Skip to main content

How to create a user in kubernetes cluster and assign read only permissions

root@ip-172-31-16-42:~# kubectl get secrets
NAME                  TYPE                                  DATA   AGE
default-token-2m258   kubernetes.io/service-account-token   3      48m
root@ip-172-31-16-42:~# kubectl create serviceaccount readonlyuser
serviceaccount/readonlyuser created
root@ip-172-31-16-42:~# kubectl create clusterrole readonlyuser --verb=get --verb=list --verb=watch --resource=pods
clusterrole.rbac.authorization.k8s.io/readonlyuser created

root@ip-172-31-16-42:~# kubectl create clusterrolebinding readonlyuser --serviceaccount=default:readonlyuser --clusterrole=readonlyuser
clusterrolebinding.rbac.authorization.k8s.io/readonlyuser created
root@ip-172-31-16-42:~# TOKEN=$(kubectl describe secrets "$(kubectl describe serviceaccount readonlyuser | grep -i Tokens | awk '{print $2}')" | grep token: | awk '{print $2}')

root@ip-172-31-16-42:~# kubectl config set-credentials vikash --token=$TOKEN
User "vikash" set.
root@ip-172-31-16-42:~# kubectl config set-context podreader --cluster=kubernetes --user=vikash
Context "podreader" created.
root@ip-172-31-16-42:~# kubectl config use-context podreader
Switched to context "podreader".

root@ip-172-31-16-42:~# kubectl auth can-i get pods --all-namespaces
yes
root@ip-172-31-16-42:~# kubectl auth can-i create pods
no

root@ip-172-31-16-42:~# kubectl get svc
Error from server (Forbidden): services is forbidden: User "system:serviceaccount:default:readonlyuser" cannot list resource "services" in API group "" in the namespace "default"
root@ip-172-31-16-42:~# kubectl auth can-i delete pods
no

root@ip-172-31-16-42:~# kubectl get nodes
Error from server (Forbidden): nodes is forbidden: User "system:serviceaccount:default:readonlyuser" cannot list resource "nodes" in API group "" at the cluster scope



Comments

  1. Madhava Krishna MeduriMay 11, 2020 at 3:56 PM

    The high liter is spoiling the article’s visibility. Why don’t you remove the highlights?

    ReplyDelete

Post a Comment

Popular posts from this blog

How to copy files from one server to another server by using ansible copy module

 We have two servers 1.master 2.worker1 create playbook example: play.yml ---   - hosts: all     tasks:     - name: Ansible copy file to remote server       copy:        src: ~/kube-cluster        dest: /root Run ansible playbook  ansible-playbook play.yml
1 comment
Read more

Kubernetes interview questions and answers

1.H ow to setup kubernetes dashboard on ubuntu16.04 cluster? To create kubernetes dashboard follow below link https://docs.aws.amazon.com/eks/latest/userguide/dashboard-tutorial.html To deploy the Metrics Server kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/download/v0.3.6/components.yaml kubectl get deployment metrics-server -n kube-system Deploy the dashboard kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta8/aio/deploy/recommended.yaml root@ip-172-31-43-76:~# kubectl get svc -n kubernetes-dashboard NAME                        TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)         AGE dashboard-metrics-scraper   ClusterIP   10.102.6.123   <none>        8000/TCP        120m kubernetes-dashboard  ...
3 comments
Read more

shell scripting and important linux questions and answers

 1.echo $0 what it means?     It will show the name of the currently running process Example: prepare test.sh #!/bin/bash echo $0 Then run test.sh after giving permission to chmod 700 test.sh root@ip-172-31-15-196:~# chmod 700 test.sh root@ip-172-31-15-196:~# ./test.sh ./test.sh 2.How to create 100 empty files at a time? touch file-{001..100} 3.What is hardlink and softlink and how it will be work and what is the difference between them? Hard link:  1.If we delete original file our data will be available 2.Inode number of both original file and hard link file both are same 3.Hard links are fast . Soft link: 1.If we delete original file our data will not be available 2.inode of original file and soft link file are different 3.Soft links are slower. 4.soft links can be used for linking directories 5.soft links will work across file systems. 6.File permissions are different. Creating sof link creating a file1.txt [root@ip-172-31-43-210 linux]# echo "ashwika tech" >...
Post a Comment
Read more