[toc]

kubernetes 操作记录四

kubernetes认证及Service Account

在master服务器上启动 proxy 并监听至8080

 # kubectl  proxy --port=8080 &
# curl http://localhost:8080/api/v1/namespaces

仅有权限获取当前Pod自身的相关信息

 # kubectl get secret -n ingress-nginx
NAME                                       TYPE                                  DATA   AGE
default-token-t54dl                        kubernetes.io/service-account-token   3      5d23h
nginx-ingress-serviceaccount-token-5dwv4   kubernetes.io/service-account-token   3      5d23h

生成yaml框架，快速编写清单

 # kubectl create serviceaccount mysa -o yaml --dry-run
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: null
  name: mysa
# kubectl get pods myapp-deploy-675558bfc5-2rfrs -o  yaml --export

 # kubectl create serviceaccount admin
 
# kubectl describe sa admin
Name:                admin
Namespace:           default
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   admin-token-hxqqf
Tokens:              admin-token-hxqqf
Events:              <none>
# kubectl get secret
NAME                    TYPE                                  DATA   AGE
admin-token-hxqqf       kubernetes.io/service-account-token   3      66s
default-token-2sgn5     kubernetes.io/service-account-token   3      26d
mysql-root-password     Opaque                                1      45h
tomcat-ingress-secret   kubernetes.io/tls                     2      5d22h

 # vim  pod-sa-demo.yaml
apiVersion: v1
kind: Pod
metadata:
  name: pod-sa-demo
  namespace: default
  labels:
    app: myapp
    tier: frontend
  annotations:
    ssjinyao.com/create-by: "cluster admin"
spec:
  containers:
  - name: myapp
    image: ikubernetes/myapp:v1
    ports:
    - name: http
      containerPort: 80
  serviceAccountName: admin
# kubectl apply -f pod-sa-demo.yaml
# kubectl describe pods  pod-sa-demo | grep 'SecretName'
    SecretName:  admin-token-hxqqf

kubernetes 集群有两类认证时的用户账号
useraccount,我们称之为用户账号，通常定义的是人使用的账号
servicecacount, 服务账号，指pod中应用的应用程序运行在kubernetes ，想访问apiserver时用的认证信息，包括用户名密码等等;

 # kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.1.87.80:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED

 /etc/kubernetes/pki
# (umask 077; openssl genrsa -out  ssjinyao.key 2048)
# openssl req -new -key ssjinyao.key  -out ssjinyao.csr -subj "/CN=ssjinyao"
# openssl x509 -req -in ssjinyao.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out ssjinyao.crt -days 36500
Signature ok
subject=/CN=ssjinyao
Getting CA Private Key
# openssl x509 -in ssjinyao.crt -text -noout
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            f3:fe:ff:e5:0e:0b:37:e2
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=kubernetes
        Validity
            Not Before: May 22 07:57:01 2019 GMT
            Not After : Apr 28 07:57:01 2119 GMT
        Subject: CN=ssjinyao
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)

接下来把用户账号信息添加到连接kubernetes 的配置信息

 # kubectl config set-credentials ssjinyao  --client-certificate=./ssjinyao.crt --client-key=./ssjinyao.key --embed-certs=true
User "ssjinyao" set.
# kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.1.87.80:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: ssjinyao
  user:
    client-certificate: /etc/kubernetes/pki/ssjinyao.crt
    client-key: /etc/kubernetes/pki/ssjinyao.key
# kubectl config set-context ssjinyao@kubernetes --cluster=kueberntes --user=ssjinyao
Context "ssjinyao@kubernetes" created.
# kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.1.87.80:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
- context:
    cluster: kueberntes
    user: ssjinyao
  name: ssjinyao@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
- name: ssjinyao
  user:
    client-certificate: /etc/kubernetes/pki/ssjinyao.crt
    client-key: /etc/kubernetes/pki/ssjinyao.key

这时候多了一个context, 可切换用户

 # kubectl config use-context ssjinyao@kubernetes
Switched to context "ssjinyao@kubernetes".

 # kubectl config set-cluster mycluster --kubeconfig=/tmp/test.conf --server="https://10.1.87.80:6443" --certificate-authority=/etc/kubernetes/pki/ca.crt  --embed-certs=true
Cluster "mycluster" set.
# kubectl config view --kubeconfig=/tmp/test.conf
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.1.87.80:6443
  name: mycluster
contexts: []
current-context: ""
kind: Config
preferences: {}
users: []

