVaR1l6TFRBd01HTXlPVE00T0RZeVl5SXNJbk4xWWlJNkluTjVjM1JsYlRwelpYSjJhV05sWVdOamIzVnVkRHByZFdKbExYTjVjM1JsYlRwcmRXSmxMV1J1Y3lKOS5qSEFVNmEycEE0WWFKWDBDajJDMGZLR3RvUE8wdjRFLUpMN1A4eDA5amhTc3hvMTVYdEMtcS1zRWRVT1N6NE9ZYTl3TzNaWjRNZkNTak5DSnUxVGJsaml1REprMmZvUFdJb0hsTXZBUFY3ME5PVnY0Um1BdEpxZ0l1ZXF2LW1hRVFkb2lZN2syZW9BOFZIaHBVWGVmY3Q2TUE0WUplUjlpNkZtRzNzb2RjdWo5blU5TlhBeXhhbzV3U2RZMlBlWEtaQVZFS3pMZXRjb3YxSmZFSEZpNDFjc0dkbjEwRmdZUlNWVTE5ZlNWUzVDOGwzMGE1cXlCWVRCS3o1U1M0SjdUMFprQ0lPRDdaV3RMTnNMLXNHTThhRE12V1VwUW51d3ZQX3ZpcmFpR1cxU2xVLUVmc29jT1RjajVKRXctWEZXUzRtcklaNXM0T3BwNUhZSFU1Z2d2LVE=

tokne转码

kubectl get secret kube-dns-token-rst6j -n kube-system -o jsonpath={".data.token"}| base64 -d

[root@docker176 kubernetes]# kubectl get secret kube-dns-token-rst6j -n kube-system -o jsonpath={".data.token"}| base64 -d

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJrdWJlLWRucy10b2tlbi1yc3Q2aiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJrdWJlLWRucyIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjE1NTc4MDdhLTVkMWYtMTFlOS05ZGYzLTAwMGMyOTM4ODYyYyIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTprdWJlLWRucyJ9.jHAU6a2pA4YaJX0Cj2C0fKGtoPO0v4E-JL7P8x09jhSsxo15XtC-q-sEdUOSz4OYa9wO3ZZ4MfCSjNCJu1TbljiuDJk2foPWIoHlMvAPV70NOVv4RmAtJqgIueqv-maEQdoiY7k2eoA8VHhpUXefct6MA4YJeR9i6FmG3sodcuj9nU9NXAyxao5wSdY2PeXKZAVEKzLetcov1JfEHFi41csGdn10FgYRSVU19fSVS5C8l30a5qyBYTBKz5SS4J7T0ZkCIOD7ZWtLNsL-sGM8aDMvWUpQnuwvP_viraiGW1SlU-EfsocOTcj5JEw-XFWS4mrIZ5s4Opp5HYHU5ggv-Q

查看calico token

查看calico账号

kubectl -n kube-system get sa calico-policy-controller

[root@docker176 kubernetes]# kubectl -n kube-system get sa
NAME                       SECRETS   AGE
calico-cni-plugin          1         2d
calico-policy-controller   1         2d
default                    1         124d
heapster                   1         55d
kube-dns                   1         2d
[root@docker176 kubernetes]# kubectl -n kube-system get sa calico-policy-controller
NAME                       SECRETS   AGE
calico-policy-controller   1         2d

取得secrets

kubectl -n kube-system get sa calico-policy-controller -o yaml

[root@docker176 kubernetes]# kubectl -n kube-system get sa calico-policy-controller -o yaml         
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: 2019-04-12T12:32:45Z
  name: calico-policy-controller
  namespace: kube-system
  resourceVersion: "16174639"
  selfLink: /api/v1/namespaces/kube-system/serviceaccounts/calico-policy-controller
  uid: 12c2762f-5d1f-11e9-9df3-000c2938862c
secrets:
- name: calico-policy-controller-token-dd7k3

取得token

同kube-dns
kubectl get secrets calico-policy-controller-token-dd7k3 -n kube-system -oyaml

