K8S rbac 使用例子

在 Kubernetes 中，ServiceAccount、Role 和 RoleBinding 是授权和认证的重要组件。以下是一个使用这些组件的示例：
创建文件 test.yaml 输入以下内容

# 创建 serviceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-serviceaccount
---
# 创建 Role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-role
rules:
  - apiGroups:
    - ""
    resources:
    - pods
    - pods/status
    - pods/log
    - services
    - services/status
    - endpoints
    - endpoints/status
    - deployments
    verbs:
    - get
    - list
    - watch
---
# 创建 RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-rolebinding
subjects:
- kind: ServiceAccount
  name: my-serviceaccount
roleRef:
  kind: Role
  name: my-role
  apiGroup: rbac.authorization.k8s.io
---
# 创建 deployment 测验 serviceAccount
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      serviceAccountName: my-serviceaccount
      containers:
        - name: my-container
          image: xxx

apply 到环境中

kubectl apply -f test.yaml

进入到 pod 中，访问 apiserver 接口

kubectl get pod 
kubectl exec -it xxx bash

# 指向内部 API 服务器的主机名
APISERVER=https://kubernetes.default.svc

# 服务账号令牌的路径
SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount

# 读取 Pod 的名字空间
NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace)

# 读取服务账号的持有者令牌
TOKEN=$(cat ${SERVICEACCOUNT}/token)

# 引用内部证书机构（CA）
CACERT=${SERVICEACCOUNT}/ca.crt

# 使用令牌访问 API
curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api/v1/namespaces/default/endpoints