9.serviceAccount · docker

# 1. k8s認證 ## 1.2 兩種賬戶信息 1. user賬戶 2. pod訪問apiServer的一種賬戶（service account） `kubectl config view`對應配置文件/root/.kube/config（認證信息） ``` apiVersion: v1 clusters: - cluster: certificate-authority-data: DATA+OMITTED server: https://192.168.56.10:6443 name: kubernetes contexts: - context: cluster: kubernetes user: kubernetes-admin name: kubernetes-admin@kubernetes current-context: kubernetes-admin@kubernetes kind: Config preferences: {} users: - name: kubernetes-admin user: client-certificate-data: REDACTED client-key-data: REDACTED ``` 有四種實體，users對象列表，clusters集群列表，contexts用戶與集群對應關系，current-context用來指定當前連接那個集群 # 2. 創建serviceAccount **1. 使用k8是證書簽名serviceAccount證書** ``` # private key openssl genrsa -out tuna.key 1024 # private Ca openssl req -new -key tuna.key -out tuna.csr -subj "/CN=tuna" # sign CA openssl x509 -req -in tuna.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out tuna.crt -days 365 ``` **2. config加入用戶tuna** ``` [root@master serviceAccount]# kubectl config set-credentials tuna --client-certificate=./tuna.crt --embed-certs=true --client-key=./tuna.key User "tuna" set. [root@master serviceAccount]# kubectl config view apiVersion: v1 clusters: ... - name: tuna user: client-certificate-data: REDACTED client-key-data: REDACTED ``` **3. 操作context將用戶與集群綁定** ``` [root@master serviceAccount]# kubectl config set-context tuna@kubernates --cluster=kubernates --user=tuna Context "tuna@kubernates" created. [root@master serviceAccount]# kubectl config view apiVersion: v1 clusters: - cluster: certificate-authority-data: DATA+OMITTED server: https://192.168.56.10:6443 name: kubernetes contexts: - context: cluster: kubernetes user: kubernetes-admin name: kubernetes-admin@kubernetes - context: cluster: kubernates user: tuna name: tuna@kubernates ``` **4. 使用tuna操作k8s** > 當前用戶切換到tuna ``` [root@master serviceAccount]# kubectl config use-context tuna@kubernates Switched to context "tuna@kubernates". ``` ``` [root@master serviceAccount]# kubectl get pods error: no configuration has been provided, try setting KUBERNETES_MASTER environment variable ```