查看token并base64转码

[root@docker176 kubernetes]# kubectl get secret calico-policy-controller-token-dd7k3 -n kube-system -o jsonpath={".data.token"}| base64 -d                    
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjYWxpY28tcG9saWN5LWNvbnRyb2xsZXItdG9rZW4tZGQ3azMiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiY2FsaWNvLXBvbGljeS1jb250cm9sbGVyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMTJjMjc2MmYtNWQxZi0xMWU5LTlkZjMtMDAwYzI5Mzg4NjJjIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmNhbGljby1wb2xpY3ktY29udHJvbGxlciJ9.jw75X2XsTnq_8zwd3YJb2hO_4N-78Zo7rmZSCQWSfABi22h6cFlih_ln8nkjlOEL2P_h10W-Zyt-VgmRJsdQTQjELhgLfuh47OCuyRSL_kGosfjbhtXt4QzDM_Svr2mzSpWVbIE68qzh4YUkYGW6aHCrhWW5W-t-dPjGyjJOglG-Xmm1jwFZe_xDKRKOqXzivrYXHJ0Uqcyb_aWQgHBf3gAHSI9OCiGa5_ZykFVOqSo69cY4xL2XOpOcXDVj767qbsi0isICX7vWhHsnaG2KzhlDM3LIAS4AQqWY_fbctSV-jjsBWgBYZgon2xAQqOMmi4xvft_Uk6uEWT4ZKOn7MA

calico controller容器中的token

查看容器

[root@docker176 ~]# docker ps|grep calico
796243554da4        192.168.14.171:5000/calico/kube-policy-controller@sha256:1ca4ccddb3cc3e57e3d8c1fe5d7236ca50250d0a274b0bc3d88ad6ce25cab73e                   "/dist/controller"       2 days ago          Up 2 days                               k8s_calico-policy-controller_calico-policy-controller-2698340612-8hksd_kube-system_13650ec9-5d1f-11e9-9df3-000c2938862c_0

进入容器中token所在目录

docker exec -it   796243554da4 sh
#或者
docker exec -it `docker ps |grep k8s_calico-policy-controller | awk '{print $1}'` sh
# 进入token所在目录
cd /var/run/secrets/kubernetes.io/serviceaccount
/var/run/secrets/kubernetes.io/serviceaccount # ls
ca.crt     namespace  token

查看token

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjYWxpY28tcG9saWN5LWNvbnRyb2xsZXItdG9rZW4tZGQ3azMiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiY2FsaWNvLXBvbGljeS1jb250cm9sbGVyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMTJjMjc2MmYtNWQxZi0xMWU5LTlkZjMtMDAwYzI5Mzg4NjJjIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmNhbGljby1wb2xpY3ktY29udHJvbGxlciJ9.jw75X2XsTnq_8zwd3YJb2hO_4N-78Zo7rmZSCQWSfABi22h6cFlih_ln8nkjlOEL2P_h10W-Zyt-VgmRJsdQTQjELhgLfuh47OCuyRSL_kGosfjbhtXt4QzDM_Svr2mzSpWVbIE68qzh4YUkYGW6aHCrhWW5W-t-dPjGyjJOglG-Xmm1jwFZe_xDKRKOqXzivrYXHJ0Uqcyb_aWQgHBf3gAHSI9OCiGa5_ZykFVOqSo69cY4xL2XOpOcXDVj767qbsi0isICX7vWhHsnaG2KzhlDM3LIAS4AQqWY_fbctSV-jjsBWgBYZgon2xAQqOMmi4xvft_Uk6uEWT4ZKOn7MA

对比 k8s中查看的token一致

测试多master 验证token是否有效

高可用master使用KeepAlievd vip设置
master主机
192.168.14.175
192.168.14.176
192.168.14.235（VIP）

curl -k -H ‘Authorization: Bearer ${token}’ https://192.168.14.176:6443/api
如下有返回信息的都是token通过校验正常访问k8s api