RBAC

授权插件: Node, ABAC,RBAC,Webhook(基于http的回调来实现)
RBAC: Role-based AC

角色 (role)
许可 (permission)

role: operations,objects
rolebinding: user account OR service account , role
clusterrole: clusterrolebinding

操作: GET HEAD PUT PUST PATCH DELETE

role binding定义

 # kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run -o yaml  > role-demo.yaml
# vim role-demo.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: null
  name: pods-reader
  namespace: default
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
# kubectl apply -f role-demo.yaml
# kubectl describe role pods-reader
Name:         pods-reader
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"annotations":{},"creationTimestamp":null,"name":"pods-reader","nam...
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  pods       []                 []              [get list watch]
# kubectl create rolebinding ssjinyao-read-pods --role=pods-reader --user=ssjinyao --dry-run -o yaml > rolebinding-demo.yaml
# vim rolebinding-demo.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: null
  name: ssjinyao-read-pods
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pods-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: ssjinyao

clusterrole binding 定义

 # useradd ik8s
# cp -a  .kube/  /home/ik8s/
# chown -R ik8s.ik8s /home/ik8s/
#

 # kubectl config use-context kubernetes-admin@kubernetes
# kubectl  create clusterrole cluster-reader  --verb=get,list,watch --resource=pods -o yaml --dry-run  > clusterrole-demo.yaml
# vim clusterrole-demo.yaml 
kind: ClusterRole
metadata:
  name: cluster-reader
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
# kubectl apply -f clusterrole-demo.yaml
clusterrole.rbac.authorization.k8s.io/cluster-reader created
# kubectl create clusterrolebinding ssjinyao-read-all-pods --clusterrole=cluster-reader --user=ssjinyao --dry-run -o yaml  > clusterrolebind-demo.yaml

cluster-role 被 rolebinding 会使的cluster 被降级

 # kubectl create rolebinding ssjinyao-read-pods --clusterrole=cluster-reader --user=ssjinayo --dry-run -o yaml  > rolebinding-clusterrole-demo.yaml

查看系统默认的授权
引用授权

 # kubectl get clusterrole admin -o yaml
# kubectl create rolebinding default-ns-admin --clusterrole=admin --user=ssjinyao
rolebinding.rbac.authorization.k8s.io/default-ns-admin created

dashboard 及认证分级授权

部署 dashboard

 # kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml

部署时下载镜像出错

 #  kubectl describe pods -n kube-system kubernetes-dashboard-5f7b999d65-jpmhs
Events:
  Type     Reason     Age                 From                           Message
  ----     ------     ----                ----                           -------
  Normal   Scheduled  113s                default-scheduler              Successfully assigned kube-system/kubernetes-dashboard-5f7b999d65-jpmhs to node01
  Warning  Failed     53s (x3 over 105s)  kubelet, node01  Failed to pull image "k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1": rpc error: code = Unknown desc = Error response from daemon: Get https://k8s.gcr.io/v2/: dial tcp 74.125.203.82:443: connect: connection timed out
  Warning  Failed     53s (x3 over 105s)  kubelet, node01  Error: ErrImagePull
  Normal   BackOff    15s (x5 over 105s)  kubelet, node01  Back-off pulling image "k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1"
  Warning  Failed     15s (x5 over 105s)  kubelet, node01  Error: ImagePullBackOff
  Normal   Pulling    2s (x4 over 112s)   kubelet, 01  Pulling image "k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1"

用手动下载的方法进行解决

 # vim docker_install_dashboard.sh
#!/bin/sh
docker pull mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1
docker tag mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1 k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
docker rmi mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1
# sh docker_install_dashboard.sh

然后再执行以下部署清单

  kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
 # kubectl  get pods -n kube-system  | grep dash
kubernetes-dashboard-5f7b999d65-fcb28        1/1     Running   0          71s

