K8S权限、Helm

最新推荐文章于 2025-01-11 20:22:58 发布

w23939296

最新推荐文章于 2025-01-11 20:22:58 发布

阅读量246

点赞数

CC 4.0 BY-SA版权

文章标签： kubernetes 容器云原生

本文链接：https://blog.csdn.net/w975121565/article/details/127192566

环境基于 k8s 1.25.0(rockylinux8.6)

一、权限

kubectl config view

生成私钥

cd /etc/kubernetes/pki/
openssl genrsa -out myuser.key 2048
ll

生成请求文件

openssl req -new -key myuser.key -out myuser.csr -subj "/CN=myuser/O=kubeusers"
ls

颁发证书

openssl x509 -req -in myuser.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out myuser.crt -days 365
ls

将用户填加至k8s集群

kubectl config set-credentials myuser --client-certificate=/etc/kubernetes/pki/myuser.crt --client-key=/etc/kubernetes/pki/myuser.key
kubectl config set-context myuser@mycluster --cluster=mycluster --user=myuser
kubectl config view

切换用户（还未授权，不可查看资源）

kubectl config use-context myuser@mycluster
kubectl get pod

kubectl config use-context kubernetes-admin@mycluster

2、创建serviceAccount（namespace内生效）

每个namespace自动创建default serviceAccount

创建sa

kubectl create ns myns
vim mynssa.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: myns
  name: myns-sa

kubectl apply -f mynssa.yaml
kubectl get sa -n myns

查看pod所用的sa(未指定sa,则用缺省default)

kubectl get pod taintexcute-db57bb998-sltcp -o yaml | grep -A 20 -i serviceaccount

3、RBAC

role: namespace内

clusterrole：所有namespace

myuser用户绑定查看角色

kubectl get clusterrole
kubectl describe clusterrole view

vim myuserrole.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: clusterrolebindingmyuser
subjects:
- kind: User
  name: myuser
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: view
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f myuserrole.yaml
kubectl config use-context myuser@mycluster
kubectl get pod
kubectl delete pod taintexcute-db57bb998-sltcp

kubectl config use-context kubernetes-admin@mycluster

此账号只具有查看权限，不能删除pod

创建role

vim mynsrole.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: myns-role
  namespace: myns
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get","watch","list"]

kubectl apply -f mynsrole.yaml
kubectl get role -n myns
kubectl describe role -n myns myns-role

rolebinding

vim mynsbind.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rolebindingmyns-sa
  namespace: myns
subjects:
- kind: ServiceAccount
  name: myns-sa
  namespace: myns
roleRef:
  kind: Role
  name: myns-role
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f mynsbind.yaml
kubectl get rolebindings.rbac.authorization.k8s.io -n myns
kubectl describe rolebindings.rbac.authorization.k8s.io -n myns rolebindingmyns-sa

创建delployment并用myns-sa

vim  mynsnginx.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
  namespace: myns
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        imagePullPolicy: IfNotPresent
      serviceAccountName: myns-sa

kubectl apply -f mynsnginx.yaml
kubectl get pods -n myns
kubectl get pod -n myns nginx-deployment-76966d8d79-hmhdz -o yaml | grep -i serviceaccount
kubectl describe pod -n myns nginx-deployment-76966d8d79-hmhdz

二、helm

1、安装

下载安装包

https://get.helm.sh/helm-v3.10.0-linux-amd64.tar.gzhttps://get.helm.sh/helm-v3.10.0-linux-amd64.tar.gz

tar -xvf helm-v3.10.0-linux-amd64.tar.gz
cd linux-amd64/
cp helm /usr/local/bin/
cd
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo list
helm version

helm repo update
helm search repo http

安装http

helm install bitnami/apache --generate-name
kubectl get deployments.apps
kubectl get pods
kubectl get svc

可以查看到 deployment svc都已自动创建完毕

helm list
helm uninstall apache-1665123936

deployment pod svc都自动删除

2、实验

helm install bitnami/nginx --generate-name
helm status nginx-1665124494
kubectl get svc
kubectl get pods
kubectl get deployments.apps

cd .cache/helm/repository/
ls
tar -xvf nginx-13.2.9.tgz
tree nginx

所有安装过的会生成tar包

详细安装信息查看（配置参数）

helm inspect values bitnami/nginx
helm show chart  bitnami/nginx
helm show all bitnami/nginx
helm show values bitnami/nginx

charts 目录存放当前charts依赖的所有charts文件

templates 目录存放当前charts用到的模板文件，可应用于charts生成有效的kubernetes清单文件

values.yaml 提供配置参数的默认值，chart支持在安装时根据参数进行定制化配置

helm env
cd .cache/helm/repository/
helm create mychart
ls
tree mychart/
cd mychart
cat values.yaml

可自行修改yaml文件，改完后检查命令

cd .cache/helm/repository/
vim mychart/values.yaml
改第5行  replicaCount: 2
改40行   type: NodePort
改41行   port: 8080

helm lint mychart

模拟安装

helm install mychart  --dry-run --debug --generate-name
helm install mychart --name-template myapp --generate-name
kubectl get deployments.apps
kubectl get pods
kubectl get svc

curl 10.10.137.93:8080
curl 192.168.3.114:32497

打包

helm package mychart
ls

下载

helm search repo tomcat
helm pull bitnami/tomcat