[root@docker176 ~]# curl -k -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjYWxpY28tcG9saWN5LWNvbnRyb2xsZXItdG9rZW4tZGQ3azMiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiY2FsaWNvLXBvbGljeS1jb250cm9sbGVyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMTJjMjc2MmYtNWQxZi0xMWU5LTlkZjMtMDAwYzI5Mzg4NjJjIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmNhbGljby1wb2xpY3ktY29udHJvbGxlciJ9.jw75X2XsTnq_8zwd3YJb2hO_4N-78Zo7rmZSCQWSfABi22h6cFlih_ln8nkjlOEL2P_h10W-Zyt-VgmRJsdQTQjELhgLfuh47OCuyRSL_kGosfjbhtXt4QzDM_Svr2mzSpWVbIE68qzh4YUkYGW6aHCrhWW5W-t-dPjGyjJOglG-Xmm1jwFZe_xDKRKOqXzivrYXHJ0Uqcyb_aWQgHBf3gAHSI9OCiGa5_ZykFVOqSo69cY4xL2XOpOcXDVj767qbsi0isICX7vWhHsnaG2KzhlDM3LIAS4AQqWY_fbctSV-jjsBWgBYZgon2xAQqOMmi4xvft_Uk6uEWT4ZKOn7MA' https://192.168.14.176:6443/api
{
  "kind": "APIVersions",
  "versions": [
    "v1"
  ],
  "serverAddressByClientCIDRs": [
    {
      "clientCIDR": "0.0.0.0/0",
      "serverAddress": "192.168.14.176:6443"
    }
  ]
}[root@docker176 ~]# curl -k -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjYWxpY28tcG9saWN5LWNvbnRyb2xsZXItdG9rZW4tZGQ3azMiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiY2FsaWNvLXBvbGljeS1jb250cm9sbGVyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMTJjMjc2MmYtNWQxZi0xMWU5LTlkZjMtMDAwYzI5Mzg4NjJjIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmNhbGljby1wb2xpY3ktY29udHJvbGxlciJ9.jw75X2XsTnq_8zwd3YJb2hO_4N-78Zo7rmZSCQWSfABi22h6cFlih_ln8nkjlOEL2P_h10W-Zyt-VgmRJsdQTQjELhgLfuh47OCuyRSL_kGosfjbhtXt4QzDM_Svr2mzSpWVbIE68qzh4YUkYGW6aHCrhWW5W-t-dPjGyjJOglG-Xmm1jwFZe_xDKRKOqXzivrYXHJ0Uqcyb_aWQgHBf3gAHSI9OCiGa5_ZykFVOqSo69cY4xL2XOpOcXDVj767qbsi0isICX7vWhHsnaG2KzhlDM3LIAS4AQqWY_fbctSV-jjsBWgBYZgon2xAQqOMmi4xvft_Uk6uEWT4ZKOn7MA' https://192.168.14.175:6443/api
{
  "kind": "APIVersions",
  "versions": [
    "v1"
  ],
  "serverAddressByClientCIDRs": [
    {
      "clientCIDR": "0.0.0.0/0",
      "serverAddress": "192.168.14.175:6443"
    }
  ]
}[root@docker176 ~]# curl -k -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjYWxpY28tcG9saWN5LWNvbnRyb2xsZXItdG9rZW4tZGQ3azMiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiY2FsaWNvLXBvbGljeS1jb250cm9sbGVyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMTJjMjc2MmYtNWQxZi0xMWU5LTlkZjMtMDAwYzI5Mzg4NjJjIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50Omt1YmUtc3lzdGVtOmNhbGljby1wb2xpY3ktY29udHJvbGxlciJ9.jw75X2XsTnq_8zwd3YJb2hO_4N-78Zo7rmZSCQWSfABi22h6cFlih_ln8nkjlOEL2P_h10W-Zyt-VgmRJsdQTQjELhgLfuh47OCuyRSL_kGosfjbhtXt4QzDM_Svr2mzSpWVbIE68qzh4YUkYGW6aHCrhWW5W-t-dPjGyjJOglG-Xmm1jwFZe_xDKRKOqXzivrYXHJ0Uqcyb_aWQgHBf3gAHSI9OCiGa5_ZykFVOqSo69cY4xL2XOpOcXDVj767qbsi0isICX7vWhHsnaG2KzhlDM3LIAS4AQqWY_fbctSV-jjsBWgBYZgon2xAQqOMmi4xvft_Uk6uEWT4ZKOn7MA' https://192.168.14.235:6443/api
{
  "kind": "APIVersions",
  "versions": [
    "v1"
  ],
  "serverAddressByClientCIDRs": [
    {
      "clientCIDR": "0.0.0.0/0",
      "serverAddress": "192.168.14.176:6443"
    }
  ]
}

