K8s（五）认证&授权

创建用户

kubectl create serviceaccount myadmin

创建POD是使用自定义用户

pod.spec.ServiceAccountName:myadmin

apiserver 客户端配置文件：

[root@k8s-master ~]# kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.211.55.11:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {
   }
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED

创建认证证书（使用k8sCA）

生成私钥：
$ openssl genrsa -out mykey.key  2048
创建证书签署请求：
$ openssl req -new -key mykey.key -out mykey.csr -subj "/CN=mykey"
签署证书：
openssl x509 -req -in mykey.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out mykey.crt -days 365

查看证书信息

[root@k8s-master pki]# openssl x509 -in mykey.crt -text -noout