授權某個linux系統root下kubectl命令給 普通用戶

###

1.創建普通用戶，設置密碼

[root@jira ~]# useradd alphaReadLog
[root@jira ~]# passwd alphaReadLog
Changing password for user test.
New password: 
BAD PASSWORD: The password is shorter than 8 characters
Retype new password: 
passwd: all authentication tokens updated successfully.

2.復制admin.conf文件到普通用戶

[alphaReadLog@iZ2ze2uuh7sdomb9ij4gxeZ ~]$ mkdir -p /home/alphaReadLog/.kube/config/

[root@iZ2ze2uuh7sdomb9ij4gxeZ ~]# cp /etc/kubernetes/admin.conf  /home/alphaReadLog/.kube/config/

[root@iZ2ze2uuh7sdomb9ij4gxeZ ~]# chown alphaReadLog.alphaReadLog /home/alphaReadLog/.kube/config/admin.conf 

[alphaReadLog@iZ2ze2uuh7sdomb9ij4gxeZ ~]$ cat /home/alphaReadLog/.bashrc 
# .bashrc
# Source global definitions
if [ -f /etc/bashrc ]; then
    . /etc/bashrc
fi
# Uncomment the following line if you don't like systemctl's auto-paging feature:
# export SYSTEMD_PAGER= export KUBECONFIG=/home/alphaReadLog/.kube/config/admin.conf source <(kubectl completion bash)
# User specific aliases and functions

[alphaReadLog@iZ2ze2uuh7sdomb9ij4gxeZ ~]$ source /home/alphaReadLog/.bashrc

3.授權alphaReadLog用戶可以執行kubectl命令(***步驟可不做)

[root@jira ~]# cat /etc/sudoers
# ****
## Allow root to run any commands anywhere 
root    ALL=(ALL)     ALL
#(為普通用戶alphaReadLog賦予root權限）
#第一個ALL：所有地方都可以登陸，localhost只能本機登陸。
#第二個(ALL):表示什么身份的用戶都執行。’
#第三個ALL：表示所有命令都可以使用
#NOPASSWD：表示不用輸入root密碼即可執行
alphaReadLog ALL=(ALL) NOPASSWD:/usr/bin/kubectl

## Allows members of the 'sys' group to run networking, software, 
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS

## Allows people in group wheel to run all commands
%wheel    ALL=(ALL)    ALL

## Same thing without a password
# %wheel    ALL=(ALL)    NOPASSWD: ALL

# ****

4.普通用戶測試

# 未授權(未操作步驟2中拷貝admin.conf)時使用命令
[alphaReadLog@iZ2ze2uuh7sdomb9ij4gxeZ ~]$ kubectl get pod
The connection to the server localhost:8080 was refused - did you specify the right host or port? # 授權后(本次未執行步驟3，執行了步驟2)
[alphaReadLog@iZ2ze2uuh7sdomb9ij4gxeZ ~]$ kubectl get pod
NAME                                     READY   STATUS    RESTARTS   AGE
alpha-abilitytest-6849db6b7c-frrt7       1/1     Running   0          127d
alpha-recruitment-548f7957d7-6glsm       1/1     Running   0          9d

 

 

###