本博客将创建一个用户devuser(自定义)只能管理demo空间
1 下载证书生成软件
# 下载证书生成工具 cd /root wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 mv cfssl_linux-amd64 /usr/local/bin/cfssl wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 mv cfssljson_linux-amd64 /usr/local/bin/cfssljson wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo chmod x /usr/local/bin/cfssl chmod x /usr/local/bin/cfssljson chmod x /usr/local/bin/cfssl-certinfo 2 生成集群证书config文件
2.1 创建devuser-csr.json
mkdir /root/devuser vi devuser-csr.json {
"CN": "devuser", "hosts": [], "key": {
"algo": "rsa", "size": 2048 }, "names": [ {
"C": "CN", "ST": "GuangZhou", "L": "GuangZhou", "O": "k8s", "OU": "System" } ] } 2.2 生成证书和密钥
cd /etc/kubernetes/pki #找到集群证书和私钥ca.crt ca.key cfssl gencert -ca=ca.crt -ca-key=ca.key -profile=kubernetes /root/devuser/devuser-csr.json | cfssljson -bare devuser #执行上一个命令后，将是/etc/kubernetes/pki生成devuser.csr devuser-key.pem devuser.pem 三个文件 输出内容：
2022/01/03 16:27:01 [INFO] generate received request 2022/01/03 16:27:01 [INFO] received CSR 2022/01/03 16:27:01 [INFO] generating key: rsa-2048 2022/01/03 16:27:01 [INFO] encoded CSR 2022/01/03 16:27:01 [INFO] signed certificate with serial number
183318846060115252175414421649635047300497396132
2022/01/03
16:27:01
[WARNING
] This certificate lacks a
"hosts" field. This makes it unsuitable
for websites. For
more information see the Baseline Requirements
for the Issuance and Management of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum
(https://cabforum.org
)
; specifically, section
10.2.3
(
"Information Requirements"
).
2.3 生成证书及密钥
2.3.1 设置集群参数
kubectl config set-cluster kubernetes \
> --certificate-authority=/etc/kubernetes/pki/ca.crt \
> --embed-certs=true \
> --server=https://192.168.3.81:6443 \
> --kubeconfig=devuser.kubeconfig
# 输出：Cluster "kubernetes" set.
2.3.2 设置客户端认证参数
kubectl config set-credentials devuser \
> --client-key=devuser-key.pem \
> --client-certificate=devuser.pem \
> --embed-certs=true \
> --kubeconfig=devuser.kubeconfig
#输出：User "devuser" set.
2.3.3 设置上下文参数
kubectl config set-context kubernetes \
> --cluster=kubernetes \
> --user=devuser \
> --kubeconfig=devuser.kubeconfig
# 输出： Context "kubernetes" created.
2.3.4 设置当前使用配置
kubectl config use-context kubernetes --kubeconfig=devuser.kubeconfig
