Kubernetes 创建普通账号

# 一、为用户创建证书
创建证书只是实现 Kubernetes 认证用，具体拥有什么样的权限取决于 RBAC 授权。也就是 Role、ClusterRole。

## 1.1 创建私钥
```
cd /etc/kubernetes/pki
(umask 077; openssl genrsa -out reader.key 2048)
```
输出如下
```
Generating RSA private key, 2048 bit long modulus
............+++
...........................+++
e is 65537 (0x10001)
```

## 1.2 创建证书颁发请求
```
openssl req -new -key reader.key -out reader.csr -subj "/CN=reader"
```
> CN 要跟后面的 User 保持一致

## 1.3 使用 CA 证书签发证书
```
openssl x509 -req -in reader.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out reader.crt -days 3650
```

输出如下
```
Signature ok
subject=/CN=reader
Getting CA Private Key
```
# 二、创建相应的 Role 和 RoleBinding
2.1 创建 Role
```
kubectl apply -f - <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pods-reader
  namespace: default
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - pods/log
  verbs:
  - get
  - list
  - watch
EOF
```
2.2 创建 RoleBinding
```
kubectl apply -f - <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: default-pods-reader
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pods-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: reader
EOF
```
# 三、为普通用户创建 KUBECONFIG 配置文件
3.1 设置集群
```
kubectl config set-cluster kubernetes \
  --server=https://192.168.100.10:6443 \
  --certificate-authority=/etc/kubernetes/pki/ca.crt \
  --embed-certs=true \
  --kubeconfig=/tmp/reader.config
```
3.2 设置凭证
```
kubectl config set-credentials pods-reader \
  --client-certificate=/etc/kubernetes/pki/reader.crt \
  --client-key=/etc/kubernetes/pki/reader.key \
  --embed-certs=true \
  --kubeconfig=/tmp/reader.config
```
3.3 设置上下文
```
kubectl config set-context pods-reader@kubernetes \
  --cluster kubernetes \
  --user=pods-reader \
  --namespace=default \
  --kubeconfig=/tmp/reader.config
```
3.4 设置当前上下文
```
kubectl config use-context pods-reader@kubernetes \
  --kubeconfig=/tmp/reader.config
```

# 创建 管理员权限的 config
```
[root@master config]# cat ./admin-clusterRole.yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: admin-role
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
```
```
kubectl create clusterrolebinding  admin-clusterrolebinding --clusterrole=admin-role --user=reader
```