cni测试token

/etc/cni/net.d存放cni相关配置文件所在目录，10-calico.conf配置文件

[root@docker176 ~]# cd /etc/cni/net.d; cat 10-calico.conf
{
    "name": "k8s-pod-network",
    "cniVersion": "0.1.0",
    "type": "calico",
    "etcd_endpoints": "http://192.168.14.175:2379,http://192.168.14.176:2379",
    "log_level": "info",
    "ipam": {
        "type": "calico-ipam"
    },
    "policy": {
        "type": "k8s",
         "k8s_api_root": "https://10.254.0.1:443",
         "k8s_auth_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjYWxpY28tY25pLXBsdWdpbi10b2tlbi14N3dsMiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJjYWxpY28tY25pLXBsdWdpbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjEyYWQyMjI5LTVkMWYtMTFlOS05ZGYzLTAwMGMyOTM4ODYyYyIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTpjYWxpY28tY25pLXBsdWdpbiJ9.VtyfKi39LKcx8Piy0x0cfa5bUxkEn1BhMYzAn_3BaZTma_nOjTMCrAHdqR1wCidH9__U43nKWRhM8qpBhc2OPp30VGFdMt25oJcCF5jcZKzbxvPt0HXKOgOeTctwgatnwsfEBtVarM1V_l9fQswinZbUHSjCCnYsVd1HMoeBOE6Gtxa14kz68wcbK9RFTHrxgo5cdtXxO7JFKRmR5GpmL0Xa2KjuWvY8H-6jSNVv-b-o5SjurV6Ha7Zysibpb8gLr86-QacMPnwP56Y9rBgxmGymUMXTJjXTXmKTY3G_Ha-CXk4Phrf9x58jVu48IHEFhzlnn6m_Kw6nGNEs-32IYw"
    },
    "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
    }
}
[root@docker176 net.d]# ll
total 8
-rw-rw-r-- 1 root root 1345 Apr 12 20:32 10-calico.conf
-rw-r--r-- 1 root root  273 Apr 12 20:32 calico-kubeconfig
[root@docker176 net.d]# cat calico-kubeconfig 
# Kubeconfig file for Calico CNI plugin.
apiVersion: v1
kind: Config
clusters:
- name: local
  cluster:
    insecure-skip-tls-verify: true
users:
- name: calico
contexts:
- name: calico-context
  context:
    cluster: local
    user: calico
current-context: calico-context

使用token请求k8s内部地址

  [root@docker176 net.d]# curl -k -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjYWxpY28tY25pLXBsdWdpbi10b2tlbi14N3dsMiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJjYWxpY28tY25pLXBsdWdpbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjEyYWQyMjI5LTVkMWYtMTFlOS05ZGYzLTAwMGMyOTM4ODYyYyIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTpjYWxpY28tY25pLXBsdWdpbiJ9.VtyfKi39LKcx8Piy0x0cfa5bUxkEn1BhMYzAn_3BaZTma_nOjTMCrAHdqR1wCidH9__U43nKWRhM8qpBhc2OPp30VGFdMt25oJcCF5jcZKzbxvPt0HXKOgOeTctwgatnwsfEBtVarM1V_l9fQswinZbUHSjCCnYsVd1HMoeBOE6Gtxa14kz68wcbK9RFTHrxgo5cdtXxO7JFKRmR5GpmL0Xa2KjuWvY8H-6jSNVv-b-o5SjurV6Ha7Zysibpb8gLr86-QacMPnwP56Y9rBgxmGymUMXTJjXTXmKTY3G_Ha-CXk4Phrf9x58jVu48IHEFhzlnn6m_Kw6nGNEs-32IYw' https://10.254.0.1:443/api
    {
      "kind": "APIVersions",
      "versions": [
        "v1"
      ],
      "serverAddressByClientCIDRs": [
        {
          "clientCIDR": "0.0.0.0/0",
          "serverAddress": "192.168.14.176:6443"
        }
      ]

中国lanwp

关注

2
点赞
踩
15

收藏

觉得还不错? 一键收藏
2
评论
k8s查看用户的token并验证

查看指定空间下所有用户 kubectl get sa -n kube-system[root@docker228 kubernetes]# kubectl get sa -n kube-systemNAME SECRETS AGEcalico-cni-plugin 1 9hcalico-policy-cont...
复制链接

扫一扫