kubectl apply -f dashborad.yaml

NAMESPACE              NAME                                          READY   STATUS    RESTARTS       AGE   IP               NODE       NOMINATED NODE   READINESS GATES
kube-system            calico-kube-controllers-c57dfffd6-9sbjs       1/1     Running   1 (178m ago)   62d   10.244.98.192    k8snode3   <none>           <none>
kube-system            calico-node-52fnv                             1/1     Running   0              62d   192.168.3.123    k8snode3   <none>           <none>
kube-system            calico-node-5ndpq                             1/1     Running   1 (59d ago)    62d   192.168.3.121    k8snode1   <none>           <none>
kube-system            calico-node-77bst                             1/1     Running   0              62d   192.168.3.125    k8snode5   <none>           <none>
kube-system            calico-node-8wpgl                             1/1     Running   0              62d   192.168.3.122    k8snode2   <none>           <none>
kube-system            calico-node-bgk6r                             1/1     Running   0              62d   192.168.3.124    k8snode4   <none>           <none>
kube-system            coredns-6dcb4b89d5-2crlk                      1/1     Running   0              60d   10.244.249.3     k8snode1   <none>           <none>
kube-system            coredns-6dcb4b89d5-c2cb9                      1/1     Running   7 (61d ago)    61d   10.244.98.194    k8snode3   <none>           <none>
kube-system            coredns-6dcb4b89d5-vvpp5                      1/1     Running   7 (61d ago)    61d   10.244.185.193   k8snode2   <none>           <none>
kubernetes-dashboard   dashboard-metrics-scraper-59d6dd7d8-7vshq     1/1     Running   0              57d   10.244.185.198   k8snode2   <none>           <none>
kubernetes-dashboard   dashboard-metrics-scraper-59d6dd7d8-g6v9k     1/1     Running   0              57d   10.244.185.197   k8snode2   <none>           <none>
kubernetes-dashboard   dashboard-metrics-scraper-59d6dd7d8-t6cw6     1/1     Running   0              57d   10.244.98.197    k8snode3   <none>           <none>
kubernetes-dashboard   kubernetes-dashboard-955db9b78-5pz4z          1/1     Running   0              57d   10.244.185.196   k8snode2   <none>           <none>
kubernetes-dashboard   kubernetes-dashboard-955db9b78-j2pmw          1/1     Running   0              57d   10.244.185.199   k8snode2   <none>           <none>
kubernetes-dashboard   kubernetes-dashboard-955db9b78-krlpf          1/1     Running   0              57d   10.244.98.198    k8snode3   <none>           <none>

[root@k8snode1 ~]# kubectl get deployments  --namespace=kubernetes-dashboard -o wide
NAME                        READY   UP-TO-DATE   AVAILABLE   AGE   CONTAINERS                  IMAGES                                SELECTOR
dashboard-metrics-scraper   3/3     3            3           57d   dashboard-metrics-scraper   kubernetesui/metrics-scraper:v1.0.8   k8s-app=dashboard-metrics-scraper
kubernetes-dashboard        3/3     3            3           57d   kubernetes-dashboard        kubernetesui/dashboard:v2.7.0         k8s-app=kubernetes-dashboard```

[root@k8snode1 ~]# kubectl get svc  --namespace=kubernetes-dashboard -o wide
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE   SELECTOR
dashboard-metrics-scraper   ClusterIP   10.96.144.232   <none>        8000/TCP        57d   k8s-app=dashboard-metrics-scraper
kubernetes-dashboard        NodePort    10.96.152.197   <none>        443:32443/TCP   57d   k8s-app=kubernetes-dashboard

# 你应该能看到我们创建的 'kubernetes-dashboard' 这个 ServiceAccount
kubectl get serviceaccount -n kubernetes-dashboard

# 2. 获取 'kubernetes-dashboard' ServiceAccount 的详细信息
# 这个命令会显示它的基本信息，但不会显示权限
kubectl describe serviceaccount kubernetes-dashboard -n kubernetes-dashboard

