linux怎么查看本机内存大小
500
2022-10-27
Kubernetes创建Dashboard超级管理员和只读账户
Kubernetes创建Dashboard超级管理员和只读账户
创建Dashboar超级管理员
mkdir -p /root/k8s-admin/ && cd /root/k8s-admin/
vi admin-sa.yaml
|
kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: admin annotations: rbac.authorization.kubernetes.io/autoupdate: "true" roleRef: kind: ClusterRole name: cluster-admin apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount name: admin namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: admin namespace: kube-system labels: kubernetes.io/cluster-service: "true" addonmanager.kubernetes.io/mode: Reconcile |
kubectl create -f admin-sa.yaml
[root@cd-k8s-master-etcd-1 k8s-admin]# kubectl get secret -n kube-system|grep admin
admin-token-8cjgd kubernetes.io/service-account-token 3 12h
[root@cd-k8s-master-etcd-1 k8s-admin]# kubectl get secret admin-token-8cjgd -o jsonpath={.data.token} -n kube-system |base64 -d
eyJhbGciOiJSUzI1NiIsImtpZCI6IklwTDJEcnQ2Y245X0E1V05jNzlEMzMzQ0ZIWVFYVG4tY052WndVMEJzWTgifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi10b2tlbi04Y2pnZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJhZG1pbiIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjU3NzExNGYxLTdlMjgtNDc5YS04ODA3LWRhYjEwNDc0NTQ0MSIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDprdWJlLXN5c3RlbTphZG1pbiJ9.dP7Ak1DTkwjhnqgvfO-8NftOIx6n26AbZFYr_nOLpvUanruMlE7DbUnNDkXC7-5rNbtnvklpci3kc_Hr7uoDt7v_mSSS7gfnKEmnrEkMyccPdaiyKAfzckoJoPUrMTjtSIWoEDYUpnoWEDpwy7WYRsXwJcp8Ly103rr9dEV445rzYycMPq6yLKRamceiovjbgXbhaRTmet3QGMJM9VMbvldMkHZNRJvIV0wsGrtIAZ7aoWO1srr_bIDXtd0RlvCnTm-ATkGnvX9QXBmTRZo5m9vYoXzrk0XWM7wW64JnLUp8pInxCx86pO8aJLkw5r0WhBrh-T_SbUwE8bSmnQqRbw[root@cd-k8s-master-etcd-1 k8s-admin]#
#然后使用这个token登陆dashboard即可
创建Dashboar只读账户
vi dashboard-viewonly.yaml
|
--- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: dashboard-viewonly rules: - apiGroups: - "" resources: - configmaps - endpoints - persistentvolumeclaims - pods - replicationcontrollers - replicationcontrollers/scale - serviceaccounts - services - nodes - persistentvolumeclaims - persistentvolumes verbs: - get - list - watch - apiGroups: - "" resources: - bindings - events - limitranges - namespaces/status - pods/log - pods/status - replicationcontrollers/status - resourcequotas - resourcequotas/status verbs: - get - list - watch - apiGroups: - "" resources: - namespaces verbs: - get - list - watch - apiGroups: - apps resources: - daemonsets - deployments - deployments/scale - replicasets - replicasets/scale - statefulsets verbs: - get - list - watch - apiGroups: - autoscaling resources: - horizontalpodautoscalers verbs: - get - list - watch - apiGroups: - batch resources: - cronjobs - jobs verbs: - get - list - watch - apiGroups: - extensions resources: - daemonsets - deployments - deployments/scale - ingresses - networkpolicies - replicasets - replicasets/scale - replicationcontrollers/scale verbs: - get - list - watch - apiGroups: - policy resources: - poddisruptionbudgets verbs: - get - list - watch - apiGroups: - networking.k8s.io resources: - networkpolicies verbs: - get - list - watch - apiGroups: - storage.k8s.io resources: - storageclasses - volumeattachments verbs: - get - list - watch - apiGroups: - rbac.authorization.k8s.io resources: - clusterrolebindings - clusterroles - roles - rolebindings verbs: - get - list - watch |
cat vss-read.yaml
|
kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: cd-read annotations: rbac.authorization.kubernetes.io/autoupdate: "true" roleRef: kind: ClusterRole name: dashboard-viewonly apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount name: cd-read namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cd-read namespace: kube-system labels: kubernetes.io/cluster-service: "true" addonmanager.kubernetes.io/mode: Reconcile |
#应用这个两个yam文件到Kubernetes集群环境
kubectl apply -f .
#查看cd-read用户的token全名
kubectl describe serviceaccount cd-read -n kube-system
#查看Token的值
kubectl describe secret cd-read-token-f8klz -n kube-system
使用此token登陆Dashboard即可
版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。
相关文章
发表评论
暂时没有评论，来抢沙发吧~