KubernetesAPI接口启用注意事项

迷南。 2023-07-21 05:29 2阅读 0赞

### KubernetesAPI接口启用注意事项 ###

*  1.API授权访问
 *  2.查看令牌
 *  3.删除用户

# 1.API授权访问 #

admin没有足够的权限，需要给admin选择一个合适的clusterrole.将admin这个user与clusterrole:cluster-admin bind到一起。
    命令如下：
    #kubectl create clusterrolebinding login-on-dashboard-with-cluster-admin --clusterrole=cluster-admin --user=admin
    返回：clusterrolebinding.rbac.authorization.k8s.io "login-on-dashboard-with-cluster-admin" created
    确认命令：
    # kubectl get clusterrolebinding/login-on-dashboard-with-cluster-admin -o yaml
    返回：
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      creationTimestamp: 2018-04-26T06:22:23Z
      name: login-on-dashboard-with-cluster-admin
      resourceVersion: "3649"
      selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/login-on-dashboard-with-cluster-admin
      uid: 2e85e277-491a-11e8-8665-000c2989f32f
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: cluster-admin
    subjects:
    - apiGroup: rbac.authorization.k8s.io
      kind: User
      name: admin

# 2.查看令牌 #

新版本访问系统页面需要令牌。
    命令如下：
    #kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')
    返回：
    Name:         admin-user-token-7xnn4
    Namespace:    kube-system
    Labels:       <none>
    Annotations:  kubernetes.io/service-account.name=admin-user
                  kubernetes.io/service-account.uid=bb669eea-4916-11e8-8665-000c2989f32f
    
    Type:  kubernetes.io/service-account-token
    
    Data
    ====
    namespace:  11 bytes
    token:      eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuLTd4bm40Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJiYjY2OWVlYS00OTE2LTExZTgtODY2NS0wMDBjMjk4OWYzMmYiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06YWRtaW4tdXNlciJ9.iJ1QZ1JLwjI7DF0mrBpgUFSftOX-vd0Mk_6mXrMrjYPFiQo6lDHP-sO3Jyun02Y9lJTr2zNPW74bTF1fu0JuoStWsa3vj4QA4Aylv_wLpnMLuWDMGvpwL1xcZrwZgLwMnmcUyWjpmW6vEYZPQ-xhBPTZgyaVtL7KyN0PE8JBU1krTW4Fh-nuEbgCF8rQ2E_REbt0EqUAPNKaKRz00vWTglAVN-vIR5tgz7-xAZJmlayw2jyVBNRVEByfQS8YWYN6g6iDJecEGFFpXbyXltTtgMK6WPar81YUgpEWyVAKtzm41Rd7ITVxaoj1NExQlYklG9UOxURXHptSbi0av-P2AQ
    ca.crt:     1346 bytes

# 3.删除用户 #

终端命令操作删除用户：
    # curl -i -k -XDELETE https://192.168.1.183:6443/api/v1/namespaces/test —basic -u admin:test1234
    注释：test是对应的用户名，-u后面是用户名密码