kubernetes新建自定义用户(新cluster 用户名)

最新推荐文章于 2024-08-17 13:16:11 发布

王亭_666

最新推荐文章于 2024-08-17 13:16:11 发布

阅读量1.3k

点赞数 1

分类专栏： kubernetes 文章标签： kubernetes k8s 容器编排 K8S新建用户

本文链接：https://blog.csdn.net/wt334502157/article/details/102822348

版权

kubernetes 专栏收录该内容

5 篇文章 0 订阅

订阅专栏

默认的kubernetes集群我们一般使用的都是：kubernetes-admin 用户来管理增删改查；那如何添加一个自定义用户呢，操作步骤如下：




[root@master pki]# pwd
/etc/kubernetes/pki
[root@master pki]# 
[root@master pki]# 
[root@master pki]# 
[root@master pki]# (umask 077; openssl genrsa -out wangting.key 2048)
Generating RSA private key, 2048 bit long modulus
...................+++
...................................................+++
e is 65537 (0x10001)
[root@master pki]# 
[root@master pki]# 
[root@master pki]# openssl req -new -key wangting.key -out wangting.csr -subj "/CN=wangting"
[root@master pki]# 
[root@master pki]# 
[root@master pki]# openssl x509 -req -in wangting.csr -CA ./ca.crt -CAkey ./ca.key -CAcreateserial -out wangting.crt -days 365
Signature ok
subject=/CN=wangting
Getting CA Private Key
[root@master pki]# 
[root@master pki]# 
[root@master pki]# openssl x509 -in wangting.crt -text -noout      #(查看新生成的用户信息)
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            cb:06:cc:67:da:2d:87:66
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=kubernetes
        Validity
            Not Before: Oct 30 08:11:51 2019 GMT
            Not After : Oct 29 08:11:51 2020 GMT
        Subject: CN=wangting
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b1:c5:24:4e:b7:a7:82:12:d2:b0:31:8d:82:1d:
                    9c:bd:ba:08:1a:c3:7c:70:83:64:7e:10:75:c0:cf:
                    e5:2e:4b:11:59:89:f8:24:57:63:1c:f1:26:d8:76:
                    29:f5:6a:42:e4:0d:cc:24:8a:3a:2f:c7:9a:50:55:
                    8e:7c:8c:51:68:ad:94:d5:c4:1e:61:60:15:3d:69:
                    76:64:90:6d:8c:fd:18:ec:ce:8b:31:e7:23:20:41:
                    a9:4d:1c:8a:cc:b4:74:56:ea:9d:7c:99:05:6c:d0:
                    46:ad:0a:b2:68:31:29:8b:ba:4e:73:81:17:ab:1a:
                    1b:d0:55:00:19:ad:6c:e7:4c:ae:00:19:42:94:15:
                    36:66:a6:67:e4:9a:a6:0f:dc:c0:de:1d:e7:1d:55:
                    05:91:ca:44:4d:f4:7b:8c:99:0d:a1:4e:dc:ba:29:
                    4e:84:21:d5:57:18:08:28:33:7a:f0:80:36:33:d2:
                    6b:1f:c6:d8:fc:02:22:d7:32:0d:13:86:81:0d:50:
                    54:ef:f9:cd:0d:19:c6:54:3a:98:d9:5d:41:0a:99:
                    0a:7b:08:50:a6:75:dd:d4:7d:15:ab:ad:7a:8e:4d:
                    a0:72:8b:f2:72:f0:ee:1f:ae:68:36:7a:4a:fd:ab:
                    3a:b0:46:4c:fd:78:99:8d:4c:e4:9e:b9:d2:28:c2:
                    83:43
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha256WithRSAEncryption
         14:60:5f:0b:ff:69:39:0e:27:81:82:8a:a7:96:63:71:04:f9:
         8a:93:a2:9a:3c:a0:01:d3:e6:28:87:72:b7:6f:b7:8f:b4:cd:
         da:8f:8e:c0:a2:d6:d4:23:9f:17:2c:6b:48:8a:5e:e1:17:71:
         9f:70:84:8a:e9:dc:04:bd:47:0c:c9:a4:b4:cd:29:66:c6:84:
         1a:6e:cc:f4:2c:cd:e7:c0:37:87:4b:fc:d6:8d:14:ba:23:3f:
         f5:0c:09:1b:2d:1a:46:2e:84:10:6a:1c:af:60:ef:f9:62:80:
         e0:dd:25:88:bc:40:27:25:6a:08:b1:f2:ca:10:17:a3:e9:c4:
         8e:00:2a:da:3d:e2:37:53:1f:3e:ec:a6:f3:2b:12:c2:d6:80:
         26:44:d3:e3:7b:f7:7d:1c:82:16:6c:d5:f5:4f:82:7f:15:f8:
         8e:06:58:d9:da:ce:ae:fb:0b:8d:d7:ed:a9:22:4b:0d:39:77:
         98:c3:53:1b:7a:f7:2a:d0:46:64:6d:2a:b2:05:a4:af:83:4c:
         6c:3d:db:fe:35:59:86:cd:3d:27:25:50:be:39:f5:63:c7:58:
         d9:fb:55:05:25:f2:ec:7b:01:1d:7f:e8:ba:67:ec:21:01:58:
         ff:b9:b3:c7:1c:c5:ae:0b:cb:91:54:a8:91:b2:6c:a6:2d:33:
         41:c4:65:14
[root@master pki]# 
[root@master pki]# 
[root@master pki]# kubectl config set-credentials wangting --client-certificate=./wangting.crt --client-key=./wangting.key --embed-certs=true
User "wangting" set.
[root@master pki]# 
[root@master pki]# 
[root@master pki]# 
[root@master pki]# kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://172.19.xxx.xxx:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: wangting							# <-----user里已经有新用户
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
[root@master pki]# 
[root@master pki]# 
[root@master pki]# 
[root@master pki]# kubectl config set-context wangting@kubernetes --cluster=kubernetes --user=wangting
Context "wangting@kubernetes" created.            # 将用户名添加至上下文context
[root@master pki]# 
[root@master pki]# 
[root@master pki]# 
[root@master pki]# kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://172.19.xxx.xxx:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
- context:
    cluster: kubernetes
    user: wangting							# <----- context上下文已添加新用户
  name: wangting@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: wangting							# <-----新用户
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
[root@master pki]# 
[root@master pki]# 
[root@master pki]# 
[root@master pki]# kubectl config use-context wangting@kubernetes 
Switched to context "wangting@kubernetes".				 # 当前操作用户已切成新建用户
[root@master pki]# 
[root@master pki]#        #初建的新用户权限没有管理员这么大，验证一下
[root@master pki]# kubectl get pods --all-namespaces 
Error from server (Forbidden): pods is forbidden: User "wangting" cannot list resource "pods" in API group "" at the cluster scope
[root@master pki]# 
[root@master pki]# 
[root@master pki]#       #再切会管理员kubernetes-admin，对比一下
[root@master pki]# kubectl config use-context kubernetes-admin@kubernetes 
Switched to context "kubernetes-admin@kubernetes".
[root@master pki]#
[root@master pki]#
[root@master pki]# kubectl get pods --all-namespaces
NAMESPACE              NAME                                    READY   STATUS    RESTARTS   AGE
kube-system            coredns-5644d7b6d9-xdqzj                1/1     Running   3          2d3h
kube-system            coredns-5644d7b6d9-xkgt8                1/1     Running   4          2d3h
kube-system            etcd-master                             1/1     Running   3          2d3h
kube-system            kube-apiserver-master                   1/1     Running   3          2d3h
kube-system            kube-controller-manager-master          1/1     Running   3          2d3h
kube-system            kube-flannel-ds-amd64-4rl55             1/1     Running   2          2d2h
kube-system            kube-flannel-ds-amd64-9nn2n             1/1     Running   2          2d2h
kube-system            kube-flannel-ds-amd64-gpgdq             1/1     Running   4          2d2h
kube-system            kube-flannel-ds-amd64-s6rwb             1/1     Running   2          2d2h
kube-system            kube-proxy-7cp2p                        1/1     Running   2          2d3h
kube-system            kube-proxy-bbc26                        1/1     Running   2          2d3h
kube-system            kube-proxy-c5qdp                        1/1     Running   3          2d3h
kube-system            kube-proxy-wlrkc                        1/1     Running   4          2d3h
kube-system            kube-scheduler-master                   1/1     Running   3          2d3h
kubernetes-dashboard   kubernetes-dashboard-7b5bf5d559-bcf8s   1/1     Running   0          47h