可以看到kubernetes-dashbroad 已经运行

默认服务暴露为ClusterIP类型的，我们需要将其改为NodePort 类型

 # kubectl patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort"}}' -n kube-system
# kubectl get svc -n kube-system
\NAME                   TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                  AGE
kube-dns               ClusterIP   10.96.0.10       <none>        53/UDP,53/TCP,9153/TCP   27d
kubernetes-dashboard   NodePort    10.109.190.204   <none>        443:31984/TCP            3m41s

这个时候可以看到登录界面

使用用token实现认证登录

这里登录需要的是serviceaccount用户，所以这里创建 serviceaccount

 # kubectl create serviceaccount dashboard-admin -n kube-system
serviceaccount/dashboard-admin created 
# kubectl  get sa -n kube-system  |  grep dash
dashboard-admin                      1         6m33s

serviceaccount 创建好后，需要将serviceaccount绑定cluster这个角色上

 # kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
clusterrolebinding.rbac.authorization.k8s.io/dashboard-cluster-admin created
# kubectl get secret -n kube-system | grep dash
dashboard-admin-token-grj84                      kubernetes.io/service-account-token   3      5m46s

绑定好 cluster 后，查看token信息，并拿token进行登录

 # kubectl describe secret -n kube-system dashboard-admin-token-grj84

登录后，可以看到整个kubernetes集群的概况

建立专用dashborad用户

 # cd /etc/kubernetes/pki/
# (umask 077; openssl genrsa -out dashboard.key 2048)
# openssl req -new -key dashboard.key -out dashboard.csr -subj "/O=ssjinyao/CN=dashboard"
# openssl x509 -req -in dashboard.csr  -CA ca.crt -CAkey ca.key  -CAcreateserial -out dashboard.crt -days 3650
Signature ok
subject=/O=ssjinyao/CN=dashboard
Getting CA Private Key
# kubectl create secret generic dashboard-cert  -n kube-system --from-file=dashboard.crt=./dashboard.crt --from-file=dashboard.key=./dashboard.key
secret/dashboard-cert created

 # kubectl create serviceaccount def-ns-admin -n default
serviceaccount/def-ns-admin created

role binding 到 default 名称空间，只允许访问default 名称空间

 # kubectl create rolebinding def-ns-admin --clusterrole=admin --serviceaccount=default:def-ns-admin
rolebinding.rbac.authorization.k8s.io/def-ns-admin created
# kubectl describe secret admin-token-hxqqf # 查看 token信息登录

接下来配置kube config 文件认证

 # kubectl config set-cluster kubernetes --certificate-authority=./ca.crt  --server="https://10.1.87.80:6443" --embed-certs=true --kubeconfig=/root/def-ns-admin.conf
Cluster "kubernetes" set.
# kubectl config view --kubeconfig=/root/def-ns-admin.conf
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.1.87.80:6443
  name: kubernetes
contexts: []
current-context: ""
kind: Config
preferences: {}
users: []

 # CLUSTER_ADMIN_TOKEN=$(kubectl get secret -n kube-system dashboard-admin-token-grj84   -o jsonpath={.data.token} | base64 -d )
# kubectl config  set-credentials  dashboard-cluster-admin --token=$CLUSTER_ADMIN_TOKEN --kubeconfig=/root/def-ns-admin.conf
User "dashboard-cluster-admin" set.
# kubectl config set-context dashboard-cluster-admin@kubernetes --cluster=kubernetes --user=dashboard-cluster-admin --kubeconfig=/root/def-ns-admin.conf
# kubectl config use-context dashboard-cluster-admin@kubernetes --kubeconfig=/root/def-ns-admin.conf

将生成的conf文件远程复制到桌面上

 ssjinyao ➤ scp root@10.1.87.80:/root/def-ns-admin.conf ~/Desktop

此时使用可以用 kubeconfig 来登录dashboard 了

	# kubectl proxy --port=8080 &
	# curl http://localhost:8080/api/v1/namespaces

	# kubectl get secret -n ingress-nginx
	NAME TYPE DATA AGE
	default-token-t54dl kubernetes.io/service-account-token 3 5d23h
	nginx-ingress-serviceaccount-token-5dwv4 kubernetes.io/service-account-token 3 5d23h

	# kubectl create serviceaccount mysa -o yaml --dry-run
	apiVersion: v1
	kind: ServiceAccount
	metadata:
	creationTimestamp: null
	name: mysa
	# kubectl get pods myapp-deploy-675558bfc5-2rfrs -o yaml --export

