创建账户并支持token访问

创建ServiceAccount

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cmdb
  namespace: kube-system
  labels:
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile

创建ClusterRoleBinding

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cmdb-cluster-admin
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: cmdb
  namespace: kube-system

创建/查看token

1.24之前版本

显示账户的token

kubectl -n kube-system describe secrets `kubectl -n kube-system get serviceaccount cmdb -o json|jq -r '.secrets[0].name'`

1.24版本

不再自动创建secret，需要额外使用来创建并查看

---
apiVersion: v1
kind: Secret
metadata:
  name: cmdb-secret
  namespace: kube-system
  annotations:
    kubernetes.io/service-account.name: cmdb
type: kubernetes.io/service-account-token

查看secret

kubectl -n kube-system get secret cmdb-secret -o jsonpath='{.data.token}'| base64 --decode