创建 service account

参考

Setting up a Kubernetes CI/CD Service Account

• 场景

权限划分，cicd限定namespace=dev使用kubectl apply -f部署服务

• 创建 namespace dev

cat <<EOF | kubectl apply -f -
{
  "apiVersion": "v1",
  "kind": "Namespace",
  "metadata": {
    "name": "dev",
    "labels": {
      "name": "dev"
    }
  }
}
EOF

创建 service account cicd-user

# 该脚本依赖 jq 组件
yum install jq -y

# [可修改]
SERVICE_ACCOUNT_NAME="cicd-user"

# [可修改]
NAMESPACE="dev"

# [可修改]
TARGET_FOLDER="/home/k8s/kube"

kubectl create sa "${SERVICE_ACCOUNT_NAME}" --namespace "${NAMESPACE}"

mkdir -p "${TARGET_FOLDER}"

SECRET_NAME=$(kubectl get sa "${SERVICE_ACCOUNT_NAME}" --namespace="${NAMESPACE}" -o json | jq -r .secrets[].name)

kubectl get secret --namespace "${NAMESPACE}" "${SECRET_NAME}" -o json | jq -r '.data["ca.crt"]' | base64 --decode > "${TARGET_FOLDER}/ca.crt"

USER_TOKEN=$(kubectl get secret --namespace "${NAMESPACE}" "${SECRET_NAME}" -o json | jq -r '.data["token"]' | base64 --decode)

KUBECFG_FILE_NAME="${TARGET_FOLDER}/k8s-${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-conf"

context=$(kubectl config current-context)

CLUSTER_NAME=$(kubectl config get-contexts "$context" | awk '{print $3}' | tail -n 1)

ENDPOINT=$(kubectl config view \
-o jsonpath="{.clusters[?(@.name == \"${CLUSTER_NAME}\")].cluster.server}")

kubectl config set-cluster "${CLUSTER_NAME}" \
--kubeconfig="${KUBECFG_FILE_NAME}" \
--server="${ENDPOINT}" \
--certificate-authority="${TARGET_FOLDER}/ca.crt" \
--embed-certs=true

kubectl config set-credentials \
"${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-${CLUSTER_NAME}" \
--kubeconfig="${KUBECFG_FILE_NAME}" \
--token="${USER_TOKEN}"


kubectl config set-context \
"${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-${CLUSTER_NAME}" \
--kubeconfig="${KUBECFG_FILE_NAME}" \
--cluster="${CLUSTER_NAME}" \
--user="${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-${CLUSTER_NAME}" \
--namespace="${NAMESPACE}"

kubectl config use-context "${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-${CLUSTER_NAME}" \
--kubeconfig="${KUBECFG_FILE_NAME}"

为 cicd-user 配置权限

cat <<EOF | kubectl apply -f -
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: "${SERVICE_ACCOUNT_NAME}-role"
  namespace: "${NAMESPACE}"
rules:
- apiGroups:
  - ""
  - apps
  - extensions
  resources:
  - '*'
  verbs:
  - '*'
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: "${SERVICE_ACCOUNT_NAME}-role"
  namespace: "${NAMESPACE}"
subjects:
  - kind: ServiceAccount
    name: "${SERVICE_ACCOUNT_NAME}"
roleRef:
  kind: Role
  name: "${SERVICE_ACCOUNT_NAME}-role"
  apiGroup: rbac.authorization.k8s.io
EOF

其他实例使用 cicd-user

• 将${TARGET_FOLDER}生成的k8s-cicd-user-dev-conf文件copy至其他实例~/.kube路径下改名为config使用