k8s租户设置
创建租户账号
[root@kube-master-01 third-test]# cat sa.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: bao
namespace: third
创建角色
[root@kube-master-01 third-test]# more role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: bao-role
namespace: third
rules:
- apiGroups:
- apps
- ''
resources:
- deployments
- replicasets
- statefulsets
- daemonsets
- services
- pods
- pods/log
- pods/exec
- namespaces
verbs:
- list
- get
- create
创建绑定关系
[root@kube-master-01 third-test]# more rolebing.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: third-role
namespace: third
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: bao-role
subjects:
- kind: ServiceAccount
name: bao
namespace: third
创建资源配额限制
[root@kube-master-01 third-test]# more resource-quota.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
name: compute-resources
namespace: third
spec:
hard:
requests.cpu: "2"
requests.memory: 4Gi
limits.cpu: "2.5"
limits.memory: 4.5Gi
pods: "10"
count/deployments.apps: "3"
count/services: "3"
配置上下文
#查看sa的secret
kubectl get secret -nthird
#查看sa对应的token
echo $(kubectl -n third get secret $(kubectl -n third get secret | grep bao | awk '{print $1}') -o go-template='{{.data.token}}' | base64 -d)
token=`echo $(kubectl -n third get secret $(kubectl -n third get secret | grep bao | awk '{print $1}') -o go-template='{{.data.token}}' | base64 -d)`
#打印token
echo $token
#创建user凭证绑定token
kubectl config set-credentials bao --token=$token
#配置集群
kubectl config set-cluster mycluster --insecure-skip-tls-verify=true --server=https://lb-apiserver.kubernetes.local:6443
#绑定集群关系
kubectl config set-context mycontext --cluster=mycluster --user=bao
#查看配置信息
cat /root/.kube/config
#切换到新的上下文
kubectl config use-context mycontext
#切换回原先的认证上下文
kubectl config use-context kubernetes-admin@cluster.local
配置网络隔离
[root@kube-master-01 tenant]# more network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: tenant-datasec
namespace: datasec
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- namespaceSelector: #匹配命名空间标签
matchLabels:
#kubesphere.io/namespace: default
name: datasec
- ipBlock: #通过cidr来进行屏蔽
cidr: 0.0.0.0/0
except:
- 172.22.56.0/21
egress:
- to:
- ipBlock: #通过cidr来进行屏蔽
cidr: 0.0.0.0/0
except:
- 172.22.56.0/21
#- 10.233.64.0/18
#- 10.233.0.0/18
- namespaceSelector:
matchLabels:
name: datasec