Kubernetes ---- API Server认证、配置文件、自定义用户连接API Server

$ kubectl describe pod deploy-demo-854b57c687-f7txr
....
Volumes:
default-token-ppzsj:
Type: Secret (a volume populated by a Secret)
SecretName: default-token-ppzsj
Optional: false
QoS Class: BestEffort
Node-Selectors: 
Tolerations: node.kubernetes.io/not-ready:NoExecute for 300s
node.kubernetes.io/unreachable:NoExecute for 300s
....

$ kubectl get secret
NAME 　　　　　　　　　　　　TYPE 　　　　　　　　　　　　　　DATA 　　AGE
default-token-ppzsj kubernetes.io/service-account-token 3 　　26d

# 首先查看系统上已有的serviceaccount;
$ kubectl get serviceaccount
NAME     SECRETS    AGE
default     1       26d

# 直接使用create创建一个名为admin的sa;
$ kubectl create sa admin

# 再次查询,发现创建成功;
$ kubectl get sa
NAME   SECRETS   AGE
admin     1      84s
default   1      26d

# 查看sa的详细信息,发现了名为"admin-token-pfp5j"的secret;
$ kubectl describe sa admin
Name: admin
Namespace: default
Labels: 
Annotations: 
Image pull secrets: 
Mountable secrets: admin-token-pfp5j
Tokens: admin-token-pfp5j
Events: 

# 查看secret,发现刚创建的sa自动创建了一个"admin-token-pfp5j"secret;
$ kubectl get secret
NAME 　　　　　　　　　　　　　　TYPE 　　　　　　　　　　　　　　DATA 　　AGE
admin-token-pfp5j kubernetes.io/service-account-token 　　 3 　　2m32s
default-token-ppzsj kubernetes.io/service-account-token 　 3 　　26d

# 创建Pod使用新创建的sa;
$ vim pod-sa.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-sa
  namespace: default
spec:
  containers:
  - name: sa-container
    image: ikubernetes/myapp:v1
    imagePullPolicy: IfNotPresent
    ports:
    - name: http
      containerPort: 80
  # 自定义serviceaccount的名称
  serviceAccountName: admin

$ kubectl apply -f pod-sa.yaml

# 查看详细信息发现默认自带的volumes中的名称变为了"admin-token-pfp5j"也就是我们刚创建sa后,集群自动帮我们创建的secret;
$ kubectl describe pods pod-sa
....
Volumes:
admin-token-pfp5j:
Type: Secret (a volume populated by a Secret)
SecretName: admin-token-pfp5j
Optional: false
QoS Class: BestEffort
Node-Selectors: 
Tolerations: node.kubernetes.io/not-ready:NoExecute for 300s
node.kubernetes.io/unreachable:NoExecute for 300s
....

# 查看配置
$ kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://192.168.133.128:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kubernetes-admin
name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
user:
client-certificate-data: REDACTED
client-key-data: REDACTED

# cd /etc/kubernetes/pki
# (umask 077; openssl genrsa -out kfree.key 2048)
# openssl req -new -key kfree.key -out kfree.csr -subj "/CN=kfree"
# openssl x509 -req -in kfree.csr -CA ./ca.crt -CAkey ./ca.key -CAcreateserial -out kfree.crt -days 365
# su - kubeadm
$ kubectl config set-credentials kfree --client-certificate=/etc/kubernetes/pki/kfree.crt --client-key=/etc/kubernetes/pki/kfree.key
$ kubectl config set-context kfree@kubernetes --cluster=kubernetes --user=kfree
$ kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://192.168.133.128:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: kfree
name: kfree@kubernetes
- context:
cluster: kubernetes
user: kubernetes-admin
name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kfree
user:
client-certificate: /etc/kubernetes/pki/kfree.crt
client-key: /etc/kubernetes/pki/kfree.key
- name: kubernetes-admin
user:
client-certificate-data: REDACTED
client-key-data: REDACTED

$ kubectl config use-context kfree@kubernetes
# 因为我们只处理了认证,没有授予权限,所以没有权限的;
$ kubectl get pods
Error from server (Forbidden): pods is forbidden: User "kfree" cannot list resource "pods" in API group "" in the namespace "default"