k8s-serviceAccount最佳实践

# 一、概述

前面我们介绍了在k8s集群中serviceAccount (opens new window)的创建及使用，接下来我会以一个真实的案例，讲解下sa在企业中的使用情况。

# 二、涉及资源

k8s-client-demo

go语言开发的程序，主要用来获取指定命名空间下pod名称

deployment

控制k8s-client-demo应用程序运行

ClusterRole

定义所需要的权限

RoleBinding

sa与角色绑定

serviceAccount

pod使用的sa名称

# 三、开发应用程序

这里简单开发k8s-client-demo，主要功能就是获取dev命名空间下pod名称

# 3.1 代码

package main

import (
	"context"
	"fmt"
	"time"

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/rest"
)

func main() {
	pods := NewPod()
	fmt.Println("Starting------")
	for {
		pods.GetPod("dev")
		time.Sleep(time.Second * 2)
	}

}

type Pod struct {
	ClientSet kubernetes.Interface
	Config    *rest.Config
}

func NewPod() *Pod {
	k8sConfig, err := rest.InClusterConfig()
	//k8sConfig, err := clientcmd.BuildConfigFromFlags("", "./config")
	if err != nil {
		fmt.Println("k8s集群config配置文件加载失败:", err)
	}
	// 初始化客户端
	k8sClient, err := kubernetes.NewForConfig(k8sConfig)
	if err != nil {
		fmt.Println("客户端初始化失败:", err)
	}

	return &Pod{
		ClientSet: k8sClient,
		Config:    k8sConfig,
	}
}

func (k *Pod) GetPod(namespace string) {
	podObj, err := k.ClientSet.CoreV1().Pods(namespace).List(context.TODO(), metav1.ListOptions{})
	if err != nil {
		fmt.Println("Error getting pods: ", err)
		return
	}

	for _, pod := range podObj.Items {
		fmt.Printf("当前命名空间:%s,pod名称:%s,查询时间:%v\n", namespace, pod.Name, time.Now().Format(time.DateTime))
	}
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

# 3.2 代码解读

这里初始化集群客户端使用的rest.InClusterConfig(),这是因为我们是运行在k8s集群中，该函数会获取集群的配置，我们客户看下函数体,可以看到，该函数会读取环境变量KUBERNETES_SERVICE_HOST，KUBERNETES_SERVICE_PORT，因此只能在pod中执行，或者自定义该变量,保证程序可以正常获取到集群的api地址。

# 3.3 应用Dockerfile

构建镜像后上传镜像仓库

FROM golang:1.20 as builder

WORKDIR /apps

COPY ./ /apps
RUN export GOPROXY=https://goproxy.cn \
    && go build  -ldflags "-s -w" -o get-pod \
    && chmod +x get-pod

FROM alpine
LABEL maintainer="tchua"
COPY --from=builder /apps/get-pod  /apps/

RUN echo -e  "http://mirrors.aliyun.com/alpine/v3.15/main\nhttp://mirrors.aliyun.com/alpine/v3.15/community" >  /etc/apk/repositories \
&& apk  update && apk --no-cache add tzdata gcompat libc6-compat \
&& cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
&& echo "Shanghai/Asia" > /etc/timezone \
&& apk del tzdata \
&& ln -s /lib/libc.so.6 /usr/lib/libresolv.so.2

WORKDIR /apps


CMD ["./get-pod"]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# 3.4 sa及授权文件

apiVersion: v1
kind: ServiceAccount
metadata:
  name: pod-reader
  namespace: dev
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole 
metadata:
  name: pod-role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-role-binding
  namespace: dev
subjects:
- kind: ServiceAccount
  name: pod-reader
  namespace: dev
roleRef:
  kind: ClusterRole
  name: pod-role
  apiGroup: rbac.authorization.k8s.io

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

# 3.5 pod资源清单文件

使用serviceAccountName字段绑定至pod中，这样在该pod中就可以操作我们定义的动作，获取对应的集群资源

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: dev
  name: get-pod-service
  labels:
    app: get-pod
spec:
  replicas: 1
  selector:
    matchLabels:
      app: get-pod
  template:
    metadata:
      labels:
        app: get-pod
    spec:
      serviceAccountName: pod-reader
      imagePullSecrets:
      - name: tfgol-registry
      containers:
      - name: get-pod
        image: registry.cn-hangzhou.aliyuncs.com/tfgol-dev/get-pod:v1 
        imagePullPolicy: Always
        resources:
          limits:
            memory: 1024Mi
          requests:
            memory: 512Mi