k8s 創建 webToken 授權用於 api-server 訪問

k8s_secret_webToken

• TSSC

• k8s_secret_webToken
  • 1.創建用戶授權-webToken
    • 1.1.創建 yaml 文件生成 webToken
    • 1.2.查看 webToken 的值
    • 1.3.重新生成 webToken

---

1.創建用戶授權-webToken

• webToken 用於使用 server-api 管理 k8s 集群
• 集群創建完成即可創建 ServiceAccount 類型的 secret（webToken），該 secret 不依賴用戶證書
• 如果需要更新 webToken 可以刪除對應的 ServiceAccount

1.1.創建 yaml 文件生成 webToken

# 創建用戶授權的 yaml 文件
mkdir -p /opt/k8s/grant
cd /opt/k8s/grant
vim k8s_create_webToken.yaml
--------------------------
# 創建賬號
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: devuser
  namespace: test01

# 創建授權規則
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: devuser
  labels:
    rbac.zuiyoujie.com/name: devuser
rules:
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/attach
      - pods/exec
      - pods/log
      - pods/status
      - configmaps
      - services
    verbs:
      - get
      - list
      - watch
      - create
      - describe
  - apiGroups:
      - extensions
      - apps
    resources:
      - deployments
    verbs:
      - get
      - list
      - watch
      - describe

# 將賬號和授權綁定起來
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: devuser
  namespace: test01
  labels:
    rbac.zuiyoujie.com/name: devuser
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: devuser
subjects:
  - kind: ServiceAccount
    name: devuser
    namespace: test01
---
-----------------------------------

# 創建 webToken 的 Secret
kubectl apply -f k8s_create_webToken.yaml

1.2.查看 webToken 的值

• 手動查詢

# 查詢 webToken 的 Secret 名稱
kubectl get secret | grep token
--------------------------------
[root@zuiyoujie ~]# kubectl get secret | grep token
default-token-frvq9                        kubernetes.io/service-account-token   3      7d
devuser-token-k6hnn                        kubernetes.io/service-account-token   3      5d23h
nginx-ingress-serviceaccount-token-dzrkb   kubernetes.io/service-account-token   3      7d
--------------------------------

# 查看 Secret 的 webToken 值
kubectl describe secret devuser-token-k6hnn
--------------------------------
[root@zuiyoujie ~]# kubectl describe secret devuser-token-k6hnn
Name:         devuser-token-k6hnn
Namespace:    test01
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: devuser
              kubernetes.io/service-account.uid: df4f9dae-6752-48af-b95d-fbec4c543691

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1029 bytes
namespace:  8 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IjZSakJtQXhwYXBGVk9PSzF0MTZoYi1qMXhxUVdxT0JlS1h6VWZ2SlhOTzgifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJydGMtcHJvZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY29
--------------------------------

• 一鍵查詢

kubectl describe secret $(kubectl get secret -n kube-system | grep ^devuser | awk '{print $1}') -n kube-system | grep -E '^token'| awk '{print $2}'

1.3.重新生成 webToken

# 需要刷新 webToken 可以刪掉重新生成
kubectl get ServiceAccount
kubectl get sa
kubectl delete sa xxxx