k8s安全，授权其他用户管理一个namespace

创建一个用户只能管理 dev 空间

vim /etc/kubernetes/pki/devuser-csr.json {   "CN": "devuser",   "hosts": [],   "key": {     "algo": "rsa",     "size": 2048   },   "names": [     {       "C": "CN",       "ST": "BeiJing",       "L": "BeiJing",       "O": "k8s",       "OU": "System"     }   ] }	创建一个json
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 mv cfssl_linux-amd64 /usr/local/bin/cfssl	下载证书生成工具
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo
cfssl gencert -ca=ca.crt -ca-key=ca.key  -profile=kubernetes /etc/kubernetes/pki/devuser-csr.json | cfssljson -bare devuser
export KUBE_APISERVER="https://10.0.0.101:6443"	配置环境变量改成自己的IP
vim /etc/profile export KUBE_APISERVER="https://10.0.0.101:6443"
kubectl config set-cluster kubernetes \ --certificate-authority=/etc/kubernetes/ssl/ca.crt \ --embed-certs=true \ --server=${KUBE_APISERVER} \ --kubeconfig=devuser.kubeconfig	# 设置集群参数
kubectl config set-credentials devuser \ --client-certificate=/etc/kubernetes/pki/devuser.pem \ --client-key=/etc/kubernetes/pki/devuser-key.pem \ --embed-certs=true \ --kubeconfig=devuser.kubeconfig	# 设置客户端认证参数
kubectl config set-context kubernetes \ --cluster=kubernetes \ --user=devuser \ --namespace=dev \ --kubeconfig=devuser.kubeconfig	# 设置上下文参数
kubectl config use-context kubernetes --kubeconfig=devuser.kubeconfig	# 设置默认上下文
kubectl create namespace dev
useradd ly01 passwd ly01 mkdir /home/ly01/.kube mv devuser.kubeconfig /home/ly01/.kube/config chown -R ly01.ly01 /home/ly01/.kube/	#创建用户名，并把devuser.kubeconfig文件放到用户家目录并更改属主和文件名称
kubectl get rolebinding -n dev	查看是否生成rolebinding资源