# 3. (可选) 列出集群中所有命名空间下的所有 ServiceAccount
kubectl get serviceaccount --all-namespaces

# 你应该能看到我们创建的 'kubernetes-dashboard' 这个 Role
kubectl get role -n kubernetes-dashboard

# 2. 查看 'kubernetes-dashboard' Role 的详细权限规则
# 这是核心！它会清楚地告诉你这个 Role 到底“能做什么”
kubectl describe role kubernetes-dashboard -n kubernetes-dashboard

# 3. 列出 'kubernetes-dashboard' 命名空间中所有的 RoleBinding
# 你应该能看到我们创建的 'kubernetes-dashboard' 这个 RoleBinding
kubectl get rolebinding -n kubernetes-dashboard

# 4. 查看 'kubernetes-dashboard' RoleBinding 的详细信息
# 这个命令会告诉你“谁”被授予了“什么权限”，即 Subjects 和 roleRef
kubectl describe rolebinding kubernetes-dashboard -n kubernetes-dashboard

# 查找与 dashboard 相关的全局权限
kubectl get clusterrole | grep dashboard
#system: 开头内置系统组件专用
#system:controller: 开头内置控制器专用
#cluster-admin / admin / edit / view
#内置用户角色其他自定义名字自己创建的


# 2. 查看 'kubernetes-dashboard' ClusterRole 的详细权限规则
# 这会显示它拥有的全局权限，比如访问 metrics.k8s.io
kubectl describe clusterrole kubernetes-dashboard

# 3. 列出集群中所有的 ClusterRoleBinding (同样用 grep 过滤)
# 查找与 dashboard 相关的全局绑定
kubectl get clusterrolebinding | grep dashboard

# 4. 查看 'kubernetes-dashboard' ClusterRoleBinding 的详细信息
# 这会显示谁（哪个 ServiceAccount）被授予了上述的全局权限
kubectl describe clusterrolebinding kubernetes-dashboard

# 5. 查看内置 ClusterRole（有 rbac-defaults 标签的）
kubectl get clusterrole -l kubernetes.io/bootstrapping=rbac-defaults

# 6. 查看自定义 ClusterRole（没有这个标签的）
kubectl get clusterrole -l '!kubernetes.io/bootstrapping'

kubectl auth can-i list pods -n default

# 2. 检查 'kubernetes-dashboard' ServiceAccount 是否可以获取它自己的命名空间中的 secrets
# 这是验证我们 Role 和 RoleBinding 是否生效的关键
# --as 指定了要模拟的用户身份
kubectl auth can-i get secrets -n kubernetes-dashboard --as=system:serviceaccount:kubernetes-dashboard:kubernetes-dashboard

# 3. 检查 'kubernetes-dashboard' ServiceAccount 是否可以更新它自己的 ConfigMap
kubectl auth can-i update configmaps -n kubernetes-dashboard --as=system:serviceaccount:kubernetes-dashboard:kubernetes-dashboard

# 4. 检查 'kubernetes-dashboard' ServiceAccount 是否可以列出集群中的所有节点 (nodes)
# 这是验证我们 ClusterRole 和 ClusterRoleBinding 是否生效的关键
# 注意：因为 nodes 是集群资源，所以不需要 -n 参数
kubectl auth can-i list nodes --as=system:serviceaccount:kubernetes-dashboard:kubernetes-dashboard

# 5. 检查 'kubernetes-dashboard' ServiceAccount 是否可以列出 'default' 命名空间中的 Pod 指标
# 这里的 'pods' 属于 'metrics.k8s.io' API 组
kubectl auth can-i list pods.metrics.k8s.io -n default --as=system:serviceaccount:kubernetes-dashboard:kubernetes-dashboard

kubectl create namespace zhipeng-space

cat > zhipeng1.yaml << 'EOF'
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: zhipeng1
  namespace: zhipeng-space
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: zhipeng1-admin
  namespace: zhipeng-space
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin          # zhipeng-space 内所有权限
subjects:
  - kind: ServiceAccount
    name: zhipeng1
    namespace: zhipeng-space
EOF
kubectl apply -f zhipeng1.yaml