# 输出：Switched to context "kubernetes".
2.3.5 rbac授权
kubectl create rolebinding devuser-admin-binding --clusterrole=admin --user=devuser --namespace=default
备注：–clusterrole=admin也可以重新创建角色。
2.3.5 查看生成的证书
cat devuser.kubeconfig
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1ekNDQWMrZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQjRYRFRJeU1ERXhPREEyTXpVd05Wb1hEVE15TURFeE5qQTJNelV3TlZvd0ZURVRNQkVHQTFVRQpBeE1LYTNWaVpYSnVaWFJsY3pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTWdqCjh5MUlVWDl5U2ZKRzRtSEswSjc0aEJxQnN0T0hKejVxeXhsTEQ5eUZRN3dXRlFMNUp4cnp5eVRmQWNzN1FYeTYKOFdpQXJMK0hmY3dJRkVseklLYVZRZnRZemxxb1REeE1RRnI5YnN4VUN6ZldXZHhrWlRKaTQ3VDZ5dExFd1RWUwpNVUh2QVlMWnNzUVBhSEN3MTZTTCtGVHR6aHVUNUVVNkJvdWNONEZpbEN3VGlVTnlRNFNQYUxFN2o3dGc0ajdDCmZ1QkZwUXpOWnhZUHFIRTFWYXhsVVFoV2IrT0s4QTVTVmJVcCtablBiaEZTRHUxWHFpd29YK1gzNXZKazAveW8KMmpzenllSW9abFJwVTRKbnZWT0Y3NlJ4L0VZUHJqYlRpTkZJd1JiU3k2Tm1DL0hiNU4zUDZFSGo4UDBEejNUWAptVlBRbFlXQVBrWXZMbjAzaVA4Q0F3RUFBYU5DTUVBd0RnWURWUjBQQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCCi93UUZNQU1CQWY4d0hRWURWUjBPQkJZRUZNU3Q3ZGU4bHdiZEoxSjQvOElBYktmSXgyVm1NQTBHQ1NxR1NJYjMKRFFFQkN3VUFBNElCQVFCdGJTUHdvNE5QbjllekQwbE45cytaYVBreHVNMG5NTmJKUVd6aHdZaW9SVXBqcGVCTQpZMVdKTC9ZaHlzN2l4cU5kb0RUeFJxWnYrUHpiaUw0cHUzV0c1WHgwTmJvVE5BQ2w0Tno3dTRGMVpMWHpucmExCnN1aXh6b2s3T25aejFrSGpMUFNLL29wcjZLbER3M3pnRys4dkd5RURKYitiREhjVDVsdW5pQkQySkRzekJYb3MKemtXeXMzaWlMRTFCSnU3MUVPcnhkZDVQVVVPWEJoWXZkYW5FcWpDQVY4ckdWMVN0VTBuUjFOeDltR2taTDhaQgpWZDZhZDNSVjRJQ3lnUDRodDZ0T3FnNnRUMCtLUHArMlJaLzk2a0pYNUxRdUhwSFNucTdvVU1vZml1dFRSeVFYClBqZkZJdGFvWHRiQXNmVGtuaXBZS281MHM2ZDlJQmZFaFN4YwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
server: https://192.168.3.81:6443
name: kubernetes
contexts:
- context:
cluster: kubernetes
user: devuser
name: kubernetes
current-context: kubernetes
kind: Config
preferences: {
}
users:
- name: devuser
user:
client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURpRENDQW5DZ0F3SUJBZ0lVZHpXcnhZR0JESVUzd0YzYnhIb1pPenFERHh3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZURVRNQkVHQTFVRUF4TUthM1ZpWlhKdVpYUmxjekFlRncweU1qQTBNRFF4T0RFM01EQmFGdzB5TXpBMApNRFF4T0RFM01EQmFNR1l4Q3pBSkJnTlZCQVlUQWtOT01SSXdFQVlEVlFRSUV3bEhkV0Z1WjFwb2IzVXhFakFRCkJnTlZCQWNUQ1VkMVlXNW5XbWh2ZFRFTU1Bb0dBMVVFQ2hNRGF6aHpNUTh3RFFZRFZRUUxFd1pUZVhOMFpXMHgKRURBT0JnTlZCQU