kubernetes 创建RBAC 用户的例子

创建Service Account

vi demo-serviceaccount.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system

[root@master-47-35 service-account]# kubectl create -f demo-serviceaccount.yaml 
serviceaccount/admin-user created

创建ClusterRoleBinding

vi demo-clusterrolebinding.yaml

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system

[root@master-47-35 service-account]# kubectl create -f demo-clusterrolebinding.yaml 
clusterrolebinding.rbac.authorization.k8s.io/admin-user created

Bearer Token

kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')

[root@master-47-35 service-account]# kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
Name:         admin-user-token-rmk9r
Namespace:    kube-system
Labels:       
Annotations:  kubernetes.io/service-account.name=admin-user
              kubernetes.io/service-account.uid=e5280b0d-b63b-11e8-8f84-5254e98192ae

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1359 bytes
namespace:  11 bytes
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLXJtazlyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJlNTI4MGIwZC1iNjNiLTExZTgtOGY4NC01MjU0ZTk4MTkyYWUiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.QlCkgEXTK8UWR3sGc3INkOIGlCHaV045KhwGK8vy1CKCF7qUkzrnJNybVa4wbATTavGv36qihnryzjDca_yARIGCOsbRWuIJiZlDzbpjd8d53JPyNTPJKpjAKxOtt-hhlWqYpizBLCuVrJqwJAxN4mx6NBxbqbIJfAqJdo1sRebyFR4afX4Y9kD3SJHlYpcRddy136KfIzwheaB19Hbdz9sCae5Oy4Hxta03GGtGzKMsoSSGag80R7SI5p20-_DsbbsriqMhhRKuIqAKjrEP7R-JSM2xvdER1wIsoDFDTnQctNG-Nt7IonRgKPwPW6EzqWLyg77Cl2yilEf3A_mYQA

参考

https://github.com/kubernetes/dashboard/wiki/Creating-sample-user