kubernetes-yaml/learn/learn-kubernetes-master/kiamol/ch17/lab
2024-02-20 17:15:27 +08:00
..
kube-explorer 新增learn-kubernetes(https://github.com/yyong-brs/learn-kubernetes)相关文件 2024-02-20 17:15:27 +08:00
solution 新增learn-kubernetes(https://github.com/yyong-brs/learn-kubernetes)相关文件 2024-02-20 17:15:27 +08:00
README.md 新增learn-kubernetes(https://github.com/yyong-brs/learn-kubernetes)相关文件 2024-02-20 17:15:27 +08:00

ch17 lab

Setup

Deploy the Kube Explorer app in the lab configuration:

kubectl apply -f lab/kube-explorer/

Note that 02-service-account.yaml sets automountServiceAccountToken to false so Pods don't automatically see the token; 04-deployment.yaml explicitly mounts the token in the Pod spec.

Browse to the app and check you can access Pods - e.g. http://localhost:8022

But not Pods in the lab namespace - http://localhost:8022?ns=kiamol-ch17-lab

Sample Solution

To access Pods in the lab namespace rbac-pods.yaml applies the default-pod-reader-lab ClusterRole to the lab namespace:

kubectl apply -f lab/solution/rbac-pods.yaml

Now you can work with Pods in the lab namespace - http://localhost:8022?ns=kiamol-ch17-lab

Kube Explorer browsing Pods in the lab namespace

But not Service Accounts - http://localhost:8022/ServiceAccounts

To access Service Accounts rbac-serviceaccounts.yaml creates:

  • a ClusterRole with get and list access to ServiceAccounts
  • a RoleBinding applying the ClusterRole to the default namespace
  • a RoleBinding applying the ClusterRole to the lab namespace
kubectl apply -f lab/solution/rbac-serviceaccounts.yaml

Now you can access Pods in the default and lab namespaces - http://localhost:8022/ServiceAccounts?ns=kiamol-ch17-lab

Kube Explorer browsing Service Accounts in the lab namespace

Teardown

Delete all the resources:

kubectl delete ns,rolebinding,role,clusterrole -l kiamol=ch17-lab