如何为serviceaccount创建kubectl配置文件

Question

我在Azure上有一个kubernetes集群,我创建了2个名称空间和2个服务帐户,因为我在集群上部署了两个团队.我想为每个团队提供他自己的kubeconfig文件,用于我创建的serviceaccount.

我是Kubernetes的新手,并且无法在kubernetes网站上找到明确的指示.如何为serviceaccount创建kube配置文件？希望有人可以帮助我:),我宁愿不给团队提供默认的kube配置文件.

亲切的问候,

布拉姆

Answer 1

# your server name goes here
server=https://localhost:8443
# the name of the secret containing the service account token goes here
name=default-token-sg96k

ca=$(kubectl get secret/$name -o jsonpath='{.data.ca\.crt}')
token=$(kubectl get secret/$name -o jsonpath='{.data.token}' | base64 --decode)
namespace=$(kubectl get secret/$name -o jsonpath='{.data.namespace}' | base64 --decode)

echo "
apiVersion: v1
kind: Config
clusters:
- name: default-cluster
  cluster:
    certificate-authority-data: ${ca}
    server: ${server}
contexts:
- name: default-context
  context:
    cluster: default-cluster
    namespace: default
    user: default-user
current-context: default-context
users:
- name: default-user
  user:
    token: ${token}
" > sa.kubeconfig

Answer 2

我稍微清理了一下乔丹·利吉特的剧本。

不幸的是，我还不能发表评论，所以这是一个额外的答案：

请注意，从 Kubernetes 1.24 开始，您将需要自己使用令牌创建 Secret并引用该Secret

# The script returns a kubeconfig for the ServiceAccount given
# you need to have kubectl on PATH with the context set to the cluster you want to create the config for

# Cosmetics for the created config
clusterName='some-cluster'
# your server address goes here get it via `kubectl cluster-info`
server='https://157.90.17.72:6443'
# the Namespace and ServiceAccount name that is used for the config
namespace='kube-system'
serviceAccount='developer'

# The following automation does not work from Kubernetes 1.24 and up.
# You might need to
# define a Secret, reference the ServiceAccount there and set the secretName by hand!
# See https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#manually-create-a-long-lived-api-token-for-a-serviceaccount for details
secretName=$(kubectl --namespace="$namespace" get serviceAccount "$serviceAccount" -o=jsonpath='{.secrets[0].name}')

######################
# actual script starts
set -o errexit


ca=$(kubectl --namespace="$namespace" get secret/"$secretName" -o=jsonpath='{.data.ca\.crt}')
token=$(kubectl --namespace="$namespace" get secret/"$secretName" -o=jsonpath='{.data.token}' | base64 --decode)

echo "
---
apiVersion: v1
kind: Config
clusters:
  - name: ${clusterName}
    cluster:
      certificate-authority-data: ${ca}
      server: ${server}
contexts:
  - name: ${serviceAccount}@${clusterName}
    context:
      cluster: ${clusterName}
      namespace: ${namespace}
      user: ${serviceAccount}
users:
  - name: ${serviceAccount}
    user:
      token: ${token}
current-context: ${serviceAccount}@${clusterName}
"

Answer 3

查看https://github.com/superbrothers/kubectl-view-serviceaccount-kubeconfig-plugin

该插件有助于通过以下方式获取服务帐户配置

kubectl view-serviceaccount-kubeconfig <service_account> -n <namespace>