	# kubectl create serviceaccount admin

	# kubectl describe sa admin
	Name: admin
	Namespace: default
	Labels: <none>
	Annotations: <none>
	Image pull secrets: <none>
	Mountable secrets: admin-token-hxqqf
	Tokens: admin-token-hxqqf
	Events: <none>
	# kubectl get secret
	NAME TYPE DATA AGE
	admin-token-hxqqf kubernetes.io/service-account-token 3 66s
	default-token-2sgn5 kubernetes.io/service-account-token 3 26d
	mysql-root-password Opaque 1 45h
	tomcat-ingress-secret kubernetes.io/tls 2 5d22h

	# vim pod-sa-demo.yaml
	apiVersion: v1
	kind: Pod
	metadata:
	name: pod-sa-demo
	namespace: default
	labels:
	app: myapp
	tier: frontend
	annotations:
	ssjinyao.com/create-by: "cluster admin"
	spec:
	containers:
	- name: myapp
	image: ikubernetes/myapp:v1
	ports:
	- name: http
	containerPort: 80
	serviceAccountName: admin
	# kubectl apply -f pod-sa-demo.yaml
	# kubectl describe pods pod-sa-demo \| grep 'SecretName'
	SecretName: admin-token-hxqqf

	# kubectl config view
	apiVersion: v1
	clusters:
	- cluster:
	certificate-authority-data: DATA+OMITTED
	server: https://10.1.87.80:6443
	name: kubernetes
	contexts:
	- context:
	cluster: kubernetes
	user: kubernetes-admin
	name: kubernetes-admin@kubernetes
	current-context: kubernetes-admin@kubernetes
	kind: Config
	preferences: {}
	users:
	- name: kubernetes-admin
	user:
	client-certificate-data: REDACTED
	client-key-data: REDACTED

	/etc/kubernetes/pki
	# (umask 077; openssl genrsa -out ssjinyao.key 2048)
	# openssl req -new -key ssjinyao.key -out ssjinyao.csr -subj "/CN=ssjinyao"
	# openssl x509 -req -in ssjinyao.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out ssjinyao.crt -days 36500
	Signature ok
	subject=/CN=ssjinyao
	Getting CA Private Key
	# openssl x509 -in ssjinyao.crt -text -noout
	Certificate:
	Data:
	Version: 1 (0x0)
	Serial Number:
	f3:fe:ff:e5:0e:0b:37:e2
	Signature Algorithm: sha256WithRSAEncryption
	Issuer: CN=kubernetes
	Validity
	Not Before: May 22 07:57:01 2019 GMT
	Not After : Apr 28 07:57:01 2119 GMT
	Subject: CN=ssjinyao
	Subject Public Key Info:
	Public Key Algorithm: rsaEncryption
	Public-Key: (2048 bit)

	# kubectl config set-credentials ssjinyao --client-certificate=./ssjinyao.crt --client-key=./ssjinyao.key --embed-certs=true
	User "ssjinyao" set.
	# kubectl config view
	apiVersion: v1
	clusters:
	- cluster:
	certificate-authority-data: DATA+OMITTED
	server: https://10.1.87.80:6443
	name: kubernetes
	contexts:
	- context:
	cluster: kubernetes
	user: kubernetes-admin
	name: kubernetes-admin@kubernetes
	current-context: kubernetes-admin@kubernetes
	kind: Config
	preferences: {}
	users:
	- name: kubernetes-admin
	user:
	client-certificate-data: REDACTED
	client-key-data: REDACTED
	- name: ssjinyao
	user:
	client-certificate: /etc/kubernetes/pki/ssjinyao.crt
	client-key: /etc/kubernetes/pki/ssjinyao.key
	# kubectl config set-context ssjinyao@kubernetes --cluster=kueberntes --user=ssjinyao
	Context "ssjinyao@kubernetes" created.
	# kubectl config view
	apiVersion: v1
	clusters:
	- cluster:
	certificate-authority-data: DATA+OMITTED
	server: https://10.1.87.80:6443
	name: kubernetes
	contexts:
	- context:
	cluster: kubernetes
	user: kubernetes-admin
	name: kubernetes-admin@kubernetes
	- context:
	cluster: kueberntes
	user: ssjinyao
	name: ssjinyao@kubernetes
	current-context: kubernetes-admin@kubernetes
	kind: Config
	preferences: {}
	users:
	- name: kubernetes-admin
	user:
	client-certificate-data: REDACTED
	client-key-data: REDACTED
	- name: ssjinyao
	user:
	client-certificate: /etc/kubernetes/pki/ssjinyao.crt
	client-key: /etc/kubernetes/pki/ssjinyao.key