1UQjJSbGRuVnpaWEl3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQgpBUURRSkszWGNYT3F3QjE2a1ExbDdQaVNBektNU0pqRjZpMjNKNGNGdXZJejM3L0I3MmNEMFUrOFZCU2ViK2VOClRsOUpWNzhlQkdNc094MmU4elpvYmNUbklpV1hYUHlOT3F0OFpzOWpDUDVMdXEyN05RZHVKbkN2a0t0YzgrZTUKU2tpRVBjQ01vUUI1N2JEUFZqaFd2ck9KY3BoUk5KN3NiWmNzYlFkZ3NtUzA1RERSajNVa3kweVRTd2gvQW1XMwptWGlYSklBZnhmbFQ4VnhIdVJCYTNKUlhEakZ0eGR0aGUxc1lOcGFKYTQ5VnVaU2hyVlQrOGUzOUhGTjFsUC9UCjZPNDlxemhuNjQzSlRuRFVpZnVwUmZualFlTkxJKzJ6cHhreFNFSTJtYnllQyt4T285NUQyQ2doeHVHYUFGbzYKd1oreWphQWpQSUdlanlIVjlKUDlkZDVEQWdNQkFBR2pmekI5TUE0R0ExVWREd0VCL3dRRUF3SUZvREFkQmdOVgpIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUlLd1lCQlFVSEF3SXdEQVlEVlIwVEFRSC9CQUl3QURBZEJnTlZIUTRFCkZnUVVJYXNCbWhOWGJaUThlbWZkUjBxWUcycmtMdEl3SHdZRFZSMGpCQmd3Rm9BVXhLM3QxN3lYQnQwblVuai8Kd2dCc3A4akhaV1l3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUxxWitYeUoxREU3Uk95TFBwTmI1VXlkS09uWgpwSTV1UjBsVFRrTkd0bkNMNS8xV0lkMmJzTS9XSEFtamFMS1dWVjZ2RWpNZkMyOG1UdDc1K0NXeXlXT3VFdXhSCll2RFRSblhBbitHMDhoNjNmcjA5alpNcklKS2RqL1NqZ1NhUkpwR3ZqazVyM2o1M1NLVDhEekxvbXliOVBtS1MKU0IvOEdkenA3bEFiWTBlVlE5TUVjcjJiYjJBOStBZk9mU3Qwa1UvTUhITHhJdFpGbWZrWFE4dTRKdWpPZVZ1MgpCbmJEOCtyWFVNbU5IeUtGNjFVRlNiWVhrVDdtTUc2RmY2UHdCaFVZdEY5VWI5Z1Jod2liUzJZcnp4OGlaeWZICmdiM2R1MzZqa3ovWExTdFJEUE1rQzB5dm1WRjRQQXpURXZYanlyQkEzWTBaQ3FaWGVEVnhIY1EwQ3N3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBMENTdDEzRnpxc0FkZXBFTlplejRrZ015akVpWXhlb3R0eWVIQmJyeU05Ky93ZTluCkE5RlB2RlFVbm0vbmpVNWZTVmUvSGdSakxEc2Rudk0yYUczRTV5SWxsMXo4alRxcmZHYlBZd2orUzdxdHV6VUgKYmlad3I1Q3JYUFBudVVwSWhEM0FqS0VBZWUyd3oxWTRWcjZ6aVhLWVVUU2U3RzJYTEcwSFlMSmt0T1F3MFk5MQpKTXRNazBzSWZ3Smx0NWw0bHlTQUg4WDVVL0ZjUjdrUVd0eVVWdzR4YmNYYllYdGJHRGFXaVd1UFZibVVvYTFVCi92SHQvUnhUZFpULzAranVQYXM0Wit1TnlVNXcxSW43cVVYNTQwSGpTeVB0czZjWk1VaENOcG04bmd2c1RxUGUKUTlnb0ljYmhtZ0JhT3NHZnNvMmdJenlCbm84aDFmU1QvWFhlUXdJREFRQUJBb0lCQVFDbW84YitScGw1S2dndgoyYk9sVjd5R2djTFZaMFhRcGpUbGZ1THQ1b2NFbXUxV0lnb1NsMkJFQWZqa0ErbVpTeGFrakhpNVduL2ZxSkNGCmNtaXI0TDRVNGxUQVF6VDdDTzdFVVRkV0xad1NHeW4rU0cxamRha2dGaTNyNUdZd0JWWGJjZWtYYmNzSTB4Q00KWHBZS2RQRWVhTDJqdmdKQ2ZWYmJ2WXA3a3pkblRocVpqOG9NMmJuV0UxdFJzK2RjamdpcnN6S0VITkUrMXJLRApyMjRycGlRM0hpK3Y1bHRwUEVLZ0JtYkFrejdEeURuTkdBWFd5YVcxbGg5cTdoMnZHaWIxdHJFTU9NVjdwUnhvCjJ6TTBiYkRuM0sycGpWbVJEajhxRlJvWTJVZk9JS1lGaTJpNVE1Ymt3NnpRcldqNENnZXg5