k8s租户设置

最新推荐文章于 2024-09-02 22:02:41 发布

Emerson_bao

最新推荐文章于 2024-09-02 22:02:41 发布

阅读量157

点赞数 3

文章标签： kubernetes 容器云原生

本文链接：https://blog.csdn.net/qq_31871661/article/details/141159877

版权

k8s租户设置

创建租户账号

[root@kube-master-01 third-test]# cat sa.yaml 
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bao
  namespace: third

创建角色

[root@kube-master-01 third-test]# more role.yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: bao-role
  namespace: third
rules:
  - apiGroups:
      - apps
      - ''
    resources:
      - deployments
      - replicasets
      - statefulsets
      - daemonsets
      - services
      - pods
      - pods/log
      - pods/exec
      - namespaces
    verbs:
      - list
      - get
      - create

创建绑定关系

[root@kube-master-01 third-test]# more rolebing.yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: third-role
  namespace: third
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: bao-role 
subjects:

- kind: ServiceAccount
  name: bao
  namespace: third

创建资源配额限制

[root@kube-master-01 third-test]# more resource-quota.yaml 
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-resources
  namespace: third
spec:
  hard:
    requests.cpu: "2"
    requests.memory: 4Gi
    limits.cpu: "2.5"
    limits.memory: 4.5Gi
    pods: "10"
    count/deployments.apps: "3"
    count/services: "3"

配置上下文

#查看sa的secret
kubectl get secret -nthird
#查看sa对应的token
echo $(kubectl -n third get secret $(kubectl -n third get secret | grep bao | awk '{print $1}') -o go-template='{{.data.token}}' | base64 -d)

token=`echo $(kubectl -n third get secret $(kubectl -n third get secret | grep bao | awk '{print $1}') -o go-template='{{.data.token}}' | base64 -d)`
#打印token
echo $token

#创建user凭证绑定token
kubectl config set-credentials bao --token=$token

#配置集群
kubectl config set-cluster mycluster --insecure-skip-tls-verify=true --server=https://lb-apiserver.kubernetes.local:6443

#绑定集群关系
kubectl config set-context mycontext --cluster=mycluster --user=bao

#查看配置信息
cat /root/.kube/config

#切换到新的上下文
kubectl config use-context mycontext

#切换回原先的认证上下文
kubectl config use-context kubernetes-admin@cluster.local

配置网络隔离

[root@kube-master-01 tenant]# more network-policy.yaml 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tenant-datasec
  namespace: datasec
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

  ingress:
  - from:
    - namespaceSelector:    #匹配命名空间标签
        matchLabels:
          #kubesphere.io/namespace: default
          name: datasec
    - ipBlock:  #通过cidr来进行屏蔽
        cidr: 0.0.0.0/0
        except:
        - 172.22.56.0/21
  egress:
  - to:
    - ipBlock: #通过cidr来进行屏蔽
        cidr: 0.0.0.0/0
        except:
        - 172.22.56.0/21
        #- 10.233.64.0/18
        #- 10.233.0.0/18
    - namespaceSelector:
        matchLabels:
          name: datasec