k8s杂记

在node节点内部使用kubectl：

root@multinode-demo-m02:/# ps aux | grep kubelet
root         218  3.1  1.6 2066316 62516 ?       Ssl  07:35   0:29 /var/lib/minikube/binaries/v1.30.0/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --config=/var/lib/kubelet/config.yaml --hostname-override=multinode-demo-m02 --kubeconfig=/etc/kubernetes/kubelet.conf --node-ip=192.168.49.3
root        3941  0.0  0.0   3456   720 pts/1    S+   07:51   0:00 grep --color=auto kubelet
root@multinode-demo-m02:/#
root@multinode-demo-m02:/#
root@multinode-demo-m02:/# kubectl get pods --kubeconfig=/etc/kubernetes/kubelet.conf
NAME                     READY   STATUS    RESTARTS      AGE
nginx-6c485c9fbb-hpbjj   1/1     Running   1 (23h ago)   24h
nginx-6c485c9fbb-nrw6c   1/1     Running   1 (23h ago)   24h
root@multinode-demo-m02:/#
root@multinode-demo-m02:/# kubectl get pod nginx-6c485c9fbb-hpbjj -o yaml --kubeconfig=/etc/kubernetes/kubelet.conf

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: "2024-10-08T07:05:05Z"
  generateName: nginx-6c485c9fbb-
  labels:
    app: nginx
    pod-template-hash: 6c485c9fbb
  name: nginx-6c485c9fbb-hpbjj

在etcd容器内部使用etcdctl：

etcdctl --endpoints=https://192.168.58.2:2379 --cert=/var/lib/minikube/certs/etcd/peer.crt --key=/var/lib/minikube/certs/etcd/peer.key --cacert=/var/lib/minikube/certs/etcd/ca.crt get /registry/configmaps --prefix --keys-only

在容器内部请求kubernetes api获取本机的pod列表：

或者给名字空间内所有服务账号添加超管角色绑定（最大权限、风险高）：

kubectl create clusterrolebinding cluster-admin-default-bind --clusterrole=cluster-admin --group=system:serviceaccounts --namespace=default

$>
clusterrolebinding.rbac.authorization.k8s.io/cluster-admin-default-bind created

或者给名字空间内默认用户添加只读角色绑定（只读权限）：

kubectl create rolebinding default-view \
  --clusterrole=view \
  --serviceaccount=my-namespace:default \
  --namespace=my-namespace

$>

rolebinding.rbac.authorization.k8s.io/default-view created

没有上面的角色绑定会报错：

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "pods is forbidden: User \"system:serviceaccount:default:default\" cannot list resource \"pods\" in API group \"\" in the namespace \"default\"",
  "reason": "Forbidden",
  "details": {
    "kind": "pods"
  },
  "code": 403
}

参考k8s api文档：https://v1-31.kubernetes.ac.cn/docs/reference/kubernetes-api/workload-resources/pod-v1/

api请求脚本：

curl https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/namespaces/$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)/pods \
   --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt\
   --header "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"

返回json结果，从中过滤出属于本机ip的容器ip：

--end--