WXVSaDFYZEVpaTcKckwxeFhUekpBb0dCQU5GYkpZWm5ZSS9wbWJDTlZjd0pNMkFScmxCcEU3cGp4cXNSTkdEblkybWxSVGRsUVMyMwpWUEFXYTNPdVJpWXB0cGk0ei9MNlRxakdMUW9aMTZ2UzFvU214OUEvL05Ddkk4RGRqZ1pPSlpCeVAwRnhMM0NNClhqVDMxWTdhRlFUUHhRSXd4OGtTRFRBeGVMZFFaanFMM00vQXF4Nk5SZnd5ZjAzNXNjVEhaWlNQQW9HQkFQNkUKWEhWZXNOeEtPNWNRZGNkY20rZnRWVFpxZmtsd2lSRC9QUnJ1aHQ5c2ZGUFNpVGdpZXJXaXljQm9BQVFXVWNENApDT0FRb2c3VTBVRi9kMlgyaGpBSldsL2FLN3AvNkRseFNqQnNmeUh1V3d4WFE2QjRtR29YQXFDaXdYV1F4T3V5ClR1ZlNHNXZwclVGbDRBcm1xVjN5Qm0yZ0NlbmdGZ1pqak9tRXhQME5Bb0dCQUpEamI3ancycGMrcUNyVDVjanIKcFM2YmpmUUFoTEsrVXNRWmlCSjRrUWlRWkxMTjFLbjY4MEdsZ24vdzRJT1E0dG9YTFhPUFg5aldMbDJMUFFPaApTdTFMTDRZa2dxYzZUcGd2dlJjSUJsOU5jaEdzYjVTSTBMbi91MEMrRlVYYk5SRXJDVmxTc09YbGx4SG5CcGtHCktxOXRQQUJNN1Y1NDVEbm0wT3pLd3JacEFvR0FIazJ1SUg5Y3VXM1JPSVJLTWFseUdxUWtZQzAveWdpdkdTbjYKb1lsQzM3a3YrRjc1M1lnbGFoanV3b3pmYTUwb3NMd1hlbTRnalhtRFRMUWJpRFZZOXNFMlZIRktnWk1YR0RmSAo2SW9TZlB5L05ISHphRmpUZE5ZMmh0KzUvd0Iwb2NlQ0k1SGRuYXV0NkRweitYaExOQmRMOHFONmFyRTJqaDR1Ck9lT0gvTVVDZ1lBQnZ5dHd6L3UyeE9HS2MvdW9CakFyVk1GU3BKdUJiNlllY1k5UjZYK1FRcmc4ZU55Z2RaaWMKeUIzaEtxL1poRWFBNlF1cG5qUkpxTUw3cWZ1WFhIZGpUcHZJWGxLalRVTGZpbzhHZnYrd1R1a3pFdUZCVDFqSwo5NzAwd0JXY1kzTy9SUzFBWFVMYjRCVjNXNVVJSTFLTDdkbG9kY01iNTF4L0J3aFk1ZGM1cEE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
3 客户端登录
安装客户端：
yum install -y kubectl-1.18.6
客户端创建config目录
mkdir /root/.kube
从master拷贝/root/devuser/config过去客户端
scp devuser.kubeconfig root@192.168.3.84:/root/.kube/config
查看集群的命名空间default情况：
[root@k8s21-worker02 .kube]# kubectl get pod -n default
NAME READY STATUS RESTARTS AGE
busybox0403-5b4f44676f-jcbhp 0/1 CrashLoopBackOff 422 37h
busybox0403-648c58cd59-5wqp6 0/1 CrashLoopBackOff 443 37h
legacy-app 2/2 Running 3 29h
nginx0329-6f68f5ffd4-vdpxn 1/1 Running 1 6d4h
nginx0403-7d458bd795-d49zb 1/1 Running 1 38h
nginx0403-7d458bd795-hl94g 1/1 Running 0 38h
nginx0403-7d458bd795-p5fr6 1/1 Running 0 38h
nginx0403-7d458bd795-qbf8j 1/1 Running 0 38h
nginx0403-7d458bd795-qg56z 1/1 Running 0 38h
查看集群的命名空间kube-system情况：
# kubectl get pod -n kube-system
Error from server (Forbidden): pods is forbidden: User "devuser" cannot list resource "pods" in API group "" in the namespace "kube-system"
可见无权限。
4 多命令空间授权
k8s服务端增加以下：
kubectl create rolebinding devuser-admin-binding2 --clusterrole=admin --user=devuser --namespace=demo2