# 创建超级用户 
cat > ui-admin.yaml << 'EOF'
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ui-admin
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ui-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: ui-admin
    namespace: kubernetes-dashboard
EOF

kubectl apply -f ui-admin.yaml

kubectl -n kubernetes-dashboard create token ui-admin
# 创建好后，我们来看地址， kubernetes-dashboard  
[root@k8snode1 ~]# kubectl get svc --namespace=kubernetes-dashboard
NAME                        TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)         AGE
dashboard-metrics-scraper   ClusterIP   10.96.144.232   <none>        8000/TCP        57d
kubernetes-dashboard        NodePort    10.96.152.197   <none>        443:32443/TCP   57d

# create token for dashboard login
kubectl -n kubernetes-dashboard create token ui-admin

[root@k8snode1 .kube]# kubectl config get-contexts  --kubeconfig=/root/.kube/config
CURRENT   NAME         CLUSTER      AUTHINFO     NAMESPACE
*         kubernetes   kubernetes   kubernetes

# 1. 生成私钥
openssl genrsa -out admin.key 2048
# 1. 生成 CSR (注意：O=system:masters 是获得集群管理权限的关键)
# 2. 生成 CSR (注意：CN=system:kubernetes)
openssl req -new -key admin.key \
    -out admin.csr \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=system:masters/CN=kubernetes"

... #省略签发证书步骤    

# 使用以下来配置 kubectl 的上下文    
kubectl config set-context kubernetes \
  --cluster=kubernetes \
  --user=kubernetes \
  --kubeconfig=/root/.kube/config

# 运行这个命令，它会列出所有被 ClusterRoleBinding 使用的用户组
kubectl get clusterrolebindings -o jsonpath='{.items[*].subjects[?(@.kind=="Group")].name}' | tr " " "\n" | sort | uniq
system:authenticated
system:masters
system:monitoring
system:serviceaccounts
system:unauthenticated

[root@k8snode1 .kube]# kubectl describe clusterrolebinding cluster-admin
Name:         cluster-admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
Role:
  Kind:  ClusterRole
  Name:  cluster-admin
Subjects:
  Kind   Name            Namespace
  ----   ----            ---------
  Group  system:masters

[root@k8snode1 certs]# cat /etc/kubernetes/cfg/kubelet.kubeconfig
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: ...
    server: https://k8smaster:9443
  name: default-cluster
contexts:
- context:
    cluster: default-cluster
    namespace: default
    user: default-auth
  name: default-context
current-context: default-context
kind: Config
users:
- name: default-auth
  user:
    client-certificate: /etc/kubernetes/certs/kubelet-client-current.pem
    client-key: /etc/kubernetes/certs/kubelet-client-current.pem
[root@k8snode1 certs]# openssl x509 -in /etc/kubernetes/certs/kubelet-client-current.pem -noout -subject
subject=O=system:nodes, CN=system:node:k8snode1
[root@k8snode1 certs]# openssl x509 -in kube-apiserver.crt -noout -subject
subject=CN=kubernetes

