——实验专题.命名空间——

一、集群的安全机制

k8s集群安全机制-rbac实现鉴权

1、创建一个命名空间

#1、创建一个命名空间[root

k8s-master~]#kubectlgetnsNAMESTATUSAGEdefaultActive3d23hkube-node-leaseActive3d23hkube-publicActive3d23hkube-systemActive3d23h[root

k8s-master~]#kubectlcreatensroledemonamespace/roledemocreated[root

k8s-master~]#kubectlgetnsroledemoActive3s#2、在新创建的命名空间下创建一个pod[root

k8s-master~]#kubectlrunnginx--image=nginx-nroledemopod/nginxcreated[root

k8s-master~]#kubectlgetpods-nroledemoNAMEREADYSTATUSRESTARTSAGEnginx0/1ErrImagePulls#3、创建角色，将rbac-role.yaml该文件上传到服务器[root

k8s-master~]#catrbac-role.yamlkind:RoleapiVersion:rbac.authorization.k8s.io/v1metadata:namespace:roledemo#命名空间的名称和刚才创建的一致name:pod-readerrules:-apiGroups:[""]#""indicatesthecoreAPIgroupresources:["pods"]verbs:["get","watch","list"]#权限[root

k8s-master~]#kubectlapply-frbac-role.yamlrole.rbac.authorization.k8s.io/pod-readercreated[root

k8s-master~]#kubectlgetrole-nroledemo#查看创建的角色NAMECREATEDATpod-reader-02-23T08:03:31Z#4、创建角色绑定过程[root

k8s-master~]#catrbac-rolebinding.yamlkind:RoleBindingapiVersion:rbac.authorization.k8s.io/v1metadata:name:read-podsnamespace:roledemosubjects:-kind:Username:mary#NameiscasesensitiveapiGroup:rbac.authorization.k8s.ioroleRef:kind:Role#thismustbeRoleorClusterRolename:pod-reader#thismustmatchthenameoftheRoleorClusterRoleyouwishtobindtoapiGroup:rbac.authorization.k8s.io[root

k8s-master~]#kubectlapply-frbac-rolebinding.yamlrolebinding.rbac.authorization.k8s.io/read-podscreated[root

k8s-master~]#kubectlgetrole,rolebinding-nroledemo#查看绑定结果NAMECREATEDATrole.rbac.authorization.k8s.io/pod-reader-02-23T08:03:31ZNAMEROLEAGErolebinding.rbac.authorization.k8s.io/read-podsRole/pod-reader94s#5、使用证书来识别它的身份，将rabc-user.sh该文件上传到服务器[root

k8s-master~]#mkdirmary[root

k8s-master~]#cdmary/catmary-csr.jsonEOF{"CN":"mary","hosts":[],"key":{"algo":"rsa","size":},"names":[{"C":"CN","L":"BeiJing","ST":"BeiJing"}]}EOFcfsslgencert-ca=ca.pem-ca-key=ca-key.pem-config=ca-config.json-profile=kubernetesmary-csr.json

cfssljson-baremarykubectlconfigset-clusterkubernetes\--certificate-authority=ca.pem\--embed-certs=true\--server=