[root@master231 serviceAccount]# cat 01-sa-rabc.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: oldboyedu-python
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: oldboyedu-pod-reader
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "watch", "list"]
#- apiGroups: ["apps"]
# resources: ["deployments"]
# verbs: ["get", "watch", "list"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: oldboyedu-sa-to-role
subjects:
- kind: ServiceAccount
name: oldboyedu-python
roleRef:
kind: Role
name: oldboyedu-pod-reader
apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: oldboyedu-python3-sa
spec:
replicas: 2
selector:
matchExpressions:
- key: apps
values:
- "python"
operator: In
template:
metadata:
labels:
apps: python
spec:
# 指定sa的名称,请确认该账号是有权限访问K8S集群的哟!
serviceAccountName: oldboyedu-python
containers:
- image: harbor.oldboyedu.com/oldboyedu-tools/python:3.9.16-alpine3.16
name: c1
command:
- tail
- -f
- /etc/hosts
[root@master231 serviceAccount]#
[root@master231 serviceAccount]# kubectl apply -f 01-sa-rabc.yaml
serviceaccount/oldboyedu-python created
role.rbac.authorization.k8s.io/oldboyedu-pod-reader created
rolebinding.rbac.authorization.k8s.io/oldboyedu-sa-to-role created
deployment.apps/oldboyedu-python3-sa created
[root@master231 serviceAccount]#
- 编写Python程序,进入到"python"Pod所在的容器执行以下Python代码即可!
[root@master231 serviceAccount]# kubectl get pods
NAME READY STATUS RESTARTS AGE
oldboyedu-python3-sa-799bdd87b4-4cdsh 1/1 Running 0 17s
oldboyedu-python3-sa-799bdd87b4-crpl7 1/1 Running 0 17s
[root@master231 serviceAccount]#
[root@master231 serviceAccount]#
[root@master231 serviceAccount]# kubectl exec -it oldboyedu-python3-sa-799bdd87b4-4cdsh -- sh
/ # pip install kubernetes -i https://pypi.tuna.tsinghua.edu.cn/simple/
/ # cat > view-k8s.py <<'EOF'
from kubernetes import client, config
with open('/var/run/secrets/kubernetes.io/serviceaccount/token') as f:
token = f.read()
configuration = client.Configuration()
configuration.host = "https://kubernetes" # APISERVER地址
configuration.ssl_ca_cert="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" # CA证书
configuration.verify_ssl = True # 启用证书验证
configuration.api_key = {"authorization": "Bearer " + token} # 指定Token字符串
client.Configuration.set_default(configuration)
apps_api = client.AppsV1Api()
core_api = client.CoreV1Api()
try:
print("###### Deployment列表 ######")
# 列出default命名空间所有deployment名称
for dp in apps_api.list_namespaced_deployment("default").items:
print(dp.metadata.name)
except:
print("没有权限访问Deployment资源!")
try:
# 列出default命名空间所有pod名称
print("###### Pod列表 ######")
for po in core_api.list_namespaced_pod("default").items:
print(po.metadata.name)
except:
print("没有权限访问Pod资源!")
EOF
/ # python view-k8s.py
###### Deployment列表 ######
没有权限访问Deployment资源!
###### Pod列表 ######
oldboyedu-python3-sa-799bdd87b4-4cdsh
oldboyedu-python3-sa-799bdd87b4-crpl7
/ #
/ #
- 安装Python程序依赖的软件包并测试
pip install kubernetes -i https://pypi.tuna.tsinghua.edu.cn/simple/
python3 <your python app name>