# 1. 创建永久 Secret 并绑定到 zhipeng1
```bash
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: zhipeng1-perm-token
  namespace: zhipeng-space
  annotations:
    kubernetes.io/service-account.name: "zhipeng1"
type: kubernetes.io/service-account-token
EOF

# 2. 提取 Token 字符串到变量中
PERM_TOKEN=$(kubectl -n zhipeng-space get secret zhipeng1-perm-token -o jsonpath={.data.token} | base64 -d)
# 验证 Token 是否获取成功
echo $PERM_TOKEN


KUBE_CONFIG="zhipeng-worker.kubeconfig"
SERVER_URL="https://k8smaster:9443" # 请确保这是 node4 能访问到的 Master 地址

# 1. 设置集群信息（复用现有的 CA 证书以确保 HTTPS 通信安全）
kubectl config set-cluster kubernetes \
  --certificate-authority=/etc/kubernetes/ssl/ca.crt \
  --embed-certs=true \
  --server=${SERVER_URL} \
  --kubeconfig=${KUBE_CONFIG}

# 2. 设置用户凭据（使用刚才生成的永久 Token）
kubectl config set-credentials zhipeng1-user \
  --token=${PERM_TOKEN} \
  --kubeconfig=${KUBE_CONFIG}

# 3. 设置上下文，并直接默认到 zhipeng-space 命名空间
kubectl config set-context zhipeng-context \
  --cluster=kubernetes \
  --user=zhipeng1 \
  --namespace=zhipeng-space \
  --kubeconfig=${KUBE_CONFIG}

# 4. 激活上下文
kubectl config use-context zhipeng-context --kubeconfig=${KUBE_CONFIG}

scp zhipeng-worker.kubeconfig root@k8snode4:/root/.kube/  #将 zhipeng-worker.kubeconfig 重命名为 config



[root@k8snode4 ~]# kubectl config current-context
zhipeng-context

# 这样一来，-A 获取全部的 pods 这个参数就失效了，因为你没有权限
[root@k8snode4 ~]# kubectl get pods -A -o wide
Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:zhipeng-space:zhipeng1" cannot list resource "pods" in API group "" at the cluster scope

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-zhipeng
  # namespace 可选，因为您的 node4 config 已默认指向 zhipeng-space
  # namespace: zhipeng-space 
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      # 使用 zhipeng1 身份运行
      serviceAccountName: zhipeng1
      nodeSelector:
      #  type: worker 因为我们给 node45 打的是一下的标签，且没有 value 所以必须这么搞才能调度到 work 上
      # 修改这里：使用系统自带的标签名，后面留空字符串
        node-role.kubernetes.io/worker: ""
      containers:
      - name: nginx
        image: nginx:1.21.6
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
  namespace: zhipeng-space
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
      nodePort: 30080 
  type: NodePort

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-zhipeng
  # namespace 可选，因为您的 node4 config 已默认指向 zhipeng-space
  # namespace: zhipeng-space 
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      # 使用 zhipeng1 身份运行
      serviceAccountName: zhipeng1
   
      nodeSelector:
      #  type: worker 因为我们给 node45 打的是一下的标签，且没有 value 所以必须这么搞才能调度到 work 上
      # 修改这里：使用系统自带的标签名，后面留空字符串
        node-role.kubernetes.io/worker: ""
      containers:
      - name: nginx
        image: nginx:1.21.6
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
  namespace: zhipeng-space
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
      nodePort: 30080 
  type: NodePort
  
  
  
  
[root@k8snode4 yaml]# kubectl get deployment
[root@k8snode4 yaml]# kubectl get deployment -o wide
NAME             READY   UP-TO-DATE   AVAILABLE   AGE   CONTAINERS   IMAGES                                       SELECTOR
nginx-zhipeng    1/2     2            1           29s   nginx        nginx:1.21.6                                 app=nginx


[root@k8snode4 yaml]# kubectl get svc
NAME             TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)        AGE
nginx-service    NodePort    10.96.94.231   <none>        80:30080/TCP   66s
springboot-svc   ClusterIP   10.96.105.20   <none>        80/TCP         58d

[root@k8snode4 yaml]# curl http://10.96.94.231
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

# 使用 node 的 ip 进行访问
[root@k8snode4 yaml]# curl http://k8snode4:30080
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>
[root@k8snode4 yaml]#

# 找其中一个 Pod 的名字替换掉下面
kubectl exec -it <Pod名字> -n zhipeng-space -- cat /var/run/secrets/kubernetes.io/serviceaccount/namespace
检查重点：输出应该是 zhipeng-space。

深度验证（查看具体 ServiceAccount）：

Bash
kubectl get pod <Pod名字> -n zhipeng-space -o jsonpath='{.spec.serviceAccountName}'
输出必须是 zhipeng1。