	# kubectl config use-context ssjinyao@kubernetes
	Switched to context "ssjinyao@kubernetes".

	# kubectl config set-cluster mycluster --kubeconfig=/tmp/test.conf --server="https://10.1.87.80:6443" --certificate-authority=/etc/kubernetes/pki/ca.crt --embed-certs=true
	Cluster "mycluster" set.
	# kubectl config view --kubeconfig=/tmp/test.conf
	apiVersion: v1
	clusters:
	- cluster:
	certificate-authority-data: DATA+OMITTED
	server: https://10.1.87.80:6443
	name: mycluster
	contexts: []
	current-context: ""
	kind: Config
	preferences: {}
	users: []

	# kubectl create role pods-reader --verb=get,list,watch --resource=pods --dry-run -o yaml > role-demo.yaml
	# vim role-demo.yaml
	apiVersion: rbac.authorization.k8s.io/v1
	kind: Role
	metadata:
	creationTimestamp: null
	name: pods-reader
	namespace: default
	rules:
	- apiGroups:
	- ""
	resources:
	- pods
	verbs:
	- get
	- list
	- watch
	# kubectl apply -f role-demo.yaml
	# kubectl describe role pods-reader
	Name: pods-reader
	Labels: <none>
	Annotations: kubectl.kubernetes.io/last-applied-configuration:
	{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"annotations":{},"creationTimestamp":null,"name":"pods-reader","nam...
	PolicyRule:
	Resources Non-Resource URLs Resource Names Verbs
	--------- ----------------- -------------- -----
	pods [] [] [get list watch]
	# kubectl create rolebinding ssjinyao-read-pods --role=pods-reader --user=ssjinyao --dry-run -o yaml > rolebinding-demo.yaml
	# vim rolebinding-demo.yaml
	apiVersion: rbac.authorization.k8s.io/v1
	kind: RoleBinding
	metadata:
	creationTimestamp: null
	name: ssjinyao-read-pods
	roleRef:
	apiGroup: rbac.authorization.k8s.io
	kind: Role
	name: pods-reader
	subjects:
	- apiGroup: rbac.authorization.k8s.io
	kind: User
	name: ssjinyao

	# useradd ik8s
	# cp -a .kube/ /home/ik8s/
	# chown -R ik8s.ik8s /home/ik8s/
	#

	# kubectl config use-context kubernetes-admin@kubernetes
	# kubectl create clusterrole cluster-reader --verb=get,list,watch --resource=pods -o yaml --dry-run > clusterrole-demo.yaml
	# vim clusterrole-demo.yaml
	kind: ClusterRole
	metadata:
	name: cluster-reader
	rules:
	- apiGroups:
	- ""
	resources:
	- pods
	verbs:
	- get
	- list
	- watch
	# kubectl apply -f clusterrole-demo.yaml
	clusterrole.rbac.authorization.k8s.io/cluster-reader created
	# kubectl create clusterrolebinding ssjinyao-read-all-pods --clusterrole=cluster-reader --user=ssjinyao --dry-run -o yaml > clusterrolebind-demo.yaml

	# kubectl get clusterrole admin -o yaml
	# kubectl create rolebinding default-ns-admin --clusterrole=admin --user=ssjinyao
	rolebinding.rbac.authorization.k8s.io/default-ns-admin created

