1

k8s_yaml/config/apex-user/apex-user-kubeconfig.yaml

@@ -16,7 +16,7 @@ contexts:
     namespace: sit
     user: apex-user
   name: apex-user-sit   # 给上下文起的名字
-current-context: apex-user-apex-evaluation  # 默认使用的上下文
+current-context: apex-user-apex-evaluation   # 默认使用的上下文
 users:
 - name: apex-user  # 给用户起的名字
   user: #  kubectl get secret apex-user-longtoken -n apex-evaluation -o jsonpath='{.data.token}' | base64 --decode             查看创建的长token

k8s_yaml/config/sit-user/sit-user-kubeconfig.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Config
+clusters:
+- cluster:  # kubectl config view --raw -o jsonpath='{.clusters[0].cluster.server}' 获取集群ca
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN5akNDQWJLZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQ0FYRFRJMU1UQXhNVEE1TWpFd09Wb1lEekl3TlRVeE1EQTBNRGt5TVRBNVdqQVZNUk13RVFZRApWUVFERXdwcmRXSmxjbTVsZEdWek1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBCnpFNHZKbXFhLytkWnpDV01QN2RYb3RzREM2RU9Nb2VSSjFSZ3ZvS1F6cFpTLzBpakFqeGEwWHZoRGs5eS91Zi8KWUk3Ukw2WVhxWVQ3c1YyanN5U21JVFVRVXhscGptUHBPb0lQdmltMnRaelBwakI5RDF5d0llWVRzbU11K3loMwpBL1RpU1pQVnVQMFpKNHJCdyt1bU1HQ25FUjJXNVc0WmpuWGV2WndCOWk2WW5oc3FNWVA4azJ6N3RhdnJRSWpOClFuSXlGRUNac3ZMbHlRRlZnR3EyWU9WRERkRUNORXptQjU4Z3NQeFZaOGFTdTZjTVA1MzN4cTNObzJwTWN6cEUKSnRvTEFqZFNCYkU4ZFpBUUFtRXB5WkEwUzJXZnAxK0NYekg0UEhHT2pjVVI0eVQ1T0NQeE5nRGxsenFNVnExOApSQlkvNGI0U3lVbmxHV0luN2tNdWhRSURBUUFCb3lNd0lUQU9CZ05WSFE4QkFmOEVCQU1DQXBRd0R3WURWUjBUCkFRSC9CQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFpM3lDWk9zbG1ScVh4eDRkY1BJaXp2K1QKWmRiT05hbHo5S3R2QmlFZHdVKytLRWRaZm5aWlpFMWFPbitxckxPSHpGcGdvblp1eTRKNFlodWRHakFYVE1McwpLWC9WUVZLcndYUVVUMXNybnZVR3FpV21teVZsd1dpUi8yT1A5aHdUVjRaYkVxMzZPMlAvOVJNUXVaYUZDbXZYCm5tcDNYUE5keVVSaHcyeWxVUWJQRGRFKyt0a1B4ZENPOXZlV3VJRUJpQXdaeC9zOFZCZVA2eWNXSjQxdmgrUVMKN2VUbXU1YVFwdllUcWNqMTFycTA1NnMzQlhYUU02TnAvV2tkVStFTHpzT2gwZzhXRU16Q0gvL1lNdFdVWGMyOQo1Z3AzcURNWW1LUW1JSHBIWEtHcEN2OEcvNmFhdWVvWGJnamtFVTRWVkhyWmg3Q1JLZGxsbkhjWU9OemY3UT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+    server: https://10.0.10.125
+  name: cls-pl1yhr34       # 给集群起的名字
+contexts:
+- context:
+    cluster: cls-pl1yhr34
+    namespace: sit
+    user: sit-user
+  name: sit-user-sit # 给上下文起的名字
+current-context: sit-user-sit   # 默认使用的上下文
+users:
+- name: sit-user  # 给用户起的名字
+  user: #  kubectl get secret sit-user-longtoken -n sit -o jsonpath='{.data.token}' | base64 --decode             查看创建的长token
+    token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjF5MjNtcUNOVzhsZTlFRUNfQ2NDQ3hjbi1TRV9wS09LYTBzUTA4UU1Yc00ifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJzaXQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlY3JldC5uYW1lIjoic2l0LXVzZXItbG9uZ3Rva2VuIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6InNpdC11c2VyIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQudWlkIjoiMzQ3OWQ5ZGYtYmRiYS00YmIxLTgyM2MtMTA0NjE0MTViZjI5Iiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50OnNpdDpzaXQtdXNlciJ9.hFvvz9PjsKygYbMhzba0p4MUyPpSgjcAvv1ZByyx9z4-q_oXGDhfBLOv9dDvwxWqQfuyWNsoo7TKnKENipSnDcZvy7-0c3jMlhIB2DycjirlFcBFgABROckR2E0N3I1X0qF0QWS_jMGxpEZNFxbCaRbvkvcEKwfs5rJV6SCsNvho-_yS1_du_-YO5YqjfAcoHKomigP4BToNw7aSuqUJt4kdDNOwARe_Rfz46h2ETzxrKVL9MMk_VrPexQvkcJEUTgoE2H_JjhgMzTm3_xqmcSPLc_lKvfn5vKxO753UwkYYR5_2NTsZxrotadqq-BmUH5l5RcKjCWl0w_8L9yRprg
+

k8s_yaml/config/sit-user/sit-user-longtoken.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sit-user-longtoken
+  namespace: sit
+  annotations:
+    kubernetes.io/service-account.name: sit-user
+type: kubernetes.io/service-account-token
+
+
+# 创建完成后：
+# kubectl get secret sit-user-longtoken -n sit -o yaml
+
+# kubectl get secret apex-user-longtoken -n apex-evaluation -o yaml
+
+# kubectl get secret sit-user-longtoken  -n sit -o jsonpath='{.data.token}' | base64 --decode  

k8s_yaml/config/sit-user/sit-user-rbac-sit.yaml

@@ -0,0 +1,37 @@
+# 1、创建 ServiceAccount（放在 sit 命名空间）
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sit-user
+  namespace: sit  # 明确 ServiceAccount 所在的命名空间（必填）
+---
+
+# 2、为 sit 命名空间创建 Role
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: sit-user-role         
+  namespace: sit   
+rules:
+- apiGroups: ["", "apps", "extensions", "batch", "networking.k8s.io"]
+  resources: ["pods", "pods/log", "pods/exec", "statefulsets", "deployments", "daemonsets", "services", "configmaps", "secrets", "events", "replicasets"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+- apiGroups: ["metrics.k8s.io"]
+  resources: ["pods","nodes"]
+  verbs: ["get","list","watch"]
+
+---
+# 3、将 apex-evaluation 命名空间的 Role 绑定到 ServiceAccount
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: sit-user-binding
+  namespace: sit
+subjects:
+- kind: ServiceAccount
+  name: sit-user
+  namespace: sit  
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: sit-user-role