Kubernetes Credential

K8S Credential

[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/kubernetes/kubernetes
After=etcd.service

[Service]
User=root
ExecStart=/opt/bin/kube-apiserver \
 --insecure-bind-address=0.0.0.0 \
 --insecure-port=8080 \
 --etcd-servers=http://192.168.51.131:2379\
 --logtostderr=false \
 --allow-privileged=true \
 --service-cluster-ip-range=172.18.0.0/16 \
 --admission-control=NamespaceLifecycle,ServiceAccount,LimitRanger,SecurityContextDeny,ResourceQuota \
 --service-node-port-range=30000-32767 \
 --advertise-address=192.168.51.131 \
 --v=6 \
 --storage-backend="etcd2" \
 --log-dir="/var/log/kubernetes" \
 --client-ca-file=/srv/kubernetes/ca.crt \
 --tls-private-key-file=/srv/kubernetes/server.key \
 --tls-cert-file=/srv/kubernetes/server.cert \
 --service_account_key_file=/srv/kubernetes/server.key \
 --runtime-config=batch/v2alpha1=true \
 --apiserver-count=2 \
 --authorization-mode=Node,RBAC \
 --secure-port=6443 \
 --token-auth-file=/etc/kubernetes/pki/tokens.csv \
 --basic-auth-file=/etc/kubernetes/basic_auth

Restart=on-failure
Type=notify
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

adding four lines above

 --authorization-mode=Node,RBAC \
 --secure-port=6443 \
 --token-auth-file=/etc/kubernetes/pki/tokens.csv \
 --basic-auth-file=/etc/kubernetes/basic_auth

where

/etc/kubernetes/pki/tokens.csv

792c62a1b5f2b07b,admin,ab47c6cb-f403-11e6-95a3-0800279704c8,system:kubelet-bootstrap

and

/etc/kubernetes/basic_auth

1234,admin,1

Binding the role and namespace

kubectl create rolebinding bob-admin-binding --clusterrole=admin --user=admin --namespace=ebot

Once we bind admin user to ebot, it cannot use in default, shown as followed

root@kubecontext:~# kubectl --token=792c62a1b5f2b07b --server=https://192.168.51.131:6443   get po --namespace=default
Error from server (Forbidden): pods is forbidden: User "admin" cannot list pods in the namespace "default"

it can use in ebot namespace, you can use token as followed,

kubectl --token=792c62a1b5f2b07b --server=https://192.168.51.131:6443  get po --namespace=ebot

Use Username Password as followed.

kubectl --username=admin --password=1234 --server=https://192.168.51.131:6443 get pod  --namespace=ebot

One can remove --namespace setting, you then can access all namespaces.

kubectl create rolebinding bob-admin-binding --clusterrole=admin --user=admin 

Set Up Kube Config

kubectl config set-cluster seccluster --server=https://192.168.51.131:6443 --insecure-skip-tls-verify=true

kubectl config set-credentials dev-user1 --username=admin --password=1234

or just use token is fine

kubectl config set-credentials dev-user1 --token=792c62a1b5f2b07b

kubectl config set-context secctx2 --cluster=seccluster --user=dev-user1 --namespace=kube-system

kubectl config use-context  secctx2

You will see the result

root@kuberm:~# kubectl get po
NAME                       READY     STATUS    RESTARTS   AGE
kube-dns-846480609-v3sn1   3/3       Running   18         54d

However, You need to add the privelege to admin role with namespace kube-system

kubectl create rolebinding bob-admin-binding --clusterrole=admin --user=admin --namespace=kube-system