	# kubectl describe pods -n kube-system kubernetes-dashboard-5f7b999d65-jpmhs
	Events:
	Type Reason Age From Message
	---- ------ ---- ---- -------
	Normal Scheduled 113s default-scheduler Successfully assigned kube-system/kubernetes-dashboard-5f7b999d65-jpmhs to node01
	Warning Failed 53s (x3 over 105s) kubelet, node01 Failed to pull image "k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1": rpc error: code = Unknown desc = Error response from daemon: Get https://k8s.gcr.io/v2/: dial tcp 74.125.203.82:443: connect: connection timed out
	Warning Failed 53s (x3 over 105s) kubelet, node01 Error: ErrImagePull
	Normal BackOff 15s (x5 over 105s) kubelet, node01 Back-off pulling image "k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1"
	Warning Failed 15s (x5 over 105s) kubelet, node01 Error: ImagePullBackOff
	Normal Pulling 2s (x4 over 112s) kubelet, 01 Pulling image "k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1"

	# vim docker_install_dashboard.sh
	#!/bin/sh
	docker pull mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1
	docker tag mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1 k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
	docker rmi mirrorgooglecontainers/kubernetes-dashboard-amd64:v1.10.1
	# sh docker_install_dashboard.sh

	kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml
	# kubectl get pods -n kube-system \| grep dash
	kubernetes-dashboard-5f7b999d65-fcb28 1/1 Running 0 71s

	# kubectl patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort"}}' -n kube-system
	# kubectl get svc -n kube-system
	\NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
	kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP,9153/TCP 27d
	kubernetes-dashboard NodePort 10.109.190.204 <none> 443:31984/TCP 3m41s

	# kubectl create serviceaccount dashboard-admin -n kube-system
	serviceaccount/dashboard-admin created
	# kubectl get sa -n kube-system \| grep dash
	dashboard-admin 1 6m33s

	# kubectl create clusterrolebinding dashboard-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:dashboard-admin
	clusterrolebinding.rbac.authorization.k8s.io/dashboard-cluster-admin created
	# kubectl get secret -n kube-system \| grep dash
	dashboard-admin-token-grj84 kubernetes.io/service-account-token 3 5m46s

kubernetes操作记录(四)

kubernetes 操作记录四

kubernetes认证及Service Account

RBAC

dashboard 及认证分级授权

使用用token实现认证登录

	# cd /etc/kubernetes/pki/
	# (umask 077; openssl genrsa -out dashboard.key 2048)
	# openssl req -new -key dashboard.key -out dashboard.csr -subj "/O=ssjinyao/CN=dashboard"
	# openssl x509 -req -in dashboard.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out dashboard.crt -days 3650
	Signature ok
	subject=/O=ssjinyao/CN=dashboard
	Getting CA Private Key
	# kubectl create secret generic dashboard-cert -n kube-system --from-file=dashboard.crt=./dashboard.crt --from-file=dashboard.key=./dashboard.key
	secret/dashboard-cert created

	# kubectl create serviceaccount def-ns-admin -n default
	serviceaccount/def-ns-admin created

	# kubectl create rolebinding def-ns-admin --clusterrole=admin --serviceaccount=default:def-ns-admin
	rolebinding.rbac.authorization.k8s.io/def-ns-admin created
	# kubectl describe secret admin-token-hxqqf # 查看 token信息登录

	# kubectl config set-cluster kubernetes --certificate-authority=./ca.crt --server="https://10.1.87.80:6443" --embed-certs=true --kubeconfig=/root/def-ns-admin.conf
	Cluster "kubernetes" set.
	# kubectl config view --kubeconfig=/root/def-ns-admin.conf
	apiVersion: v1
	clusters:
	- cluster:
	certificate-authority-data: DATA+OMITTED
	server: https://10.1.87.80:6443
	name: kubernetes
	contexts: []
	current-context: ""
	kind: Config
	preferences: {}
	users: []

	# CLUSTER_ADMIN_TOKEN=$(kubectl get secret -n kube-system dashboard-admin-token-grj84 -o jsonpath={.data.token} \| base64 -d )
	# kubectl config set-credentials dashboard-cluster-admin --token=$CLUSTER_ADMIN_TOKEN --kubeconfig=/root/def-ns-admin.conf
	User "dashboard-cluster-admin" set.
	# kubectl config set-context dashboard-cluster-admin@kubernetes --cluster=kubernetes --user=dashboard-cluster-admin --kubeconfig=/root/def-ns-admin.conf
	# kubectl config use-context dashboard-cluster-admin@kubernetes --kubeconfig=/root/def-ns-admin.conf