관리자용 토큰 기반 kubeconfig 생성

1 개요[ | ]

관리자용 토큰 기반 kubeconfig 생성

2 변수 지정[ | ]

USERNAME=admin-user

3 ServiceAccount 생성[ | ]

kubectl -n kube-system create sa $USERNAME

4 Role & RoleBinding 생성[ | ]

kubectl create clusterrolebinding $USERNAME --clusterrole=cluster-admin --serviceaccount=kube-system:$USERNAME

5 TOKEN 추출[ | ]

TOKEN=$(kubectl -n kube-system get secret $(kubectl -n kube-system get sa $USERNAME -ojsonpath='{.secrets[0].name}') -ojsonpath='{.data.token}' | base64 -d)

6 ca.crt 파일 생성[ | ]

kubectl config view --flatten -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d > ca.crt

7 kubeconfig 파일 생성[ | ]

kubectl config set-cluster $(kubectl config view -o jsonpath='{.clusters[0].name}') \
--server=$(kubectl config view -o jsonpath='{.clusters[0].cluster.server}') \
--certificate-authority=ca.crt \
--embed-certs \
--kubeconfig=./$USERNAME-kubeconfig

kubectl config set-credentials $USERNAME \
--token=$TOKEN \
--kubeconfig=./$USERNAME-kubeconfig

kubectl config set-context $USERNAME \
--cluster=$(kubectl config view -o jsonpath='{.clusters[0].name}') \
--namespace=$NS \
--user=$USERNAME \
--kubeconfig=./$USERNAME-kubeconfig

kubectl config use-context $USERNAME \
--kubeconfig=./$USERNAME-kubeconfig

8 테스트[ | ]

kubectl --kubeconfig=$USERNAME-kubeconfig get no
kubectl --kubeconfig=$USERNAME-kubeconfig get pod -n kube-system

9 ⚠️ 원복 (모두 제거)[ | ]

kubectl -n kube-system delete sa $USERNAME
kubectl delete clusterrole $USERNAME
kubectl delete clusterrolebinding $USERNAME
rm -f *

10 같이 보기[ | ]

11 참고[ | ]