tencent cloud

USERNAME='sa-acc' # Set the test account name
NAMESPACE='sa-test' # Set the test namespace name
CLUSTER_NAME='cluster_name_xxx' # Set the test cluster name
# Create the test namespace
kubectl  create namespace ${NAMESPACE} 
# Create the test ServiceAccount account
kubectl create sa ${USERNAME} -n ${NAMESPACE} 
# Obtain the Secret token resource name automatically created by the ServiceAccount account
SECRET_TOKEN=$(kubectl get sa ${USERNAME} -n ${NAMESPACE} -o jsonpath='{.secrets[0].name}')
# Get the plaintext token of the Secrets
SA_TOKEN=$(kubectl get secret ${SECRET_TOKEN} -o jsonpath={.data.token} -n sa-test | base64 -d)
# Set an access credential of token type using the obtained plaintext token information
kubectl config set-credentials ${USERNAME} --token=${SA_TOKEN}
# Set the context entries for accessing the cluster
kubectl config set-context ${USERNAME} --cluster=${CLUSTER_NAME} --namespace=${NAMESPACE} --user=${USERNAME}

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata: 
    namespace: sa-test # Specify the namespace
    name: sa-role-test
rules: # Set the permission rule
- apiGroups: ["", "extensions", "apps"]
  resources: ["deployments", "replicasets", "pods"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]


apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: 
    name: sa-rb-test
    namespace: sa-test 
subjects: 
- kind: ServiceAccount
  name: sa-acc
  namespace: sa-test # The namespace of the ServiceAccount 
  apiGroup: ""  # The default apiGroup is `rbac.authorization.k8s.io`.
  roleRef: 
  kind: Role
  name: sa-role-test
  apiGroup: ""  # The default apiGroup is `rbac.authorization.k8s.io`.


USERNAME='role_user' # Set the username
NAMESPACE='default' # Set the test namespace name
CLUSTER_NAME='cluster_name_xxx' # Set the test cluster name
# Use OpenSSL to generate a self-signed certificate key
openssl genrsa -out ${USERNAME}.key 2048
# Use OpenSSL to generate a self-signed CSR file, where `CN` indicates the username and `O` indicates the group name
openssl req -new -key ${USERNAME}.key -out ${USERNAME}.csr -subj "/CN=${USERNAME}/O=${USERNAME}" 
# Create a Kubernetes CSR
cat <<EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
   name: ${USERNAME}
spec:
   request: $(cat ${USERNAME}.csr | base64 | tr -d '\\n')
   usages:
   - digital signature
   - key encipherment
   - client auth
EOF
# Approve the certificate as trustworthy
kubectl certificate approve ${USERNAME}
# Obtain the self-signed certificate CRT
kubectl get csr ${USERNAME} -o jsonpath={.status.certificate} | base64 --decode > ${USERNAME}.crt
# Set the cluster resource access credential (X.509 certificate)
kubectl config set-credentials ${USERNAME} --client-certificate=${USERNAME}.crt --client-key=${USERNAME}.key
# Set the Context cluster and default namespace
kubectl config set-context  ${USERNAME} --cluster=${CLUSTER_NAME} --namespace=${NAMESPACE} --user=${USERNAME}

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata: 
    name: test-clusterrole
rules: 
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list", "create"]


apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: 
    name: clusterrole-rb-test
    namespace: default 
subjects: 
- kind: User
  name: role_user
  namespace: default # The namespace of the user 
  apiGroup: ""  # The default apiGroup is `rbac.authorization.k8s.io`.
  roleRef: 
  kind: ClusterRole
  name: test-clusterrole
  apiGroup: ""  # The default apiGroup is `rbac.authorization.k8s.io`.


apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: 
    name: clusterrole-rb-test
    namespace: default2 
subjects: 
- kind: User
  name: role_user
  namespace: default # The namespace of the user 
  apiGroup: ""  # The default apiGroup is `rbac.authorization.k8s.io`.
  roleRef: 
  kind: ClusterRole
  name: test-clusterrole
  apiGroup: ""  # The default apiGroup is `rbac.authorization.k8s.io`.


apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata: 
    name: clusterrole-crb-test
subjects: 
- kind: User
  name: role_user
  namespace: default # The namespace of the user 
  apiGroup: ""  # The default apiGroup is `rbac.authorization.k8s.io`.
  roleRef: 
  kind: ClusterRole
  name: test-clusterrole
  apiGroup: ""  # The default apiGroup is `rbac.authorization.k8s.io`.