k8s 创建 serviceAccount 并配置自定义ClusterRole 再授权用于 api-server 访问

创建用户授权-webToken
webToken 用于使用 server-api 管理 k8s 集群
集群创建完成即可创建 ServiceAccount 类型的 secret（webToken），该 secret 不依赖用户证书
如果需要更新 webToken 可以删除对应的 ServiceAccount

1.创建 yaml 文件生成 webToken

# 创建用户授权的 yaml 文件
mkdir -p /opt/k8s/grant
cd /opt/k8s/grant
vim k8s_create_webToken.yaml
--------------------------
# 创建账号
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: devuser
  namespace: test01

# 创建授权规则
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: devuser
  labels:
    rbac.zuiyoujie.com/name: devuser
rules:
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/attach
      - pods/exec
      - pods/log
      - pods/status
      - configmaps
      - services
    verbs:
      - get
      - list
      - watch
      - create
      - describe
  - apiGroups:
      - extensions
      - apps
    resources:
      - deployments
    verbs:
      - get
      - list
      - watch
      - describe

# 将账号和授权绑定起来
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: devuser
  namespace: test01
  labels:
    rbac.zuiyoujie.com/name: devuser
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: devuser
subjects:
  - kind: ServiceAccount
    name: devuser
    namespace: test01
---
-----------------------------------

# 创建 webToken 的 Secret
kubectl apply -f k8s_create_webToken.yaml

2.查看 webToken 的值

• 手动查询

# 查询 webToken 的 Secret 名称
kubectl get secret | grep token
--------------------------------
# kubectl get secret | grep token
default-token-frvq9                        kubernetes.io/service-account-token   3      7d
devuser-token-k6hnn                        kubernetes.io/service-account-token   3      5d23h
nginx-ingress-serviceaccount-token-dzrkb   kubernetes.io/service-account-token   3      7d
--------------------------------

# 查看 Secret 的 webToken 值
kubectl describe secret devuser-token-k6hnn
--------------------------------
# kubectl describe secret devuser-token-k6hnn
Name:         devuser-token-k6hnn
Namespace:    test01
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: devuser
              kubernetes.io/service-account.uid: df4f9dae-6752-48af-b95d-fbec4c543691

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1029 bytes
namespace:  8 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IjZSakJtQXhwYXBGVk9PSzF0MTZoYi1qMXhxUVdxT0JlS1h6VWZ2SlhOTzgifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJydGMtcHJvZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY29
--------------------------------

• 一键查询

kubectl describe secret $(kubectl get secret -n kube-system | grep ^devuser | awk '{print $1}') -n kube-system | grep -E '^token'| awk '{print $2}'

3.重新生成 webToken

# 需要刷新 webToken 可以删掉重新生成
kubectl get ServiceAccount
kubectl get sa
kubectl delete sa xxxx