Kubernetes 身份认证和授权操作全攻略：访问控制之 Service Account

  kubectl get serviceAccounts

NAME      SECRETS   AGEdefault   1         122m

 kubectl get svc

NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGEkubernetes   ClusterIP   10.96.0.1            443/TCP   123m

  kubectl get secret

NAME                  TYPE                                  DATA   AGEdefault-token-4rpmv   kubernetes.io/service-account-token   3      123m

kubectl run -i --tty --rm curl-tns --image=radial/busyboxplus:curl

kubectl run --generator=deployment/apps.v1 is DEPRECATED and will be removed in a future version. Use kubectl run --generator=run-pod/v1 or kubectl create instead.If you don't see a command prompt, try pressing enter.[ root@curl-tns-56c6d54585-6v2xp:/ ]$

[ root@curl-tns-56c6d54585-6v2xp:/ ]$ curl https://kubernetes:8443/api

[ root@curl-tns-56c6d54585-6v2xp:/ ]$ cd /var/run/secrets/kubernetes.io/serviceaccount

[ root@curl-tns-56c6d54585-6v2xp:/tmp/secrets/kubernetes.io/serviceaccount ]$ lsca.crt     namespace  token

CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crtTOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)

[ root@curl-tns-56c6d54585-6v2xp:~ ]$ curl --cacert $CA_CERT -H "Authorization: Bearer $TOKEN" "https://kubernetes/api/v1/namespaces/$NAMESPACE/services/"

{  "kind": "Status",  "apiVersion": "v1",  "metadata": {   },  "status": "Failure",  "message": "services is forbidden: User \"system:serviceaccount:default:default\" cannot list resource \"services\" in API group \"\" in the namespace \"default\"",  "reason": "Forbidden",  "details": {    "kind": "services"  },  "code": 403}

kubectl create rolebinding default-view \  --clusterrole=view \  --serviceaccount=default:default \  --namespace=default

 rolebinding.rbac.authorization.k8s.io/default-view created

kubectl run -i --tty --rm curl-tns --image=radial/busyboxplus:curl

kubectl run --generator=deployment/apps.v1 is DEPRECATED and will be removed in a future version. Use kubectl run --generator=run-pod/v1 or kubectl create instead.If you don't see a command prompt, try pressing enter.[ root@curl-tns-56c6d54585-2cx44:/ ]$

CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crtTOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)

curl --cacert $CA_CERT -H "Authorization: Bearer $TOKEN" "https://kubernetes/api/v1/namespaces/$NAMESPACE/services/"

{  "kind": "ServiceList",  "apiVersion": "v1",  "metadata": {    "selfLink": "/api/v1/namespaces/default/services/",    "resourceVersion": "11076"  },  "items": [    {      "metadata": {        "name": "kubernetes",        "namespace": "default",        "selfLink": "/api/v1/namespaces/default/services/kubernetes",        "uid": "b715a117-6be1-4de0-8830-45bddcda701c",        "resourceVersion": "151",        "creationTimestamp": "2019-08-13T09:45:27Z",        "labels": {          "component": "apiserver",          "provider": "kubernetes"        }      },      "spec": {        "ports": [          {            "name": "https",            "protocol": "TCP",            "port": 443,            "targetPort": 8443          }        ],        "clusterIP": "10.96.0.1",        "type": "ClusterIP",        "sessionAffinity": "None"      },      "status": {        "loadBalancer": {         }      }    }  ]}